Configuration reference

All the standalone edition’s configuration lives in .env. The installer creates it from .env.example. This file holds secrets: keep it at mode 0600 and out of any code repository.

After a change:

docker compose up -d

Required

Variable	Role
AARVIEW_DOMAIN	the name your users type; it must resolve to this server
AARVIEW_OPERATOR_NAME	your organisation, shown to your users (sign-in page, reports, e-mails)
AARVIEW_ADMIN_EMAIL	the identity provider’s administrator, and the contact shown when an account is locked

Optional

Variable	Default	Role
AARVIEW_OPERATOR_TENANT	operator	short identifier of your own organisation (lowercase letters, digits, dashes)
AARVIEW_SUPPORT_EMAIL	AARVIEW_ADMIN_EMAIL	support address shown to your users
AARVIEW_BIND	0.0.0.0	address port 443 listens on (0.0.0.0 = every interface)
AARVIEW_LOCKOUT_SECONDS	900	how long an account stays locked after 5 failed sign-ins
AARVIEW_LICENCE_KEY	empty	the licence key; it can also be installed from the Licence page

Public feeds

Outbound HTTPS, carrying no data of yours. Set them to false on a closed network.

Variable	Default	Role
CVE_FEED_ENABLED	true	CVE feed (NVD and the CISA KEV catalogue)
EUVD_ENABLED	true	ENISA’s EUVD list
NEWS_ALERTS_ENABLED	true	an hourly notification of recent critical CVEs
NEWS_SOURCES	the official CERTs	the feeds the News page reads; empty (NEWS_SOURCES=) = none
NVD_API_KEY	empty	optional NVD API key: it raises the request limit NVD applies

Without NEWS_SOURCES in .env, the News page reads cert-fr, cert-eu-adv, cert-eu-ti, cccs-fr, ancs-tn and africacert.

Mail

Variable	Default	Role
SMTP_HOST	empty	outgoing mail server (notifications, account links)
SMTP_PORT	587	port
SMTP_USER, SMTP_PASSWORD	empty	credentials

Existing engines

All optional; empty = not configured. The event store, endpoint manager and threat intelligence platform each work with a compatible engine (list on request). Details in Existing engines.

Variables	Engine
EVENTS_URL, EVENTS_USER, EVENTS_PASSWORD, EVENTS_CA_CERT	event store
ENDPOINTS_API_URL, ENDPOINTS_API_USER, ENDPOINTS_API_PASSWORD, ENDPOINTS_API_CA_CERT	endpoint manager
INTEL_URL, INTEL_API_KEY, INTEL_CA_CERT	threat intelligence platform
CORTEX_URL, CORTEX_API_KEY, CORTEX_CA_CERT	Cortex
AI_SERVICE_URL, AI_SERVICE_TOKEN	AI assistant service

A private authority file goes in certs/ and is referred to as /certs/<file>.

Generated by the installer

Leave them empty: install.sh fills them. Never reuse them between installations.

Variable	Content
AARVIEW_INSTANCE_ID	instance id (aarv-…), bound to the licence; never change it on a running install
POSTGRES_PASSWORD, AARVIEW_DB_APP_PASSWORD, AUTHENTIK_DB_PASSWORD	database passwords
AUTHENTIK_SECRET_KEY, AUTHENTIK_BOOTSTRAP_PASSWORD	identity provider; the second is akadmin’s initial password
AUTHENTIK_CLIENT_ID, AUTHENTIK_CLIENT_SECRET	the portal’s OpenID Connect client
AARVIEW_AUTHENTIK_TOKEN	the token of the portal’s directory account
NEXTAUTH_SECRET	the interface’s sessions
SOURCES_MASTER_KEY, WEBHOOK_MASTER_KEY	encryption of source and webhook secrets

Published images

By default the images are built from the source tree. To use published images instead, set AARVIEW_BACKEND_IMAGE and AARVIEW_FRONTEND_IMAGE.