Administration
Despite following many security best practices, the SillyTavern server is not secure enough for exposure to the public internet.
NEVER HOST ANY INSTANCES ON THE OPEN INTERNET WITHOUT ENSURING PROPER SECURITY MEASURES FIRST.
WE ARE NOT RESPONSIBLE FOR ANY DAMAGE OR LOSSES RESULTING FROM UNAUTHORIZED ACCESS DUE TO IMPROPER OR INADEQUATE SECURITY IMPLEMENTATION.
The main configuration file for SillyTavern. It contains various settings, such as network, security, and backend-specific options.
To share your SillyTavern instance with others, you can create multiple user accounts. Each user has their own settings, extensions, and data. User accounts can also be password-protected.
You can access your SillyTavern instance from your phone, tablet, or another computer.
To access your SillyTavern instance from the internet, you can use a VPN or a tunneling service like Cloudflare Zero Trust, ngrok, or Tailscale.
Enthusiasts can set up a reverse proxy to access their SillyTavern instance from the internet.
Data Layout
This section provides an overview of the user data storage structure in SillyTavern. Only the default data layout (data root is a subdirectory of the SillyTavern installation directory) is described here. If you have customized the data layout, refer to your custom configuration for details.
data/[user-handle] (e.g. data/default-user)
Created for each user account, this folder contains user-specific data such as character files, conversation history, and settings.
data/_cache
A storage for files downloaded by the server, such as tokenizer files and transformers.js models.
data/_cache/characters
Contains parsed character data when the performance.useDiskCache setting is enabled, synchronized on startup and when characters are updated.
This allows for faster loading of character data at the cost of disk space.
data/_css
A storage for custom CSS files.
Currently, only the user.css file is supported, which allows you to add custom styles to the frontend.
data/_errors
A storage of HTML files containing error pages for various HTTP status codes. These files are used to display custom error pages when the server encounters errors.
forbidden-by-whitelist.html: Displayed when a request is blocked by the IP address whitelist.host-not-allowed.html: Displayed when a request is blocked by the host whitelist.unauthorized.html: Displayed when the basic authentication fails.url-not-found.html: Displayed when a requested resource is not found.
data/_storage
A storage for user account data.
Editing these files manually is not recommended and can lead to data corruption.
data/_uploads
A temporary storage for files uploaded by users, while they are being processed by the server.
These files are automatically cleared on every startup.
data/_webpack
A storage for compiled webpack assets and cache files.
If you experience issues with the frontend after an update, try clearing this folder to force a full rebuild of the frontend assets.
data/access.log
A log file that records incoming HTTP requests to the server, after the first successful connection.
Inspect this file regularly to monitor for any suspicious activity.
data/cookie-secret.txt
Contains the secret key used for signing cookies in the server.
This file is automatically generated on the first startup if it doesn't exist.
Security checklist
These are just recommendations. Please consult a web application security specialist before making your ST instance live.
- Keep your operating system and runtime software, such as Node.js, up to date. This ensures your system has the latest security patches and fixes, which helps prevent potential vulnerabilities.
- Use a whitelist and a network firewall. Only allow trusted IP ranges to access the server.
- Enable basic authentication. It acts as a "master password" before you can access the front-end app.
- Alternatively, configure external authentication. Some known services for this are Authelia and authentik. See the SSO guide for details.
- Never leave admin accounts without passwords. The server will warn you on startup if you have any unprotected admin accounts.
- Use the discreet login setting outside the local network. This hides the user list from potential outsiders.
- Check the access logs often. They are written to the server console and to the
access.logfile and provide information about incoming connections, such as IP address and user agent. - Configure HTTPS. For a localhost server, you can generate and use a self-signed certificate. Otherwise, you may need to deploy a reverse-proxy web server such as Traefik or Caddy.
- Configure and enable host whitelisting, especially if you're not using HTTPS encryption on a local network.
- Configure and enable private address whitelisting to prevent SSRF attacks.
Find more information about secure proxying in the following guide: Reverse Proxying SillyTavern.