Configuration

Configuration

Most values can be read from the environment or from *_FILE paths (Docker secrets style), for example UI_PASSWORD_FILE, AGENT_SECRET_FILE, DATABASE_URL_FILE.

Exception: OIDC settings are read from the plain OIDC_* environment variables (not OIDC_*_FILE).

Server (core)

Variable	Default	Description
DATABASE_URL	postgres://monitor:monitor@localhost:5432/monitor	PostgreSQL URL. In Compose, the compose file sets this to the db service.
LISTEN_ADDR	0.0.0.0:9000	Bind address for HTTP and WebSocket.
STATIC_DIR	./static	Built dashboard files (/app/static in Docker).
UI_PASSWORD	(unset)	Bootstrap admin password for the first dashboard user when the DB has zero users (backward compatible fallback for ADMIN_PASSWORD). After bootstrap, passwords are stored in Postgres and changes to UI_PASSWORD do not affect existing users.
ADMIN_USERNAME	admin	Username for the default bootstrap admin (only used on first run when there are zero dashboard users).
ADMIN_PASSWORD	(unset)	Password for the default bootstrap admin (bootstrap only). If unset, UI_PASSWORD is used as a backward-compatible fallback.
AGENT_SECRET	(unset)	If set, agents must send this value as the secret query parameter. If unset and ALLOW_INSECURE_AGENT_AUTH is not true, agents are denied.
RUST_LOG	info	Tracing log filter.
ENFORCE_HTTPS	true	When true, non-health requests need X-Forwarded-Proto: https or wss. Set false for plain HTTP without a proxy.
CORS_ORIGINS	(empty)	Comma-separated browser origins. Empty means permissive CORS.
COOKIE_SECURE	(see server)	Session cookies use Secure when this is true or X-Forwarded-Proto is https. For plain HTTP, avoid forcing COOKIE_SECURE=true.

Server (optional behaviour)

Variable	Default	Description
ALLOW_INSECURE_DASHBOARD_OPEN	false	If true, allows running without UI_PASSWORD (insecure).
ALLOW_INSECURE_AGENT_AUTH	false	If true, allows agents without AGENT_SECRET (insecure).
WOL_MIN_INTERVAL_SECS	15	Minimum seconds between Wake-on-LAN per agent (0 = no throttle).
ALLOW_REMOTE_SCRIPT_EXECUTION	false	If true, enables remote script endpoints (remote code).
DASHBOARD_OPERATOR_NAME	operator	Audit log label for UI actions.
EXPOSE_INTERNAL_ERRORS	false	If true, JSON 500 responses may include internal error text.
LOG_FORCE_COLOR	—	1 or true for ANSI logs when stderr is not a TTY (e.g. Docker).
NO_COLOR	—	If set, disables ANSI in logs.

External notifications (Home Assistant)

To send alert rule matches into Home Assistant as a custom event:

Variable	Default	Description
HOME_ASSISTANT_URL	(unset)	Home Assistant base URL, e.g. https://homeassistant.local:8123
HOME_ASSISTANT_ACCESS_TOKEN	(unset)	Long-lived access token (Home Assistant Profile → Security)
HOME_ASSISTANT_EVENT_TYPE	sentinel_alert	Event type posted to POST /api/events/<event_type> (must be [a-z0-9_]+)
HOME_ASSISTANT_SKIP_TLS_VERIFY	false	If true, disables TLS certificate verification for HA requests (insecure)
PUBLIC_BASE_URL	(unset)	When set, Sentinel includes dashboard_url and dashboard_activity_url deep-links in the HA event payload

Docker Compose (from docker-compose.yml)

Variable	Description
PUBLISH_PORT	Host port mapped to container 9000. Unset if only Traefik exposes the service.
TRAEFIK_ENABLE	true to apply Traefik labels.
TRAEFIK_HOST	Hostname for the Traefik router.
TRAEFIK_NETWORK	External network name (default traefik).
TRAEFIK_ENTRYPOINT	Entry point (default websecure).
TRAEFIK_CERTRESOLVER	Certificate resolver (default cloudflare).

OpenID Connect (OIDC) / SSO

Sentinel supports dashboard login via OIDC (Authorization Code flow).

The required environment variables are documented in OIDC, including:

• OIDC_ISSUER_URL, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET, OIDC_REDIRECT_URL
• optional OIDC_SCOPES, OIDC_ADMIN_GROUP, OIDC_OPERATOR_GROUP