Server configuration

Server settings are environment variables, normally set in .env next to docker-compose.yml. Restart FireSight after changing them (docker compose up -d). They can't be changed from the browser; Settings, System shows the ones that matter.

Every FireSight setting starts with FIRESIGHT_. Day-to-day options (approvals, lockout, DNS, schedules, monitoring) are set in the browser instead, under Settings.

Required in production

Variable	Default	Meaning
`FIRESIGHT_ENVIRONMENT`	`prod`	`prod` refuses to start with weak or built-in secrets. `dev` is for the demo and testing only.
`FIRESIGHT_SECRET_KEY`	built-in development value	32+ random characters. Encrypts stored secrets, offline snapshots and configuration backups. Never change it on a running system: everything encrypted with the old key becomes unreadable.
`FIRESIGHT_JWT_SECRET`	built-in development value	32+ random characters. Signs sign-in sessions. Changing it signs everyone out.
`POSTGRES_PASSWORD`	none	Password of the bundled PostgreSQL database. Used by `docker-compose.yml`, which refuses to start without it.

First administrator

Variable	Default	Meaning
`FIRESIGHT_ADMIN_USERNAME`	`admin`	Created on first start if there are no users.
`FIRESIGHT_ADMIN_PASSWORD`	empty	If empty, a random password is generated and written to the log once.

Deployment

Variable	Default	Meaning
`FIRESIGHT_DEPLOY_MODE`	`simulate`	`simulate` records what would be pushed without writing anything. `live` writes to FortiManager and FortiGates. See First run.

Web and network

Variable	Default	Meaning
`FIRESIGHT_TRUSTED_PROXIES`	empty	Comma-separated IP addresses of reverse proxies whose `X-Forwarded-For` header is trusted for the client address in the audit log. See Reverse proxy.
`FIRESIGHT_PUBLIC_BASE_URL`	empty	The address people use, for single sign-on redirects. Overridden by Public address of FireSight under Settings, Sign-in methods, General once an administrator saves it.
`FIRESIGHT_CORS_ORIGINS`	`http://localhost:5173`	Comma-separated origins of the interface, only needed if it is served from a different address than the API. `*` is refused in production.
`FIRESIGHT_DATABASE_URL`	`sqlite:///./firesight.db`; set to PostgreSQL by `docker-compose.yml`	The database connection. PostgreSQL is recommended for production; FireSight logs a warning if it runs on SQLite in production.
`FIRESIGHT_STATIC_DIR`	set by the `Dockerfile`	Where the built web interface is. Don't change it in the standard image.

Variable	Default	Meaning
`FIRESIGHT_JWT_EXPIRE_MINUTES`	`480`	Default session length, until an administrator sets Session length (minutes) in Settings.
`FIRESIGHT_JWT_ALGORITHM`	`HS256`	Signing algorithm of sessions. Leave it as it is.

LDAP, OpenID Connect and SAML are configured in the browser under Sign-in methods.

Background jobs

Variable	Default	Meaning
`FIRESIGHT_SCHEDULER`	`true`	Run scheduled syncs, audits, health checks, rule expiry and license renewal in this container. Set `false` on extra replicas if you like; jobs are claimed in the database, so they never run twice.

The intervals are set under Settings.

Defaults for browser settings

These set the starting value of a setting on the Policies & schedules tab. Once an administrator saves the setting in the browser, the saved value wins.

Variable	Default	Setting
`FIRESIGHT_INACTIVE_AFTER_DAYS`	`90`	Inactive rule threshold (days)
`FIRESIGHT_ALLOW_SELF_APPROVAL`	`false`	Allow self-approval
`FIRESIGHT_ALLOW_SAME_APPROVER_MULTIPLE_STAGES`	`false`	Same approver for several stages
`FIRESIGHT_LOCKOUT_THRESHOLD`	`5`	Failed sign-ins before lockout
`FIRESIGHT_LOCKOUT_MINUTES`	`15`	Lockout duration (minutes)

API tokens from the environment

Instead of pasting a connection's API token into FireSight, you can supply it as an environment variable whose name starts with FMG_, for example FMG_ROME_TOKEN=<api-token>. Enter the variable name in Or read the token from an environment variable when you add the connection. This suits secrets managed outside FireSight, such as a Kubernetes secret. The variable must be set in the app container.

Licensing

Variable	Default	Meaning
`FIRESIGHT_PORTAL_REQUEST_KEY`	empty	An extra portal encryption key for activation requests, as `<key-id>:<public-key>`. Set it only if FireSight support gives you a value. See Troubleshooting.

Older releases configured directory and single sign-on in the environment. These are still read as starting values until an administrator saves the sign-in method in the browser. Configure new installations under Sign-in methods instead.

Variable	Used as
`FIRESIGHT_LDAP_SERVER`	The first LDAP server
`FIRESIGHT_LDAP_BIND_DN`	Service account DN
`FIRESIGHT_LDAP_BIND_PASSWORD`	Service account password
`FIRESIGHT_LDAP_USER_BASE`	User search base
`FIRESIGHT_OIDC_ISSUER`	OpenID Connect issuer URL
`FIRESIGHT_OIDC_CLIENT_ID`	OpenID Connect client ID
`FIRESIGHT_OIDC_CLIENT_SECRET`	OpenID Connect client secret

Demo only

Variable	Default	Meaning
`FIRESIGHT_LOAD_DEMO`	`false`	Load the demo FortiManager, FortiGate, regions, chains and users on first start (when there are no connections yet).
`FIRESIGHT_DEMO_PASSWORD`	random	Password for every demo user. If unset, each is random and written to the log.
`FIRESIGHT_PORT`	`8081`	Host port the demo listens on (in `docker-compose.demo.yml` only).

See Demo mode.