Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/webhood-io/webhood/llms.txt

Use this file to discover all available pages before exploring further.

Webhood is configured through a .env file located at the project root. Docker Compose reads this file automatically at startup and injects the values into the appropriate containers. Most variables are optional and have sensible defaults — only SCANNER_TOKEN must be set before the scanner can connect to the backend.
SCANNER_TOKEN must be set before the scanner container will successfully authenticate with the backend. Generate a token from the Settings page in the Webhood UI after your first boot, then add it to your .env file and restart the stack.

​
Complete .env Example

############
# Required configuration
############

SCANNER_TOKEN=your-scanner-token-here

############
# Optional configuration
############

EXTERNAL_URL=

# SCANNER_LOG_LEVEL is one of debug, info, warn, error, fatal
SCANNER_LOG_LEVEL=info

# SCANNER_NO_PRIVATE_IPS is one of true, false
SCANNER_NO_PRIVATE_IPS=false

WEBHOOD_HTTP_PORT=8000
WEBHOOD_HTTPS_PORT=8443
WEBHOOD_TLS_CERT=
WEBHOOD_TLS_KEY=

HTTP_PROXY=
HTTPS_PROXY=
NO_PROXY=

​
Variables

​
Authentication

​
SCANNER_TOKEN
string
required
The token the scanner uses to authenticate with the Webhood backend. Generate this token from Settings → General in the web UI after the first boot. The scanner container will not connect until this value is set.

​
Backend URL

​
EXTERNAL_URL
string
The URL that the core container uses to reach the backend API (passed as the API_URL environment variable on the core service). When left blank, the core service will not have a backend URL configured. Set this to the externally accessible URL of your Webhood instance — for example, if you are hosting Webhood behind a reverse proxy at a public domain.
EXTERNAL_URL=https://webhood.example.com

​
Scanner Behavior

​
SCANNER_LOG_LEVEL
string
default:"info"
Controls the verbosity of scanner log output. Accepted values are debug, info, warn, error, and fatal. Increase to debug when troubleshooting scan failures; use warn or error in production to reduce noise.
​
SCANNER_NO_PRIVATE_IPS
boolean
default:"false"
When set to true, the scanner will refuse to scan URLs that resolve to private or RFC 1918 IP addresses (e.g. 192.168.x.x, 10.x.x.x, 172.16.x.x). Enable this in public-facing deployments to prevent server-side request forgery (SSRF) attacks.

​
Port Bindings

​
WEBHOOD_HTTP_PORT
number
default:"8000"
The host port that Kong binds for HTTP traffic. Change this if port 8000 is already in use on your host.
WEBHOOD_HTTP_PORT=8080
​
WEBHOOD_HTTPS_PORT
number
default:"8443"
The host port that Kong binds for HTTPS traffic. Only relevant when TLS certificates are provided via WEBHOOD_TLS_CERT and WEBHOOD_TLS_KEY.
WEBHOOD_HTTPS_PORT=443

​
TLS Certificates

​
WEBHOOD_TLS_CERT
string
Absolute path on the host to a PEM-encoded TLS certificate file. Docker Compose mounts this file read-only into the Kong container. When set, Kong enables HTTPS using this certificate. See TLS & Proxy for a full setup guide.
WEBHOOD_TLS_CERT=/etc/ssl/certs/webhood.crt
​
WEBHOOD_TLS_KEY
string
Absolute path on the host to the PEM-encoded private key that corresponds to WEBHOOD_TLS_CERT. Both WEBHOOD_TLS_CERT and WEBHOOD_TLS_KEY must be set together for TLS to be enabled.
WEBHOOD_TLS_KEY=/etc/ssl/private/webhood.key

​
HTTP Proxy

​
HTTP_PROXY
string
Standard proxy environment variable forwarded directly to the scanner container. Use this to route all scanner HTTP traffic through a network proxy.
HTTP_PROXY=http://proxy.example.com:3128
​
HTTPS_PROXY
string
Same as HTTP_PROXY but applies to HTTPS connections made by the scanner.
HTTPS_PROXY=http://proxy.example.com:3128
​
NO_PROXY
string
A comma-separated list of hostnames or IP addresses that the scanner should contact directly, bypassing the proxy. Always include internal service names such as backend and kong to prevent internal API traffic from being routed through an external proxy.
NO_PROXY=backend,kong,localhost,127.0.0.1

Build docs developers (and LLMs) love

Get started for freeTalk to us