Environment variables
Every THREEAM_* variable the 3AM container reads, with its default and meaning, grouped by area (core, intake and concurrency, models, investigation, causal, mail, licence, Keychain, syslog, FIPS).
The installer, Compose and the Helm chart set these for you; installer options map to them. Change them only when you
run the container yourself, or to override a default. Secrets: prefer the _FILE form.
Core
| Variable | Default | Meaning |
|---|---|---|
THREEAM_DATA | /var/lib/3am | The data directory: audit log, incidents, settings, secrets. Back it up |
THREEAM_PORT | 8700 | The port inside the container |
THREEAM_BIND | 0.0.0.0 | The address inside the container (the installer publishes it on --bind, default 127.0.0.1) |
THREEAM_CONSOLE_URL | none | The console's address as people reach it: links in messages; where Keychain sites reach this install |
THREEAM_CONSOLE_DIR | the image's console | Where the console's files are (development) |
THREEAM_ADMIN_TOKEN | generated | The admin token; generated at first start and kept in admin-token in the data directory |
THREEAM_INGEST_TOKEN | none | Bearer token for POST /v1/events and POST /v1/alerts/<source>; ingestion is off without it |
THREEAM_ORCHESTRATE | 1 | 0 turns incident handling off (the console, API and audit log still work) |
THREEAM_LICENCE | /etc/3am/licence.json | A licence file; absent: install it in the console |
THREEAM_PACKS | /etc/3am/packs | Sealed check packs |
THREEAM_CONNECTORS | /etc/3am/connectors.json | Connectors in a file (GitOps); console-added ones are in the data directory |
THREEAM_POLICY | /etc/3am/policy.json | The policy in a file |
THREEAM_INSTANCE | the host name | This instance's name, for the licence's instance limit |
Intake and concurrency
| Variable | Default | Meaning |
|---|---|---|
THREEAM_POLL_S | 15 | How often alert sources and approval channels are polled, in seconds |
THREEAM_POLL_WORKERS | 16 | Alert-source polls at once |
THREEAM_MAX_CONCURRENT | 2 per vCPU, 4–32 | Investigations at once (16 on 8 vCPU); 32–64 if bursts are common |
THREEAM_CONNECTOR_CONCURRENCY | 4 | Calls in flight per connector (max_in_flight on a connector wins) |
THREEAM_SNAPSHOT_S | 600 | How often 3AM reads how your systems are set up (what changed) |
THREEAM_DISCOVER_TIMEOUT_S | 45 | Discovery's limit per connector |
Models
| Variable | Default | Meaning |
|---|---|---|
THREEAM_MODEL_URL | none (required without a GPU) | OpenAI-compatible endpoint for the investigator and the note |
THREEAM_MODEL | qwen2.5:7b-instruct on a local GPU runtime; otherwise from the System 2 profile | The model name at that endpoint (OpenRouter id, Hugging Face id on vLLM, Ollama tag) |
THREEAM_SYSTEM2 | llama-3.3-70b | System 2 profile: llama-3.3-70b or qwen2.5-72b; THREEAM_MODEL wins |
THREEAM_MODEL_KEY_FILE / THREEAM_MODEL_KEY | none | Its bearer token |
THREEAM_MODEL_EXTRA | none | JSON merged into every request, e.g. {"provider":{"data_collection":"deny"}} |
THREEAM_MODEL_TIMEOUT_S | 60 | A model call is given up after this (the note falls back to the template) |
THREEAM_MODEL_CONCURRENCY | 8 | Model calls at once |
THREEAM_MODEL_DAILY_TOKENS | 0 (none) | Daily token ceiling; spent, model steps are skipped until 00:00 UTC |
THREEAM_MODEL_LOCAL | 1: treat the endpoint as on this host (labs) | |
THREEAM_S1_URL | OpenRouter's when THREEAM_MODEL_URL is OpenRouter, else none | System 1's decisions endpoint, or none. Required without a GPU otherwise |
THREEAM_S1_MODEL | togethercomputer/tev1-4b-experimental | System 1's model |
THREEAM_S1_KEY_FILE / THREEAM_S1_KEY | the model key, with OpenRouter | System 1's key |
THREEAM_S1_TIMEOUT_S | 20 | A System 1 call is given up after this (what it gates stays unverified) |
THREEAM_S1_CONCURRENCY | 16 | System 1 calls at once |
THREEAM_S1_DAILY_TOKENS | 0 (none) | Daily token ceiling for System 1 |
THREEAM_MODEL_CASSETTE, THREEAM_MODEL_REPLAY | none | Record and replay model calls: a directory, and record, replay or auto |
Never on the CPU: Models: GPU or endpoint.
