Environment template

Environment template (full reference)

This is a copy-paste reference for every variable you might set when running sentinel-server outside the minimal Docker quick start. For explanations and defaults, see Configuration.

New deployments should prefer **ADMIN_PASSWORD**; **UI_PASSWORD** remains as a backward-compatible alias for the bootstrap admin password.

# Required (typical self-hosted)
POSTGRES_PASSWORD=replace_me_strong
ADMIN_PASSWORD=replace_me_strong
# Legacy alias for bootstrap admin password (optional if ADMIN_PASSWORD is set)
# UI_PASSWORD=replace_me_strong
AGENT_SECRET=replace_me_strong

# Optional
POSTGRES_DB=monitor
POSTGRES_USER=monitor
RUST_LOG=info

# Structured logs (JSON lines) for log pipelines
LOG_JSON=false

# Server default configuration
LISTEN_ADDR=0.0.0.0:9000
STATIC_DIR=/app/static

# SQLx pool size (default 20)
POOL_MAX_CONNECTIONS=20

# Prometheus metrics at /metrics (default true)
METRICS_ENABLED=true

# Per-IP HTTP rate limit for /api/* (0 = disabled). Suggested: 50–200 in production.
API_RATE_LIMIT_PER_SECOND=0

# Retention background job (seconds)
RETENTION_INTERVAL_SECS=3600

# Optional: delete alert-rule events (and screenshots) older than N days (omit = keep forever)
# ALERT_EVENT_RETENTION_DAYS=365

# Optional: delete software inventory rows older than N days by captured_at (omit = keep forever)
# SOFTWARE_INVENTORY_RETENTION_DAYS=730

# Recommended in production behind HTTPS reverse proxy
COOKIE_SECURE=true

# Comma-separated list of allowed browser origins (lock this down in prod)
# Example: https://monitor.example.com
CORS_ORIGINS=

# Security opt-ins for local/dev only
# Defaults are fail-closed: missing secrets deny access.
# Set to `true` only if you intentionally want an insecure dev setup.
ALLOW_INSECURE_DASHBOARD_OPEN=false
ALLOW_INSECURE_AGENT_AUTH=false

# Direct port exposure (no reverse proxy). Example: 9000
# PUBLISH_PORT=

# Traefik integration (enable if using Traefik reverse proxy)
# TRAEFIK_ENABLE=true
# TRAEFIK_NETWORK=traefik
# TRAEFIK_HOST=monitor.example.com
# TRAEFIK_ENTRYPOINT=websecure
# TRAEFIK_CERTRESOLVER=cloudflare

# Internet exposure hardening:
# When true, the server will require `X-Forwarded-Proto: https` on requests
# (so it must be behind a TLS-terminating reverse proxy like Traefik).
ENFORCE_HTTPS=true

# ── External notifications (alert rule matches) ─────────────────────────────
# Optional: Home Assistant — fires a custom event you can catch in automations.
# Recommended: long-lived access token (Profile → Security) + event API; automations
# decide how to notify (mobile app, TTS, lights). See server/src/notify/home_assistant.rs.
#
# HOME_ASSISTANT_URL=https://homeassistant.local:8123
# HOME_ASSISTANT_ACCESS_TOKEN=your_long_lived_token
# Optional event name (default: sentinel_alert); must be [a-z0-9_]+
# HOME_ASSISTANT_EVENT_TYPE=sentinel_alert
# Only for dev / self-signed HA TLS (insecure):
# HOME_ASSISTANT_SKIP_TLS_VERIFY=false

# Optional: public base URL for deep links embedded in external notifications
# (e.g. Home Assistant event payload fields `dashboard_url` / `dashboard_activity_url`).
# Example: https://sentinel.gladsonsam.com
# PUBLIC_BASE_URL=