Installation
Configuration reference
Every setting in .env: required ones, security, ES connection, models and reasoning, alert ingest, scheduled reports, baseline, audit and retention. Values changed in the UI win.
All configuration lives in .env in the install directory and is read when docker compose starts. After editing .env, docker compose -f docker-compose.prod.yml up -d recreates the gateway so the change applies.
Required
| Variable | Notes |
|---|---|
ES_URL | Your Elasticsearch, https://es.corp.local:9200; several nodes comma-separated |
ES_USER / ES_PASSWORD | ES account; both empty when security is off |
LLM_API_KEY / LLM_BASE_URL / LLM_MODEL | The first LLM provider |
CADDY_SITE_ADDRESS | Hostname analysts use; several space-separated |
RST_GATEWAY_SHARED_SECRET | Shared secret between Caddy and the gateway, generated by deploy.sh |
RST_ADMIN_TOKEN | Ops API token (X-RST-Admin-Token header), generated |
RST_ADMIN_PASSWORD_HASH | First administrator's password hash, generated. Unset, the gateway refuses every non-local login |
GATEWAY_IMAGE_TAG | Image tag to run; written by deploy.sh, changed by rst-update.sh |
Login and accounts
| Variable | Default | Notes |
|---|---|---|
RST_ADMIN_USERNAME | admin | First administrator's name |
RST_SESSION_TTL_HOURS | 12 | Session lifetime |
RST_USER_DB_URL | set by compose | Postgres for the multi-user table; empty = single account |
RST_USER_DB_PASSWORD | generated | Password of the bundled userdb |
RST_ALLOW_DEFAULT_PASSWORD | empty | 1 allows the shipped password over the LAN (isolated labs only) |
RST_CORS_ORIGINS | empty | Cross-origin sources; not needed, the gateway serves its own frontend |
Elasticsearch
| Variable | Default | Notes |
|---|---|---|
RST_ES_VERIFY_CERTS | true | Verify the ES certificate; false for self-signed, or set a CA |
RST_ES_CA_CERT | empty | Private CA path inside the container, e.g. /certs/es-ca.pem; put the file under ./certs/ |
RST_ES_TIMEOUT_S | 30 | Per-request ES timeout |
RST_ES_MAX_RETRIES | 2 | Transparent retries on timeout / connection error |
RST_INDEX_WHITELIST | empty | Strongly recommended: queryable index patterns, logs-*,filebeat-*,winlogbeat-* |
KIBANA_URL | empty | Kibana, for deep links only; empty = off |
KIBANA_PUBLIC_URL | empty | The Kibana address the analyst browser can reach, when it differs from the gateway's |
RST_CONVERSATION_BACKEND | es | Conversations in ES (.rst_copilot_conversations) - survive restarts, shared across replicas; memory = in-process only |
RST_CONVERSATION_TTL_DAYS | 7 | Idle expiry |
RST_DSL_CACHE_TTL_S | 600 | Cache identical NL→DSL generations; 0 = off |
RST_FIELD_DICT_CACHE_TTL_S | 300 | Field-dictionary scan cache |
Models and reasoning
| Variable | Default | Notes |
|---|---|---|
LLM_TIMEOUT_S | 180 | Per-call LLM timeout; raise if investigations / triage time out |
LLM_REASONING | auto | This provider's reasoning level auto / off / low / high, see AI models |
RST_NL2DSL_REASONING | low | Reasoning for the NL→DSL step: none / low / high / native |
RST_LLM_FIRST_TOKEN_TIMEOUT_S | 45 | Hard cap on the first token while generating a query; 0 = unlimited |
RST_EMBED_MODEL / RST_EMBED_BASE_URL / RST_EMBED_DIM | empty | Embedding model; better set on the AI models page |
RST_EMBED_COOLDOWN_S | 60 | Cool-down after an embedding endpoint failure |
RST_MASKING_MODE | per licence | Force cloud / private / airgapped |
RST_TIMEZONE | UTC | Timezone the model uses for "today / yesterday"; set +08:00 for China |
RST_TRIAL_DAILY_LIMIT | 200 | Daily LLM calls while unactivated |
RST_RATELIMIT_GENERATE / _EXECUTE / _KIBANA_LINK | 30 / 30 / 120 | Per-IP per-minute limits; raise for a large team behind one NAT address |
Live alerts
| Variable | Default | Notes |
|---|---|---|
RST_ALERT_INGEST_INDEX | .alerts-security.alerts-default | Alert index to poll (the read alias); empty = off |
RST_ALERT_INGEST_INTERVAL_SECONDS | 10 | Poll interval |
RST_ALERT_WEBHOOK_SECRET | empty | Shared secret for Kibana webhook push (X-RST-Alert-Token); enables push when set |
RST_ALERT_INGEST_CONCURRENCY / RST_ALERT_INGEST_BUDGET_S | 4 / 20 | One push carries up to 200 alerts, each costing one summary call; these bound concurrency and total time |
Scheduled reports and baseline
| Variable | Default | Notes |
|---|---|---|
RST_REPORT_SCHEDULE | empty | daily,weekly,monthly; empty = no automatic reports |
RST_REPORT_TZ | RST_TIMEZONE | Timezone of period boundaries |
RST_REPORT_WEBHOOK_URL / _HEADERS | empty | POST every report here |
RST_REPORT_PERSIST / RST_REPORT_INDEX | 1 / .rst_copilot_reports | Archive to ES |
RST_REPORT_CATCHUP_MAX | 7 | Periods to catch up after downtime |
RST_BASELINE_INTERVAL_SECONDS | empty | Baseline poll interval, ≥ 300; empty = manual only |
RST_BASELINE_MAX_AGE_HOURS | 48 | osquery data older than this is stale |
RST_BASELINE_HOST_ROSTER_DAYS | 30 | Hosts silent this long leave the roster |
RST_BASELINE_OSQUERY_INDEX | logs-osquery_manager.result-* | Read: your osquery results |
RST_BASELINE_RESULTS_INDEX / _RULES_INDEX / _RUNS_INDEX | baseline-results / -rules / -runs | Write: the gateway's three indices |
Audit and retention
| Variable | Default | Notes |
|---|---|---|
RST_AUDIT_ENABLED | true | Audit to .rst_copilot_audit |
RST_AUDIT_WEBHOOK_ALLOWLIST | empty | Hosts audit forwarding may POST to; empty = only loopback / link-local refused |
RST_ILM_BOOTSTRAP | 0 | 1 = create the ILM policy + index template on start; do it when audit is on |
RST_AUDIT_RETENTION_DAYS | 180 | Audit retention (with ILM on) |
RST_METRICS_TOKEN | empty | Scrape token for /metrics |
Resources
| Variable | Default | Notes |
|---|---|---|
RST_GATEWAY_CPUS / RST_GATEWAY_MEM | 2 / 2g | Gateway container ceiling |
SSO variables are on the Enterprise SSO page.
Installing from the archive
What the delivery archive contains, what every step of deploy.sh does and how to answer each prompt, how to install by hand, and the post-install checklist.
ES account permissions
A dedicated Elasticsearch account for the gateway: read on log indices, read / write on its own .rst_copilot_* indices, optionally read on alerts and osquery results. Kibana steps and the API version.