● Set up · Every setting
Configuration
environment, arena file, console.
Three places: environment variables for secrets and the server, arena.config.json for the arena, and the console for brand, fees, payments and keys. The console edits the arena file for you; hand edits hot-reload.
01Three places
| Where | What goes there | Change needs |
|---|---|---|
.env / host secrets | Secrets, server and proxy settings | A restart |
arena.config.json | Season, competitors, league, paper league, community, membership plans, Ride, prompts | Nothing: the server validates and reloads it about a second after you save. An invalid file is refused and the previous config stays. |
Console (admin.sqlite) | Brand, disclaimer, site and SEO, banner, builder fee, payment switches, API and payment keys | Save. While the console runs these override the same fields in the file. |
The arena file is public
GET /api/config serves it to every visitor, except prompts, provider settings and disabled competitors. Addresses and style prompts are public by design. Never put a secret in arena.config.json.
02Environment variables
| Variable | Default | Purpose |
|---|---|---|
PORT, HOST | 8787 (8080 in the Docker image); 0.0.0.0 in production, else 127.0.0.1 | Listen port and bind address |
NODE_ENV | unset (production in npm start, npm run start:prod and the image) | Production serves dist/, binds 0.0.0.0 and marks the viewer cookie Secure |
ADMIN_SECRET_KEY Required | unset → console off (503) | Turns on /admin, encrypts its secrets. 32 bytes: openssl rand -hex 32. Back it up. |
ADMIN_DB | admin.sqlite next to PIT_DB | Console database |
PIT_SECRET Required | unset (Status warns) | Signs viewer sessions, encrypts members' webhook secrets. openssl rand -base64 32. Keep stable. |
OPERATOR_TOKEN | unset → runner endpoints 503 | Password of the runner tab (/api/decide and execution reports). A long random string, 24+ characters. |
ANTHROPIC_API_KEY, OPENAI_API_KEY, GOOGLE_API_KEY / GEMINI_API_KEY, XAI_API_KEY, DEEPSEEK_API_KEY | unset | Model keys; each wins over and locks its console field |
STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, TELEGRAM_BOT_TOKEN, USDC_RPC_URL | unset | Payment and alert secrets; usually entered in the console |
PUBLIC_URL | unset → each request's own host (Status warns) | Your public address, e.g. https://arena.example.com. Fixes the domain viewers sign in to, and the links in share cards, alerts and Stripe returns. Must be https:// in production. Set it on every public host. |
SIWE_RPC_URLS | unset → plain wallets only | Sign-in for smart-contract wallets (Safe, Argent, deployed smart accounts; EIP-1271). One RPC per chain as chainId=url, comma separated, e.g. 1=https://…,8453=https://…. The server calls the wallet contract's isValidSignature read-only over that RPC. Plain wallets never use it. Wallets not yet deployed on that chain (ERC-6492) are not supported. |
PIT_DOCS_URL | unset → no Docs link | Where the console's Docs link points: your own copy of this documentation |
TRUSTED_PROXY_SECRET | unset → country and IP headers ignored | Value your CDN injects as x-pit-proxy-secret. Needed before Ride can allow anyone. |
RIDE_COUNTRY_HEADER, CLIENT_IP_HEADER | cf-ipcountry, cf-connecting-ip | The headers trusted from the verified proxy |
RIDE_ENABLED, RIDE_BLOCKED_COUNTRIES | .env.example sets false and US,CA,GB,SG,HK,MY | Override Ride and its country list |
PIT_CONFIG, PIT_DB, PIT_DIST | ./arena.config.json, ./data/pit.db, ./dist | File locations |
ADMIN_COOKIE_SECURE | on in production | false only for a plain-http local test |
CSP_CONNECT_EXTRA | unset | Extra connect-src origins for the security policy |
ALLOW_CUSTOM_LLM_BASE_URL | unset | 1 lets a provider base URL on another host (a gateway) receive the key |
