Configuration

Central platform (`.env`)

All central-platform configuration is read from environment variables, set in the .env file next to docker-compose.yml. Defaults below are the backend’s built-in defaults. The shipped .env.example deliberately omits defaults for secrets so an install can’t accidentally go live with a known password.

Required in production

Variable	Description
`POSTGRES_DB`, `POSTGRES_USER`, `POSTGRES_PASSWORD`	Application database credentials
`JWT_SECRET`	Session token signing secret. The backend refuses to start if unset or left as `change-me-in-production`
`ICINGA2_API_PASSWORD`	Must match the password configured in the Icinga 2 container’s `api-users.conf`
`CLICKHOUSE_PASSWORD`	ClickHouse credential
`CADDY_DOMAIN`	Public domain/IP(s) Caddy serves; also the ACME domain in Let’s Encrypt mode

Backend (Go API)

Variable	Default	Description
`DATABASE_URL`	— (no default, must be set)	PostgreSQL connection string, e.g. `postgres://user:pass@postgres:5432/db`
`REDIS_URL`	`redis://localhost:6379/0`	Redis connection string
`ICINGA2_API_URL`	`https://localhost:5665`	Icinga 2 REST API base URL
`ICINGA2_API_USER`	— (no default, must be set)	Icinga 2 API user
`ICINGA2_API_PASSWORD`	— (no default, must be set)	Icinga 2 API password
`VICTORIAMETRICS_URL`	`http://localhost:8428`	VictoriaMetrics query endpoint
`CLICKHOUSE_URL`	—	ClickHouse DSN, e.g. `clickhouse://user:pass@clickhouse:9000/db`
`CLICKHOUSE_READ_TIMEOUT`	`30s`	Read timeout for ClickHouse queries (Go duration). The production compose file sets `300s` so long-running migrations don’t time out during an upgrade
`PROBE_EVENT_RETENTION_DAYS`	`30`	Retention for probe telemetry in ClickHouse
`ANTHROPIC_API_KEY`	—	Claude API key. Leave unset to disable the AI features
`JWT_SECRET`	— (required)	Session token signing secret
`JWT_ALGORITHM`	`HS256`	JWT signing algorithm
`JWT_EXPIRATION`	`86400`	Token lifetime in seconds
`PORT`	`8000`	Backend listen port
`TLS_CERT`, `TLS_KEY`	—	Optional: terminate TLS directly on the backend rather than at Caddy (e.g. agent-only edge sites)
`CORS_ORIGINS`	`http://localhost:5173,https://localhost`	Allowed CORS origins
`ZEEK_LOG_DIR`	—	Path to Zeek’s rotated log directory (mounted read-only from the `zeek-logs` volume, typically `/var/log/zeek/current`)
`SMTP_HOST`, `SMTP_PORT`, `SMTP_USER`, `SMTP_PASSWORD`, `SMTP_FROM`	port `587`, from `noreply@example.com`	Outbound mail for notifications. In Compose, `SMTP_HOST` defaults to the Docker host gateway to reach a local MTA on the host
`GEO_HOME_LAT`, `GEO_HOME_LON`	—	Reference coordinates for geo-based features, e.g. your main site’s latitude/longitude
`AETHIS_PUBLIC_BASE_URL`	`https://localhost:1443`	This instance’s externally reachable URL, used to build callback URLs sent to the Perimeter Probe
`BOOTSTRAP_ADMIN_EMAIL`, `BOOTSTRAP_ADMIN_PASSWORD`, `BOOTSTRAP_ADMIN_NAME`	—	See First-boot admin account below
`RATE_LIMIT_AUTH_PER_MIN`, `RATE_LIMIT_API_PER_MIN`	built-in defaults	Per-IP, per-minute rate limits for authentication and API requests
`AETHIS_ENV`	`development`	Set to `production` on every production install: the backend then refuses to start with known development credentials
`GEOIP_DB_DIR` / `GEOIP_HOST_DIR`	`/var/lib/eon/geoip` / `./data/geoip`	Container path / host path for optional MaxMind GeoLite2 databases (`GeoLite2-ASN.mmdb`, `GeoLite2-Country.mmdb`). If the host path doesn’t exist, enrichment falls back to category-only

First-boot admin account

If BOOTSTRAP_ADMIN_EMAIL and BOOTSTRAP_ADMIN_PASSWORD are both set and no users exist yet, the backend creates a single admin user with those values on startup. On every subsequent boot the check is a no-op, so it’s safe to leave the variables set permanently. install.sh also offers an interactive prompt for the same purpose — use whichever fits: env vars for zero-interaction/CI installs, the prompt for manual ones.

Zeek

Variable	Default	Description
`ZEEK_INTERFACE`	`eth0`	Network interface Zeek sniffs
`ZEEK_PROFILE`	`prod`	`prod` = minimal logging; `dev` = verbose full-protocol capture
`ZEEK_LOG_RETENTION_HOURS`	`24` (prod) / `72` (dev)	Rotated logs older than this are deleted
`ZEEK_MAX_DISK_MB`	`20480`	Hard disk ceiling for `/var/log/zeek`; the janitor force-prunes the oldest rotated files once exceeded, as a last-resort guard against disk-fill

Caddy / TLS

Variable	Default	Description
`CADDY_DOMAIN`	`localhost`	Domain(s)/IP(s) Caddy serves, comma-separated
`CADDY_DEFAULT_SNI`	value of `CADDY_DOMAIN`	Fallback SNI for connections without a Server Name (e.g. IP-based access)
`CADDY_TLS`	`internal`	`internal` = self-signed; empty = ACME (Let’s Encrypt/ZeroSSL, needs port 80 open); or `"<cert path> <key path>"` for a supplied certificate
`CADDY_CERTS_DIR`	—	Host directory mounted read-only at `/etc/caddy/certs` when supplying your own certificate
`CADDY_HTTPS_PORT`, `CADDY_HTTP_PORT`	`443`, `80`	Host ports Caddy binds — change when another reverse proxy already owns 443/80 on the host

Postgres / ClickHouse container credentials

Variable	Description
`POSTGRES_DB`, `POSTGRES_USER`, `POSTGRES_PASSWORD`	Passed straight through to the `postgres:16-alpine` image
`CLICKHOUSE_DB`, `CLICKHOUSE_USER`, `CLICKHOUSE_PASSWORD`	Passed straight through to the `clickhouse/clickhouse-server` image; the backend’s `CLICKHOUSE_URL` must reference the same values

Aethis Agent (`eon-aethis.conf`, YAML)

See Agents & Probes — Aethis Agent for the full field reference. Defaults if a field is omitted: server.tls_verify: true, checks.interval: 60s, checks.plugins_dir: /usr/lib/eon-aethis/plugins, checks.system_plugins_dir: /usr/lib/nagios/plugins, and all metrics.* flags true.

Aethis Probe (`probe.yaml`)

See Agents & Probes — Aethis Probe for the full field reference: backend_url, probe_id, auth_token, ca_path, tls_verify, push_interval, buffer_path, buffer_max_events, buffer_max_bytes, interfaces (list of {name, mode, bpf}), log_level.

Perimeter Probe (`probe.yaml`)

See Agents & Probes — Perimeter Probe for the full field reference: addr, server_cert, server_key, operator_ca, client_cert, client_key.

Agents & Probes