template.env

##
# Build-time variables
##

CORE_TAG=v2.5.50
# CORE_FLAVOR=standard
MODULES_TAG=v3.1.0
# MODULES_FLAVOR=standard
GUARD_TAG=v1.2

# Build variables
# PHP_API_VERSION=20240924
# PHP_PACKAGE_VERSION=8.4
# PYPI_SETUPTOOLS_VERSION="==84.0.0"
# PYPI_SUPERVISOR_VERSION="==4.3.0"

# Build variables overriding MISP requirements
# PYPI_JSONSCHEMA_VERSION=">=4.19.1"
# PYPI_LIEF_VERSION=">=0.13.1"
# PYPI_MISP_STIX_VERSION="==2.4.194"
# PYPI_PLYARA_VERSION="==2.1.*"
# PYPI_PYDEEP2_VERSION="==0.5.*"
# PYPI_PYMISP_VERSION="==2.5.9"
# PYPI_PYTHON_MAGIC_VERSION="==0.4.*"
# PYPI_PYZMQ_VERSION="==0.4.*"
# PYPI_REDIS_VERSION="==5.0.*"
# PYPI_TAXII2_CLIENT_VERSION="==2.3.0"

# CORE_COMMIT takes precedence over CORE_TAG
# CORE_COMMIT=0bba3f5
# MODULES_COMMIT takes precedence over MODULES_TAG
# MODULES_COMMIT=de69ae3
# GUARD_COMMIT takes precedence over GUARD_TAG
# GUARD_COMMIT=370b043

##
# Run-time variables
##

# CORE_RUNNING_TAG=latest
# MODULES_RUNNING_TAG=latest
# GUARD_RUNNING_TAG=latest

# optional: use a registry mirror for docker images (include trailing slash, e.g., internal.mirror.com/)
# REGISTRY_MIRROR_URL=

# Email/username for user #1, defaults to MISP's default (admin@admin.test)
ADMIN_EMAIL=
# name of org #1, default to MISP's default (ORGNAME)
ADMIN_ORG=
# uuid of org #1, defaults to an automatically generated one
ADMIN_ORG_UUID=
# defaults to an automatically generated one
ADMIN_KEY=
# defaults to MISP's default (admin)
ADMIN_PASSWORD=
# Prevent MISP Initialization from writing ADMIN_KEY and ADMIN_PASSWORD in plaintext
# Recommend uncommenting / setting to true in production or kubernetes environments where output is logged.
#DISABLE_PRINTING_PLAINTEXT_CREDENTIALS=true
# defaults to 'passphrase'
GPG_PASSPHRASE=
# defaults to 1 (the admin user)
CRON_USER_ID=
# defaults to 'http://localhost'
# note: if you are exposing MISP on a non-standard port (i.e., the port is part of the URL you would use to access it, e.g., http://192.168.0.1:4433) you need to include the port in the BASE_URL variable
BASE_URL=http://localhost
# NGINX_HTTP_PORT=80
# NGINX_HTTPS_PORT=443
# store settings in db except those that must stay in config.php. true/false, defaults to false
ENABLE_DB_SETTINGS=
# encryption key. defaults to empty string
ENCRYPTION_KEY=
# salt, mostly vestigial. autogenerated if blank and unset in config.php
SALT=
# instance uuid. autogenerated if blank and is unset in config.php
UUID=
# enable background updates. defaults to false
ENABLE_BACKGROUND_UPDATES=
# use a different attachments_dir. defaults to /var/www/MISP/app/files
ATTACHMENTS_DIR=
# enable UI themes
# ENABLE_THEMES=false

# Setting the timezone (UTC, Europe/Berlin etc.). Default is UTC.
# TZ="UTC"

# By default, a daily synchronization is performed, but you can modify this by changing the push, pull, feed fetch and feed cache frequency (in seconds).
# CRON_PULLALL="86400"
# CRON_PUSHALL="86400"
# FETCH_FEED_INTERVAL="86400"
# CACHE_FEED_INTERVAL="86400"

