Web server only

legato serve runs Legato’s web server and its agents without the TUI. Use it when nobody sits at a terminal on the machine: a server, a VM, a spare box, or your workstation when you only want the web UI and your phone.

It is the same Legato as the TUI. It uses the same configuration and database, starts agents in tmux, and serves the same web UI.

Start it

legato serve

It prints the address and keeps running until you stop it with ctrl+c:

Legato web UI: http://localhost:3080

legato serve listens on web.port (3080 by default). --port overrides it for one run:

legato serve --port 4000

It reads the rest of the web settings: web.tls.* for HTTPS, web.discovery to announce itself on the local network, and web.public_url for the links in notifications. See Your phone and other devices.

Do not run legato serve and a TUI with web.enabled: true on the same port. Whichever starts second cannot take the port.

The web server makes a token the first time it starts and checks it on every request. Open the address in a browser, and paste the token when the page asks:

legato auth token

To pair a phone instead, run legato pair while the server runs. See Web access and tokens.

Run it as a service

On Linux, a systemd user service keeps Legato running after you log out and starts it again when it stops. Save this as ~/.config/systemd/user/legato.service:

[Unit]
Description=Legato
After=network-online.target

[Service]
ExecStart=%h/.local/bin/legato serve --port 3080
Environment=PATH=%h/.local/bin:/usr/local/bin:/usr/bin
Restart=on-failure
RestartForceExitStatus=75
KillMode=process

[Install]
WantedBy=default.target

PATH must hold every agent tool and toolchain your agents use. A service does not read your shell’s profile.
RestartForceExitStatus=75 lets Legato restart itself after an update.
KillMode=process stops only Legato. tmux and the agents in it keep running, and Legato finds them again when it starts.

Then start it:

loginctl enable-linger "$USER"     # run user services with nobody logged in
systemctl --user daemon-reload
systemctl --user enable --now legato
journalctl --user -u legato -f     # follow its log

For a whole machine set up for agents, with Tailscale, logins for the agent tools, GitHub and the sandbox, follow Agents on a server of their own.

Check that it runs

GET /health answers without a token, so a monitor can use it:

curl http://localhost:3080/health

{"status":"ok","version":"v0.4.2"}

The version is the one legato version prints.

Web server only

Start it

Sign in from a browser

Run it as a service

Check that it runs