Installation settings

Set addresses, ports and storage in operator.env before startup.

LogForge · Runs in your infrastructure

Before you begin

Use this reference for operator.env in the signed air-gapped package. For online installation, edit .env in the cloned repository instead; its setting names differ.

Where: Bash on the server's Linux host, inside the extracted customer release directory.
Access: permission to use Docker and the chosen persistent storage.
When: choose addresses, ports, and storage before the first startup.

If your bundle is still packed, extract and verify it using your chosen installation guide first. Return here before starting the LogForge server.

Open the existing operator.env in your text editor. Replace its four setting lines with one complete example below, then change the hostname and storage path for your installation. Do not combine the examples.

observability.example.test is a placeholder. Use a hostname your devices can resolve, or the LogForge server's reachable IPv4 address. If the LogForge server is on another machine, localhost in your browser points to your own computer.

Important: edit operator.env only. The launcher manages private secrets separately. Leave .env.example and generated deployment.env to the supplied release.

Settings you can change

ECHO in the literal setting names means Remote Agent. Keep the names exactly as shown.

Setting	Default	Purpose
`UNICRON_PUBLIC_URL`	`https://localhost`	Browser address. Its explicit port selects the published HTTPS port; otherwise 443.
`UNICRON_ECHO_PUBLIC_URL`	`https://localhost`	Agent enrollment and API address. Normally use the browser's address and HTTPS port. A local browser can use localhost while remote agents use a reachable DNS name.
`UNICRON_ECHO_MTLS_PUBLIC_URL`	`https://localhost:9443`	Agent mutual TLS address: both machines authenticate with certificates. Use a different port from HTTPS.
`UNICRON_DATA_ROOT`	`auto`	Persistent storage. `auto` uses the launching user's `$HOME/.local/share/unicron`; otherwise use a writable absolute Linux path.

Address rules: HTTPS, DNS hostname or IPv4 address, optional port 1–65535. No trailing slash, path, query, fragment, credentials, or IPv6 literal. Configured names and IPs become certificate names during initial setup.

File rules:

One KEY=value per line, with no spaces around =.
Values are literal: no quotes, export, ~, $HOME, or inline comments.
Put comments on separate # lines and end the file with a newline.
Use only the four settings above. Unknown names stop startup.

Choose one configuration

One machine using the default ports

Use when the browser runs on the server's host and agents use This Docker Host:

UNICRON_PUBLIC_URL=https://localhost
UNICRON_ECHO_PUBLIC_URL=https://localhost
UNICRON_ECHO_MTLS_PUBLIC_URL=https://localhost:9443
UNICRON_DATA_ROOT=auto

Remote operators and agents

Replace the hostname. Prepare /srv/unicron on persistent storage and make it writable by the launching account:

UNICRON_PUBLIC_URL=https://observability.example.test
UNICRON_ECHO_PUBLIC_URL=https://observability.example.test
UNICRON_ECHO_MTLS_PUBLIC_URL=https://observability.example.test:9443
UNICRON_DATA_ROOT=/srv/unicron

Check: the name resolves to the LogForge server from operator devices and agent hosts. Another machine cannot reach the LogForge server through localhost.

Local browser with remote agents

Keep the browser on this server while agents connect through your real DNS name:

UNICRON_PUBLIC_URL=https://localhost
UNICRON_ECHO_PUBLIC_URL=https://observability.example.test
UNICRON_ECHO_MTLS_PUBLIC_URL=https://observability.example.test:9443
UNICRON_DATA_ROOT=/srv/unicron

The launcher includes the agent names in certificate coverage. Those names do not become additional browser login addresses.

Custom host ports

Choose unused ports if 443 or 9443 is occupied:

UNICRON_PUBLIC_URL=https://observability.example.test:8444
UNICRON_ECHO_PUBLIC_URL=https://observability.example.test:8444
UNICRON_ECHO_MTLS_PUBLIC_URL=https://observability.example.test:9444
UNICRON_DATA_ROOT=/srv/unicron

This publishes HTTPS on 8444 and mutual TLS on 9444. Keep those ports in browser addresses, firewall rules, and generated agent addresses. A separate Remote Agent HTTPS value does not create another listener. Reverse proxies need deployment-specific configuration.

Restrict access before starting

Before startup: localhost is not a firewall. Docker normally publishes these ports on all host interfaces, including for the default configuration.

Have your infrastructure administrator:

Allow HTTPS from approved operators and agents needing enrollment/API access.
Allow mutual TLS from the intended agent hosts.
Block other machines for a single-machine evaluation.
Keep databases, telemetry stores, and certificate-signing services private.

Use network/cloud controls or Docker-aware host rules. Ordinary UFW rules alone may not filter Docker-published traffic. See Docker's port publishing and firewall guidance.

Check after startup: an allowed device connects and a denied device cannot. A local connection tests neither restriction.

Start, verify, and preserve the settings

Save operator.env.
Review usage reporting before startup.
Return to Install air-gapped. Start with ./unicron up --trust /absolute/path/to/vendor-public.jwks.json. The launcher validates the signed package, settings and CPU; there is no ./unicron validate command.

Keep the unchanged signed archive beside the extracted package during first setup. Editing operator.env does not authorize changes to signed package files.

If startup rejects a setting, address, path, or occupied port, fix the reported cause and retry with the same data location.

Keep the same installation: use the same launching account with auto, or the same absolute data path. Adding sudo or changing accounts can select different storage.

Preserve data and certificates after startup. Later address/port changes need a repair plan. Retention, resource limits, provider credentials, reporting, and bind-address controls are not extra operator.env settings. Configure alert delivery through Notifications; ask your release contact about other deployment changes.