@cryptotaxi247 / CoPilot
Code Commits Issues Pulls Sessions CI/CD
main
main
example 171 lines 5.36 KB
Raw
1 # Leave this as is if connecting from a remote machine
2 SERVER_IP=0.0.0.0
3
4 # SECURITY: JWT secret for token signing.
5 # REQUIRED — the application will refuse to start if this is unset or set to the
6 # known-compromised default disclosed in GHSA-4gxj-hw3c-3x2x.
7 # Generate a unique secret with: openssl rand -base64 32
8 JWT_SECRET=REPLACE_ME
9
10 # SECURITY: Dedicated secret for signing OAuth2 state tokens (SSO flows).
11 # If not set, falls back to JWT_SECRET — set this to isolate SSO state signing.
12 # Generate with: openssl rand -base64 32
13 SSO_STATE_SECRET=REPLACE_ME
14
15 # SECURITY: Fernet encryption key for TOTP secrets stored in the database.
16 # If not set, falls back to a key derived from JWT_SECRET.
17 # ⚠️ Once set and users have enrolled 2FA, do NOT change this key — existing
18 # TOTP secrets in the database will become unreadable.
19 # Generate with: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
20 TOTP_ENCRYPTION_KEY=REPLACE_ME
21 GRAYLOG_API_HEADER_VALUE=ab73de7a-6f61-4dde-87cd-3af5175a7281
22 VELOCIRAPTOR_API_HEADER_VALUE=ab73de7a-6f61-4dde-87cd-3af5175a7281
23 # Shared secret required on the Grafana-invoked /api/agents/dashboard/agents route
24 # (GHSA-xh98-w6qh-cr44). Unlike the two values above, this one FAILS CLOSED: if it is
25 # left blank the route is denied for everyone. Generate a unique random value per
26 # deployment (e.g. `openssl rand -hex 32`) and set the same value as a request header
27 # named `grafana` in your Grafana dashboard's datasource. Do NOT reuse the default above.
28 GRAFANA_API_HEADER_VALUE=
29
30 MYSQL_URL=copilot-mysql
31 # ! Avoid using special characters in the password ! #
32 MYSQL_ROOT_PASSWORD=REPLACE_WITH_PASSWORD
33 MYSQL_USER=copilot
34 # ! Avoid using special characters in the password ! #
35 MYSQL_PASSWORD=REPLACE_WITH_PASSWORD
36
37 MINIO_URL=copilot-minio
38 MINIO_ROOT_USER=admin
39 # ! Make the password at least 8 characters long ! #
40 MINIO_ROOT_PASSWORD=REPLACE_ME
41 MINIO_SECURE=False
42
43 # ! ALERT FORWARDING IP
44 # Set this to the IP of the host running CoPilot. This is used by Graylog to forward alerts to CoPilot
45 # ! Not needed anymore since we are reading from the index now
46 # ! Ensure Graylog is able to reach this IP and port 5000
47 ALERT_FORWARDING_IP=0.0.0.0
48
49 # Connector Credentials
50 # ! SETTING UP YOUR CONNECTORS DEMOs https://www.youtube.com/@taylorwalton_socfortress/videos! #
51 WAZUH_INDEXER_URL=https://127.1.1.1:9200
52 WAZUH_INDEXER_USERNAME=admin
53 WAZUH_INDEXER_PASSWORD=admin
54
55 WAZUH_MANAGER_URL=https://127.1.1.1
56 WAZUH_MANAGER_USERNAME=dummy
57 WAZUH_MANAGER_PASSWORD=dummy
58
59 GRAYLOG_URL=http://127.1.1.1
60 GRAYLOG_USERNAME=dummy
61 GRAYLOG_PASSWORD=dummy
62
63 GRAYLOG_NETWORK_URL=http://127.1.1.1
64 GRAYLOG_NETWORK_USERNAME=dummy
65 GRAYLOG_NETWORK_PASSWORD=dummy
66
67 SHUFFLE_URL=https://127.1.1.1
68 SHUFFLER_API_KEY=dummy
69 SHUFFLE_WORKFLOW_ID=dummy
70
