OMNI-GRC

Configuration Guide

Complete configuration reference for OMNI-GRC including environment variables, settings, integrations, and security options.

Environment Variables
Database Configuration
Authentication Settings
AI Provider Configuration
Scanner Configuration
Notification Channels
Organization Settings
Security Settings
Performance Tuning

Environment Variables

All environment variables should be defined in .env.local file in the project root.

###Core Settings

# Application Environment
NODE_ENV=development              # development | production | test
PORT=3000                         # Application port
HOST=0.0.0.0                     # Bind address

# Application URL
NEXT_PUBLIC_APP_URL=http://localhost:3000

Database Configuration

# PostgreSQL Connection
DATABASE_URL="postgresql://username:password@localhost:5432/omni_grc"

# Connection Pool Settings (optional)
DATABASE_POOL_MIN=2
DATABASE_POOL_MAX=10
DATABASE_CONNECTION_TIMEOUT=30000
DATABASE_IDLE_TIMEOUT=30000

Connection String Format:

postgresql://[user[:password]@][host][:port][/dbname][?param1=value1&...]

SSL Connection:

DATABASE_URL="postgresql://user:pass@host:5432/dbname?sslmode=require"

Authentication (NextAuth.js)

# NextAuth Configuration
NEXTAUTH_SECRET="your-secret-key-minimum-32-characters-long"
NEXTAUTH_URL="http://localhost:3000"

# Session Settings
NEXTAUTH_SESSION_MAX_AGE=2592000     # 30 days in seconds
NEXTAUTH_SESSION_UPDATE_AGE=86400    # Update every 24 hours

Generate Secret:

openssl rand -base64 32

OAuth Providers

Google OAuth

GOOGLE_CLIENT_ID=your-google-client-id.apps.googleusercontent.com
GOOGLE_CLIENT_SECRET=your-google-client-secret

Setup:

Go to Google Cloud Console
Create OAuth 2.0 credentials
Add redirect URI: http://localhost:3000/api/auth/callback/google

GitHub OAuth

GITHUB_CLIENT_ID=your-github-client-id
GITHUB_CLIENT_SECRET=your-github-client-secret

Setup:

Go to GitHub Settings → Developer settings → OAuth Apps
Create New OAuth App
Add callback URL: http://localhost:3000/api/auth/callback/github

AI Provider Configuration

Configure at least one AI provider for automated analysis.

OpenAI

OPENAI_API_KEY=sk-proj-...your-openai-api-key
OPENAI_MODEL=gpt-4                   # gpt-4 | gpt-3.5-turbo
OPENAI_MAX_TOKENS=2000
OPENAI_TEMPERATURE=0.7
OPENAI_ORGANIZATION=org-...          # Optional

Models:

gpt-4 - Best quality, higher cost
gpt-3.5-turbo - Faster, lower cost

Anthropic Claude

ANTHROPIC_API_KEY=sk-ant-...your-anthropic-key
ANTHROPIC_MODEL=claude-3-opus-20240229  # or claude-3-sonnet, claude-3-haiku
ANTHROPIC_MAX_TOKENS=4000
ANTHROPIC_TEMPERATURE=0.7

Models:

claude-3-opus - Most capable
claude-3-sonnet - Balanced
claude-3-haiku - Fastest

Ollama (Self-Hosted)

OLLAMA_BASE_URL=http://localhost:11434
OLLAMA_MODEL=mistral                 # mistral | llama2 | codellama | phi

Setup Ollama:

# Install Ollama
curl https://ollama.ai/install.sh | sh

# Pull a model
ollama pull mistral

Background Jobs (Optional)

# Redis Configuration
REDIS_URL=redis://localhost:6379
REDIS_PASSWORD=                      # If password protected
REDIS_TLS_ENABLED=false