# defines the FQDN of the mail sub-system (defaults to 'mail')
# SMTP_FQDN=
# override the port of the mail sub-system (defaults to 25)
# SMTP_PORT=

# optional and used by the mail sub-system
SMARTHOST_ADDRESS=
SMARTHOST_PORT=
SMARTHOST_USER=
SMARTHOST_PASSWORD=
SMARTHOST_ALIASES=

# optional AWS SES SMTP relay settings (use these instead of the generic smarthost)
# SES_USER=
# SES_PASSWORD=
# aws region (e.g., us-east-1)
# SES_REGION=
# default ses port is 587
# SES_PORT=

# optional comma separated list of IDs of syncservers (e.g. SYNCSERVERS=1)
# For this to work ADMIN_KEY must be set, or AUTOGEN_ADMIN_KEY must be true (default)
SYNCSERVERS=
# note: if you have more than one syncserver, you need to update docker-compose.yml
SYNCSERVERS_1_URL=
SYNCSERVERS_1_NAME=
SYNCSERVERS_1_UUID=
SYNCSERVERS_1_KEY=
# pull rules are JSON encoded (and escaped) dictionaries
# Example: only pull events where the analysis is complete
# 	SYNCSERVERS_1_PULL_RULES='{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]},\"url_params\":\"{\\\"searchanalysis\\\": \\\"2\\\"}\"}'
SYNCSERVERS_1_PULL_RULES=

# optional, specify host and credentials for externally running supervisord
# SUPERVISOR_HOST=127.0.0.1
# SUPERVISOR_USERNAME=supervisor
# SUPERVISOR_PASSWORD=supervisor

# optional and used to set mysql db and credentials
# MYSQL_HOST=
# MYSQL_PORT=
# MYSQL_USER=
# MYSQL_PASSWORD=
# MYSQL_ROOT_PASSWORD=
# MYSQL_DATABASE=

# optional and used to set mysql db TLS configuration
# MYSQL_TLS=true
# MYSQL_TLS_CA=/custom/files/tls/mysql_ca.pem
# MYSQL_TLS_CERT=/custom/files/tls/mysql_pubcert.cert
# MYSQL_TLS_KEY=/custom/files/tls/mysql_privkey.key

# optional and used to set redis
# REDIS_HOST=
# REDIS_PORT=
# remember to escape special character '$', e.g., 'test1%<$1323>' becomes 'test1%<$$1323>'
# REDIS_PASSWORD=
# Enable passwordless Redis connection (defaults to false for security)
# ENABLE_REDIS_EMPTY_PASSWORD=false
# Disable automatic snapshot dump to disk (defaults to false)
# DISABLE_REDIS_SNAPSHOT=false

# These variables allows overriding some MISP email values.
# They all default to ADMIN_EMAIL.

# MISP.email, used for notifications. Also used
# for GnuPG.email and GPG autogeneration.
# MISP_EMAIL=

# MISP.contact, the e-mail address that
# MISP should include as a contact address
# for the instance's support team.
# MISP_CONTACT=

# Enable GPG autogeneration (default true)
# AUTOCONF_GPG=true

# Enable admin (user #1) API key autogeneration
# if ADMIN_KEY is not set above (default true)
# AUTOGEN_ADMIN_KEY=true

# Disable IPv6 completely
# DISABLE_IPV6=true

# Disable CA refresh
# DISABLE_CA_REFRESH=true

# Enforce external authentication, disabling the builtin login form.
# Applies to any external provider (OIDC/LDAP/AAD/CustomAuth)
# WARNING: enable only after the external method is verified working, else you'll need to disable via the cli (cake)
# AUTH_ENFORCED=true

