Configuration

Every setting is an environment variable. The shipped .env.example is the practical starting point; this page is the full reference.

Caution

Never put a # comment on the same line as a value. Docker Compose keeps it as part of the value, and an empty key with a trailing comment becomes the comment.

Core

Variable	Required	Default	Description
DATABASE_URL		file:/data/app.db	SQLite path. Defaults to the persistent volume, so there is no need to change it.
BETTER_AUTH_SECRET		(generated)	Secret used to sign sessions. The container generates one on first start and keeps it in the volume at /data/auth-secret. Set it to choose your own, and always set it for pnpm dev. It must be at least 32 characters; generate one with openssl rand -base64 32.
BETTER_AUTH_URL		(inferred from the proxy headers)	The public URL of the dashboard, e.g. https://dashboard.example.com. Leave it unset for plain HTTP at http://<host>:3000. Set it when you serve over HTTPS, so the session cookie is marked Secure. The flag is picked at startup, so without this it stays unmarked even behind an HTTPS proxy, and the dashboard warns when it notices. Also set it if logins fail with “Invalid origin”.
SIGN_IN_RATE_LIMIT_MAX		5	Password sign-in attempts allowed per client IP in each window. Further attempts get “Too many sign-in attempts” and a countdown.
SIGN_IN_RATE_LIMIT_WINDOW		60	Length of that window in seconds.
TRUSTED_PROXIES		loopback and private ranges	Comma-separated IPs or CIDR ranges of your reverse proxies. Sign-in is rate limited per client IP, and the dashboard only believes X-Forwarded-For when the connection comes from one of these. The default covers a proxy on the same host or LAN. Narrow it, e.g. to your Docker network 172.18.0.0/16, if untrusted machines share those ranges.

CrowdSec LAPI

See LAPI setup for where these values come from.

Variable	Required	Default	Description
LAPI_URL	Yes		LAPI base URL including port, e.g. http://192.168.1.100:8080.
LAPI_MACHINE_ID	Yes		Machine ID for watcher authentication.
LAPI_MACHINE_PASSWORD	Yes		Machine password for watcher authentication.
LAPI_BOUNCER_API_TOKEN	Yes		API token for bouncer (read) access.
LAPI_POLL_INTERVAL		60	Seconds between LAPI decision syncs.
LAPI_DECISION_ORIGINS		crowdsec,cscli	Comma-separated decision origins to mirror. The default keeps the decisions your own agents and cscli made. Set it to an empty value to pull every origin LAPI holds, which adds the CAPI and community blocklist decisions: tens of thousands of rows, most with no alert evidence.
LAPI_ALERT_LIMIT		100	Alerts requested per host when fetching evidence. Raise it if a busy host shows fewer alerts than cscli alerts list does.

Without the machine credentials there is no alert evidence and no ASN data, so the expanded row stays empty.

Retention

Both limits apply on every sync. Days are applied first, then the count.

Variable	Required	Default	Description
DECISION_RETENTION_COUNT		20000	Maximum decisions kept in the database. The oldest inactive ones are pruned first, together with hosts and alerts nothing references anymore. Set to 0 to keep everything.
DECISION_RETENTION_DAYS		0	Also drop inactive decisions older than this many days. 0 disables the age limit.

Logging

Variable	Required	Default	Description
LOG_LEVEL		info	Lowest level written: fatal, error, warn, info, debug or trace.
LOG_FORMAT		human	human is one colored line per event. json writes one JSON object per line for a log collector.

At info the log records what changed: sign-ins and failed sign-ins, users created or deleted, decisions removed from the dashboard and by whom, every sync that changed something, and LAPI outages with their recovery. Stack traces appear only at debug, where quiet polls are logged too.

Set NO_COLOR=1 to drop the colors from human output.

Updates

Variable	Required	Default	Description
UPDATE_CHECK		true	Ask GitHub for the newest release a few times a day so the sidebar can point out an update. Set to false to never contact GitHub.

SSO

Optional. See SSO setup for the provider side.

Variable	Required	Default	Description
OIDC_CLIENT_ID			Client ID from your OIDC provider. Required to enable SSO.
OIDC_CLIENT_SECRET			Client secret from your OIDC provider. Required to enable SSO.
OIDC_ISSUER_URL			Issuer URL, e.g. https://authentik.example.com/application/o/my-app/. Required to enable SSO.
OIDC_BUTTON_LABEL		Sign in with SSO	Label shown on the SSO login button.
OIDC_AUTO_REDIRECT		false	Set to true to skip the login form and redirect straight to your SSO provider.