Configuration

Backend configuration lives in xcloak-platform/backend/.env. Per-tenant settings (OIDC SSO, LDAP, threat feed credentials, API keys, custom roles) are configured from the dashboard instead, and stored in the database.

Database

Variable	Default	Description
DB_HOST	localhost	PostgreSQL host
DB_PORT	5432	PostgreSQL port
DB_USER	xcloak	Migration pool user (DDL permissions)
DB_PASSWORD	—	Migration pool password
DB_NAME	ngfw	Database name
DB_SSLMODE	disable	Set to require or verify-full in production
APP_DB_USER	xcloak_app	App pool user (DML-only, RLS load-bearing)
APP_DB_PASSWORD	change_me_in_production	App pool password — must be changed. Backend emits a warning on startup if this is still the default.

Security — required

Variable	Required	Description
JWT_SECRET	Yes	HMAC-SHA256 secret for access and refresh token signing. Backend refuses to start if shorter than 32 characters.
METRICS_TOKEN	Yes	Bearer token for /metrics Prometheus endpoint.
CORS_ALLOWED_ORIGINS	Yes	Comma-separated list of allowed origins (frontend URL).
APP_BASE_URL	Yes (prod)	Public URL for password-reset/invite email links.

TLS

TLS_CERT_FILE	Path to TLS certificate
TLS_KEY_FILE	Path to TLS private key

AI (choose one provider)

LLM_PROVIDER	ollama or anthropic
OLLAMA_URL	Ollama base URL (if provider=ollama)
OLLAMA_MODEL	Model name, e.g. qwen2.5:3b
ANTHROPIC_API_KEY	Anthropic API key (if provider=anthropic)
ANTHROPIC_MODEL	Model ID (default: claude-sonnet-4-6)

Redis

REDIS_ADDR	Default localhost:6379 — used for rate limiting and sessions
REDIS_PASSWORD	Redis password (empty by default)

Kafka

KAFKA_ENABLED	Default false — set true to enable the event bus
KAFKA_BROKERS	Comma-separated broker list, e.g. localhost:9092
KAFKA_REQUIRE_ALL_ACKS	Set true for min.insync.replicas=2 clusters

Elasticsearch

ELASTICSEARCH_URL	ES/OpenSearch URL, e.g. http://elasticsearch:9200
ELASTICSEARCH_USERNAME	Optional basic auth username
ELASTICSEARCH_PASSWORD	Optional basic auth password

MinIO — immutable audit log export

MINIO_ENDPOINT	MinIO endpoint, e.g. minio:9000
MINIO_ACCESS_KEY	Access key
MINIO_SECRET_KEY	Secret key
MINIO_AUDIT_BUCKET	Bucket for WORM audit exports
MINIO_USE_SSL	true / false
AUDIT_EXPORT_RETENTION_DAYS	Days to retain exports (default: 365)

Agent release signing

AGENT_RELEASE_SIGNING_KEY	base64url-encoded ed25519 seed (32 bytes)
AGENT_RELEASE_REQUIRE_SIGNATURE	true to reject unsigned release uploads

# Generate a signing key
openssl rand 32 | base64 | tr '+/' '-_' | tr -d '='

Logging

Variable	Default	Description
LOG_FORMAT	text	Set json for structured production logs
LOG_LEVEL	info	debug / info / warn / error

Email (optional)

SMTP_HOST / SMTP_PORT	e.g. smtp.gmail.com / 587
SMTP_USER / SMTP_PASSWORD	SMTP credentials (use an app password for Gmail)
SMTP_FROM	From address for outbound alert emails

Agent-side variables

XCLOAK_SERVER	Backend URL (required on first run)
LOG_FORMAT	text or json
LOG_LEVEL	info by default
XCLOAK_DISABLE_SELF_UPDATE	Set to 1 to skip update checks