Configuration

Configuration

Each flag can also be set with an environment variable named SIEMLITE_ plus the flag name in capitals with _ for - (e.g. SIEMLITE_GEOIP_CITY). A flag on the command line wins. SIEMLITE_INTEL_FEED takes several feeds separated by spaces.

Flag	Default	Meaning
-addr	localhost:8443	HTTPS listen address
-tls-mode	self-signed	self-signed (or the -tls-cert files), or letsencrypt for -domain; the System page takes precedence
-domain		The domain to get a Let's Encrypt certificate for; port 443 must reach SIEMLite
-acme-directory	Let's Encrypt	Another ACME server, such as Let's Encrypt's staging server for testing
-acme-ca-root		A CA certificate (PEM file) to trust when talking to the ACME server, for a private ACME CA
-local-addr	localhost:8444	HTTPS listen address that counts as the server itself, for the sign-in restrictions (off when empty). Only the server must be able to reach it
-http-addr		Plain-HTTP listen address for your own reverse proxy that does the HTTPS (off when empty). Never publish it
-trusted-proxies		Reverse proxies whose X-Forwarded-For is believed: addresses, networks or host names, e.g. proxy. With it set, the -http-addr port refuses everyone else
-db	siemlite.db	SQLite database path; events go in a folder beside it named after it (siemlite-events)
-retention-days	730	Keep events this many days, two years by default (checked daily; whole days are deleted as files). The System page takes precedence once it is saved there
-tls-cert, -tls-key	<db dir>/siemlite.crt, .key	Certificate and key; a self-signed pair is generated if both are missing
-tls-hosts		Extra DNS names or IPs for a generated certificate
-syslog-udp, -syslog-tcp, -syslog-tls		Syslog listen addresses, e.g. :514, :514, :6514 (each off when empty)
-syslog-allow	loopback and private networks	Comma-separated IPs/CIDRs allowed to send syslog
-geoip-city		MaxMind or DB-IP City/Country .mmdb
-geoip-asn		MaxMind or DB-IP ASN .mmdb
-intel-feed		Threat intel feed as name=https://url; repeat for several
-intel-refresh	6h	How often to re-download feeds
-ai-url		Ollama server for AI Parsers, e.g. http://ollama:11434: turns it on with this server until the Integrations page saves its own settings
-ai-model	qwen2.5-coder:3b	Ollama model for AI Parsers, with -ai-url
-backup-dir	<db dir>/backups	Folder for database backups
-update-check	true	Check GitHub for new releases and offer updates on the System page

siemlite version prints the version. siemlite install installs it as a service (see Install as a service).