HOST=127.0.0.1
PORT=4310
PUBLIC_URL=http://127.0.0.1:4310
# Generate a random value of at least 32 characters. Required to start.
ADMIN_TOKEN=
DATA_DIR=./data
# Encrypted policy delivery is required by default; false is allowed only for loopback development.
REQUIRE_PQ_MANAGEMENT_CHANNEL=true
# Require a different SSO administrator to approve every signed policy publication.
# This is deployment configuration, never editable from a browser policy.
REQUIRE_INDEPENDENT_POLICY_APPROVAL=true
# Deploy a trusted ML-DSA-87 public PEM outside the browser profile for PQ initial trust.
SAFETYNET_CHANNEL_SIGNATURE_KEY_FILE=
SAFETYNET_REQUIRE_CHANNEL_PIN=false
# Optional enterprise ICAPS trust/client identity. PEM files stay in protected deployment storage.
SAFETYNET_ICAP_CA_FILE=
SAFETYNET_ICAP_CERT_FILE=
SAFETYNET_ICAP_KEY_FILE=
# For the Node.js management service's outbound HTTP clients. Set through the service environment.
# NODE_USE_ENV_PROXY=1
# HTTP_PROXY=http://company-proxy.example:8080
# HTTPS_PROXY=http://company-proxy.example:8080
# NO_PROXY=localhost,127.0.0.1,::1
# NODE_USE_SYSTEM_CA=1
# NODE_EXTRA_CA_CERTS=C:/ProgramData/SafetyNet/company-ca.pem
# Required for enterprise SSO. Register PUBLIC_URL/auth/callback with the IdP.
OIDC_ISSUER=
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=
OIDC_ADMIN_GROUP=safetynet-admins
OIDC_OPERATOR_GROUP=
OIDC_AUDITOR_GROUP=
OIDC_DEVICE_GROUP=
OIDC_GROUPS_CLAIM=groups
# Optional: server-held credentials for an approved OpenAI-compatible endpoint.
AI_BASE_URL=
AI_API_KEY=
AI_MODEL=
# Must match policy.ai.endpointId; local mode requires numeric loopback.
AI_ENDPOINT_ID=default
# Optional OTLP HTTP trace export; no prompt/content attributes are emitted.
OTEL_EXPORTER_OTLP_ENDPOINT=
# Durable SIEM delivery: default is data/security.ndjson. Optional HTTPS push.
SIEM_FORMAT=ecs
SIEM_HTTP_URL=
SIEM_HTTP_TOKEN=
SIEM_CA_FILE=
SIEM_CERT_FILE=
SIEM_KEY_FILE=
# Opt-in database event retention; 0 disables deletion. Incident evidence,
# pending SIEM delivery and device-event replay deduplication are preserved.
# SIEM receiver / local export file retention must be configured separately.
AUDIT_RETENTION_DAYS=0
# Separate encrypted analyst evidence; leave unset to disable. The deployment
# key file must contain exactly 32 raw bytes and be protected separately from DB.
EVIDENCE_KEY_FILE=
EVIDENCE_RETENTION_DAYS=30
# Customer-hosted content inspector. Never point this at an untrusted public service.
INSPECTOR_URL=http://127.0.0.1:4311
INSPECTOR_TOKEN=
# Exact local model snapshot directory and its commit revision; inspection never downloads weights.
EMBEDDING_MODEL_DIR=
EMBEDDING_MODEL_REVISION=

# Optional external owner-only ML-DSA-87 PKCS8 PEM audit signing key.
# Once enabled, restarting without the same key fails; archive public pin/head externally.
AUDIT_SIGNING_KEY_FILE=
# Optional upstream proxy credentials require an exact endpoint pin.
# These are deployment-only; never publish passwords in policy bundles.
SAFETYNET_PROXY_AUTH_HOST=
SAFETYNET_PROXY_AUTH_PORT=