Investigation
| Variable | Default | Meaning |
|---|---|---|
THREEAM_INVESTIGATOR | loop | loop or mcts (the tree search) |
THREEAM_MCTS_S2_CALLS | 16 | The tree search's System 2 calls |
THREEAM_MCTS_READS | 24 | Its reads |
THREEAM_MCTS_DEPTH | 4 | Its depth |
THREEAM_ML_DIR | <data>/ml | Verified ML artifacts (the graph network, DPO adapters) |
THREEAM_ML_TRUST | none | A public key: ML artifacts must also be signed by it, or are refused |
Causal discovery
| Variable | Default | Meaning |
|---|---|---|
THREEAM_CAUSAL_URL | none | 3am-causal's address (the installer's --causal sets it) |
THREEAM_CAUSAL_TOKEN_FILE / THREEAM_CAUSAL_TOKEN | none | The bearer token it expects |
THREEAM_CAUSAL_TAU | 6 | PCMCI+'s maximum lag |
THREEAM_CAUSAL_TIMEOUT_S | 20 | A discovery call is given up after this |
| Variable | Default | Meaning |
|---|---|---|
THREEAM_MAIL_PROVIDER | Resend, or SMTP when THREEAM_SMTP_HOST is set | resend or smtp |
THREEAM_MAIL_FROM | 3AM <verify@3am.si> | The sender, on a domain your provider has verified |
THREEAM_RESEND_KEY_FILE / THREEAM_RESEND_KEY | none | Resend's key |
THREEAM_RESEND_URL | https://api.resend.com/emails | Resend's API |
THREEAM_SMTP_HOST, THREEAM_SMTP_PORT | none, 587 | Your SMTP server |
THREEAM_SMTP_USER, THREEAM_SMTP_PASSWORD_FILE / THREEAM_SMTP_PASSWORD | none | Its account |
THREEAM_SMTP_SECURITY | starttls | starttls, ssl (465) or none (a relay on a trusted network) |
Licence
| Variable | Default | Meaning |
|---|---|---|
THREEAM_LICENCE_CHECK | auto | auto, strict (confirmed within 72 h, or setup mode) or offline (Licensing) |
THREEAM_WARDEN_URL | https://warden.3am.si | Warden, 3AM's licence authority |
THREEAM_WARDEN_PINS | none | sha256/<base64> SPKI pins of Warden's certificate, comma-separated |
THREEAM_CA_BUNDLE | the system's | Your CA, for a TLS-inspecting proxy |
THREEAM_REVOCATION_FILE | the bundle's | A signed revocation list |
THREEAM_CLOCK_TOLERANCE_S | 3600 | How far the clock may move back before it's treated as tampering |
THREEAM_MACHINE_ID_FILE | /etc/machine-id | The single-host fingerprint source |
THREEAM_HARDWARE_ID_FILE | none | A hardware id (as root on RHEL, from 3am-hardware-id.service) |
THREEAM_CLUSTER_UID | none | Set by Helm: the fingerprint follows the cluster |
HTTPS_PROXY and NO_PROXY are honoured for licence checks.
Keychain
| Variable | Installer | Meaning |
|---|---|---|
THREEAM_KEYCHAIN_JOIN, THREEAM_KEYCHAIN_SITE_KEY | --keychain-join, --keychain-site-key-file | Set this new site up from its home with a site key (retried every 30 s for up to 2 hours) |
THREEAM_KEYCHAIN_FILE, THREEAM_KEYCHAIN_PASSPHRASE_FILE / THREEAM_KEYCHAIN_PASSPHRASE | --keychain, --keychain-passphrase-file | Set this install up from a sealed Keychain file, once per version |
Syslog and SIEM
| Variable | Default | Meaning |
|---|---|---|
THREEAM_SYSLOG | auto | Where security and licence events go: stdout (journald under Podman on RHEL), /dev/log, udp://siem:514, tcp://…, tls://… |
THREEAM_SYSLOG_EVENTS | security | Which events: security, or more |
THREEAM_SYSLOG_FACILITY | authpriv | The syslog facility |
FIPS and hardening
| Variable | Default | Meaning |
|---|---|---|
THREEAM_FIPS | auto-detected | 1: FIPS mode (also when OPENSSL_FORCE_FIPS_MODE=1): the audit log seals with ECDSA P-256, sealed Keychain files use PBKDF2 |
THREEAM_ANTIDEBUG | Anti-debugging checks in the compiled build |
Labs only
| Variable | Installer | Meaning |
|---|---|---|
THREEAM_LAB_APPROVER | --lab-approver | 1: offer the auto-approving connection. Doctor fails while it's on |
THREEAM_DEV_LICENCE_PUBKEY, THREEAM_DEV_PACKS, THREEAM_DEV_PACK_SECRET | Development builds only |
The fingerprint comes from THREEAM_CLUSTER_UID, the machine id or the hardware id. Changing them (moving 3AM to
another host) makes a new install: add it to the licence.
Secrets in connector settings
A connector's secret settings never hold the secret itself; they point to it:
{"token": {"file": "/etc/3am/secrets/pagerduty-token"}}
{"token": {"env": "PD_API_TOKEN"}}Read only when the connector is built; never logged.