Configuration

Most settings are in the app under Settings (administrators). A few that decide how Cerberon is reached are set on the machine, through the installer.

Settings in the app

Page	What you set there
Organisation	Your organisation's details, shown on reports
Access	Sign-in methods, single sign-on, API tokens
Scanning	Scan defaults, Git hosts, remediation time targets (SLA)
Reporting	Report templates, report signing, the author shown on reports
AI	The AI provider used by agent-assisted scans and AI review
Privacy and network	What leaves the machine, and which outbound addresses are reachable
Integrations	Webhook notifications
Data	How long scans and reports are kept (data and retention)
Licence and updates	Licence, machine ID, updates (licence, updates)
System	Machine resources, services, scanner tools

Your own domain and certificate

By default Cerberon serves HTTPS on port 443 with its own certificate, at the machine's domain name when it has one, otherwise its IP address. On a cloud server the public address belongs to the provider's network, not the machine, so the installer shows the private one: set your DNS name as below. To use your own name and certificate, have the certificate and its key as PEM files on the machine (readable by your account), then run the installer as an upgrade:

CERBERON_BASE_URL=https://cerberon.example.com \
CERBERON_TLS_CERT=/etc/cerberon/cert.pem \
CERBERON_TLS_KEY=/etc/cerberon/key.pem \
sh install.sh --upgrade --change-posture

CERBERON_BASE_URL is the address people open; Cerberon builds links and sign-in addresses from it.
--change-posture is required to change the address of an existing installation.
Point your DNS name at the machine. The installer's final check says whether the address answers.
Your data, users and licence are kept. Renewing the certificate later: replace the files and run sh install.sh --upgrade again.

Behind your own reverse proxy

If a reverse proxy or load balancer on the same machine serves your domain, Cerberon can listen on plain HTTP on 127.0.0.1 only, behind it:

CERBERON_EXPOSURE=fronted CERBERON_PORT=8741 CERBERON_BASE_URL=https://cerberon.example.com \
sh install.sh --upgrade --change-posture

Your proxy uses port 443, so give Cerberon another port (for example CERBERON_PORT=8741) and point the proxy at http://127.0.0.1:8741. Cerberon then trusts the proxy's X-Forwarded-Proto and X-Forwarded-Host headers.

Single sign-on

Settings → Access → Single sign-on supports Google, Microsoft Entra ID, any other OpenID Connect provider, and SAML 2.0.

Set your own domain first (above). Sign-in providers expect a domain name, not an IP address, and the browser must trust the certificate.
Open the provider you use in Cerberon. It shows the exact redirect (OIDC) or ACS and entity ID (SAML) addresses to register with your provider, built from your address.
Register Cerberon with the provider, then enter the client ID and secret (OIDC) or the provider's metadata (SAML) in Cerberon.
Sign in with SSO in a second browser before turning off password sign-in.

For Microsoft Entra ID, use your tenant's issuer, https://login.microsoftonline.com/<tenant id>/v2.0, to admit only your organisation.

Port

Cerberon uses port 443, the standard HTTPS port. If another program already uses it, the installer stops and says so; it never picks another port by itself. To use another port, run the installer with CERBERON_PORT:

CERBERON_PORT=9443 sh install.sh --upgrade --change-posture

On Windows, set CERBERON_PORT before running the Windows installer; the firewall rule and the port forward follow it.

Outbound proxy

If the machine reaches the internet through a proxy, set HTTP_PROXY, HTTPS_PROXY and NO_PROXY before running the installer; they are passed to the scanner build. Which outbound addresses Cerberon itself may reach is shown and controlled under Settings → Privacy and network.

AI provider

Agent-assisted scans (DAST, penetration test, cloud, Kubernetes) and AI review need an AI provider: Settings → AI. Until one is set, those scans are refused with that reason. Settings → Privacy and network controls what is redacted before anything is sent to the provider.