Configuration reference

Every key in .env: required keys, login and accounts, Elasticsearch connection, model and reasoning, live alerts, scheduled reports and baseline, audit and retention, resource limits.

All configuration lives in .env in the installation directory and is read by docker compose at start. After editing .env, run docker compose -f docker-compose.prod.yml up -d to recreate the gateway container.

Keys that can be changed on the Settings and AI settings pages (Elasticsearch connection, whitelist, masking, audit, providers) are stored on the gateway state volume and take precedence over .env. For those keys, .env only seeds the first start.

Required

Key	Description
`ES_URL`	Elasticsearch URL, for example `https://es.corp.local:9200`; comma-separated for multiple nodes
`ES_USER`, `ES_PASSWORD`	Elasticsearch account; leave empty when security is disabled. `ES_API_KEY` can be used instead
`LLM_API_KEY`, `LLM_BASE_URL`, `LLM_MODEL`	The first LLM provider
`CADDY_SITE_ADDRESS`	Hostname analysts open; space-separated for several
`RST_GATEWAY_SHARED_SECRET`	Shared secret between Caddy and the gateway; generated by `deploy.sh`
`RST_ADMIN_TOKEN`	Operations API token (`X-RST-Admin-Token` header); generated
`RST_ADMIN_PASSWORD_HASH`	Hash of the first administrator's password; generated. When unset, the gateway refuses every non-local login
`GATEWAY_IMAGE_TAG`	Image tag in use; written by `deploy.sh`, changed by `rst-update.sh` during online update

Key	Default	Description
`RST_ADMIN_USERNAME`	`admin`	First administrator account name
`RST_SESSION_TTL_HOURS`	`12`	Session lifetime
`RST_USER_DB_URL`	Written by `deploy.sh`	Postgres holding the multi-user account table; empty means single account
`RST_USER_DB_PASSWORD`	Generated	Password of the bundled `userdb` container
`RST_ALLOW_DEFAULT_PASSWORD`	Empty	Set to `1` to allow LAN logins with the factory password; isolated test environments only
`RST_CORS_ORIGINS`	Empty	Cross-origin sources. The gateway serves its own front end; not needed in a standard installation

Elasticsearch

Key	Default	Description
`RST_ES_VERIFY_CERTS`	`true`	Verify the Elasticsearch server certificate. Set to `false` or configure a CA for self-signed certificates
`ES_API_KEY`	Empty	Elasticsearch API key (the `encoded` value from the response). Takes precedence over `ES_USER` / `ES_PASSWORD`; Kibana calls also use it when no Kibana credentials are set. `.env` only; see Use an API key
`RST_ES_CA_CERT`	Empty	In-container path of a private CA, for example `/certs/es-ca.pem`; place the file under `./certs/` in the installation directory
`RST_KIBANA_CA_CERT`	Empty	Set when the Kibana certificate is issued by a different private CA, for example `/certs/kibana-ca.pem`. Empty reuses `RST_ES_CA_CERT`. The CA is trusted in addition to the public CAs, not instead of them
`RST_ES_TIMEOUT_S`	`30`	Per-request Elasticsearch timeout, seconds
`RST_ES_MAX_RETRIES`	`2`	Transparent retries on timeout or connection error
`RST_INDEX_WHITELIST`	Empty	Queryable index patterns, for example `logs-,filebeat-,winlogbeat-*`. Recommended
`KIBANA_URL`	Empty	Kibana URL for deep links only; empty disables them
`KIBANA_PUBLIC_URL`	Empty	Kibana URL reachable from analyst browsers, when it differs from the one the gateway sees
`RST_ELK_VERSION`	`9.5.3` written on a new install	Image version of the bundled Elasticsearch and Kibana only. Empty means `8.12.2`. Do not change only this value on a host with bundled ES data; see Bundled Elasticsearch and Kibana
`RST_CONVERSATION_BACKEND`	`es`	Multi-turn conversation store. `es` writes `.rst_copilot_conversations`, survives restarts and is shared across replicas; `memory` is in-process only
`RST_CONVERSATION_TTL_DAYS`	`7`	Idle expiry of conversations, days
`RST_DSL_CACHE_TTL_S`	`600`	Cache of generated queries for identical questions, seconds; 0 disables
`RST_FIELD_DICT_CACHE_TTL_S`	`300`	Field-dictionary scan cache, seconds