# Job Queue Settings
QUEUE_CONCURRENCY=5
QUEUE_MAX_RETRIES=3
QUEUE_RETRY_DELAY=5000              # milliseconds

Email Configuration

# SMTP Settings
SMTP_HOST=smtp.gmail.com
SMTP_PORT=587
SMTP_SECURE=false                   # true for 465, false for other ports
SMTP_USER=your-email@gmail.com
SMTP_PASSWORD=your-app-password
SMTP_FROM=noreply@yourdomain.com
SMTP_FROM_NAME="OMNI-GRC"

Gmail Setup:

Enable 2-factor authentication
Generate App Password
Use App Password as SMTP_PASSWORD

File Storage

# Local Storage
STORAGE_TYPE=local                  # local | s3 | minio
STORAGE_PATH=./uploads

# S3/MinIO (if using S3-compatible storage)
S3_ENDPOINT=https://s3.amazonaws.com
S3_REGION=us-east-1
S3_BUCKET=omni-grc-uploads
S3_ACCESS_KEY_ID=your-access-key
S3_SECRET_ACCESS_KEY=your-secret-key

Logging

# Log Level
LOG_LEVEL=info                      # error | warn | info | debug | trace

# Log Format
LOG_FORMAT=json                     # json | pretty

# Log Files
LOG_FILE_ENABLED=true
LOG_FILE_PATH=./logs/omni-grc.log
LOG_FILE_MAX_SIZE=10485760         # 10MB in bytes
LOG_FILE_MAX_FILES=10

Security Headers

# CORS Configuration
CORS_ORIGIN=http://localhost:3000
CORS_CREDENTIALS=true

# Content Security Policy
CSP_ENABLED=true
CSP_REPORT_ONLY=false

# Rate Limiting
RATE_LIMIT_ENABLED=true
RATE_LIMIT_WINDOW=900000           # 15 minutes in ms
RATE_LIMIT_MAX_REQUESTS=100

Database Configuration

Connection Pooling

Optimize database connections:

// prisma.config.ts
export default defineConfig({
  datasource: {
    url: process.env.DATABASE_URL,
  },
  // Connection pool settings
  pool: {
    min: 2,
    max: 10,
    acquireTimeoutMillis: 30000,
    idleTimeoutMillis: 30000,
  },
});

Performance Settings

PostgreSQL Configuration (postgresql.conf):

# Memory Settings
shared_buffers = 256MB
effective_cache_size = 1GB
work_mem = 16MB

# Connection Settings
max_connections = 100

# Logging
log_statement = 'all'
log_min_duration_statement = 1000  # Log slow queries (>1s)

Backup Configuration

# Daily backup script
#!/bin/bash
pg_dump -h localhost -U omni_grc_user omni_grc > backup-$(date +%Y%m%d).sql

Authentication Settings

Password Policy

Configure in Settings → Security:

Minimum length: 8-32 characters
Require uppercase: Yes/No
Require lowercase: Yes/No
Require numbers: Yes/No
Require special characters: Yes/No
Password expiration: 90 days

Multi-Factor Authentication (MFA)

Enable MFA for enhanced security:

Go to Settings → Security
Toggle “Require MFA for all users”
Users will be prompted to set up authenticator app

Supported MFA Methods:

Authenticator apps (Google Authenticator, Authy)
SMS (if configured)

Session Management

# Session timeout (seconds)
SESSION_TIMEOUT=1800                # 30 minutes

# Remember me duration (seconds)
REMEMBER_ME_DURATION=2592000        # 30 days

# Concurrent sessions per user
MAX_CONCURRENT_SESSIONS=3

Single Sign-On (SSO)

Enable SSO in Settings → Security → SSO Settings:

Toggle “Enable SSO”
Configure OAuth providers (Google, GitHub)
Set default role for SSO users
Map OAuth attributes to user fields

AI Provider Configuration

Provider Selection

Configure AI provider in Settings → Integrations → AI Provider:

OpenAI
- API Key
- Model selection (GPT-4 recommended)
- Max tokens
- Temperature
Anthropic Claude
- API Key
- Model selection (Claude 3 Opus recommended)
- Max tokens
Ollama (Self-Hosted)
- Base URL
- Model name
- No API key required

