Environment template

Environment template (full reference)

The repository’s minimal variables are in .env.example; copy to .env and run docker compose up -d (see Deployment).

This page is a copy-paste reference for additional keys when running sentinel-server outside that minimal set. For explanations and defaults, see Configuration.

New deployments should prefer ADMIN_PASSWORD; UI_PASSWORD remains as a backward-compatible alias for the bootstrap admin password.

# Required (typical self-hosted)
POSTGRES_PASSWORD=replace_me_strong
ADMIN_PASSWORD=replace_me_strong
# Legacy alias for bootstrap admin password (optional if ADMIN_PASSWORD is set)
# UI_PASSWORD=replace_me_strong
AGENT_SECRET=replace_me_strong

# Optional
POSTGRES_DB=monitor
POSTGRES_USER=monitor
RUST_LOG=info

# Structured logs (JSON lines) for log pipelines
LOG_JSON=false

# Server default configuration
LISTEN_ADDR=0.0.0.0:9000
STATIC_DIR=/app/static

# SQLx pool size (default 20)
POOL_MAX_CONNECTIONS=20

# Prometheus metrics at /metrics (default true)
METRICS_ENABLED=true

# Per-IP HTTP rate limit for /api/* (0 = disabled). Suggested: 50–200 in production.
API_RATE_LIMIT_PER_SECOND=0

# Retention background job (seconds)
RETENTION_INTERVAL_SECS=3600

# Optional: delete alert-rule events (and screenshots) older than N days (omit = keep forever)
# ALERT_EVENT_RETENTION_DAYS=365

# Optional: delete software inventory rows older than N days by captured_at (omit = keep forever)
# SOFTWARE_INVENTORY_RETENTION_DAYS=730

# Recommended in production behind HTTPS reverse proxy
COOKIE_SECURE=true

# Comma-separated list of allowed browser origins (lock this down in prod)
# Example: https://monitor.example.com
CORS_ORIGINS=

# Security opt-ins for local/dev only
# Defaults are fail-closed: missing secrets deny access.
# Set to `true` only if you intentionally want an insecure dev setup.
ALLOW_INSECURE_DASHBOARD_OPEN=false
ALLOW_INSECURE_AGENT_AUTH=false

# Traefik: add labels on the server service in your compose override (see wiki Deployment).
# Typical env additions: ENFORCE_HTTPS=true, PUBLIC_BASE_URL=https://…, SENTINEL_MDNS_PORT=443

# Internet exposure hardening:
# When true, the server will require `X-Forwarded-Proto: https` on requests
# (so it must be behind a TLS-terminating reverse proxy like Traefik).
ENFORCE_HTTPS=true

# ── External notifications (alert rule matches) ─────────────────────────────
# Optional: Home Assistant — fires a custom event you can catch in automations.
# Recommended: long-lived access token (Profile → Security) + event API; automations
# decide how to notify (mobile app, TTS, lights). See server/src/notify/home_assistant.rs.
#
# HOME_ASSISTANT_URL=https://homeassistant.local:8123
# HOME_ASSISTANT_ACCESS_TOKEN=your_long_lived_token
# Optional event name (default: sentinel_alert); must be [a-z0-9_]+
# HOME_ASSISTANT_EVENT_TYPE=sentinel_alert
# Only for dev / self-signed HA TLS (insecure):
# HOME_ASSISTANT_SKIP_TLS_VERIFY=false

# Optional: public base URL for deep links embedded in external notifications
# (e.g. Home Assistant event payload fields `dashboard_url` / `dashboard_activity_url`).
# Example: https://sentinel.gladsonsam.com
# PUBLIC_BASE_URL=