Defaults, fallbacks and priorities

Where an effective value comes from when several places can set it.

The first source that has a value wins, from left to right.

System settings vs. environment

For every setting a super admin can save under System settings: saved value → .env variable → built-in default.

Setting	Saved in UI	Environment	Built-in
Interval defaults for new plans	Defaults for new plans	`POLARIS_DEFAULT_INTERVAL_*`	see below
Minimum interval per check	Minimum interval	—	0
Abuse contact	Abuse contact	`POLARIS_ABUSE_*`	none
Mail server	Mail server	`MAIL_*`	—
Address lookup	Address lookup	—	Nominatim, public server
Require TOTP	Sign-in	—	off

Check parameters

A plan stores its parameters when it is saved. At run time: plan value → default of the check (all defaults). Two values are adjusted by Polaris before the plan reaches a satellite:

Test access without a password (detail_no_auth) is forced off for satellites in zone external.
Automatic follow-up plans always use discovered ports only.

Minimum intervals

The effective at most every N minutes of a check is the larger of the plan’s value and the system minimum of that check. 0 means every slot. The prefill of new plans comes from the system defaults (never below the minimum):

Check	Default (minutes)	Variable
`ping`	0 (every run)	`POLARIS_DEFAULT_INTERVAL_PING`
`traceroute`	60	`POLARIS_DEFAULT_INTERVAL_TRACEROUTE`
`nmap`	60	`POLARIS_DEFAULT_INTERVAL_NMAP`
`http`	0 (every run)	`POLARIS_DEFAULT_INTERVAL_HTTP`
`https`	0 (every run)	`POLARIS_DEFAULT_INTERVAL_HTTPS`
`cert`	360	`POLARIS_DEFAULT_INTERVAL_CERT`
`smtp`	60	`POLARIS_DEFAULT_INTERVAL_SMTP`
`ftp`	60	`POLARIS_DEFAULT_INTERVAL_FTP`
`details`	360	`POLARIS_DEFAULT_INTERVAL_DETAILS`
`reach`	60	`POLARIS_DEFAULT_INTERVAL_REACH`
`dns`	60	`POLARIS_DEFAULT_INTERVAL_DNS`
`mail`	360	`POLARIS_DEFAULT_INTERVAL_MAIL`

Targets a satellite gets

A plan’s targets are filtered per satellite, in this order:

only target types the check supports,
hosts expanded to all their addresses (unless Check every known address is off),
for global satellites: no private addresses,
no addresses of an IP family the satellite cannot reach (IPv4-only / IPv6-only); unknown connectivity counts as reachable,
for follow-up checks: the ports discovered by the last port scan of that satellite.

Plans of a product the tenant has switched off are not sent at all.

Zone of a satellite

Global satellite → external. Tenant satellite → its manual tag zone=<name>, else external. Tags from the container (PULSAR_TAGS) cannot set the zone.

Location on the maps

Set by hand (coordinates typed or looked up from the address) → automatic (satellite: RIPEstat location of the address it connects from; host: RIPEstat location of its first located public IP) → not shown.

Abuse contact on a satellite page

Tenant satellite with an own tenant contact → System settings contact → POLARIS_ABUSE_*.

Mail delivery

Notification channel with its own SMTP server → System settings mail server → MAIL_*. Reports use the tenant’s SMTP channel if it has its own server, else the same fallback.

Hostname for TLS checks on an IP

Known hostnames of the host (each one as SNI) → confirmed PTR name → none (chain checked, name not checked).

Port closed

A port counts as closed after 2 scans in a row miss it from the same satellite. A policy violation needs 2 scans in a row that see it.

Languages

User’s choice (My account or footer) → browser language (German or English) → APP_LOCALE. Finding titles, satellite logs and report contents are stored data and stay in English.