Configuration

Configuration

Everything host-specific lives in secwatch.yaml. The committed secwatch.example.yaml is a fully-commented template — copy it and edit.

Resolution order

For every setting, secwatch resolves in this order:

1. Environment variable (SECWATCH_*) — wins if set.
2. secwatch.yaml — your site config (or the file named by $SECWATCH_CONFIG).
3. Built-in default — a generic fallback so the code is portable.

This means you can keep secrets and per-host overrides in the environment (or a systemd drop-in) without editing the YAML, and the YAML stays shareable.

The file

paths:
  access_log: /var/log/traefik/access.json.log
  auth_log: /var/log/auth.log
  dashboard_url: http://localhost:8931/

log_source:
  type: traefik          # traefik | nginx | caddy | regex

network:
  trusted_nets:          # exempt from detection/ban — keep NARROW
    - 127.0.0.0/8
    - 10.0.0.0/24        # your server subnet
  autoban_private: false # RFC1918 anomalies alert but aren't auto-banned

ban:
  enabled: true
  actuator: traefik      # traefik | nftables | nginx | none

auth:
  enabled: false         # dashboard login (turn on for IP:PORT deployments)

See Log Sources, Detection and Bans, and Dashboard and Authentication for the sections that matter most.

What you'll actually touch

Setting	Purpose	Guide
paths.access_log + log_source.type	the one log to watch, and its format	Log Sources
log_sources	watch several logs at once	Log Sources
network.trusted_nets	who is exempt from bans (keep narrow)	Detection and Bans
ban.actuator	how a ban is enforced	Detection and Bans
endpoint_rules	custom per-endpoint detection	Detection and Bans
auth.*	dashboard login	Dashboard and Authentication
alerting.discord_webhook_url	Discord alerts	Dashboard and Authentication
cve.*	image CVE scanning	CVE Scanning
llm.*	optional AI analysis	LLM Analysis
crowd.*	optional community blocklist	Crowd Intel

Applying changes

Edit secwatch.yaml, then restart secwatch (systemctl restart secwatch). No code change is needed to retune detection. Log sources added from the dashboard apply live, no restart (see Log Sources).

Environment variables

Any setting has a SECWATCH_* equivalent — handy for containers and secrets. Common ones: SECWATCH_CONFIG (path to the YAML), SECWATCH_PORT, SECWATCH_MODE (all/core/agent), SECWATCH_DISCORD_WEBHOOK_URL, SECWATCH_LLM_API_KEY, SECWATCH_INGEST_TOKEN. See the top of each secwatch.example.yaml section for the matching variable.