Polaris configuration

Environment variables of the Polaris stack (.env), with the default that applies when a variable is not set.

Polaris reads .env through env_file in docker-compose.yml. Change a value, then docker compose up -d to recreate the containers.

Default is the value in the code. For framework settings (database, mail, cache, session) it is the value .env.example ships with, which is what a standard installation uses.
Values a super admin saves under System settings win over the matching variables (mail server, abuse contact, interval defaults).
see X means the variable falls back to variable X.

Variable	Default	Purpose
`ACME_EMAIL`	–	Contact address for Let’s Encrypt when the `proxy` profile (Caddy) gets certificates.
`APP_DEBUG`	`false`	Shows error details in the browser. Keep `false` in production: details can contain secrets.
`APP_ENV`	`production`	`production` for real installations. The demo data command refuses to run in production.
`APP_FALLBACK_LOCALE`	`en`	Language used for a text that has no translation.
`APP_KEY`	–	Encryption key for sessions, satellite secrets and channel credentials. Leave empty: it is generated on first start into the storage volume (`storage/app/.app_key`). Back it up — without it encrypted data is lost.
`APP_LOCALE`	`de`	Interface language when the browser asks for neither German nor English. Users can switch in the footer or under My account.
`APP_NAME`	`Polaris`	Name shown in mails and the browser title (`Polaris` in `.env.example`).
`APP_TIMEZONE`	–	Timezone of the server side. Keep `UTC`; tenants and users have their own timezone for display.
`APP_URL`	`https://mon.example.com`	Public URL of the web UI. Links in mails and notifications are built from it.
`ASTERION_PULSAR_IMAGE`	–	Set by the release build: the Pulsar image (with digest) this Polaris release was tested with. Used for deployment snippets when `POLARIS_PULSAR_IMAGE` is empty.
`ASTERION_VERSION`	`dev`	Set by the release build. Satellites running another version are marked as outdated. `dev` disables the comparison.
`BROADCAST_CONNECTION`	`null`	`reverb` enables the websocket (immediate checks). Anything else, or an empty `POLARIS_WS_URL`, runs in HTTPS-only mode.
`CACHE_STORE`	`database`	Laravel cache store. `database` keeps everything in MariaDB; it also holds the single-use nonces of the Pulsar API.
`COMPANY_CHAMBER`	`Wirtschaftskammer Oberösterreich, Fachgruppe Unternehmensberatung, Buchhaltung und Informationstechnologie (UBIT)`	Chamber membership shown in the imprint (§ 5 ECG).
`COMPANY_CITY`	`Bad Schallerbach`	City of the operator (imprint, privacy policy).
`COMPANY_COUNTRY`	`Österreich`	Country of the operator.
`COMPANY_DISPUTE_BODY`	`Internet Ombudsstelle`	Consumer dispute resolution body named in the imprint.
`COMPANY_DISPUTE_BODY_ADDRESS`	`Ungargasse 64-66/3/404, 1030 Wien`	Address of the dispute resolution body.
`COMPANY_DISPUTE_BODY_URL`	`https://www.ombudsstelle.at`	Website of the dispute resolution body.
`COMPANY_EMAIL`	`office@poetti.net`	Contact e-mail of the operator.
`COMPANY_LEGAL_FORM`	`Einzelunternehmen (e.U.)`	Legal form of the operator.
`COMPANY_MEDIA_DIRECTION`	–	Basic direction of the medium (§ 25 MedienG). Empty leaves the line out.
`COMPANY_NAME`	`poetti.net e.U.`	Operator of the installation, shown in the imprint, privacy policy and footer. Override all `COMPANY_*` values when someone other than poetti.net e.U. operates Polaris.
`COMPANY_OWNER`	`Matthias Pöttinger`	Owner or managing director.
`COMPANY_PHONE`	`+43 7249 22522`	Phone number of the operator.
`COMPANY_POSTAL_CODE`	`4701`	Postal code of the operator.
`COMPANY_PURPOSE`	`Dienstleistungen in der automatischen Datenverarbeitung und Informationstechnik`	Business purpose.
`COMPANY_REGISTER_COURT`	`Landesgericht Wels`	Court keeping the company register.
