When using Helm --set flags, prefix all configuration values with config. (e.g., --set config.publisher.apiKey=...)

General Settings

Parameter	Type	Default	Description
`logLevel`	string	`"info"`	Logging level (`debug`, `info`, `warn`, `error`)
`serverPort`	integer	`8080`	Port for the HTTP server (metrics, probes)

Graph Settings

Parameter	Type	Default	Description
`graph.pruneInterval`	duration	`1h`	How often to prune old nodes/edges
`graph.maxPruneAge`	duration	`24h`	Max age of nodes/edges before pruning

Kubernetes Settings

Parameter	Type	Default	Description
`kube.configPath`	string	`""`	Path to kubeconfig (if not in-cluster)
`kube.resyncInterval`	duration	`5m`	Informer resync interval
`kube.clusterName`	string	`""`	Optional cluster identifier
`kube.resources`	array	`["pods", "services", ...]`	List of resources to monitor
`kube.namespaceFilter.mode`	string	`""`	Namespace scoping mode: `""`/`none` (all namespaces), `allow`, or `deny`. See below.
`kube.namespaceFilter.namespaces`	array	`[]`	Namespaces the mode applies to. Required when mode is `allow` or `deny`.

Namespace scope

Scope which namespaces Edge maps into the resource graph, so blast radius and dependency maps cover only the workloads that matter to you. Filtering is off by default — every namespace is graphed.

Mode	Behavior
`""` or `none`	No filtering. Every namespace is graphed (default).
`allow`	Allow-list. Only the listed namespaces enter the graph.
`deny`	Deny-list. Every namespace except the listed ones enters the graph.

Cluster-scoped resources (nodes, persistent volumes, storage classes) are always graphed regardless of mode. Namespace names must be valid DNS-1123 labels. Allow-list — map only production workloads:

config:
  kube:
    namespaceFilter:
      mode: allow
      namespaces:
        - prod
        - staging

Deny-list — map everything except system namespaces:

config:
  kube:
    namespaceFilter:
      mode: deny
      namespaces:
        - kube-system
        - kube-public
        - monitoring

In deny mode the same namespace list also seeds the Network Observability Hubble flow filter (netobs.excludeNamespaces), so dropped namespaces are excluded from traffic collection too.

Services (DNSTap) Settings

Parameter	Type	Default	Description
`services.address`	string	`":6000"`	Address to listen for DNSTap streams
`services.maxConns`	integer	`100`	Max concurrent DNSTap connections
`services.workers`	integer	`4`	Worker pool size for service enrichment
`services.readTimeout`	duration	`30s`	Timeout for reading frames
`services.writeTimeout`	duration	`10s`	Timeout for writing frames
`services.tls.enabled`	boolean	`false`	Enable TLS for DNSTap
`services.tls.certFile`	string	`""`	Path to certificate file
`services.tls.keyFile`	string	`""`	Path to private key file
`services.tls.caFile`	string	`""`	Path to CA certificate file
`services.tls.requireClientCert`	boolean	`false`	Require client certificate
`services.tls.minVersion`	string	`"1.2"`	Minimum TLS version
`services.tls.cipherSuites`	array	`[...]`	Allowed cipher suites
`services.compression.enabled`	boolean	`true`	Enable DNSTap compression
`services.compression.type`	string	`"gzip"`	Compression type
`services.compression.level`	integer	`-1`	Compression level (-1 to 9)
`services.handshake.timeout`	duration	`10s`	Handshake timeout
`services.handshake.contentType`	string	`"protobuf..."`	Expected content type

Publisher Settings

Parameter	Type	Default	Description
`enablePublishing`	boolean	`false`	Enable graph publishing
`publisher.apiKey`	string	`""`	Authentication key for NOFire AI
`publisher.timeout`	duration	`5m`	Request timeout
`publisher.maxRetries`	integer	`3`	Max retries for failed requests
`publisher.retryDelay`	duration	`1m`	Delay between retries
`publisher.enableCompression`	boolean	`false`	Enable GZIP for published data
`publisher.graph.url`	string	`""`	Endpoint for graph updates
`publisher.graph.interval`	duration	`1h`	Full graph sync interval