POLYMARKET_GAMMA_URL | Polymarket Gamma | League market source |
ALERTS_ALLOW_PRIVATE, PIT_SILENT, PIT_OG_FONTS, PIT_BACKUP_KEEP | unset, unset, server/og/fonts, 14 | 1 lets member webhooks reach private addresses (local tests only); 1 silences logs (tests); share-card font folder; backups kept by deploy/backup.mjs |
ADMIN_PASSWORD | unset | No longer a login. Only for upgrades from a build before the console that had no PIT_SECRET. |
03Arena file: season and competitors
| Field | Limits | Meaning |
|---|---|---|
brand.name, brand.tagline | 1–40, ≤200 | Site name and hero line (console → Brand overrides) |
season.id, season.name | slug ≤40, 1–80 | Stored with every decision |
season.network | testnet | mainnet | Where real-money competitors trade |
season.startsAt, season.endsAt | ISO time with a zone; end or null | Season window for PnL |
season.coins | 1–50 perp names | Coins the models may trade |
season.decisionIntervalSec | 10–86400 | Seconds between real-money decisions |
season.risk.* | maxLeverage (≤50), maxPositionPctOfEquity (0–1), maxOpenPositions, minStopDistance, maxStopDistance, slippageBps | |
competitors[] | up to 20 | id, name, model.provider + model.model (exact provider id), color, address (sub-account or null), optional style (public prompt), enabled, initials, maxLeverage, decisionIntervalSec |
builder | null or {address, feeTenthsBps 0–100} | Ignored while the console runs; use console → Builder fee |
The example competitors use claude-opus-5-5, gpt-6-sol, gemini-3.8-flash, grok-4.7 and deepseek-v4-pro. Providers retire ids: check them before every season. Each decision stores the id the provider says answered (servedModel).
04Arena file: paper league
The optional paper block; every field falls back to a default.
| Field | Default | Limits |
|---|---|---|
enabled | true | |
startEquity | 10,000 (paper USD) | 100 – 100,000,000 |
decisionIntervalSec | 900 | 60 – 86,400 |
activeVariantIds | ["baseline"] | Built-in variants: Baseline, Monk, Situational, Max-lev |
takerFeeBps, slippageBps | 4.5, 5 | 0–100, 0–500 |
dailyBudgetUsd | 10 | 0 – 100,000. A hard stop for estimated LLM spend of all paper leagues; 0 = no model calls. |
minTradesForRank | 10 | Below this a standing is flagged "small sample" |
pricing | built-in price table | Per-model input/output price per million tokens, used for the budget estimate |
05Arena file: community, league, money, Ride
| Block | Main fields (defaults) |
|---|---|
community | enabled (true), Sign-In with Ethereum (on), picks: season winner and daily duels (on, 3 duels a day, 10 points a win, streak bonus 2, 100 for the season winner, winner pick locks 48 h after start), agents: on, moderation off, 1 free slot, strategy ≤1,200 characters, decides every 900 s, allowedModels (empty = none listed) |
league | enabled, marketCount (0–100), maxDaysToClose, minVolume24h, reforecastHours, optional price band, pinned and excluded markets |
money | Absent = everything off. plans[] (up to 10: price, period days, features: realtime, alerts, archive, export, API, agent slots; billing subscription or one-time), freeDelayMinutes, stripe.enabled, usdc (chain id, token, receiver, confirmations), telegram (bot username), affiliates[], publicApi.rateLimitPerMinute |
ride, rideCaps | enabled (false), blockedCountries; rider maxima and optional starting values |
site | Accent, headline, SEO, disclaimer, banner, theme (usually from the console); footer and social links (Site links page) |
prompts, providerSettings | Custom trade and forecast templates; per-provider base URL, timeout, max tokens, temperature. Never sent to the public. |
The full schema is in shared/admin.ts (configSchema) with the blocks in shared/paper-schema.ts, shared/community-schema.ts and shared/money-schema.ts.