`COMPANY_REGISTER_NUMBER`	`FN 493932x`	Company register number.
`COMPANY_STREET`	`Badstraße 18/108`	Street address of the operator.
`COMPANY_TRADE`	`Dienstleistungen in der automatischen Datenverarbeitung und Informationstechnik (freies Gewerbe)`	Trade licence.
`COMPANY_TRADE_AUTHORITY`	`Bezirkshauptmannschaft Grieskirchen`	Authority that issued the trade licence.
`COMPANY_VAT_ID`	`ATU73395346`	VAT identification number.
`CONTAINER_ROLE`	–	Set per service in `docker-compose.yml`: `web`, `reverb`, `scheduler` or `queue`. One image, four roles.
`DB_CONNECTION`	`mariadb`	Database driver. Polaris is built and tested for `mariadb`.
`DB_DATABASE`	`polaris`	Database name.
`DB_HOST`	`mariadb`	Database host; `mariadb` is the service in the compose stack.
`DB_PASSWORD`	`change-me-db`	Password of the database user. Required by the compose file.
`DB_PORT`	`3306`	Database port.
`DB_ROOT_PASSWORD`	–	Root password of the MariaDB container. Required by the compose file, not used by Polaris itself.
`DB_USERNAME`	`polaris`	Database user.
`LOG_CHANNEL`	`stderr`	`stderr` writes logs to the container output (`docker compose logs`).
`LOG_LEVEL`	`info`	Minimum level of log lines (`debug`, `info`, `warning`, `error`).
`MAIL_FROM_ADDRESS`	`polaris@example.com`	Sender of mails (password resets, reports, notifications without own SMTP server).
`MAIL_FROM_NAME`	`Polaris`	Sender name.
`MAIL_HOST`	`smtp.example.com`	Default SMTP server. A super admin can override all mail settings under System settings; those values win.
`MAIL_MAILER`	`smtp`	Laravel mailer, `smtp` for real delivery.
`MAIL_PASSWORD`	–	SMTP password.
`MAIL_PORT`	`587`	SMTP port.
`MAIL_USERNAME`	–	SMTP user.
`OIDC_ADMIN_GROUP`	–	Members of this group (value in the groups claim) become super admins on login.
`OIDC_AUTO_CREATE_USERS`	`true`	Create a user on the first OIDC login. Without it, only users that already exist can sign in.
`OIDC_CLIENT_ID`	–	Client ID registered at the identity provider.
`OIDC_CLIENT_SECRET`	–	Client secret registered at the identity provider.
`OIDC_DEFAULT_ROLE`	`viewer`	Role of a newly created OIDC user in the default tenant (`viewer`, `editor`, `admin`).
`OIDC_DEFAULT_TENANT`	–	Tenant a newly created OIDC user joins.
`OIDC_DISABLE_LOCAL_LOGIN`	`false`	Hide the password login when everyone signs in through the identity provider.
`OIDC_DISPLAY_NAME`	`Single Sign-On`	Label of the sign-in button.
`OIDC_GROUPS_CLAIM`	`groups`	Claim of the ID token that lists the user’s groups.
`OIDC_ISSUER`	–	Issuer URL of the identity provider (Entra ID: `https://login.microsoftonline.com/<tenant-id>/v2.0`, Keycloak: `https://sso.example.com/realms/<realm>`). Setting it enables single sign-on; redirect URI: `${APP_URL}/auth/oidc/callback`.
`OIDC_OPERATOR_GROUP`	–	Members of this group become operators: admin in every tenant, no user or system administration.
`OIDC_SCOPES`	`openid profile email`	Scopes requested from the identity provider.
`POLARIS_ABUSE_EMAIL`	–	Abuse e-mail shown on every satellite’s public page. Saved system settings and a tenant’s own contact take precedence.
`POLARIS_ABUSE_NOTE`	–	Short note on the satellite page, e.g. why the scans happen.
`POLARIS_ABUSE_ORGANIZATION`	–	Organisation named on the satellite page.
`POLARIS_ABUSE_PHONE`	–	Abuse phone number.
`POLARIS_ABUSE_URL`	–	Abuse web page.
`POLARIS_ADMIN_EMAIL`	–	Unattended installation: creates the first tenant and a super admin with this address instead of the setup wizard.