# Enable OIDC authentication, according to https://github.com/MISP/MISP/blob/2.5/app/Plugin/OidcAuth/README.md
# OIDC_ENABLE=true
# OIDC_PROVIDER_URL=
# OIDC_ISSUER=
# OIDC_CLIENT_ID=
# OIDC_CLIENT_SECRET=
# OIDC_CODE_CHALLENGE_METHOD=S256
# OIDC_ROLES_PROPERTY="roles"
# OIDC_ROLES_MAPPING="{\"admin\": 1}"
# OIDC_DEFAULT_ORG=
# OIDC_MIXEDAUTH=true
# OIDC_LOGIN_TEXT="Login with OIDC"
# OIDC_AUTH_METHOD="client_secret_post"
# OIDC_REDIRECT_URI=
# OIDC_SCOPES="[\"profile\", \"email\"]"
# OIDC_LOGOUT_URL=
# OIDC_DISABLE_REQUEST_OBJECT=false
# OIDC_DISABLE_PUSHED_AUTHORIZATION_REQUEST=false
# OIDC_SKIP_PROXY=true
# OIDC_ALLOW_EMAIL_LINKING=false
# OIDC_REQUIRE_EMAIL_VERIFIED=true

# Enable LDAP (using the ApacheSecureAuth component) authentication, according to https://github.com/MISP/MISP/issues/6189
# NOTE: Once you enable LDAP authentication with the ApacheSecureAuth component,
#	users should not be able to control the HTTP header configured in LDAP_APACHE_ENV
#	(e.g. REMOTE_USER), this means you must not allow direct access to MISP.
# NOTE 2: You need to escape special characters twice, e.g., "pass\word" becomes "pass\\\\word".
# APACHESECUREAUTH_LDAP_ENABLE=true
# APACHESECUREAUTH_LDAP_APACHE_ENV="REMOTE_USER"
# APACHESECUREAUTH_LDAP_SERVER="ldap://your_domain_controller"
# APACHESECUREAUTH_LDAP_STARTTLS=true
# APACHESECUREAUTH_LDAP_READER_USER="CN=service_account_name,OU=Users,DC=domain,DC=net"
# APACHESECUREAUTH_LDAP_READER_PASSWORD="password"
# APACHESECUREAUTH_LDAP_DN="OU=Users,DC=domain,DC=net"
# APACHESECUREAUTH_LDAP_SEARCH_FILTER=""
# APACHESECUREAUTH_LDAP_SEARCH_ATTRIBUTE="uid"
# APACHESECUREAUTH_LDAP_FILTER="[\"mail\", \"uid\", \"cn\" ]"
# APACHESECUREAUTH_LDAP_DEFAULT_ROLE_ID="3"
# APACHESECUREAUTH_LDAP_DEFAULT_ORG="1"
# APACHESECUREAUTH_LDAP_EMAIL_FIELD="[\"mail\"]"
# APACHESECUREAUTH_LDAP_OPT_PROTOCOL_VERSION="3"
# APACHESECUREAUTH_LDAP_OPT_NETWORK_TIMEOUT="-1"
# APACHESECUREAUTH_LDAP_OPT_REFERRALS=false

# Enable LDAP (using the MISP plugin native) authentication, according to https://github.com/MISP/MISP/tree/2.5/app/Plugin/LdapAuth
# NOTE 2: You need to escape special characters twice, e.g., "pass\word" becomes "pass\\\\word".
# LDAPAUTH_ENABLE=true
# LDAPAUTH_LDAPSERVER="ldap://your_domain_controller"
# LDAPAUTH_LDAPDN="OU=Users,DC=domain,DC=net"
# LDAPAUTH_LDAPREADERUSER="CN=service_account_name,OU=Users,DC=domain,DC=net"
# LDAPAUTH_LDAPREADERPASSWORD="password"
# LDAPAUTH_LDAPSEARCHFILTER=""
# LDAPAUTH_LDAPSEARCHATTRIBUTE="mail"
# LDAPAUTH_LDAPEMAILFIELD="mail"
# LDAPAUTH_LDAPNETWORKTIMEOUT="-1"
# LDAPAUTH_LDAPPROTOCOL="3"
# LDAPAUTH_LDAPALLOWREFERRALS=true
# LDAPAUTH_STARTTLS=false
# LDAPAUTH_MIXEDAUTH=true
# LDAPAUTH_LDAPDEFAULTORGID="1"
# LDAPAUTH_LDAPDEFAULTROLEID="3"
# LDAPAUTH_UPDATEUSER=true
# LDAPAUTH_DEBUG=false
# LDAPAUTH_LDAPTLSREQUIRECERT="LDAP_OPT_X_TLS_ALLOW"
# LDAPAUTH_LDAPTLSCUSTOMCACERT=false
# LDAPAUTH_LDAPTLSCRLCHECK="LDAP_OPT_X_TLS_CRL_PEER"
# LDAPAUTH_LDAPTLSPROTOCOLMIN="LDAP_OPT_X_TLS_PROTOCOL_TLS1_2"

