Configuration Reference

All Sentro configuration is done through environment variables. This page documents every available option.

Required Variables

These must be set for the application to start:

Variable	Description	How to Generate
AUTH_SECRET	Signs auth session cookies	openssl rand -hex 32
ENCRYPTION_KEY	AES-256-GCM key for field encryption (64 hex characters)	openssl rand -hex 32
ADMIN_SESSION_SECRET	Signs admin panel session cookies	openssl rand -hex 32
DATABASE_URL	PostgreSQL connection string	See Database
REDIS_URL	Redis connection string	See Redis
ADMIN_EMAIL	Admin panel login email	Any valid email
ADMIN_PASSWORD	Admin panel login password	Strong password

danger

ENCRYPTION_KEY can never be changed or regenerated. Every encrypted field in the database is unreadable without the original value — back it up with your database.

In Docker Compose these are all set in .env. In Helm they map to secrets.authSecret, secrets.encryptionKey, secrets.adminSessionSecret, secrets.adminEmail, and secrets.adminPassword.

License

Variable	Default	Description
SELF_HOSTED	true	Enables self-hosted mode. Set for you by Docker Compose and Helm.
LICENSE_KEY	—	Ed25519-signed license key. Without it, runs in Community mode (5 monitors, 1 member).
LICENSE_CHECK_URL	—	Optional revocation check endpoint. Leave unset for a fully offline install.

In Docker Compose you set the key as SENTRO_LICENSE_KEY in .env and the stack passes it in as LICENSE_KEY. In Helm it is secrets.licenseKey.

See Licensing for full details on editions, key generation, and management.

Database

Variable	Default	Description
DATABASE_URL	—	PostgreSQL connection string

Format: postgresql://USER:PASSWORD@HOST:PORT/DATABASE

Examples:

# Docker Compose (internal network)
DATABASE_URL=postgresql://sentro:secret@postgres:5432/sentro

# External database
DATABASE_URL=postgresql://sentro:secret@db.example.com:5432/sentro?sslmode=require

Redis

Variable	Default	Description
REDIS_URL	—	Redis connection string

danger

Redis must run with eviction disabled (maxmemory-policy noeviction). If Redis is allowed to evict keys, scheduled checks are silently dropped and monitors stop running with no error anywhere. The bundled Redis in both the Compose bundle and the Helm chart is configured correctly; managed Redis services often are not.

Format: redis://:PASSWORD@HOST:PORT

Examples:

# Docker Compose (internal network)
REDIS_URL=redis://:secret@redis:6379

# External Redis (with TLS)
REDIS_URL=rediss://:secret@redis.example.com:6380

Authentication

Variable	Default	Description
AUTH_SECRET	—	Session signing key
AUTH_URL	http://localhost:3001	Dashboard app base URL
NEXTAUTH_URL	http://localhost:3001	Same as AUTH_URL (Auth.js requirement)
AUTH_GOOGLE_ID	—	Google OAuth client ID (optional)
AUTH_GOOGLE_SECRET	—	Google OAuth client secret (optional)
AUTH_GITHUB_ID	—	GitHub OAuth client ID (optional)
AUTH_GITHUB_SECRET	—	GitHub OAuth client secret (optional)
AUTH_TRUST_HOST	true	Required when running behind a proxy
APP_HOSTNAMES	—	Extra hostnames that serve the dashboard

tip

For production with HTTPS, set AUTH_URL and NEXTAUTH_URL to your full HTTPS URL:

AUTH_URL=https://app.yourdomain.com
NEXTAUTH_URL=https://app.yourdomain.com

Admin Panel

Variable	Default	Description
ADMIN_EMAIL	—	Login email for the admin panel
ADMIN_PASSWORD	—	Login password for the admin panel

The admin panel runs on a separate port (default 3002) with its own authentication, completely independent from user auth.

Email / SMTP

Variable	Default	Description
SMTP_HOST	—	SMTP server hostname
SMTP_PORT	587	SMTP server port
SMTP_USER	—	SMTP username
SMTP_PASS	—	SMTP password
SMTP_FROM	noreply@sentro.local	From address for outgoing emails

info

Email is optional. With no mail relay configured the product stays fully usable: accounts are created already verified and the verification prompt is suppressed, because there would be no way to deliver the link. Alert delivery by email obviously requires a relay — Slack and webhook alerts work without one.

Once you set SMTP_HOST, normal email verification applies to accounts created from then on.

Common SMTP providers:

# SendGrid
SMTP_HOST=smtp.sendgrid.net
SMTP_PORT=587
SMTP_USER=apikey
SMTP_PASS=SG.your-api-key

# AWS SES
SMTP_HOST=email-smtp.us-east-1.amazonaws.com
SMTP_PORT=587
SMTP_USER=your-access-key
SMTP_PASS=your-secret-key

# Postmark
SMTP_HOST=smtp.postmarkapp.com
SMTP_PORT=587
SMTP_USER=your-server-token
SMTP_PASS=your-server-token

# Gmail (not recommended for production)
SMTP_HOST=smtp.gmail.com
SMTP_PORT=587
SMTP_USER=you@gmail.com
SMTP_PASS=your-app-password

REST API

Variable	Default	Description
PORT	4000	API server port
HOST	0.0.0.0	API server bind address
CORS_ORIGIN	http://localhost:3001	Allowed CORS origin
LOG_LEVEL	info	Log level (debug, info, warn, error)

Observability

Variable	Default	Description
PROMETHEUS_METRICS_PORT	9464	Worker Prometheus metrics port
GRAFANA_ADMIN_PASSWORD	—	Grafana admin password (if using monitoring profile)

Security Recommendations

For production self-hosted deployments:

1. Use strong, unique passwords for all services (Postgres, Redis, Admin)
2. Enable TLS via a reverse proxy (nginx, Caddy, or Ingress)
3. Restrict port exposure — only expose the reverse proxy publicly
4. Rotate AUTH_SECRET when needed — changing it signs everyone out, which is harmless. Never change ENCRYPTION_KEY — doing so makes all previously encrypted data unrecoverable
5. Back up your database daily (see Docker Compose backup guide)
6. Keep images updated — pull new versions regularly for security patches

Single Sign-On

Available on the Business and Enterprise editions. Up to five OpenID Connect providers can be configured; each one appears on the sign-in screen only when all three of its values are set.

Variable	Description
SSO_<n>_NAME	Button label (defaults to SSO <n>)
SSO_<n>_ISSUER	OpenID Connect issuer URL
SSO_<n>_CLIENT_ID	Client ID from your identity provider
SSO_<n>_CLIENT_SECRET	Client secret from your identity provider
SSO_ENFORCE	true hides password and social sign-in, leaving only SSO

<n> is 1 to 5. The redirect URI for the first provider is <AUTH_URL>/api/auth/callback/sso-1.

On Community and Team the variables are ignored and the buttons never appear. SSO_ENFORCE is also ignored whenever no usable provider exists, so it can never lock you out of your own installation.

Host Ports (Docker Compose only)

Every service is published on the loopback interface. Override any of these in .env if the port is already taken:

Variable	Default
CADDY_HTTP_PORT	80
CADDY_HTTPS_PORT	443
APP_HOST_PORT	3001
ADMIN_HOST_PORT	3002
API_HOST_PORT	4000
DOCS_HOST_PORT	3003
POSTGRES_HOST_PORT	5432
REDIS_HOST_PORT	6379