Docs / Configuration reference
Configuration reference
Every input, environment variable and chart value you can set, with defaults. Setup walk-throughs are on the install pages.
GitHub Action inputs (protet/monitor@v1)
Preview: see the Action page for current status.
| Input | Default | Description |
|---|---|---|
token (required) | Ingest token from the dashboard, stored as a secret. | |
environment | prod | Cloud target. Only prod exists; other values fall back to it. |
gateway-url | empty (https://ingress.protet.io) | Ingest base URL override, for on-prem or self-hosted. |
app-url | empty (https://protet.io) | Account base URL override, for on-prem or self-hosted. |
fail-on-malicious | false | Fail the job on a malicious verdict. |
github-token | ${{ github.token }} | Token used to write the pull request comment. Needs pull-requests: write. |
Cloud collector variables
If you run your own collector against the cloud ingest, the dashboard (Connect your cluster) shows these three values:
| Variable | Value | Description |
|---|---|---|
GATEWAY_URL | https://ingress.protet.io | Where events are posted (POST /v1/ingest). |
INGEST_REFRESH_URL | https://protet.io/v1/ingest/refresh | Where the refresh token is traded for an access token. |
INGEST_REFRESH_TOKEN | from the dashboard | The long-lived refresh token. Treat it as a password. |
On-prem install variables
Read by the pipeline services, set through docker-compose or Helm. The docker-compose files and the Helm chart ship with your on-prem deployment.
| Variable | Default | Description |
|---|---|---|
MODEL_BUNDLE_URL | empty | Where to pull the signed bundle at runtime: https://protet.io/v1/bundle. |
MODEL_BUNDLE_KEY | empty | Your pull token. Sent as the x-license-key header. |
MODEL_BUNDLE_DIR | empty | Directory holding a pre-extracted bundle. When set it takes precedence over the URL (air-gapped installs). |
BUNDLE_PUBLIC_KEY | empty | Base64 Ed25519 public key that verifies the bundle. From GET /v1/public-keys, field bundle. |
LICENSE_ENFORCE | false in the compose file and chart | Set true to require a valid license. An expired license then stops the services at start. |
LICENSE_FILE | /license/license.json | Path of the license inside the container. |
LICENSE_PUBLIC_KEY | empty | Base64 Ed25519 public key that verifies the license. From GET /v1/public-keys, field license. |
docker-compose also reads these (set in the shell or a .env next to the compose file):
| Variable | Default | Description |
|---|---|---|
BUNDLE_DIR | ./bundle | Host folder with the extracted bundle (bundle overlay). Mounted read-only at /bundle. |
LICENSE_DIR | ./license | Host folder with license.json (bundle overlay). Mounted read-only at /license. |
SLACK_WEBHOOK_URL | empty | Optional. Also post alerts to this Slack incoming webhook. |
TETRAGON_ADDR | localhost:54321 | Collector: address of the Tetragon gRPC server. |
REDIS_URL | redis://redis:6379 | Redis used between services. The compose collector uses redis://localhost:6379 because it runs on the host network. |
NODE_NAME | compose-node-0 | Name stamped on events from this host. |
Helm values
| Value | Default | Description |
|---|---|---|
global.imageTag | latest | Image tag for all services. Pin it to the version you were given. |
global.imagePullPolicy | Always | Kubernetes pull policy. |
global.imagePullSecret | empty | Name of a docker-registry secret for the image registry. |
redis.enabled | true | Run the chart's own Redis. Set false and fill redis.url to use another. |
redis.url | redis://redis:6379 | Redis address. |
redis.maxmemory | 1gb | Redis memory ceiling. The eviction policy is deliberately noeviction; do not change it. |
license.enforce | false | Require a valid license. Set true for on-prem. |
license.secretName | empty | Kubernetes secret holding license.json, mounted at /license. |
signing.bundlePublicKey | empty | Public key verifying the bundle (BUNDLE_PUBLIC_KEY). |
signing.licensePublicKey | empty | Public key verifying the license (LICENSE_PUBLIC_KEY). |
modelBundle.dir | empty | Mount path of the bundle (MODEL_BUNDLE_DIR). |
modelBundle.pvcName | empty | Persistent volume claim holding the extracted bundle. |
modelBundle.url | empty | Bundle endpoint (MODEL_BUNDLE_URL). With dir and pvcName, pods refresh the bundle from it on every start and keep the last verified copy if Protet is unreachable. |
modelBundle.keySecretName | empty | Secret holding your pull token. Required with modelBundle.url. |
modelBundle.keySecretKey | LICENSE_KEY | Key inside that secret; exposed to the pod as MODEL_BUNDLE_KEY. |
collector.enabled | true | Run the per-node collector that reads Tetragon. |
collector.tetragonAddr | tetragon.kube-system.svc.cluster.local:54321 | Tetragon gRPC address. |
collector.ignoredBinaries | containerd-shim,pause,runc,tini | Binaries the collector skips. |
The chart's values.yaml is the authority for the rest (resources and the other pipeline services).
Limits, lifetimes and retention
| What | Value |
|---|---|
| Free plan build sessions | 500 per calendar month |
| Access token lifetime | 1 hour (expires_in: 3600) |
| Refresh (ingest) token lifetime | 90 days |
| Build activity retention (cloud) | at most 24 hours, never archived |
| Build result retention (cloud) | up to 6 hours, then deleted |
| Largest API request body | 64 KiB (65,536 bytes) |
| Sign-ups, verification re-sends and password-reset requests | 5 per hour per source address, counted separately for each |
| Logins | 10 per hour per email and source address |
| Intel files | cached for 5 minutes |