config_example.php

<?php

/**
 * 411 configuration file
 *
 * Rename this to 'config.php' and modify.
 */
$config = [];

/**
 * Authentication configuration
 */
$config['auth'] = [
    'proxy' => [
        /**
         * Whether to enable proxy auth.
         * IT IS VERY INSECURE TO ENABLE THIS IF 411 is not run behind an auth proxy.
         */
        'enabled' => false,
        /**
         * The name of the header the proxy is setting.
         */
        'header' => null,
        /**
         * Whether to automatically create users who are authenticated.
         */
        'auto_create' => false,
        /**
         * Email domain for automatically created users.
         */
        'domain' => null,
    ],
    'api' => [
        /**
         * Whether to enable api access to 411.
         */
        'enabled' => true
    ]
];

/**
 * Database configuration
 */
$config['db'] = [
    /**
     * A PDO compatible DSN. See https://secure.php.net/manual/en/pdo.drivers.php for details.
     * SQLite is the default configuration but MySQL is also supported. To configure the latter,
     * you'll need a dsn like the following: 'mysql:host=localhost;dbname=fouroneone'.
     */
    'dsn' => 'sqlite:' . realpath(__DIR__ . '/data.db'),
    /**
     * The user name for connecting to the database.
     */
    'user' => 'root',
    /**
     * The password for connecting to the database. Optional if the PDO driver doesn't
     * require a password.
     */
    'pass' => null,
];


/****
 *
 * Search type configuration
 * Note: All hostnames should specify protocol!
 *
 ***/

/**
 * Elasticsearch search type
 */
$config['elasticsearch'] = [
    /**
     * Each entry in this array represents an Elasticsearch source that 411 can query.
     *
     * 'hosts': An array of hosts powering your ES cluster. Credentials can be passed in the url.
     *          Ex: 'http://user:pass@localhost:9200'
     * 'index_hosts': An array of hosts to use for indexing (if different from 'hosts').
     * 'ssl_cert': Path to an ssl certificate if your cluster uses HTTPS.
     * 'ssl_client_cert': Path to an ssl client certificate if your cluster uses HTTPS.
     * 'ssl_client_key': Path to an ssl client key if your cluster uses HTTPS.
     * 'index': The index to query. Leave as null to query all indices.
     *          If the index is date_based, accepts index patterns. (Otherwise, it's taken literally)
     *          Any characters wrapped by [] will be taken literally.
     *          All other characters are interpretted via PHP's date formatting syntax.
     *          See https://secure.php.net/manual/en/function.date.php for details.
     * 'date_based': Whether to generate an index name according to a date-based index pattern.
     * 'date_interval': If the index is date_based, this defines the indexing pattern interval.
     *                  'h' - Hourly.
     *                  'd' - Daily.
     *                  'w' - Weekly.
     *                  'm' - Monthly.
     *                  'y' - Yearly.
     * 'date_field': The field to use for doing date-based queries.
     * 'date_type': The format of the date field.
     *              null - Automatically detect and parse. Should work most of the time!
     *              '@' - Parse as a UNIX timestamp.
     *              '#' - Parse as a UNIX timestamps (in milliseconds).
     *              All other strings are interpretted via PHP's date formatting syntax.
     * 'src_url': A server name for generating source links.
     *            Ex: 'https://localhost:5601'
     */

    # Configuration for the 411 Alerts index.
    'alerts' => [
        'hosts' => ['http://localhost:9200'],
        'index_hosts' => [],
        'ssl_cert' => null,
        'ssl_client_cert' => null,
        'ssl_client_key' => null,
        'index' => null,
        'date_based' => false,
        'date_interval' => null,
        'date_field' => 'alert_date',
        'date_type' => null,
        'src_url' => null,
    ],
    # Configuration for the logstash index that 411 queries.
    'logstash' => [
        'hosts' => ['http://localhost:9200'],
        'index_hosts' => [],
        'ssl_cert' => null,
        'ssl_client_cert' => null,
        'ssl_client_key' => null,
        'index' => '[logstash-]Y.m.d',
        'date_based' => true,
        'date_interval' => 'd',
        'date_field' => '@timestamp',
        'date_type' => null,
        'src_url' => null,
    ],
];

/**
 * Graphite
 *
 * Configure to allow querying Graphite.
 */
$config['graphite'] = [
    /**
     * Each entry in this array represents a Graphite source that 411 can query.
     *
     * 'host': The hostname for your Graphite instance.
     */
    'graphite' => [
        'host' => null,
    ],
];

/**
 * ThreatExchange
 * See https://developers.facebook.com/products/threat-exchange for details.
 *
 * Configure to allow querying ThreatExchange.
 */
$config['threatexchange'] = [
    /**
     * The api token for connecting to ThreatExchange.
     */
    'api_token' => null,
    /**
     * The api secret for connecting to ThreatExchange.
     */
    'api_secret' => null,
];


/****
 *
 * Target configuration
 *
 ***/

/**
 * Jira
 *
 * Fill in to enable Jira integration.
 */
$config['jira'] = [
    /**
     * The hostname for your Jira instance.
     */
    'host' => null,
    /**
     * The username for connecting to Jira.
     */
    'user' => null,
    /**
     * The password for connecting to Jira.
     */
    'pass' => null,
];

/**
 * Slack
 *
 * Fill in to enable Slack integration.
 */
$config['slack'] = [
    /**
     * A webhook url to push Alerts to.
     * See https://api.slack.com/incoming-webhooks for details.
     */
    'webhook_url' => null,
    /**
     * The username to display on Alerts.
     */
    'username' => null,
    /**
     * The icon to display on Alerts.
     */
    'icon' => null,
];