Sentry Settings

Parameter	Type	Default	Description
`sentry.dsn`	string	`""`	Sentry DSN
`sentry.environment`	string	`""`	Environment tag
`sentry.release`	string	`""`	Release tag
`sentry.debug`	boolean	`false`	Enable Sentry debug mode
`sentry.sampleRate`	float	`1.0`	Error sampling rate
`sentry.tracesSampleRate`	float	`0.0`	Transaction sampling rate

Example Configuration (JSON)

{
  "logLevel": "info",
  "services": {
    "address": ":6000",
    "maxConns": 100,
    "tls": {
      "enabled": true,
      "certFile": "/etc/certs/tls.crt",
      "keyFile": "/etc/certs/tls.key"
    }
  },
  "enablePublishing": true,
  "publisher": {
    "apiKey": "secret-key",
    "graph": {
      "url": "https://my.nofire.ai/api/edge",
      "interval": "10m"
    }
  },
  "sentry": {
    "dsn": "https://[email protected]/123",
    "environment": "production"
  }
}

Edge Proxy Configuration

These settings apply when you deploy on-prem connections alongside Edge. Adding any onPremConnections entry automatically deploys the Edge Proxy.

Edge Proxy Stream Settings

These settings control the persistent gRPC connection between the Edge Proxy and NOFire.

Parameter	Default	Description
`edgeProxy.stream.serverAddress`	`""`	Required. The NOFire gRPC endpoint: `edge.nofire.ai:443`. This is a different host from the dashboard (`my.nofire.ai`), which does not serve gRPC.
`edgeProxy.stream.useTLS`	`true`	Use TLS for the gRPC connection. Set to `false` only for local testing.
`edgeProxy.stream.reconnectDelay`	`1s`	Initial delay before reconnecting after a disconnect.
`edgeProxy.stream.maxReconnectDelay`	`60s`	Maximum backoff delay between reconnection attempts. Backoff doubles on each attempt.
`edgeProxy.stream.heartbeatInterval`	`30s`	Interval between heartbeat messages sent to NOFire. NOFire marks streams stale after 3 missed heartbeats (90s).
`edgeProxy.stream.maxMessageSize`	`16777216`	Maximum gRPC message size in bytes (16 MB).
`edgeProxy.stream.maxConcurrent`	`10`	Maximum concurrent in-flight proxy requests. Additional requests are rejected with HTTP 503.
`edgeProxy.stream.keepaliveTime`	`30s`	Interval between gRPC keepalive pings.
`edgeProxy.stream.keepaliveTimeout`	`10s`	Timeout for a keepalive ping response before the connection is considered dead.
`edgeProxy.stream.protocolVersion`	`1`	Edge protocol version sent in the StreamInit handshake.

Edge Proxy HTTP Client Settings

These settings apply to HTTP requests made from the Edge Proxy to your data sources.

Parameter	Default	Description
`edgeProxy.http.timeout`	`30s`	Per-request timeout for upstream HTTP calls.
`edgeProxy.http.maxIdleConns`	`100`	Maximum number of idle HTTP connections across all backends.
`edgeProxy.http.retryMaxAttempts`	`3`	Maximum retry attempts for 5xx and 429 responses. Uses exponential backoff.

PII Redaction

The Edge Proxy redacts sensitive data from response bodies before sending them to NOFire. Redaction is on by default.

Parameter	Default	Description
`edgeProxy.redaction.enabled`	`true`	Master switch for PII redaction.
`edgeProxy.redaction.standardPII`	`true`	Apply the 15 built-in PII patterns listed below.

Standard PII Patterns

When standardPII is true, these patterns are applied in order:

#	Pattern	Matches	Replacement
1	`email`	`[email protected]`	`[EMAIL_REDACTED]`
2	`jwt`	`eyJhbG...` (3-part base64 token)	`[JWT_REDACTED]`
3	`bearer_token`	`Bearer <token>`	`Bearer [TOKEN_REDACTED]`
4	`api_key`	`api_key=...`, `auth_token=...`	`[APIKEY_REDACTED]`
5	`password_field`	`password=...`, `pwd=...`	`[PASSWORD_REDACTED]`
6	`ipv4`	`192.168.1.1` (validated octets)	`[IP_REDACTED]`
7	`ipv6`	Full and compressed IPv6 addresses	`[IPV6_REDACTED]`
8	`iso_date`	`2024-01-15` (YYYY-MM-DD)	`[DATE_REDACTED]`
9	`dob_us`	`01/15/1990` (MM/DD/YYYY)	`[DOB_REDACTED]`
10	`cc_expiry`	`01/25` or `01/2025` (MM/YY or MM/YYYY)	`[EXPIRY_REDACTED]`
11	`ssn`	`123-45-6789`	`[SSN_REDACTED]`
12	`ein`	`12-3456789` (employer ID)	`[EIN_REDACTED]`
13	`credit_card`	13-19 digit sequences (Luhn-validated)	`[CC_REDACTED]`
14	`us_street_address`	`123 Main Street`, `456 Oak Ave`	`[ADDRESS_REDACTED]`
15	`phone_generic`	`+1 (555) 123-4567` (validated separators)	`[PHONE_REDACTED]`

Patterns 13 (credit card) and 15 (phone) use validators to reduce false positives. Credit cards are checked with the Luhn algorithm. Phone numbers require separators or a + prefix.

Edge Proxy General Settings

Parameter	Default	Description
`edgeProxy.serverPort`	`8081`	HTTP port for health checks (`/healthz`) and Prometheus metrics (`/metrics`).
`edgeProxy.secretsPath`	`/etc/nofire/secrets`	Base path where Kubernetes Secrets are mounted inside the pod.
`edgeProxy.replicaCount`	`1`	Number of edge-proxy pod replicas.
`edgeProxy.image.repository`	`edge-proxy`	Container image repository.
`edgeProxy.image.tag`	Chart `appVersion`	Container image tag.
`edgeProxy.resources.requests.cpu`	`100m`	CPU request.
`edgeProxy.resources.requests.memory`	`128Mi`	Memory request.
`edgeProxy.resources.limits.cpu`	`500m`	CPU limit.
`edgeProxy.resources.limits.memory`	`256Mi`	Memory limit.

Secret Key Reference

The Edge Proxy reads credentials from files mounted at {secretsPath}/{secretName}/{key}.

Key	Used For	Header Set
`token`	Bearer token auth (most backends)	`Authorization: Bearer <token>`
`token`	Elasticsearch ApiKey auth	`Authorization: ApiKey <token>`
`username`	Basic auth or MongoDB Atlas digest auth	`Authorization: Basic <base64>`
`password`	Basic auth or MongoDB Atlas digest auth	`Authorization: Basic <base64>`

If both token and username are present, token takes priority (except for MongoDB Atlas, which always uses digest auth).

Environment Variables

Variable	Description
`NOFIRE_API_KEY`	NOFire API key. Injected from the `nofire-credentials` secret by the Helm chart. Referenced in the config as `{NOFIRE_API_KEY}`.

Get Started

Skills

Platform Features

Setup & Integrations

Security

Configuration

General Settings

Graph Settings

Kubernetes Settings

Namespace scope

Services (DNSTap) Settings

Publisher Settings

Sentry Settings

Example Configuration (JSON)

Edge Proxy Configuration

Edge Proxy Stream Settings

Edge Proxy HTTP Client Settings

PII Redaction

Standard PII Patterns

Edge Proxy General Settings

Secret Key Reference

Environment Variables

​General Settings

​Graph Settings

​Kubernetes Settings

​Namespace scope

​Services (DNSTap) Settings

​Publisher Settings

​Sentry Settings

​Example Configuration (JSON)

​Edge Proxy Configuration

​Edge Proxy Stream Settings

​Edge Proxy HTTP Client Settings

​PII Redaction

​Standard PII Patterns

​Edge Proxy General Settings

​Secret Key Reference

​Environment Variables

General Settings

Graph Settings

Kubernetes Settings

Namespace scope

Services (DNSTap) Settings

Publisher Settings

Sentry Settings

Example Configuration (JSON)

Edge Proxy Configuration

Edge Proxy Stream Settings

Edge Proxy HTTP Client Settings

PII Redaction

Standard PII Patterns

Edge Proxy General Settings

Secret Key Reference

Environment Variables