Model and reasoning

Key	Default	Description
`LLM_TIMEOUT_S`	`180`	Per-call model timeout, seconds. Raise if investigation or triage times out
`LLM_REASONING`	`auto`	Reasoning effort for this provider: `auto`, `off`, `low`, `high`; see AI settings
`RST_NL2DSL_REASONING`	`low`	Reasoning effort for the query-generation step of Ask AI: `none`, `low`, `high`, `native`
`RST_LLM_FIRST_TOKEN_TIMEOUT_S`	`45`	Hard limit for the first token during query generation, seconds; 0 disables
`RST_EMBED_MODEL`, `RST_EMBED_BASE_URL`, `RST_EMBED_DIM`	Empty	Embedding model for the knowledge base. Configure it on the AI settings page
`RST_EMBED_COOLDOWN_S`	`60`	Cool-down after an embedding endpoint failure, seconds
`RST_MASKING_MODE`	Per licence	Force the masking mode: `cloud`, `private`, `airgapped`
`RST_TIMEZONE`	`UTC`	Timezone the model uses to resolve "today" and "yesterday"
`RST_OUTPUT_LANG`	`zh`	Output language for background work with no user request: `zh` or `en`. Applies to alert-ingest summaries, scheduled reports, and notification delivery text. Requests follow the interface language
`RST_RATELIMIT_GENERATE`, `RST_RATELIMIT_EXECUTE`, `RST_RATELIMIT_KIBANA_LINK`	`30`, `30`, `120`	Per-IP rate limits per minute. Raise when a team shares one egress IP

Alerts

Key	Default	Description
`RST_ALERT_INGEST_INDEX`	Empty	Alert index to poll, as a read alias such as `.alerts-security.alerts-default`. Empty disables polling
`RST_ALERT_INGEST_INTERVAL_SECONDS`	`10`	Poll interval, seconds
`RST_ALERT_INGEST_LOOKBACK`	`1h`	How far back the first pull reaches, for example `7d`. Set it when the index already holds alert history
`RST_ALERT_WEBHOOK_SECRET`	Empty	Shared secret for Kibana webhook push (`X-RST-Alert-Token`); push is enabled when set
`RST_ALERT_INGEST_CONCURRENCY`, `RST_ALERT_INGEST_BUDGET_S`	`4`, `20`	One push carries up to 200 alerts, each costing one summary call; these bound concurrency and the total time budget

Scheduled reports and baseline

Key	Default	Description
`RST_REPORT_SCHEDULE`	Empty	Any of `daily,weekly,monthly`; empty disables automatic reports
`RST_REPORT_TZ`	Same as `RST_TIMEZONE`	Timezone of report period boundaries
`RST_REPORT_WEBHOOK_URL`, `RST_REPORT_WEBHOOK_HEADERS`	Empty	Target each report is POSTed to
`RST_REPORT_PERSIST`, `RST_REPORT_INDEX`	`1`, `.rst_copilot_reports`	Archive to Elasticsearch
`RST_REPORT_CATCHUP_MAX`	`7`	Maximum periods back-filled after downtime
`RST_BASELINE_INTERVAL_SECONDS`	Empty	Baseline poll interval, seconds; effective at 300 or more. Empty means manual runs only
`RST_BASELINE_MAX_AGE_HOURS`	`48`	osquery data older than this is judged stale
`RST_BASELINE_HOST_ROSTER_DAYS`	`30`	Hosts silent for longer are no longer enumerated
`RST_BASELINE_OSQUERY_INDEX`	`logs-osquery_manager.result-*`	Customer osquery result index the gateway reads
`RST_BASELINE_RESULTS_INDEX`, `RST_BASELINE_RULES_INDEX`, `RST_BASELINE_RUNS_INDEX`	`baseline-results`, `baseline-rules`, `baseline-runs`	The three indices the gateway writes

Audit and retention

Key	Default	Description
`RST_AUDIT_ENABLED`	`true`	Audit events are written to `.rst_copilot_audit`
`RST_AUDIT_WEBHOOK_ALLOWLIST`	Empty	Hosts allowed as audit-forwarding webhook targets; empty refuses only loopback and link-local addresses
`RST_ILM_BOOTSTRAP`	`0`	Set to `1` to create the ILM policy and index template at start. Recommended when audit is enabled
`RST_AUDIT_RETENTION_DAYS`	`180`	Audit index retention, days; effective with ILM enabled
`RST_METRICS_TOKEN`	Empty	Scrape token for `/metrics`

Resources

Key	Default	Description
`RST_GATEWAY_CPUS`, `RST_GATEWAY_MEM`	`2`, `2g`	Gateway container limits

SSO keys are listed under SSO.

On this page