TheHive Flow Configuration Files#
6.0 One
A TheHive Flow Docker Compose deployment is configured through a handful of files in the profile directory, prod1-thehive-flow or prod2-thehive-flow, of the StrangeBee Docker Compose repository. These files don't exist on a Kubernetes deployment, where the configuration is set through the Helm chart values, as described in Configuration and operations on Kubernetes.
The following table lists each file, what it holds, and the page that documents it.
| File | Purpose | Editable after init |
|---|---|---|
.env |
Secrets, image versions, and runtime parameters, generated by init.sh |
Yes. Applied by recreating the affected service with docker compose up -d <service>. Running init.sh again rewrites the file and keeps the secrets |
thehive-flow/config/thehive-flow.yml |
Application configuration | Yes. Applied by recreating the thehive-flow service with docker compose up -d --force-recreate thehive-flow |
thehive-flow/secret/ |
TheHive API key file, thehive-api-key, read at startup |
Yes. Applied by restarting the thehive-flow service. See Rotate secrets |
certificates/ |
Custom TLS certificate, private key, and certificate authority (CA) certificate, copied to nginx/certs/ by init.sh |
Yes. A new run of init.sh copies the new files, and an nginx restart applies them. See TLS certificate renewal |
temporal/config/temporal-server.yaml.template |
Temporal cluster configuration template | Yes, but rarely needed. The container reads temporal/config/temporal-server.yaml, which init.sh renders from this template with the database password filled in. An edit to the template takes effect after a new run of bash ./scripts/init.sh and a restart of the temporal service. The run also renews a self-signed certificate: see TLS certificate renewal |
temporal/config/dynamicconfig/production.yaml |
Temporal runtime knobs | Yes. Most knobs reload live. Three history cache keys need a restart: see Runtime knobs |
nginx/templates/default.conf.template |
Nginx reverse proxy configuration | Yes. Applied by restarting nginx |
nginx/docker-entrypoint.d/40-thehive-allow.sh |
Writes the list of addresses nginx accepts TheHive requests from, based on nginx_thehive_addresses at container start |
No. Editing nginx_thehive_addresses in .env and recreating nginx runs it again |
docker-compose.yml |
Service definitions: images, memory limits, published ports, and the variables passed to each container | Yes, for the limits and ports, applied with docker compose up -d. StrangeBee maintains the rest: see Upgrade TheHive Flow with Docker Compose |
../versions.env |
Image versions of every profile of the repository, maintained by StrangeBee | Not for routine changes. Upgrades move the pins, and init.sh copies them into .env. The one exception is a temporary pin move to apply a security patch before the next release, as described in Respond to a CVE |
docker-compose.override.yml |
Optional file created next to docker-compose.yml, which Docker Compose reads automatically, for environment variable overrides, extra volumes, or published ports |
Yes. Applied by recreating the affected service |