PolarBot reads one TOML file: --config <path>, or /etc/polarbot/config.toml by default. Every section and every key is optional; the defaults below apply. Unknown keys are rejected at startup so typos are caught. An annotated example is crates/polarbot/config.example.toml.
Secrets never go in this file. A key named token, secret, password or api_key (any case, at any depth) makes the bot refuse to start. Secrets are systemd credentials.
The SQLite database file. Its directory is the data directory: the threat-list and adult-list caches live next to it. The directory is created if missing and must be writable.
What the process logs to stderr/journald: error, warn, info, debug, trace, or a filter such as polarbot=debug,info. An invalid value falls back to info. (Not the per-server Discord log level.)
json
true/false
false
Log JSON lines (for log collectors) instead of human-readable text.
Phishing-domain lists (plain domain lists or hosts files). Setting it replaces the defaults; [] turns threat lists off. name must match [a-z0-9_-]+ (at most 64 characters) and be unique: it names the cache file <data dir>/threatlists/<name>.txt. url must be https without credentials. A download that is empty, an HTML page or has no valid entries keeps the previous list.
Adult-site domain lists for the separate NSFW-link category (/scanner nsfw-links); they never raise the scam score. Same rules as threatlists, cached as <data dir>/adultlists/<name>.txt; [] turns the category off.
Where the OAuth callback server listens. Keep it on localhost and let a reverse proxy (nginx) terminate TLS. The server only runs when both OAuth credentials are present.
public_url
https URL, no trailing slash
https://bot.polarsystems.net
Public base URL of the callback server. The OAuth redirect URI is <public_url>/oauth/callback and must be registered exactly like that in the Discord Developer Portal. Change it to your own domain.