> ## Documentation Index
> Fetch the complete documentation index at: https://docs.panguard.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Environment Variables

> Complete reference for all environment variables across Panguard services.

Environment variables configure Panguard services at startup. Set them in your shell profile, `.env` file, or container orchestration system.

## Panguard Guard

| Variable             | Default                  | Description                                                    |
| -------------------- | ------------------------ | -------------------------------------------------------------- |
| `PANGUARD_DATA_DIR`  | `~/.panguard-guard`      | Base directory for Guard data, rules, and logs                 |
| `PANGUARD_MODE`      | `protect`                | Operating mode: `learning`, `detect`, `protect`                |
| `OLLAMA_ENDPOINT`    | `http://localhost:11434` | Ollama API endpoint for local AI analysis                      |
| `ANTHROPIC_API_KEY`  | --                       | Anthropic API key for Claude-based analysis (Layer 2/3)        |
| `OPENAI_API_KEY`     | --                       | OpenAI API key for GPT-based analysis (Layer 2/3)              |
| `ABUSEIPDB_KEY`      | --                       | AbuseIPDB API key for IP reputation lookups                    |
| `PANGUARD_LOG_LEVEL` | `info`                   | Log level: `debug`, `info`, `warn`, `error`                    |
| `PANGUARD_LANG`      | `en`                     | Language for CLI output and notifications: `en`, `zh-TW`, `ja` |

<CodeGroup>
  ```bash Linux / macOS theme={null}
  export PANGUARD_DATA_DIR=~/.panguard-guard
  export PANGUARD_MODE=protect
  export PANGUARD_LOG_LEVEL=info
  export PANGUARD_LANG=en

  # AI providers (at least one recommended)
  export OLLAMA_ENDPOINT=http://localhost:11434
  export ANTHROPIC_API_KEY=sk-ant-...
  export OPENAI_API_KEY=sk-...

  # Optional
  export ABUSEIPDB_KEY=your-key-here
  ```

  ```powershell Windows theme={null}
  $env:PANGUARD_DATA_DIR = "$HOME\.panguard-guard"
  $env:PANGUARD_MODE = "protect"
  $env:PANGUARD_LOG_LEVEL = "info"
  $env:PANGUARD_LANG = "en"

  # AI providers
  $env:OLLAMA_ENDPOINT = "http://localhost:11434"
  $env:ANTHROPIC_API_KEY = "sk-ant-..."
  ```
</CodeGroup>

<Info>
  Guard uses a three-layer AI system. At minimum, configure `OLLAMA_ENDPOINT` for local analysis (Layer 1). Add `ANTHROPIC_API_KEY` or `OPENAI_API_KEY` for cloud-based analysis (Layer 2/3).
</Info>

***

## Panguard Threat Cloud

| Variable                 | Default                  | Description                              |
| ------------------------ | ------------------------ | ---------------------------------------- |
| `TC_API_KEYS`            | --                       | Comma-separated list of valid API keys   |
| `TC_PORT`                | `4000`                   | HTTP port for the Threat Cloud API       |
| `TC_DB_PATH`             | `./data/threat-cloud.db` | SQLite database file path                |
| `ALLOW_ANONYMOUS_UPLOAD` | `false`                  | Allow unauthenticated threat submissions |

<CodeGroup>
  ```bash Linux / macOS theme={null}
  export TC_API_KEYS=key1,key2,key3
  export TC_PORT=4000
  export TC_DB_PATH=/var/lib/panguard/threat-cloud.db
  export ALLOW_ANONYMOUS_UPLOAD=false
  ```
</CodeGroup>

<Info>
  `ALLOW_ANONYMOUS_UPLOAD=true` enables users to submit threat data without an API key. Uploaded data still goes through validation and reputation scoring.
</Info>

***

## Docker / Production

| Variable   | Default       | Description                                    |
| ---------- | ------------- | ---------------------------------------------- |
| `NODE_ENV` | `development` | Set to `production` for production deployments |

Setting `NODE_ENV=production`:

* Disables debug logging and stack traces in error responses
* Enables response compression
* Enables stricter security headers
* Disables development-only routes

<CodeGroup>
  ```yaml docker-compose.yml theme={null}
  services:
    threat-cloud:
      image: panguard/threat-cloud
      environment:
        - NODE_ENV=production
        - TC_PORT=4000
        - TC_API_KEYS=${TC_API_KEYS}
        - TC_DB_PATH=/data/threat-cloud.db
      volumes:
        - tc-data:/data
  ```
</CodeGroup>

## Precedence

Environment variables take precedence over configuration file values. The resolution order is:

1. Environment variables (highest priority)
2. Configuration file values (`config.json`)
3. Built-in defaults (lowest priority)

<Tip>
  For local development, create a `.env` file in the service directory and use a tool like `dotenv` to load it. Never commit `.env` files to version control.
</Tip>