`POLARIS_ADMIN_PASSWORD`	–	Password of that super admin. Remove it from `.env` after the first start.
`POLARIS_API_HOST`	–	Hostname of the Pulsar API for the `proxy` profile.
`POLARIS_API_PORT`	`8002`	Host port of the optional `api` container (`split-api` profile).
`POLARIS_API_URL`	`see APP_URL`	URL satellites call (the API endpoint). Same as `APP_URL` unless the API has its own hostname.
`POLARIS_AUTO_MIGRATE`	`true`	Run database migrations when the web container starts (default on). Set `false` to migrate by hand.
`POLARIS_BIND`	`0.0.0.0`	Address the published ports (web, websocket, api) bind to. Behind a proxy on the same host use `127.0.0.1`, so nobody reaches Polaris around the proxy.
`POLARIS_CERT_WARNING_DAYS`	`21`	Days before expiry from which a certificate counts as expiring (notification `cert.expiring`).
`POLARIS_CONSOLE_OTP_MINUTES`	`15`	How long the one-time password that unlocks a satellite’s web console is valid.
`POLARIS_CT_ENABLED`	`true`	Check monitored domains in Certificate Transparency logs (crt.sh).
`POLARIS_CT_PAUSE_SECONDS`	`10`	Pause between two crt.sh requests. crt.sh is a free service that often answers 502 under load.
`POLARIS_CT_REFRESH_HOURS`	`6`	Every monitored domain is checked once in this period; the checks are spread evenly over it.
`POLARIS_CT_URL`	`https://crt.sh/`	crt.sh compatible endpoint.
`POLARIS_DEFAULT_INTERVAL_CERT`	`360`	Prefill of at most every N minutes for new `cert` plans. Super admins can change all prefills under System settings.
`POLARIS_DEFAULT_INTERVAL_DETAILS`	`360`	Prefill for new `details` plans.
`POLARIS_DEFAULT_INTERVAL_DNS`	`60`	Prefill for new `dns` plans.
`POLARIS_DEFAULT_INTERVAL_FTP`	`60`	Prefill for new `ftp` plans.
`POLARIS_DEFAULT_INTERVAL_HTTP`	`0`	Prefill for new `http` plans.
`POLARIS_DEFAULT_INTERVAL_HTTPS`	`0`	Prefill for new `https` plans.
`POLARIS_DEFAULT_INTERVAL_MAIL`	`360`	Prefill for new `mail` plans.
`POLARIS_DEFAULT_INTERVAL_NMAP`	`60`	Prefill for new `nmap` plans.
`POLARIS_DEFAULT_INTERVAL_PING`	`0`	Prefill for new `ping` plans.
`POLARIS_DEFAULT_INTERVAL_REACH`	`60`	Prefill for the segmentation (`reach`) plans.
`POLARIS_DEFAULT_INTERVAL_SMTP`	`60`	Prefill for new `smtp` plans.
`POLARIS_DEFAULT_INTERVAL_TRACEROUTE`	`60`	Prefill for new `traceroute` plans.
`POLARIS_DEFAULT_TENANT`	`Default`	Name of the first tenant for an unattended installation.
`POLARIS_DOCS_URL`	`https://asteriondoc.meinlan.at`	Address of this documentation site. The ? next to page titles, the footer and the user menu link here. Empty = no links.
`POLARIS_HEARTBEAT_INTERVAL`	`30`	Seconds between two heartbeats of a satellite (sent to the satellites on registration).
`POLARIS_HOST`	–	Hostname of the web UI for the `proxy` profile.
`POLARIS_IMAGE`	`ghcr.io/poettinet/asterion-polaris:latest`	Polaris image the compose file starts.
`POLARIS_MODE`	`all`	What a container serves: `all` (UI and Pulsar API), `ui` or `api`.
`POLARIS_PULSAR_ALLOW_HTTP`	`false`	Accept Pulsar API calls over plain HTTP. Lab only — satellites also need `PULSAR_ALLOW_INSECURE=true`.
`POLARIS_PULSAR_IMAGE`	–	Pulsar image used in the generated `docker run` and compose snippets. Empty on a release: the tested image is used.
