Repository navigation
Expand file tree
/
Copy path.env.example
More file actions
113 lines (100 loc) · 4.81 KB
/
Copy path.env.example
File metadata and controls
113 lines (100 loc) · 4.81 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
# =============================================================================
# VulTrack Configuration
# =============================================================================
# Copy this file to .env and adjust the values for your environment.
# -----------------------------------------------------------------------------
# Database (PostgreSQL)
# -----------------------------------------------------------------------------
POSTGRES_HOST=postgres
POSTGRES_PORT=5432
POSTGRES_USER=vultrack
POSTGRES_PASSWORD=changeme_in_production
POSTGRES_DB=vultrack
# -----------------------------------------------------------------------------
# Backend
# -----------------------------------------------------------------------------
BACKEND_PORT=8080
LOG_LEVEL=info
# Comma-separated origins for CORS (required for cookie-based auth; e.g. http://localhost:3000)
# Leave empty to allow all origins without credentials.
CORS_ORIGINS=http://localhost:3000
# -----------------------------------------------------------------------------
# Importer Settings
# -----------------------------------------------------------------------------
# Path to the directory containing Vuls scan results (JSON files)
# In Docker, this is the container path where the volume is mounted
SCAN_RESULTS_PATH=./results
# Delete JSON files and empty directories after successful import
# Set to 'false' during development to preserve test data
DELETE_AFTER_IMPORT=false
# How often to check for new scan results (e.g., 5m, 1h, 30s)
IMPORT_INTERVAL=5m
# Minimum CVSS score for findings to appear in triage queue (0.0 - 10.0)
TRIAGE_CVSS_THRESHOLD=7.0
# -----------------------------------------------------------------------------
# Frontend
# -----------------------------------------------------------------------------
VITE_API_URL=http://localhost:8080/api/v1
# -----------------------------------------------------------------------------
# Scan Queue
# -----------------------------------------------------------------------------
# Number of concurrent scan workers (default: 5)
SCAN_WORKERS=5
# Timeout per scan in seconds (default: 600 = 10 minutes)
SCAN_TIMEOUT=600
# Maximum retry attempts for failed scans (default: 3)
SCAN_MAX_RETRIES=3
# Maximum queue depth (default: 500)
SCAN_QUEUE_SIZE=500
# -----------------------------------------------------------------------------
# SMTP Email (optional). When SMTP_ENABLED=false, no emails are sent.
# -----------------------------------------------------------------------------
SMTP_ENABLED=false
SMTP_HOST=smtp.example.com
SMTP_PORT=587
# Leave SMTP_USER empty for unauthenticated SMTP relay
SMTP_USER=
SMTP_PASSWORD=
SMTP_FROM=VulTrack <vultrack@example.com>
# TLS mode: "starttls" (port 587), "tls" (port 465), "none" (port 25)
SMTP_TLS=starttls
# EHLO hostname sent to the SMTP server (default: OS hostname).
# Many relays (e.g. Google) reject "localhost". Set to your server's FQDN if needed.
# SMTP_HELO_HOST=vultrack.example.com
# -----------------------------------------------------------------------------
# Jira Integration (optional). When JIRA_ENABLED=false, no tickets are created.
# A Jira ticket is automatically created when a finding is assessed as "Relevant".
# -----------------------------------------------------------------------------
JIRA_ENABLED=false
JIRA_BASE_URL=https://your-org.atlassian.net
JIRA_USER_EMAIL=your-email@example.com
JIRA_API_TOKEN=your-jira-api-token
JIRA_PROJECT_KEY=SEC
# Issue type for created tickets (default: Task)
JIRA_ISSUE_TYPE=Task
# -----------------------------------------------------------------------------
# AI Assessment (optional). When ANTHROPIC_API_KEY is empty, the feature is off.
# The key is environment-only and is never exposed through the API or UI.
# -----------------------------------------------------------------------------
ANTHROPIC_API_KEY=
# Workspace to act in, e.g. wrkspc_01ABC... Required for identity-linked API
# keys, which are not bound to a single workspace; the API rejects their
# requests with 400 unless a workspace is named. Leave empty for a
# workspace-scoped key, where the workspace is derived from the key itself.
ANTHROPIC_WORKSPACE_ID=
# Number of concurrent assessment workers (default: 2)
AI_ASSESSMENT_WORKERS=2
# Maximum retry attempts on transient errors (default: 2)
AI_ASSESSMENT_MAX_RETRIES=2
# Timeout per model request in seconds (default: 60)
AI_ASSESSMENT_TIMEOUT=60
# -----------------------------------------------------------------------------
# Authentication (OIDC). When OIDC_ENABLED=false, no user login is required.
# -----------------------------------------------------------------------------
OIDC_ENABLED=false
OIDC_ISSUER=https://your-idp.example.com
OIDC_CLIENT_ID=vultrack
OIDC_CLIENT_SECRET=your-client-secret
OIDC_REDIRECT_URL=http://localhost:8080/api/v1/auth/callback
OIDC_FRONTEND_URL=http://localhost:3000
OIDC_SCOPES=openid profile email