Operate

Configuration

All configuration is via environment variables. The common ones, grouped.

Core & capture

Variable	Default	Purpose
`GMONK_DATABASE_URL`	local `gmonk`	Postgres connection for gmonk's own store.
`GMONK_TARGET_URL`	—	The database to protect (target for `protect-db`).
`GMONK_CONFIG`	—	Path to your `gmonk.config.mjs` (compensations + executors).
`GMONK_TENANT_ID`	`default`	Tenant id for the RLS seam.
`GMONK_SQL_CAPTURE`	`on`	Kill-switch for SQL capture.
`GMONK_WAL` / `GMONK_WAL_SLOT`	`off` / `gmonk_slot`	Enable WAL capture; slot name.
`GMONK_RECORD_READS`	`off`	Also record read-only tool calls (fuller audit).

Variable	Purpose
`GMONK_S3_BUCKET` (`_REGION`, `_ENDPOINT`, `_FORCE_PATH_STYLE`)	Use S3/MinIO for before-images (recommended for production).
`GMONK_OBJECT_STORE`	Local FS path for before-images when no bucket is set (mount a volume).
`GMONK_OBJECT_ALLOW_BUCKETS`	Fail-closed allowlist — comma/space list of `bucket` or `bucket/prefix`.

Variable	Default	Purpose
`GMONK_GATE`	`advise`	`advise` · `block` · `guarantee` · `off`.
`GMONK_GATE_WARN_BELOW`	`manual`	Band floor to warn at-or-below.
`GMONK_GATE_BLOCK_BELOW`	`impossible`	Band floor to block (block mode).
`GMONK_GATE_GUARANTEE_UNPROVABLE`	`hold`	Guarantee mode when undo can't be proven: `hold` · `block`.
`GMONK_POLICY_FILE`	—	JSON file of extra guard rules.
`GMONK_GUARD_DEFAULTS`	`on`	`off` drops the built-in DROP/TRUNCATE/no-WHERE blocks.
`GMONK_SHELL_GATE`	`ask`	`ask` · `deny` · `off`.
`GMONK_SHELL_ALLOW`	—	Comma-separated regexes that always run.

Variable	Default	Purpose
`GMONK_PG_BACKEND_TLS` / `GMONK_MYSQL_BACKEND_TLS`	host-aware	`disable`·`prefer`·`require`·`verify`. Remote → require, loopback → prefer. Per-URL `?sslmode=` wins.
`GMONK_PG_BACKEND_CA` / `GMONK_MYSQL_BACKEND_CA`	system CAs	CA bundle (inline PEM or path) for `verify`.

Variable	Default	Purpose
`GMONK_HOOK_TOKEN`	auto	Bearer token for the fast `/hook-ingest` endpoint. `""` disables it.
`GMONK_HOOK_TOKEN_FILE`	`~/.gmonk/hook-token`	Where the auto token is stored.
`GMONK_HOOK_ENDPOINT`	`on`	`off` disables the fast HTTP hook (falls back to spawn).
`GMONK_HOOK_WATCHDOG_MS`	`8000`	Hard upper bound on hook work.

Variable	Default	Purpose
`GMONK_ALERT_WEBHOOK`	—	URL to POST alerts to (e.g. a Slack incoming webhook).
`GMONK_ALERT_EVENTS`	require_approval, block, recoverability_degraded/lost, out_of_band	Comma list of events that fire an alert.
`GMONK_SLACK_SIGNING_SECRET` / `GMONK_SLACK_APP_TOKEN`	—	Interactive Slack approve/deny (HTTP / Socket Mode).
`GMONK_APPROVAL_TIMEOUT_MS`	`300000`	How long a held action waits for a decision (5 min).

Variable	Default	Purpose
`GMONK_WEB_TOKEN`	—	If set, the UI requires it on every API call.
`GMONK_WEB_ALLOW_NONLOOPBACK`	`0`	Allow binding off-loopback without a token (behind a trusted proxy only).
`GMONK_OIDC_*`	—	SSO/OIDC login (`_ISSUER`, `_CLIENT_ID`, `_REDIRECT_URI`, …). Validate with `gmonk sso-check`.