Pulsar configuration
Environment variables of a satellite container.
POLARIS_URL, PULSAR_ID and PULSAR_SECRET are required and come from the deployment snippet in Polaris. The satellite refuses to start without them, with a secret shorter than 32 characters, or with an http:// URL unless PULSAR_ALLOW_INSECURE=true.
Intervals (heartbeat, sync) are not configured on the satellite: Polaris sends them on registration and with every heartbeat answer.
| Variable | Default | Purpose |
|---|---|---|
ASTERION_VERSION | dev | Set by the image build; reported to Polaris, which marks satellites running another release. |
POLARIS_URL | – | API base URL of Polaris (the callback URL from the deployment snippet). Must be https:// unless PULSAR_ALLOW_INSECURE=true. |
PULSAR_ALLOW_INSECURE | false | Allow http:// for POLARIS_URL. Lab only. |
PULSAR_DATA | /data | Directory for cached plans, queued results and state. Mount a volume here so nothing is lost on restart. |
PULSAR_DNS | – | Up to 3 resolver IPs (comma separated) that get all DNS queries of this container. Authoritative name servers are then not asked, so delegation, SOA serials and manipulation are not checked on this satellite. |
PULSAR_ID | – | Satellite id generated by Polaris. |
PULSAR_LOG_LEVEL | INFO | DEBUG, INFO, WARNING or ERROR. Log lines are also shipped to Polaris (satellite log). |
PULSAR_MAX_PARALLEL_RUNS | 4 | How many plan runs execute at the same time. |
PULSAR_MAX_PARALLEL_TARGETS | 4 | How many targets one run checks at the same time. |
PULSAR_SECRET | – | 64-character secret generated by Polaris. Signs every request; bound to the first instance that registers. |
PULSAR_TAGS | – | Extra tags key=value,… reported on registration. The zone cannot be set this way. |
PULSAR_TRACE_HIDE | – | Extra CIDRs whose hops are hidden in traceroutes. Docker and Kubernetes default networks are always hidden. |
PULSAR_VERIFY_TLS | true | Verify the certificate of Polaris. Turn off only for lab setups with self-signed certificates. |
PULSAR_WEB_ENABLED | true | Serve the status page with the abuse contact. |
PULSAR_WEB_PORT | 8080 | Port of the status page. |
Container
| Capabilities | NET_RAW, NET_ADMIN (SYN scans, OS detection, traceroute). Without them nmap falls back to connect scans. |
| Volume | /data — cached plans, queued results, state (instance id, last runs, port cache) |
| Port | 8080 — public status page |