.env.example

POSTGRES_DB=sentinelstack
POSTGRES_USER=sentinel
POSTGRES_PASSWORD=sentinelpass
DATABASE_URL=postgresql://sentinel:sentinelpass@postgres:5432/sentinelstack
LOGGING_SERVICE_URL=http://logging-service:8000
NEXT_PUBLIC_LOGGING_API_BASE_URL=http://localhost:8080/api/logging
LOGGING_API_BASE_URL=http://logging-service:8000
PORTGUARD_API_BASE_URL=http://portguard-service:8000
PORTGUARD_ALLOWED_TARGETS=demo-app,nginx,postgres,logging-service
PORTGUARD_DEFAULT_TARGET=demo-app
PORTGUARD_CONNECT_TIMEOUT=1.0
PORTGUARD_ALERTS_ENABLED=true
PORTGUARD_SCHEDULE_ENABLED=false
PORTGUARD_SCHEDULE_MINUTES=60
PORTGUARD_SCHEDULE_TARGETS=
PORTGUARD_WEBHOOK_SECRET=
PORTGUARD_ALERT_DEDUPE_MINUTES=45
ADMIN_TOKEN=admin-secret
FAILED_LOGIN_THRESHOLD=5
FAILED_LOGIN_SCORE=35
REQUEST_SPIKE_THRESHOLD=30
REQUEST_SPIKE_SCORE=30
REPEATED_404_THRESHOLD=8
REPEATED_404_SCORE=20
SENSITIVE_PROBE_THRESHOLD=3
SENSITIVE_PROBE_SCORE=25
LOW_MAX=29
MEDIUM_MAX=59
HIGH_MAX=79
AUTO_BLOCK_MINUTES=60

# Behavioral pipeline (optional — defaults in logging-service code)
# BEHAVIOR_WINDOW_MINUTES=5
# BEHAVIOR_MIN_SAMPLES=5
# ANOMALY_EVENT_THRESHOLD=0.72
# ANOMALY_POINTS_MAX=35
# CRITICAL_RULE_FLOOR=50
# ANOMALY_IFOREST_ENABLED=true
# ANOMALY_LLM_ENABLED=true

# Optional OpenAI features (heuristic scores stay authoritative for blocking and severity)
OPENAI_API_KEY=
OPENAI_MODEL=gpt-4o-mini
AI_ALERT_EXPLAIN_ENABLED=true
AI_THREAT_SCORING_ENABLED=true
AI_RECOMMENDATIONS_ENABLED=true
# Auto-acknowledge new alerts when AI advisory score <= N (empty = off; use with care)
# AI_AUTO_ACK_WHEN_AI_SCORE_LE=30