# Enable Azure AD (Entra) authentication, according to https://github.com/MISP/MISP/blob/2.4/app/Plugin/AadAuth/README.md
# Note: AAD has no per plugin mixedAuth toggle. For AAD-only login set AUTH_ENFORCED=true
# AAD_ENABLE=true
# AAD_CLIENT_ID=
# AAD_TENANT_ID=
# AAD_CLIENT_SECRET=
# AAD_REDIRECT_URI="https://misp.mydomain.com/users/login"
# AAD_PROVIDER="https://login.microsoftonline.com/"
# AAD_PROVIDER_USER="https://graph.microsoft.com/"
# AAD_AUTH_PROPERTY_NAME="userPrincipalName"  # set to "mail" if your tenant authenticates against the mail attribute
# AAD_MISP_USER="Misp Users"
# AAD_MISP_ORGADMIN="Misp Org Admins"
# AAD_MISP_SITEADMIN="Misp Site Admins"
# AAD_CHECK_GROUPS=false

# Enable Custom Auth Plugin
# CUSTOM_AUTH_ENABLE=true
# CUSTOM_AUTH_HEADER="X_CUSTOM_AUTH"
# CUSTOM_AUTH_USE_HEADER_NAMESPACE=true
# CUSTOM_AUTH_REQUIRED=false
# CUSTOM_AUTH_HEADER_NAMESPACE="HTTP_"
# CUSTOM_AUTH_ONLY_ALLOW_SOURCE=
# CUSTOM_AUTH_NAME="External Authentication"
# CUSTOM_AUTH_DISABLE_LOGOUT=false
# CUSTOM_AUTH_CUSTOM_PASSWORD_RESET=
# CUSTOM_AUTH_CUSTOM_LOGOUT=

# Enable the use of a Proxy server (MISP-Guard or external)
# PROXY_ENABLE=true
# PROXY_HOST=
# PROXY_PORT=
# Setting PROXY_METHOD is required when credentials are used, otherwise MISP will not send them
# PROXY_METHOD=Basic
# PROXY_USER=
# PROXY_PASSWORD=

# Set up S3 based attachment storage
# S3_BUCKET=
# S3_ENDPOINT=
# S3_ACCESS_KEY=
# S3_SECRET_KEY=

# stunnel configuration for arbitrary proxying of local plaintext connections to tls endpoints
# STUNNEL=false
# STUNNEL_CONFIG=/custom/stunnel/stunnel.conf

## MISP-Guard
# Configure rules in ./guard/config.json.
# Requires restart of misp-guard container after changes.

# Toggle to enable MISP-Guard container (optional)
# COMPOSE_PROFILES=misp-guard
# If you enable MISP-Guard, you must also configure MISP to use it as a proxy:
# PROXY_PORT must match GUARD_PORT
# For proxy authentication set PROXY_METHOD=Basic, PROXY_USER and PROXY_PASSWORD
# PROXY_METHOD=Basic
# PROXY_USER must match GUARD_USER (if proxy authentication is configured)
# PROXY_PASSWORD must match GUARD_PASSWORD (if proxy authentication is configured)

# Optional credentials for authenticated proxying with MISP-Guard
# GUARD_USER=
# GUARD_PASSWORD=

# MISP-Guard runtime flags (optional)
# GUARD_PORT=8888
# mitmdump misp-guard runtime arguments (space separated, no quotes)
# GUARD_ARGS=--ssl-insecure -v