`POLARIS_RETENTION_FAILED_JOBS`	`30`	Days failed queue jobs are kept.
`POLARIS_RETENTION_HEARTBEATS`	`30`	Days satellite heartbeats are kept.
`POLARIS_RETENTION_HISTORY`	`730`	Days the change history is kept: service events, DNS, registry and certificate changes, certificate observations, expired CT entries, resolved findings, stale paths.
`POLARIS_RETENTION_LOGS`	`60`	Days satellite log lines are kept.
`POLARIS_RETENTION_NOTIFICATION_LOGS`	`90`	Days the log of sent notifications is kept.
`POLARIS_RETENTION_RAW`	`30`	Days raw tool output (nmap XML, …) and debug steps are kept. The parsed result stays with its run.
`POLARIS_RETENTION_REPORTS_YEARS`	`7`	Years archived reports are kept, also when their definition is deleted.
`POLARIS_RETENTION_RESULTS`	`365`	Days scan runs and their raw results are kept. Hosts, services and their history stay.
`POLARIS_REVERB_PORT`	`8081`	Host port of the websocket server.
`POLARIS_RIR_ENABLED`	`true`	Enrich public IPs with prefix, origin AS and location (RIPEstat) and registration data (RDAP).
`POLARIS_RIR_REFRESH_HOURS`	`24`	How old enrichment data may get before the daily refresh fetches it again.
`POLARIS_SATELLITE_OFFLINE_AFTER`	`180`	Seconds without a heartbeat after which a satellite counts as offline (`satellite.offline`).
`POLARIS_SYNC_INTERVAL`	`60`	Seconds between two plan syncs of a satellite. A websocket satellite also syncs at once when plans change.
`POLARIS_VERIFY_DOMAINS`	`true`	New domains must be delegated by their registry. Turn off for portals without outbound DNS.
`POLARIS_VERIFY_HOSTNAMES`	`true`	New hostnames must resolve (portal resolver, else public resolvers). Turn off when names only resolve inside the satellites’ networks.
`POLARIS_WEB_MODE`	`all`	`POLARIS_MODE` of the `web` container. Set `ui` together with the `split-api` profile.
`POLARIS_WEB_PORT`	`8000`	Host port of the web UI.
`POLARIS_WS_HOST`	–	Hostname of the websocket server for the `proxy` profile.
`POLARIS_WS_URL`	–	Public websocket URL satellites connect to, e.g. `wss://ws.mon.example.com`. Empty = HTTPS-only mode.
`PRIVACY_HOSTING`	`auf eigenen Servern in Österreich`	Where the servers run, as worded in the German privacy policy.
`PRIVACY_HOSTING_EN`	`on our own servers in Austria`	The same in the English translation.
`PRIVACY_LOG_DAYS`	`14`	Promised deletion of web server logs. nginx keeps shortened IPs only; the host must delete container logs after this many days.
`QUEUE_CONNECTION`	`database`	Laravel queue. `database` needs no extra service; the `queue` container works it off.
`REVERB_APP_ID`	–	Reverb application id (any string).
`REVERB_APP_KEY`	–	Reverb key. Satellites receive it with their welcome message.
`REVERB_APP_SECRET`	–	Reverb secret; signs private channel subscriptions. Keep it secret.
`REVERB_HOST`	`reverb`	How the Polaris containers reach the Reverb container internally.
`REVERB_PORT`	`8080`	Internal Reverb port.
`REVERB_SCHEME`	`http`	Internal scheme to Reverb (`http` inside the compose network).
`REVERB_SERVER_HOST`	–	Address the Reverb server binds to inside its container.
`REVERB_SERVER_PORT`	`8080`	Port the Reverb server listens on inside its container.
`SESSION_DRIVER`	`database`	Where sessions live. `database`: expired ones are deleted daily by `privacy:prune`.
`SESSION_SECURE_COOKIE`	`true`	Send the session cookie over HTTPS only. Keep `true` behind TLS.
`TRUSTED_PROXIES`	`127.0.0.1,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7`	Proxies whose `X-Forwarded-For` / `-Proto` headers are believed (client IP for rate limits, HTTPS detection): IPs or CIDRs, comma separated, `*` for all. Default: loopback and private networks. Narrow it to your proxy.