AI Features Configuration

// AI feature toggles
AI_FEATURES = {
  findingAnalysis: true,      // Analyze security findings
  complianceAssessment: true, // Assess control compliance
  reportGeneration: true,     // Generate AI reports
  remediationSuggestions: true, // Suggest fixes
  riskScoring: true          // AI-powered risk scoring
}

Cost Management

OpenAI Cost Estimation:

GPT-4: ~$0.03 per 1K input tokens, ~$0.06 per 1K output tokens
GPT-3.5-turbo: ~$0.0005 per 1K tokens

Budget Controls:

AI_MONTHLY_BUDGET=100              # USD
AI_ALERT_THRESHOLD=80              # Alert at 80% of budget
AI_AUTO_DISABLE_AT_LIMIT=true

Scanner Configuration

Scanner Registry

Each scanner needs to be configured with proper credentials and paths.

Container Scanners

Trivy:

TRIVY_PATH=/usr/local/bin/trivy
TRIVY_DB_REPOSITORY=ghcr.io/aquasecurity/trivy-db
TRIVY_CACHE_DIR=~/.cache/trivy

Grype:

GRYPE_PATH=/usr/local/bin/grype
GRYPE_DB_AUTO_UPDATE=true

Cloud Scanners

Prowler (AWS):

AWS_PROFILE=default
AWS_REGION=us-east-1
AWS_ACCESS_KEY_ID=your-access-key
AWS_SECRET_ACCESS_KEY=your-secret-key
PROWLER_PATH=/usr/local/bin/prowler

ScoutSuite:

SCOUTSUITE_PATH=/usr/local/bin/scout
SCOUTSUITE_REPORT_DIR=./scout-reports

Secret Scanners

Gitleaks:

GITLEAKS_PATH=/usr/local/bin/gitleaks
GITLEAKS_CONFIG=/path/to/gitleaks.toml

TruffleHog:

TRUFFLEHOG_PATH=/usr/local/bin/trufflehog

SAST Scanners

Semgrep:

SEMGREP_PATH=/usr/local/bin/semgrep
SEMGREP_RULES=p/security-audit
SEMGREP_TIMEOUT=1800              # 30 minutes

Bandit (Python):

BANDIT_PATH=/usr/local/bin/bandit
BANDIT_CONFIG=.bandit.yml

Scanner Defaults

Configure default scanner settings in Settings → Integrations → Scanners:

Default timeout: 30 minutes
Max concurrent scans: 5
Auto-retry failed scans: Yes
Retain scan logs: 30 days

Notification Channels

Email Notifications

Configure in Settings → Notifications:

{
  "email": {
    "enabled": true,
    "recipients": ["security@company.com"],
    "includeDetails": true,
    "attachReports": false
  }
}

Slack Integration

Create Slack App at api.slack.com/apps
Add Incoming Webhook
Configure in OMNI-GRC:

SLACK_WEBHOOK_URL=https://hooks.slack.com/services/T00/B00/XXX
SLACK_CHANNEL=#security-alerts
SLACK_USERNAME=OMNI-GRC
SLACK_ICON_EMOJI=:shield:

Microsoft Teams

TEAMS_WEBHOOK_URL=https://outlook.office.com/webhook/xxx

PagerDuty

PAGERDUTY_INTEGRATION_KEY=your-integration-key
PAGERDUTY_SERVICE_ID=your-service-id

Custom Webhooks

{
  "webhook": {
    "url": "https://your-endpoint.com/alerts",
    "method": "POST",
    "headers": {
      "Authorization": "Bearer token",
      "Content-Type": "application/json"
    },
    "retries": 3,
    "timeout": 5000
  }
}

Organization Settings

General Settings

Configure in Settings → General:

Organization name
Logo upload
Timezone (for scheduling)
Date format
Default language

Enabled Frameworks

Select which compliance frameworks to track:

