Configuration

Each flag can also be set with an environment variable named SIEMLITE_ plus the flag name in capitals with _ for - (e.g. SIEMLITE_GEOIP_CITY). A flag on the command line wins. SIEMLITE_INTEL_FEED takes several feeds separated by spaces.

Flag	Default	Meaning
`-addr`	`localhost:8443`	HTTPS listen address
`-tls-mode`	`self-signed`	`self-signed` (or the `-tls-cert` files), or `letsencrypt` for `-domain`; the System page takes precedence
`-domain`		The domain to get a Let's Encrypt certificate for; port 443 must reach SIEMLite
`-acme-directory`	Let's Encrypt	Another ACME server, such as Let's Encrypt's staging server for testing
`-acme-ca-root`		A CA certificate (PEM file) to trust when talking to the ACME server, for a private ACME CA
`-local-addr`	`localhost:8444`	HTTPS listen address that counts as the server itself, for the sign-in restrictions (off when empty). Only the server must be able to reach it
`-http-addr`		Plain-HTTP listen address for your own reverse proxy that does the HTTPS (off when empty). Never publish it
`-trusted-proxies`		Reverse proxies whose `X-Forwarded-For` is believed: addresses, networks or host names, e.g. `proxy`. With it set, the `-http-addr` port refuses everyone else
`-db`	`siemlite.db`	SQLite database path; events go in a folder beside it named after it (`siemlite-events`)
`-retention-days`	`730`	Keep events this many days, two years by default (checked daily; whole days are deleted as files). The System page takes precedence once it is saved there
`-tls-cert`, `-tls-key`	`<db dir>/siemlite.crt`, `.key`	Certificate and key; a self-signed pair is generated if both are missing
`-tls-hosts`		Extra DNS names or IPs for a generated certificate
`-syslog-udp`, `-syslog-tcp`, `-syslog-tls`		Syslog listen addresses, e.g. `:514`, `:514`, `:6514` (each off when empty)
`-syslog-allow`	loopback and private networks	Comma-separated IPs/CIDRs allowed to send syslog
`-geoip-city`		MaxMind or DB-IP City/Country `.mmdb`
`-geoip-asn`		MaxMind or DB-IP ASN `.mmdb`
`-intel-feed`		Threat intel feed as `name=https://url`; repeat for several
`-intel-refresh`	`6h`	How often to re-download feeds
`-ai-url`		Ollama server for AI Parsers, e.g. `http://ollama:11434`: turns it on with this server until the Integrations page saves its own settings
`-ai-model`	`qwen2.5-coder:3b`	Ollama model for AI Parsers, with `-ai-url`
`-backup-dir`	`<db dir>/backups`	Folder for database backups
`-update-check`	`true`	Check GitHub for new releases and offer updates on the System page

siemlite version prints the version. siemlite install installs it as a service (see Install as a service).