Configuration

The platform is configured through environment variables (see .env.example, used by the compose stack). This page is the complete reference. Values shown are defaults.

Core & networking

Variable	Default	Purpose
`INTERNAL_API_TOKEN`	—	Shared bearer token between Rails and Python; required (fails closed when unset)
`PYTHON_API_URL`	`http://python:8000/api/v1`	Base URL for Rails→Python calls
`RAILS_API_URL`	`http://rails:80`	Base URL for Python→Rails calls
`RAILS_REQUEST_TIMEOUT`	`10`	Rails→Python timeout (seconds)
`SOCIAL_ENRICH_TIMEOUT`	`120`	Social enrichment timeout (seconds)
`REDIS_URL`	`redis://redis:6379/1`	Redis connection for pub/sub + ActionCable

Rails

Variable	Default	Purpose
`RAILS_ENV`	`development`	Environment
`RAILS_MASTER_KEY`	—	Credentials key
`RAILS_PORT`	`3000`	Host port for the Rails container
`DATABASE_URL`	—	Database connection
`TEST_DATABASE_URL`	—	Test database connection
`RAILS_MAX_THREADS`	—	Puma threads
`RAILS_LOG_LEVEL`	—	Log verbosity
`SOLID_QUEUE_IN_PUMA`	—	Run Solid Queue in Puma
`JOB_CONCURRENCY`	—	Job concurrency
`WEB_CONCURRENCY`	—	Web workers
`PORT`	—	Server port
`PIDFILE`	—	Pid file
`CI`	—	CI flag
`BUNDLE_GEMFILE`	—	Gemfile override

Postgres

Variable	Default	Purpose
`POSTGRES_USER`	`brand_protect`	Database user
`POSTGRES_PASSWORD`	—	Database password
`POSTGRES_DB`	`brand_protect_development`	Main database

Python service

Variable	Default	Purpose
`APP_ENV`	`development`	App environment
`LOG_LEVEL`	`INFO`	Log level
`LOG_FORMAT`	`json`	`json` or `text` logging
`SERVICE_NAME`	—	Service name in logs
`AVATARS_DIR`	—	Social avatar storage
`SCREENSHOTS_DIR`	—	Screenshot storage
`EMBEDDING_MODEL`	`sentence-transformers/all-MiniLM-L6-v2`	Identity-matching embeddings

GlitchTip (Sentry-compatible)

Variable	Purpose
`GLITCHTIP_DB`	Separate GlitchTip database
`GLITCHTIP_SECRET_KEY`	GlitchTip secret
`SENTRY_DSN_PYTHON`	Python error tracking DSN
`SENTRY_DSN_RUBY`	Rails error tracking DSN

AI

Provider keys

Variable	Purpose
`OPENAI_API_KEY`	OpenAI key
`ANTHROPIC_API_KEY`	Anthropic key
`GEMINI_API_KEY`	Google Gemini key

Provider configuration (env fallbacks)

These only fill gaps when the admin ai_provider setting is unconfigured:

Variable	Default	Purpose
`AI_ENABLED`	—	Master switch (env fallback)
`AI_PROVIDER`	`openai`	Provider type
`AI_API_KEY`	—	Overrides per-provider keys
`AI_BASE_URL`	—	OpenAI-compatible base URL
`AI_MODEL`	`gpt-4o-mini`	Default model
`AI_MAX_TOKENS`	`1024`	Output cap
`AI_TEMPERATURE`	`0.7`	Sampling temperature

AI audit

Variable	Default	Purpose
`AI_AUDIT_ENABLED`	`1`	Master switch for the AI audit stage

Keyword expansion

Variable	Default	Purpose
`KEYWORD_EXPANSION_TOP_K`	`10`	Number of derived keywords
`AI_KEYWORD_EXPANSION_ENABLED`	—	Enable AI keyword inference
`AI_KEYWORD_CONTEXT_CHARS`	`8000`	Context window for inference
`KEYWORD_EXPAND_MAX_RETRIES`	`2`	Retries on failure
`KEYWORD_EXPAND_RETRY_BASE_DELAY`	`60`	Retry backoff (seconds)

Threat feeds

Variable	Purpose
`SAFE_BROWSING_API_KEY`	Google Safe Browsing
`URLHAUS_API_KEY`	URLhaus
`ABUSEIPDB_API_KEY`	AbuseIPDB
`VIRUSTOTAL_API_KEY`	VirusTotal
`SHODAN_API_KEY`	Shodan
`SECURITYTRAILS_API_KEY`	SecurityTrails
`CENSYS_API_KEY`	Censys
`HACKERTARGET_API_KEY`	HackerTarget

Variable	Default	Purpose
`SOCIAL_SCAN_ENABLED`	`true`	Enable social discovery
`MAIGRET_MAX_HANDLES`	`100`	Max handle probes
`MAIGRET_MAX_CONNECTIONS`	—	Connection pool
`MAIGRET_WORKERS`	—	Worker threads
`MAIGRET_TIMEOUT`	—	Per-probe timeout
`MAIGRET_RETRIES`	—	Probe retries
`MAIGRET_PROXY`	—	Proxy for probes
`MAIGRET_TOR_PROXY`	—	Tor proxy for probes

Search dorking

Variable	Purpose
`DORK_BACKEND`	`serpapi` or `google_cse`
`SERPAPI_KEY`	SerpAPI key
`GOOGLE_CSE_KEY`	Google Programmable Search key
`GOOGLE_CSE_CX`	Google CSE context
`DORK_DELAY` / `DORK_BETWEEN_QUERIES`	Query pacing
`DORK_DISABLE_FREE`	Disable free (non-key) backends
`DORK_HTTP_TIMEOUT`	Request timeout
`DORK_MAX_RESULTS`	Result cap

Scoring

Variable	Default	Purpose
`MIN_LABELED_SAMPLES`	`10`	Min labels before adaptive learning
`WEIGHTS_DECAY_DAYS`	`90`	Sample recency window
`JARM_ENABLED`	`1`	JARM TLS fingerprinting
`BULLETPROOF_ASNS`	—	Comma-separated ASN blocklist
`SANCTIONED_COUNTRIES`	—	Comma-separated country names

See also