☑ SOC 2 Type II
☑ ISO 27001:2022
☑ HIPAA
☑ PCI-DSS 4.0
☑ NIST CSF 2.0
☐ GDPR
☐ FedRAMP Rev 5
☐ CMMC 2.0 L2

User Management

Invitation expiration: 7 days
Default new user role: Viewer
Require email verification: Yes
Allow self-service password reset: Yes

Security Settings

API Keys

Generate API keys for programmatic access:

Go to Settings → API Keys
Click “Generate New Key”
Set permissions and expiration
Copy key (shown only once)

Usage:

curl -H "Authorization: Bearer your-api-key" \
     https://grc.company.com/api/scans

IP Whitelist

Restrict access by IP:

IP_WHITELIST=10.0.0.0/8,192.168.1.0/24,1.2.3.4

Audit Logging

AUDIT_LOG_ENABLED=true
AUDIT_LOG_RETENTION_DAYS=365
AUDIT_LOG_INCLUDE_READ_OPERATIONS=false

Audit log captures:

User authentication
Data modifications
Configuration changes
Permission changes
Failed access attempts

Data Encryption

# Encryption at rest
DATABASE_ENCRYPTION_ENABLED=true
DATABASE_ENCRYPTION_KEY=your-encryption-key

# Encryption in transit
TLS_ENABLED=true
TLS_CERT_PATH=/path/to/cert.pem
TLS_KEY_PATH=/path/to/key.pem

Performance Tuning

Caching

# Redis caching
CACHE_ENABLED=true
CACHE_TTL=3600                    # 1 hour in seconds
CACHE_PREFIX=omni-grc:

# Cache specific data
CACHE_DASHBOARD_STATS=true
CACHE_COMPLIANCE_SCORES=true
CACHE_FINDING_COUNTS=true

Database Indexing

Ensure critical indexes exist:

-- Findings table
CREATE INDEX idx_findings_severity ON findings(severity);
CREATE INDEX idx_findings_status ON findings(status);
CREATE INDEX idx_findings_target ON findings(target);

-- Scans table
CREATE INDEX idx_scans_status ON scans(status);
CREATE INDEX idx_scans_scanner ON scans(scanner);

Query Optimization

# Pagination defaults
DEFAULT_PAGE_SIZE=50
MAX_PAGE_SIZE=100

# Query timeouts
QUERY_TIMEOUT=30000              # 30 seconds in ms

Load Balancing

For high-availability deployments:

# nginx.conf
upstream omni_grc {
    server 10.0.1.10:3000;
    server 10.0.1.11:3000;
    server 10.0.1.12:3000;
}

server {
    listen 80;
    server_name grc.company.com;
    
    location / {
        proxy_pass http://omni_grc;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

Next Steps

Installation Guide - Setup instructions
CLI Guide - Command-line interface
Scanner Integration - Configure scanners
Troubleshooting - Common issues

Security Note: Never commit .env.local file to version control. Use environment-specific configuration management tools like AWS Secrets Manager, HashiCorp Vault, or similar for production deployments.

OMNI-GRC

Configuration Guide

Table of Contents

Environment Variables

Database Configuration

Authentication (NextAuth.js)

OAuth Providers

Google OAuth

GitHub OAuth

AI Provider Configuration

OpenAI

Anthropic Claude

Ollama (Self-Hosted)

Background Jobs (Optional)

Email Configuration

File Storage

Logging

Security Headers

Database Configuration

Connection Pooling

Performance Settings

Backup Configuration

Authentication Settings

Password Policy

Multi-Factor Authentication (MFA)

Session Management

Single Sign-On (SSO)

AI Provider Configuration

Provider Selection

AI Features Configuration

Cost Management

Scanner Configuration

Scanner Registry

Container Scanners

Cloud Scanners

Secret Scanners

SAST Scanners

Scanner Defaults

Notification Channels

Email Notifications

Slack Integration

Microsoft Teams

PagerDuty

Custom Webhooks

Organization Settings

General Settings

Enabled Frameworks

User Management

Security Settings

API Keys

IP Whitelist

Audit Logging

Data Encryption

Performance Tuning

Caching

Database Indexing

Query Optimization

Load Balancing

Next Steps