# 3pm-backend flags and environment `3pm-backend --help`: every flag, the environment variable that sets it, its default. ```text 3pm fleet backend: enrolls agents, ingests telemetry, serves the dashboard Usage: 3pm-backend [OPTIONS] Options: --listen Address to bind [env: THREEPM_BACKEND_LISTEN=] [default: 127.0.0.1:9616] --advertise Where agents connect (goes into the pasted `3pm link` line): `host:port`, or a URL whose scheme wins — `wss://fleet.example.com` behind a proxy that terminates TLS. Defaults to this machine's hostname and the listen port [env: THREEPM_BACKEND_ADVERTISE=] --db SQLite database path (created on first run) [env: THREEPM_BACKEND_DB=] [default: 3pm-backend.sqlite] --call-margin-ms Over a remote command's own timeout, the margin before this backend settles it (`unacked` / `lost`), ms: the agent's 5 s and the link's round trips [env: THREEPM_BACKEND_CALL_MARGIN_MS=] [default: 15000] --data-dir Where the files actions leave (profiles, dumps) are stored; default `.d/` next to the database [env: THREEPM_BACKEND_DATA_DIR=] --dev Development mode: clear-text HTTP/WS, and localhost is an acceptable advertise address [env: THREEPM_BACKEND_DEV=] --history-points Samples kept per process for the dashboard charts (1 Hz) [env: THREEPM_BACKEND_HISTORY_POINTS=] [default: 300] --stale-after-ms A node is `stale` after this many ms without a frame [env: THREEPM_BACKEND_STALE_AFTER_MS=] [default: 3000] --offline-after-ms A node is `offline` after this many ms without a frame [env: THREEPM_BACKEND_OFFLINE_AFTER_MS=] [default: 30000] --handshake-timeout-ms The link handshake (challenge → hello) must finish within this many ms, else 4408 `ERR_HANDSHAKE_TIMEOUT` [env: THREEPM_BACKEND_HANDSHAKE_TIMEOUT_MS=] [default: 10000] --ping-every-ms Ping every live link this often, ms [env: THREEPM_BACKEND_PING_EVERY_MS=] [default: 20000] --silence-ms A link without any frame (pongs count) for this many ms is closed [env: THREEPM_BACKEND_SILENCE_MS=] [default: 60000] --enroll-pending-per-ip Enrollment handshakes one client address may have pending at once; beyond it `/api/v1/enroll` answers `ERR_RATE_LIMITED` [env: THREEPM_BACKEND_ENROLL_PENDING_PER_IP=] [default: 16] --link-pending-per-ip Link handshakes one client address may have pending at once (an IPv6 one counted by its /64); beyond it `/api/v1/link` answers 503 `ERR_LINK_BUSY`. Behind a reverse proxy, without `--trust-proxy`, every agent is the proxy and shares it [env: THREEPM_BACKEND_LINK_PENDING_PER_IP=] [default: 64] --header-timeout-ms How long a connection may take to send its request headers before it is dropped (slowloris); `0` disables the timeout [env: THREEPM_BACKEND_HEADER_TIMEOUT_MS=] [default: 30000] --trust-proxy Peers whose `X-Forwarded-For` is believed (the reverse proxy in front, `127.0.0.1`): the per-address enrollment budget and the link logs then key on the client it names. Leave it empty when the port is reachable directly: anyone can send the header [env: THREEPM_BACKEND_TRUST_PROXY=] --registration Who may create an account (`POST /api/auth/register`): `closed` lets the first account in — it adopts every bucket without an owner — and no other; `open` lets anyone who reaches the port. `--dev` means `open` Possible values: - closed: The first account only - open: Anyone who reaches the port [env: THREEPM_BACKEND_REGISTRATION=] [default: closed] --direct Whether the bytes of a call between two LAN neighbours may go agent to agent (`on`), or always through this backend (`off`). Each node's own setting (`setNodeAccess.direct`) narrows it [env: THREEPM_BACKEND_DIRECT=] [default: on] [possible values: on, off] --cookie-secure Mark the session cookie `Secure`: set it when the dashboard is reached over HTTPS (behind a TLS proxy), so a browser never sends the cookie in clear text. Over plain HTTP a `Secure` cookie is never set, and nobody can log in [env: THREEPM_BACKEND_COOKIE_SECURE=] --metrics-url Base URL of the metrics engine (VictoriaMetrics, `http://127.0.0.1:8428`): the telemetry is persisted there. Unset: nothing is persisted [env: THREEPM_BACKEND_METRICS_URL=] --events-url Base URL of the events engine (VictoriaLogs, `http://127.0.0.1:9428`): process lifecycle events go there [env: THREEPM_BACKEND_EVENTS_URL=] --insights-url Base URL of the insights apps' `triage` (`http://127.0.0.1:9700`): `GET /api/buckets/{id}/insights` relays its ranked incidents. Unset: that route answers 409 `ERR_INSIGHTS_DISABLED` [env: THREEPM_BACKEND_INSIGHTS_URL=] --store-interval-ms Stored resolution, ms: one sample per series per interval (the engine's dedup interval must match). At least 1000 [env: THREEPM_BACKEND_STORE_INTERVAL_MS=] [default: 5000] --store-query-concurrency Chart queries in flight against the metrics engine at once; past it a query waits a few seconds, then answers 503 [env: THREEPM_BACKEND_STORE_QUERY_CONCURRENCY=] [default: 8] --store-query-cache-mb Memory the query cache may hold, MB: the engine's answers kept for a step (a minute at most), so the same chart refreshed by several viewers costs the engine one request. 0 turns it off [env: THREEPM_BACKEND_STORE_QUERY_CACHE_MB=] [default: 64] --app-metrics-every-s How often, in seconds, an agent asks its daemon for the application metrics that moved (`welcome.pace.metrics_s`: the pace of the `app/` sections); 0 reads as every tick [env: THREEPM_BACKEND_APP_METRICS_EVERY_S=] [default: 1] --trees-every-s How often, in seconds, an agent sends the figures of its apps' process trees (`welcome.pace.trees`: `figures`); 0 sends the shape only, when it changes (`shape`) [env: THREEPM_BACKEND_TREES_EVERY_S=] [default: 1] --state-every-s How often, in seconds, an agent sends what moved in its state — the host, the process table, the application metrics, the process trees — as one `state` frame (`welcome.pace.state_s`). 1 at least: the stream is the node's only one and its heartbeat, so `0` — which used to mean "the older streams" — is refused rather than read as something else [env: THREEPM_BACKEND_STATE_EVERY_S=] [default: 1] --blob-quota-mb Bytes of blobs one bucket may have in flight at once, MB [env: THREEPM_BACKEND_BLOB_QUOTA_MB=] [default: 4096] --blob-disk-mb Bytes every blob together may hold on disk, MB: a `file` blob spills only while a reader is behind, and this is the ceiling [env: THREEPM_BACKEND_BLOB_DISK_MB=] [default: 16384] --blob-window-mb How far a `PUT` may run ahead of the slowest reader of its blob, MB; past it the body simply stops being read [env: THREEPM_BACKEND_BLOB_WINDOW_MB=] [default: 64] --live-window-ms How much of a `live` blob the memory ring keeps, ms [env: THREEPM_BACKEND_LIVE_WINDOW_MS=] [default: 100] --blob-max-mb Where any one blob is cut, MB [env: THREEPM_BACKEND_BLOB_MAX_MB=] [default: 4096] -h, --help Print help (see a summary with '-h') -V, --version Print version ```