Install FireSight

FireSight runs as one container that serves both the web interface and the API, with PostgreSQL alongside it. You run both with Docker Compose.

To try FireSight first with built-in demo firewalls, see Demo mode instead.

What you need

A Linux server or VM with Docker Engine and the Docker Compose plugin (Docker Desktop works for a trial).
The FireSight release, from Downloads. The steps below are run in the folder that holds its docker-compose.yml, Dockerfile and .env.example.
A TLS-terminating reverse proxy (for example your load balancer or nginx) in front of FireSight. The container is only published on 127.0.0.1:8000. See Reverse proxy.
Network access from the FireSight server to your FortiManagers and FortiGates on HTTPS (port 443 by default).
Optional: outbound HTTPS to license.firesightsystems.com if you want online license renewal.

Install for production

To install FireSight:

Copy the example settings file:
```
cp .env.example .env
```

Edit .env and fill in the required values:

Setting	What to put
`FIRESIGHT_ENVIRONMENT`	`prod` (the default).
`FIRESIGHT_SECRET_KEY`	32 or more random characters. Encrypts API tokens, directory and SSO secrets, the SMTP password, webhook URLs, offline snapshots and FortiGate configuration backups.
`FIRESIGHT_JWT_SECRET`	32 or more random characters. Signs sign-in sessions.
`POSTGRES_PASSWORD`	A password for the bundled PostgreSQL database.
`FIRESIGHT_ADMIN_USERNAME`	The first administrator's user name (default `admin`).
`FIRESIGHT_ADMIN_PASSWORD`	The first administrator's password. If you leave it empty, FireSight generates one and writes it to the log once.
`FIRESIGHT_DEPLOY_MODE`	Leave as `simulate` until you have tested against a lab. See First run.
`FIRESIGHT_CORS_ORIGINS`	The example file sets `https://firesight.example.com`. Only needed if the interface is served from a different address than the API; set it to your FireSight address or remove the line.

To make a random value:

python -c "import secrets; print(secrets.token_urlsafe(48))"

Start FireSight:
```
docker compose up -d --build
```
Point your reverse proxy at http://127.0.0.1:8000, and add the proxy's IP address to FIRESIGHT_TRUSTED_PROXIES in .env so the audit log records the real client address. Restart with docker compose up -d after changing .env.
Open FireSight in a browser through the proxy and sign in as the first administrator. Continue with First run.

Warning

Keep .env safe and back it up. If FIRESIGHT_SECRET_KEY is lost, FireSight can't decrypt the stored API tokens, sign-in secrets, notification secrets, offline snapshots or FortiGate configuration backups. See Backups and upgrades.

Note

With FIRESIGHT_ENVIRONMENT=prod, FireSight refuses to start if FIRESIGHT_SECRET_KEY or FIRESIGHT_JWT_SECRET is missing, shorter than 32 characters, or still the built-in development value. It also refuses FIRESIGHT_CORS_ORIGINS=*.

Check it's running

docker compose ps shows the app and db services. Both have a health check.
http://127.0.0.1:8000/api/health on the server answers with {"status": "ok", "version": "…"}.
If you didn't set FIRESIGHT_ADMIN_PASSWORD, read the generated password from the log:
```
docker compose logs app
```
Look for the line Created admin user 'admin' with password: …. Change it after the first sign-in under Your account.

What the containers hold

Service	Image	Data
`app`	Built from the FireSight `Dockerfile`: a Python 3.12 runtime with the built web interface, running as an unprivileged user.	Nothing you need to keep: all state is in the database.
`db`	`postgres:16-alpine`	The `pgdata` Docker volume: every request, approval, deployment record, connection, setting, license, snapshot, backup and audit event.

The database schema is created and upgraded automatically each time FireSight starts.

Interface build

Settings, System shows the interface build. To stamp it with your own build reference, build with docker compose build --build-arg FIRESIGHT_COMMIT=<reference>.

Running more than one copy

You can run several app replicas against the same database. Scheduled jobs (syncs, audits, rule expiry, health checks and license renewal) are claimed in the database, so each runs once. Set FIRESIGHT_SCHEDULER=false on replicas that shouldn't run them at all.

Other settings

Every server setting is listed in Server configuration. Day-to-day options are set in the browser under Settings.