# Enable debugging
# ALWAYS SET THIS TO 0 IN PRODUCTION
# 0 - Debug off (default)
# 1 - Debug on
# 2 - Debug on + SQL dump
# DEBUG=

# FastCGI configuration on nginx
# FASTCGI_READ_TIMEOUT=300s
# FASTCGI_SEND_TIMEOUT=300s
# FASTCGI_CONNECT_TIMEOUT=300s

# Where to listen to PHP-FPM status. Can be a port or a ip:port. If not set the status page will not be shown.
# Do not expose this page in public networks.
# FASTCGI_LISTEN_STATUS=""

# PHP FPM configuration

## Basic PHP settings
# Maximum memory a PHP script can use.
# PHP_MEMORY_LIMIT=2048M
# Maximum execution time for a PHP script in seconds.
# PHP_MAX_EXECUTION_TIME=300
# Maximum file upload size for PHP scripts.
# PHP_UPLOAD_MAX_FILESIZE=50M
# Maximum size for POST data sent to PHP.
# PHP_POST_MAX_SIZE=50M
# Maximum time PHP spends parsing input data in seconds.
# PHP_MAX_INPUT_TIME=300
# Maximum number of file to upload per request.
# PHP_MAX_FILE_UPLOADS=50

## PHP FPM pool setup
# Maximum number of php-fpm processes, limits the number of simultaneous requests.
# PHP_FCGI_CHILDREN=5
# Number of processes created on startup.
# PHP_FCGI_START_SERVERS=2
# The desired number of idle server processes.
# PHP_FCGI_SPARE_SERVERS=1
# The number of requests each process should execute before respawning. "0" means endless request processing.
# PHP_FCGI_MAX_REQUESTS=0

## Additional PHP settings
# Timeout (in minutes) for user session inactivity before it expires.
# PHP_SESSION_TIMEOUT=60
# Session cookie validity period in minutes.
# PHP_SESSION_COOKIE_TIMEOUT=10080
# Default PHP configurations.
# PHP_SESSION_DEFAULTS=php
# Automatically regenerate session ID on each request.
# PHP_SESSION_AUTO_REGENERATE=false
# Check user agent on each request for security.
# PHP_SESSION_CHECK_AGENT=false
# Domain for session cookie validity (leave empty for current domain).
# PHP_SESSION_COOKIE_DOMAIN=
# SameSite policy for cookies ("Lax" allows top-level navigation).
# PHP_SESSION_COOKIE_SAMESITE=Lax

# MariaSQL/MySQL (InnoDB) configuration
# INNODB_BUFFER_POOL_SIZE=2048M
# INNODB_CHANGE_BUFFERING=none
# INNODB_IO_CAPACITY=1000
# INNODB_IO_CAPACITY_MAX=2000
# INNODB_LOG_FILE_SIZE=600M
# INNODB_READ_IO_THREADS=16
# INNODB_STATS_PERSISTENT=ON
# INNODB_WRITE_IO_THREADS=4

# Whether to enable processing of the X-Forwarded-For header (default to false)
# NGINX_X_FORWARDED_FOR=true
# Comma separated list of trusted IP addresses
# NGINX_SET_REAL_IP_FROM=127.0.0.1

# Security Settings
# Maximum time (in seconds) for HSTS (HTTP Strict Transport Security), ensures HTTPS is used.
# NGINX_HSTS_MAX_AGE=

# X-Frame-Options policy configuration: controls whether the site can be embedded in frames or iframes.
# Options: DENY, SAMEORIGIN, ALLOW-FROM <URL> Default: SAMEORIGIN
# NGINX_X_FRAME_OPTIONS=

# NGINX maximum allowed size of the client request body.
# NGINX_CLIENT_MAX_BODY_SIZE=50M

# Content-Security-Policy (CSP) configuration: defines allowed resources and prevents attacks like XSS.
# Example: "frame-src 'self' https://*.example.com; frame-ancestors 'self' https://*.example.com; object-src 'none'; report-uri https://example.com/cspReport"
# NGINX_CONTENT_SECURITY_POLICY=