71 VELOCIRAPTOR_URL=https://127.1.1.1
72 VELOCIRAPTOR_API_KEY_PATH=dummy
73
74 SUBLIME_URL=http://127.1.1.1
75 SUBLIME_API_KEY=dummy
76
77 INFLUXDB_URL=http://127.1.1.1
78 INFLUXDB_API_KEY=dummy
79 INFLUXDB_ORG_AND_BUCKET=dummy,dummy
80
81 GRAFANA_URL=http://127.1.1.1
82 GRAFANA_USERNAME=dummy
83 GRAFANA_PASSWORD=dummy
84
85 WAZUH_WORKER_PROVISIONING_URL=http://127.1.1.1
86
87 EVENT_SHIPPER_URL=graylog_host
88 GELF_INPUT_PORT=gelf_port
89
90 ALERT_CREATION_PROVISIONING_URL=http://127.1.1.1
91
92 HAPROXY_PROVISIONING_URL=http://127.1.1.1
93
94 # VirusTotal
95 VIRUSTOTAL_URL=https://www.virustotal.com/api/v3
96 VIRUSTOTAL_API_KEY=REPLACE_ME
97
98 # Portainer
99 PORTAINER_URL=http://127.1.1.1:9000
100 PORTAINER_USERNAME=admin
101 PORTAINER_PASSWORD=admin
102 PORTAINER_ENDPOINT_ID=2
103
104 # SOCFORTRESS TALON : https://github.com/taylorwalton/talon/tree/main
105 TALON_URL=http://127.1.1.1:3100
106 TALON_API_KEY=REPLACE_ME
107
108 # ! CoPilot MCP
109
110 # OpenAI Configuration
111 OPENAI_API_KEY=REPLACE_ME
112 OPENAI_MODEL=gpt-4o
113
114 # Application Configuration
115 LOG_LEVEL=INFO
116 # JWT token expiry in minutes (default: 1440 = 24h)
117 ACCESS_TOKEN_EXPIRE_MINUTES=1440
118
119 # MCP Server Process Management
120 MCP_SERVER_ENABLED=true
121
122 # External OpenSearch Configuration
123 OPENSEARCH_URL=https://your-wazuh-indexer-url:9200 # Likely your wazuh-indexer
124 OPENSEARCH_USERNAME=YOUR_WAZUH_INDEXER_USERNAME
125 OPENSEARCH_PASSWORD=YOUR_WAZUH_INDEXER_PASSWORD
126 OPENSEARCH_SSL_VERIFY=false
127 OPENSEARCH_SSL_SHOW_WARN=false
128
129 # OpenSearch MCP Server Configuration
130 MCP_OPENSEARCH_AUTH_TOKEN=secret-token
131
132 # External MySQL Configuration
133 MYSQL_ENABLED=true
134 MYSQL_HOST=copilot-mysql
135 MYSQL_PORT=3306
136 MYSQL_DATABASE=copilot
137
138 # MySQL MCP Server Configuration
139 MCP_MYSQL_AUTH_TOKEN=mysql-token
140 MCP_MYSQL_SERVER_ENABLED=true
141
142 # External Wazuh Configuration
143 WAZUH_PROD_URL=https://your-wazuh-manager:55000
144 WAZUH_PROD_USERNAME=wazuh-wui
145 WAZUH_PROD_PASSWORD=wazuh-wui
146 WAZUH_PROD_SSL_VERIFY=false
147 WAZUH_PROD_TIMEOUT=30
148
149 # Wazuh MCP Server Configuration
150 MCP_WAZUH_AUTH_TOKEN=wazuh-token
151 MCP_WAZUH_SERVER_ENABLED=true
152
153 # External Velociraptor Configuration
154 VELOCIRAPTOR_API_KEY=/app/velociraptor-config.yaml # Dont change this
155 VELOCIRAPTOR_SSL_VERIFY=false
156 VELOCIRAPTOR_TIMEOUT=30
157
158 # Velociraptor MCP Server Configuration
159 MCP_VELOCIRAPTOR_AUTH_TOKEN=velociraptor-token
160 MCP_VELOCIRAPTOR_SERVER_ENABLED=true
161 MCP_VELOCIRAPTOR_HOST=0.0.0.0
162 MCP_VELOCIRAPTOR_PORT=8001
163
164 # SOCFortress MDR Forwarding
165 # When enabled, alerts for customers that have the "SOCFortress MDR" integration
166 # deployed are forwarded to the MDR server (POST /api/v1/alerts/copilot). The
167 # per-customer collector UUID is entered in the integration UI; MDR_COLLECTOR_UUID
168 # below is only a single-tenant fallback.
169 MDR_ENABLED=false
170 MDR_SERVER_URL=https://mdr-server.socfortress.co
171 MDR_COLLECTOR_UUID=