Configuration

The server is configured by two files:

wasmx.json: which WASM resources the host loads, plus the userx admin address.
.env: port, database, signing secret, initial administrator and other runtime variables.

1. `wasmx.json`

The base structure after initialization:

{
  "env_file": ".env",
  "userx": {
    "admin_url": "${USERX_ADMIN_URL}",
    "public_url": "${USERX_PUBLIC_URL}",
    "login": {
      "credential": "${USERX_ADMIN_CREDENTIAL}",
      "password": "${USERX_ADMIN_PASSWORD}"
    }
  },
  "resources": []
}

wasmx add maintains resources. Each entry contains roughly:

Field	Description
`name`	Resource name: `resx`, `msgx`, `userx`, `conn`, `agix`
`path`	WASM path relative to the deployment directory
`prefix`	Route prefix; `resx` uses `/`, others use `/<name>`
`rate_limit`	Host-level per-minute limits
`control_plane`	Whether this is a control-plane resource (`resx`)
`allow_http` / `allow_backend`	Resource capability switches
`providers`	Optional `conn` backend list; empty by default and filled with locally installed CLIs

2. `.env`

Initialization writes .env.example; copy it and edit:

cp .env.example .env

Key variables:

Variable	Description
`WASMX_ADDR`	Listen address, defaults to `127.0.0.1:3001`
`WASMX_DB`	SQLite path, defaults to `sqlite://data/keragi.db`
`JWT_SECRET`	Shared signing secret for the host and `userx`, at least 32 characters
`BOOTSTRAP_ADMIN_CREDENTIAL`	Initial administrator account
`BOOTSTRAP_ADMIN_PASSWORD`	Initial administrator password
`USERX_ADMIN_URL` / `USERX_PUBLIC_URL`	How the host reaches `userx`
`USERX_ADMIN_CREDENTIAL` / `USERX_ADMIN_PASSWORD`	`userx` administrator credentials

Generate a random secret:

openssl rand -base64 48

Never commit .env or put it in a publicly accessible directory.

3. Resource prefixes

Resource	Prefix
`resx`	`/`
`msgx`	`/msgx`
`userx`	`/userx`
`conn`	`/conn`
`agix`	`/agix`

The web client’s config.json must match these prefixes.

4. Restart after changes

wasmx stop
wasmx start
wasmx status

Follow the logs:

tail -f wasmx.log

5. Security notes

Change the initial administrator password and JWT_SECRET before first start.
Do not expose administrative interfaces to untrusted networks.
Use HTTPS / a reverse proxy for public access.
Back up data/ and .env regularly; protect the backups too.

Next steps

WASM resource packs: selective install and upgrades.
Deploy the web client: config.json and service addresses.