Configure Mach5 One

Mach5 One reads configuration from a TOML file.

Default config path:

~/.mach5-one/mach5-one.toml

Create the default config and data directories:

mach5-one init

Use a custom config file:

mach5-one --config ./mach5-one.toml start

You can also set:

export MACH5_ONE_CONFIG=./mach5-one.toml
mach5-one start

Example config

[server]
http_port = 8080
pg_port = 5432
# Listeners bind loopback by default. Set explicitly to expose externally.
# bind_address = "127.0.0.1"

[storage]
data_dir = "~/.mach5-one/data"

[metadata]
backend = "sqlite"

[engine]
workers = 1
# memory_limit = "4GB"

[controllers]
warehouse_interval_secs = 10
compaction_interval_secs = 60
mv_refresh_interval_secs = 30
mv_max_concurrent_jobs = 1
generation_plan_max_ingestor_workflows_limit = 8
generation_plan_append_batch_size_bytes = 1073741824

[ingestion]
# kafka_brokers = "localhost:9092"

[observability]
log_level = "info"

[ui]
# dex_dist_path = "/path/to/data-explorer/dist"

Network exposure

All listeners (HTTP/MCP, PostgreSQL wire, msearch) bind 127.0.0.1 by default: a Mach5 One process is reachable only from its own host unless you opt in.

To expose Mach5 One on a network, set an explicit bind address:

[server]
bind_address = "0.0.0.0"

Mach5 One does not authenticate requests or terminate TLS. If you expose it beyond localhost, place it behind a reverse proxy that does both, and treat every reachable client as an administrator.

Container images ship with bind_address = "0.0.0.0" inside the container (required for port publishing). Publish container ports to the host loopback unless you intend remote access:

docker run -p 127.0.0.1:8080:8080 -p 127.0.0.1:5432:5432 -p 127.0.0.1:8081:8081 ...

Server ports

[server]
http_port = 8080
pg_port = 5432
# Listeners bind loopback by default. Set explicitly to expose externally.
# bind_address = "127.0.0.1"

• http_port serves the Web UI, /apis, /mcp, /session, and /version.txt.
• pg_port serves the PostgreSQL-compatible SQL endpoint.

The HTTP and PostgreSQL ports must be different.

Data directory

[storage]
data_dir = "~/.mach5-one/data"

Mach5 One stores local server state under data_dir.

UI assets

[ui]
dex_dist_path = "/path/to/data-explorer/dist"

When dex_dist_path is set, Mach5 One serves Data Explorer from /.

Logging

[observability]
log_level = "info"

The RUST_LOG environment variable can also control logging:

RUST_LOG=debug mach5-one start

Secrets

Mach5 One can read local secrets from:

<data_dir>/secrets/

You can also define secrets in the config file:

[secrets.my-kafka-creds]
username = "admin"
password = "redacted"

Do not commit real secrets to Git.