# soc-ai automated-install settings.
#
#   cp setup.conf.example setup.conf
#   $EDITOR setup.conf          # fill in the REQUIRED values below
#   ./setup.sh --auto           # installs with no prompts
#
# The format is KEY=value, one per line. setup.sh ignores a line that starts
# with #. It also ignores anything after a space-then-# on a value line. Quote a
# value that contains ` #`, as KEY='value'. A blank value falls back to the
# default shown.
# setup.conf holds secrets. It is chmod 600 and gitignored. Keep it private.

# ── REQUIRED ──────────────────────────────────────────────────────────────────
# Security Onion URL
SO_HOST=https://your-so-grid
# SO analyst login. Elasticsearch uses the same login.
SO_USERNAME=analyst@example.com
# SO analyst password
SO_PASSWORD=
# your LiteLLM gateway
LITELLM_BASE_URL=http://localhost:4000
# a model your gateway serves. GET /v1/models lists them. REQUIRED for hunts to work.
ANALYST_MODEL=

# ── Connection details (sensible defaults) ────────────────────────────────────
# false for a self-signed Security Onion
SO_VERIFY_SSL=false
# Elasticsearch URL. Blank = <SO_HOST>:9200
ES_HOSTS=
ES_VERIFY_SSL=false
# gateway API key, if it requires one
LITELLM_API_KEY=
# false if the gateway uses a self-signed cert
LITELLM_VERIFY_SSL=true

# ── Grid-specific tuning (defaults fit most single-node grids) ────────────────
# What the triage queue counts as an alert. SO's own pipelines tag Suricata,
# Sigma, Wazuh and Strelka with `tags:alert`. Elastic Defend endpoint alerts
# carry ECS `event.kind:alert`. The default joins both. Narrow it only after you
# check `soc-ai doctor`, for example to event.dataset:suricata.alert.
WEBUI_ALERTS_QUERY=tags:alert OR event.kind:alert
# Events are in SO 3.x `logs-*` data streams. During its ES check, setup.sh
# detects the cluster prefix and writes the concrete value. Leave blank to accept
# that value. Single-node = logs-* ; multi-node or distributed = *:logs-* .
# Keep the `logs-*` form, which is the data-stream name. The `.ds-…` form
# addresses hidden backing indices and makes you list each Elastic Agent
# namespace. If you omit `.ds-logs-*-default-*`, system.auth and system.syslog
# disappear with no error.
EVENTS_INDEX_PATTERN=logs-*
# require a login or token for the API. Recommended.
API_AUTH_REQUIRED=true

# ── Secrets (leave blank to auto-generate; fill in to pin a value) ────────────
# Fernet key for encrypted secret overrides. Auto-generated if blank.
CONFIG_SECRET_KEY=
# first admin password. Auto-generated and printed if blank.
BOOTSTRAP_ADMIN_PASSWORD=

# ── Store ─────────────────────────────────────────────────────────────────────
# y keeps the store in PostgreSQL: the compose "postgres" profile runs the
# server next to soc-ai. n keeps SQLite, which suits one site. setup.sh offers
# PostgreSQL on a fresh install only. To move a store, see docs/DOCKER.md,
# PostgreSQL.
STORE_POSTGRES=n
# The password of the soc_ai role. Auto-generated if blank. Letters, digits,
# '.', '_', '~' and '-' only, because the store URL carries it.
SOC_AI_POSTGRES_PASSWORD=

# ── TLS cert ──────────────────────────────────────────────────────────────────
# IP or DNS name for the self-signed cert SAN. Blank = this host's primary IP.
CERT_HOST=

# ── HTTPS domain: the proxy path ──────────────────────────────────────────────
# A domain puts Caddy in front of soc-ai on ports 80 and 443. Caddy gets the
# certificate and renews it. Blank keeps the direct path: the self-signed
# cert on 8443. See docs/DOCKER.md, TLS paths.
HTTPS_DOMAIN=
# auto = Let's Encrypt. The name must resolve to this host from the internet.
# internal = Caddy's own CA. setup.sh prints the steps to trust its root.
HTTPS_CA=internal