2026-10-13 10:33:31 +02:00
|
|
|
HOST=127.0.0.1
|
|
|
|
|
PORT=4310
|
|
|
|
|
PUBLIC_URL=http://127.0.0.1:4310
|
|
|
|
|
# Generate a random value of at least 32 characters. Required to start.
|
|
|
|
|
ADMIN_TOKEN=
|
|
|
|
|
DATA_DIR=./data
|
|
|
|
|
# Encrypted policy delivery is required by default; false is allowed only for loopback development.
|
|
|
|
|
REQUIRE_PQ_MANAGEMENT_CHANNEL=true
|
|
|
|
|
# Require a different SSO administrator to approve every signed policy publication.
|
|
|
|
|
# This is deployment configuration, never editable from a browser policy.
|
|
|
|
|
REQUIRE_INDEPENDENT_POLICY_APPROVAL=true
|
|
|
|
|
# Deploy a trusted ML-DSA-87 public PEM outside the browser profile for PQ initial trust.
|
|
|
|
|
SAFETYNET_CHANNEL_SIGNATURE_KEY_FILE=
|
|
|
|
|
SAFETYNET_REQUIRE_CHANNEL_PIN=false
|
|
|
|
|
# Optional enterprise ICAPS trust/client identity. PEM files stay in protected deployment storage.
|
|
|
|
|
SAFETYNET_ICAP_CA_FILE=
|
|
|
|
|
SAFETYNET_ICAP_CERT_FILE=
|
|
|
|
|
SAFETYNET_ICAP_KEY_FILE=
|
|
|
|
|
# For the Node.js management service's outbound HTTP clients. Set through the service environment.
|
|
|
|
|
# NODE_USE_ENV_PROXY=1
|
|
|
|
|
# HTTP_PROXY=http://company-proxy.example:8080
|
|
|
|
|
# HTTPS_PROXY=http://company-proxy.example:8080
|
|
|
|
|
# NO_PROXY=localhost,127.0.0.1,::1
|
|
|
|
|
# NODE_USE_SYSTEM_CA=1
|
|
|
|
|
# NODE_EXTRA_CA_CERTS=C:/ProgramData/SafetyNet/company-ca.pem
|
|
|
|
|
# Required for enterprise SSO. Register PUBLIC_URL/auth/callback with the IdP.
|
|
|
|
|
OIDC_ISSUER=
|
|
|
|
|
OIDC_CLIENT_ID=
|
|
|
|
|
OIDC_CLIENT_SECRET=
|
|
|
|
|
OIDC_ADMIN_GROUP=safetynet-admins
|
|
|
|
|
OIDC_OPERATOR_GROUP=
|
|
|
|
|
OIDC_AUDITOR_GROUP=
|
|
|
|
|
OIDC_DEVICE_GROUP=
|
|
|
|
|
OIDC_GROUPS_CLAIM=groups
|
|
|
|
|
# Optional: server-held credentials for an approved OpenAI-compatible endpoint.
|
|
|
|
|
AI_BASE_URL=
|
|
|
|
|
AI_API_KEY=
|
|
|
|
|
AI_MODEL=
|
|
|
|
|
# Must match policy.ai.endpointId; local mode requires numeric loopback.
|
|
|
|
|
AI_ENDPOINT_ID=default
|
|
|
|
|
# Optional OTLP HTTP trace export; no prompt/content attributes are emitted.
|
|
|
|
|
OTEL_EXPORTER_OTLP_ENDPOINT=
|
|
|
|
|
# Durable SIEM delivery: default is data/security.ndjson. Optional HTTPS push.
|
|
|
|
|
SIEM_FORMAT=ecs
|
|
|
|
|
SIEM_HTTP_URL=
|
|
|
|
|
SIEM_HTTP_TOKEN=
|
|
|
|
|
SIEM_CA_FILE=
|
|
|
|
|
SIEM_CERT_FILE=
|
|
|
|
|
SIEM_KEY_FILE=
|
|
|
|
|
# Opt-in database event retention; 0 disables deletion. Incident evidence,
|
|
|
|
|
# pending SIEM delivery and device-event replay deduplication are preserved.
|
|
|
|
|
# SIEM receiver / local export file retention must be configured separately.
|
|
|
|
|
AUDIT_RETENTION_DAYS=0
|
|
|
|
|
# Separate encrypted analyst evidence; leave unset to disable. The deployment
|
|
|
|
|
# key file must contain exactly 32 raw bytes and be protected separately from DB.
|
|
|
|
|
EVIDENCE_KEY_FILE=
|
|
|
|
|
EVIDENCE_RETENTION_DAYS=30
|
|
|
|
|
# Customer-hosted content inspector. Never point this at an untrusted public service.
|
|
|
|
|
INSPECTOR_URL=http://127.0.0.1:4311
|
|
|
|
|
INSPECTOR_TOKEN=
|
|
|
|
|
# Exact local model snapshot directory and its commit revision; inspection never downloads weights.
|
|
|
|
|
EMBEDDING_MODEL_DIR=
|
|
|
|
|
EMBEDDING_MODEL_REVISION=
|
2026-10-13 16:58:15 +02:00
|
|
|
|
|
|
|
|
# Optional external owner-only ML-DSA-87 PKCS8 PEM audit signing key.
|
|
|
|
|
# Once enabled, restarting without the same key fails; archive public pin/head externally.
|
|
|
|
|
AUDIT_SIGNING_KEY_FILE=
|
2026-10-13 23:19:22 +02:00
|
|
|
# Optional upstream proxy credentials require an exact endpoint pin.
|
|
|
|
|
# These are deployment-only; never publish passwords in policy bundles.
|
|
|
|
|
SAFETYNET_PROXY_AUTH_HOST=
|
|
|
|
|
SAFETYNET_PROXY_AUTH_PORT=
|
