Configuration

The configuration is YAML. Every key can be overridden with an environment variable named SENTINEL_ plus the upper-case path joined with _.

Key	Default	Description
dev	false	Evaluation only. Allows plain HTTP on loopback; never in production.
data_dir	directory of the config file	Setup token, default key file location, Windows logs
public_url	— (required, https://)	Base URL devices use; enrollment links and media URLs are built from it
console_url	public_url	Console base URL used in links sent to integrations
database.url	— (required)	postgres://user:password@host:5432/db?sslmode=verify-full (SENTINEL_DATABASE_URL)
database.max_open_conns / max_idle_conns	20 / 5	Connection pool per node
database.auto_migrate	true	Apply database migrations at start
keys.kek_file	<data_dir>/sentinel.key	Key-encryption key file (created by init)
keys.kek	—	The key itself, base64 (SENTINEL_KEYS_KEK), instead of a file
listen.endpoint	:8443	Device API listener
listen.admin	:9443	Console listener; set it equal to listen.endpoint for one listener
tls.endpoint.cert_file / key_file	—	PEM certificate chain and key for the endpoint listener
tls.admin.cert_file / key_file	—	Same for the admin listener
trusted_proxies	[]	CIDRs of reverse proxies whose X-Forwarded-For is trusted
log.level	info	debug, info, warn, error
log.format	json	json or text
license_file	—	Optional license file (licenses can also be uploaded in the console)

Outside dev mode, Sentinel requires https in public_url, and either TLS on the endpoint listener or trusted_proxies.

Behind a reverse proxy or load balancer

Terminate TLS at the proxy, forward to the listener over a private network, and list the proxy addresses in trusted_proxies so client IPs in logs, rate limits and the audit log are correct. Requirements:

• Pass request bodies of at least 12 MiB (image sync) and allow long-lived responses for /admin/api/v1/stream (Server-Sent Events): disable response buffering and use a read timeout of at least 2 minutes.
• Do not rewrite paths: devices sign the exact /api/v1/… path.
• Health checks: GET /readyz.