This repository was archived by the owner on Mar 31, 2026. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 15
Expand file tree
/
Copy path.env.example
More file actions
192 lines (138 loc) · 5.23 KB
/
.env.example
File metadata and controls
192 lines (138 loc) · 5.23 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
# ============================================================================
# SENTINEL AI Security Platform — Environment Configuration
# ============================================================================
# Copy this file to .env and customize for your deployment
#
# Required: Uncomment and set values marked with [REQUIRED]
# Optional: Values with defaults can be left as-is
# ============================================================================
# ============================================================================
# GENERAL
# ============================================================================
# Deployment environment: development | staging | production
SENTINEL_ENV=production
# Log level: DEBUG | INFO | WARNING | ERROR
LOG_LEVEL=INFO
# Timezone
TZ=UTC
# ============================================================================
# BRAIN SERVICE (Python gRPC Server)
# ============================================================================
# gRPC port for Brain service
BRAIN_GRPC_PORT=50051
# Maximum prompt size in bytes (100KB default)
MAX_PROMPT_LENGTH=102400
# Enabled engines (comma-separated, empty = all)
# Example: injection,pii,rag_guard,tda_enhanced,behavioral
ENGINES_ENABLED=
# Strange Math engines (advanced mathematical detection)
ENABLE_STRANGE_MATH=true
# Hive Intelligence (enterprise feature)
ENABLE_HIVE=false
# Post-Quantum Cryptography
ENABLE_PQC=false
# ============================================================================
# GATEWAY SERVICE (Go HTTP Server)
# ============================================================================
# Gateway HTTP port
GATEWAY_HTTP_PORT=8080
# Gateway HTTPS port (set 0 to disable)
GATEWAY_HTTPS_PORT=8443
# [REQUIRED] API key for authentication
# Generate with: openssl rand -hex 32
GATEWAY_API_KEY=
# Rate limiting (requests per minute per client)
RATE_LIMIT_RPM=100
# Proof-of-Work difficulty (0 = disabled)
POW_DIFFICULTY=0
# CORS allowed origins (comma-separated)
CORS_ORIGINS=http://localhost:3000,http://localhost:8080
# ============================================================================
# LLM PROVIDER PROXY
# ============================================================================
# [REQUIRED for proxy mode] OpenAI API key
OPENAI_API_KEY=
# [REQUIRED for proxy mode] Anthropic API key
ANTHROPIC_API_KEY=
# [REQUIRED for proxy mode] Google AI API key
GOOGLE_AI_API_KEY=
# Default LLM provider: openai | anthropic | google
DEFAULT_LLM_PROVIDER=openai
# Default model
DEFAULT_LLM_MODEL=gpt-4o-mini
# ============================================================================
# REDIS (Caching & Rate Limiting)
# ============================================================================
# Redis connection
REDIS_HOST=redis
REDIS_PORT=6379
REDIS_PASSWORD=
REDIS_DB=0
# Cache TTL in seconds
CACHE_TTL=3600
# ============================================================================
# POSTGRESQL (Optional: Audit Logs & Metrics)
# ============================================================================
# Database connection
POSTGRES_HOST=postgres
POSTGRES_PORT=5432
POSTGRES_USER=sentinel
POSTGRES_PASSWORD=
POSTGRES_DB=sentinel
# Connection pool
POSTGRES_POOL_SIZE=10
POSTGRES_MAX_OVERFLOW=20
# ============================================================================
# DASHBOARD (Web UI)
# ============================================================================
# Dashboard port
DASHBOARD_PORT=3000
# [REQUIRED] Dashboard admin credentials
DASHBOARD_ADMIN_USER=admin
DASHBOARD_ADMIN_PASSWORD=
# Session secret (generate with: openssl rand -hex 32)
DASHBOARD_SESSION_SECRET=
# ============================================================================
# TLS/SSL CERTIFICATES
# ============================================================================
# Path to TLS certificate
TLS_CERT_PATH=./certs/server.crt
# Path to TLS private key
TLS_KEY_PATH=./certs/server.key
# Enable mTLS (mutual TLS)
ENABLE_MTLS=false
# Path to CA certificate for mTLS
TLS_CA_PATH=./certs/ca.crt
# ============================================================================
# OBSERVABILITY
# ============================================================================
# Enable OpenTelemetry tracing
ENABLE_OTEL=false
# OTLP endpoint for traces
OTEL_EXPORTER_OTLP_ENDPOINT=http://jaeger:4317
# Prometheus metrics port
METRICS_PORT=9090
# Enable health check endpoints
ENABLE_HEALTH_CHECKS=true
# ============================================================================
# SECURITY HARDENING
# ============================================================================
# Force HTTPS redirect
FORCE_HTTPS=true
# Enable request signing verification
ENABLE_REQUEST_SIGNING=false
# Maximum request body size (bytes)
MAX_REQUEST_SIZE=10485760
# Session timeout (seconds)
SESSION_TIMEOUT=3600
# Maximum concurrent sessions per user
MAX_SESSIONS=10
# ============================================================================
# DEVELOPMENT OPTIONS (disable in production!)
# ============================================================================
# Allow insecure gRPC (no TLS) — NEVER in production
INSECURE_MODE_ALLOWED=false
# Enable debug endpoints
ENABLE_DEBUG=false
# Verbose logging (may expose sensitive data)
VERBOSE_LOGGING=false