Configuration reference
Every setting that changes how PathWise runs, in one place. Most people never need to touch these.
Where settings live
Nearly everything lives in the web interface, on the Settings page, and persists in the engine's data directory, the volume you mount, so it survives a restart or an update. A few deployment-level values, like the data directory itself, come from environment variables set when you start the container.
The Settings panels
Settings is one page with seven panels, admin only.
- Engine. The verification loop: off, on for every diagnosis, or auto for high-confidence answers only, plus an optional webhook.
- Model. The reasoning engine: a frontier preset, a local Ollama model, or your own endpoint, each with its own key and a Test connection button. See the reasoning engine.
- Network. Where the PathWise web server listens, behind your reverse proxy in most deployments.
- Environment. How your network is shaped, so probes see it the way your users' machines do: DNS servers, a public comparison resolver, search suffixes, an egress proxy, and an optional probe target allowlist. Every field is optional, and changes take effect on the next investigation.
- Modules. The installed module list, with a reload button that picks up added or removed modules without a restart. Each module shows an on-off switch. Switch one off and it stops loading, so it takes no part in investigations and frees its module slot. It stays listed so you can switch it back on. A module that declares a live door, such as the Check Point Management API, shows fields to set its endpoint and store its credential, with a Test Connection button. See installing modules.
- Users. Accounts and approval. New teammates register and wait for an admin to approve them, within what your license seats allow.
- License. Apply your license file and see what it covers.
Every setting, in one table
The table below lists every editable value, what it does, its default, and its accepted values. Network host, port, and TLS changes take effect after a restart. Environment and model changes take effect on the next investigation.
| Panel | Setting | What it does | Default | Allowed values |
|---|---|---|---|---|
| Engine | Verification loop | Runs a second pass that can hold or lower confidence. | Auto | Off, On, Auto |
| Engine | Webhook URL | Posts an investigation summary after a run finishes or fails. | Blank, disabled | Blank, or an http: or https: URL |
| Engine | Webhook secret | Sends x-pathwise-secret with the webhook. | Blank | Any string. Blank clears the stored secret |
| Model | Reasoning engine | Selects the model tier. | Frontier preset, Anthropic active | Local (Ollama), Frontier preset, Your own LLM |
| Model | Local endpoint | Sets the OpenAI-compatible local endpoint. | http://localhost:11434/v1 | A URL |
| Model | Local model | Sets the local model name. | llama3.1:8b | Any nonblank model identifier |
| Model | Frontier preset | Selects a pinned provider and model. | Anthropic Claude | Anthropic Claude, OpenAI GPT, xAI Grok, Google Gemini, DeepSeek |
| Model | Cost tier | Picks the model within the Anthropic ladder by cost. | Balanced (Sonnet 5) | Best (Opus 4.8), Balanced (Sonnet 5), Economy (Haiku 4.5) |
| Model | Automatic escalation | Re-runs an inconclusive investigation once on the best model. | On | On, Off |
| Model | Frontier API key | Stores the selected provider key. | No key saved | Any nonblank string. Blank keeps the saved key |
| Model | Custom endpoint | Sets a user-chosen OpenAI-compatible endpoint. | Blank | A URL |
| Model | Custom model | Sets the custom model identifier. | Blank | Any nonblank model identifier |
| Model | Custom API key (optional) | Stores the custom endpoint key. | Blank | Any nonblank string. Blank keeps the saved key |
| Network | Host | Sets the web-server bind interface. | 127.0.0.1 | A host value |
| Network | Port | Sets the web-server port. | 7180 | Whole number from 1 through 65535 |
| Network | Terminate TLS in the app | Stores the app TLS flag. | Off | On or off |
| Environment | DNS Server 1, 2, 3 | Sets resolver addresses in order. | Blank | Up to three resolver addresses |
| Environment | Public DNS for comparison | Sets the split-horizon comparison resolver. | Blank, probes use 1.1.1.1 | A resolver address |
| Environment | DNS search suffixes | Expands short names with each suffix. | Blank | Comma-separated or line-separated suffixes |
| Environment | Egress HTTP proxy | Routes the HTTP probe through a proxy. | Blank, direct | A proxy address |
| Environment | Allowed target scope | Restricts which targets probes can touch. | Blank, no restriction | Domains and IPv4 CIDRs, comma-separated or one per line |
| Modules | Modules directory | Sets the folder loaded at boot and reload. | modules | Nonblank path. Blank restores the default |
| Modules | Per-module switch | Enables or disables a module. A disabled module does not load, takes no part in investigations, and frees its module slot. | Enabled | On or off |
| Modules | Connection endpoint and credential | For a module with a live API or MCP door, sets the endpoint and the name of a stored credential. Only the credential name lives here; the value is stored encrypted. | Blank | A URL and a credential name |
| Users | Per-user role | Sets an approved user's role. New registrations start pending. | Pending, no role | admin, approver, user |
| License | License input | Installs or replaces a license, or applies a renewal code. | Unlicensed | A pasted PathWise license or renewal block, or an uploaded license.json |
Networking and probes
Some network checks need host-level permissions. Those are covered under System requirements.