Adapters

32 adapters in 13 categories. Add one in the console under System > Adapters, or with pando adapter add. Settings marked Credential are stored encrypted and never shown again.

Find an adapter, provider or setting

Identity

OpenID Connectoidc

issuerIssuer URLRequired

The provider's issuer. Pando reads <issuer>/.well-known/openid-configuration for the rest.

string · For example https://example.okta.com

client_idClient IDRequired

The client ID of the web application you registered for Pando.

string

client_secretClient secretCredential

The application's client secret. Stored encrypted and never shown again.

string

scopesScopes

Space-separated. Add groups if your provider needs a scope to send them.

string · Default openid email profile

groups_claimGroups claim

The claim that lists the person's groups. Each one becomes a synced group in Pando.

string · Default groups

subject_claimSubject claim

The claim that identifies a person and never changes. Microsoft Entra ID needs oid.

string · Default sub

username_claimUsername claim

The claim holding the person's username in Pando.

string · Default preferred_username

email_claimEmail claim

The claim holding the person's email address.

string · Default email

name_claimName claim

The claim holding the person's display name. When it is empty, given_name and family_name are used.

string · Default name

hosted_domainGoogle Workspace domain

Only accept Google accounts from this domain. Without it, anyone with a Google account can sign in.

string · For example example.com

promptPrompt

Ask the provider to always show its sign-in form or account chooser.

(empty) Provider's choice
login Always ask for credentials
select_account Always offer an account choice

one of the values above

disable_userinfoSkip the userinfo endpoint

Use only the ID token's claims. By default Pando fills in missing claims from userinfo.

bool

session_max_lifetimeSession length

How long a sign-in lasts. Without SCIM this is also how long access can outlive its removal at the provider.

string · Default 12h

Presets

Okta In Okta, create an OIDC Web Application, set its sign-in redirect URI to the one Pando shows, and assign it to people. Add a groups claim (Filter: Matches regex .*) to send groups.
Microsoft Entra ID In Entra, register an application with a Web redirect URI set to the one Pando shows, create a client secret, and add the groups claim under Token configuration. Entra does not vouch for email addresses, so accounts are never linked by email.
Google Workspace In Google Cloud, create an OAuth client of type Web application with the redirect URI Pando shows. Google sends no groups; use SCIM or Pando groups for access.
Keycloak In the realm, create an OpenID Connect client with client authentication on and the redirect URI Pando shows. Add a Group Membership mapper named groups, with Full group path off.
Authentik Create an OAuth2/OpenID Provider with a confidential client and the redirect URI Pando shows, and an application using it. Authentik sends groups in the profile scope.

SAML 2.0saml

idp_metadata_urlProvider metadata URL

Where the provider publishes this application's metadata. Pando re-reads it daily, so certificate rollovers are followed.

string · For example https://example.okta.com/app/…/sso/saml/metadata

idp_metadata_xmlProvider metadata XML

Or paste the metadata instead of giving a URL.

string

name_id_formatNameID format

What Pando asks the provider to identify people by. The NameID must never change for a person.

(empty) Unspecified — Whatever the provider is set to send.
persistent Persistent — An opaque ID that never changes.
email Email address

one of the values above

groups_attributeGroups attribute

The attribute listing the person's groups. Empty tries groups, memberOf, member and Microsoft's groups claim.

string

subject_attributeSubject attribute

Identify people by this attribute instead of the NameID.

string

email_attributeEmail attribute

Empty tries email, mail and Microsoft's emailaddress claim.

string

name_attributeName attribute

Empty tries displayName, name, and first and last name.

string

username_attributeUsername attribute

The attribute holding the person's username in Pando. Empty tries username, uid, login and Microsoft's name claim.

string

trust_emailThe provider's email addresses are verified

Only if people cannot set their own email in the provider. Needed to link accounts by email.

bool

allow_idp_initiatedAllow sign-in from the provider's dashboard

Off is safer: a sign-in the provider starts is not tied to the browser that presents it.

bool

session_max_lifetimeSession length

How long a sign-in lasts. Without SCIM this is also how long access can outlive its removal at the provider.

string · Default 12h

Presets

Okta In Okta, create a SAML 2.0 app. Single sign-on URL is Pando's ACS URL; Audience URI is Pando's entity ID. Add attribute statements email, displayName, and a group attribute statement groups (Matches regex .*). Then paste the app's Metadata URL here.
Microsoft Entra ID In Entra, create an enterprise application with SAML. Identifier is Pando's entity ID, Reply URL is the ACS URL. Add a group claim. Paste the App Federation Metadata Url here.
Google Workspace In the Admin console, add a custom SAML app. ACS URL and Entity ID are Pando's. Map Primary email to email and group membership to groups. Download the IdP metadata and paste it here.
Keycloak Create a SAML client whose Client ID is Pando's entity ID and whose valid redirect URI is the ACS URL. Add a Group list mapper named groups. The metadata is at /realms/<realm>/protocol/saml/descriptor.
Authentik Create a SAML Provider with Pando's ACS URL and entity ID as audience, and an application using it. Its metadata can be downloaded from the provider page.

Routing

Cloudflare Tunnelcloudflare

Gives apps their own hostnames through a Cloudflare Tunnel. Nothing on this machine needs to be reachable from the internet, and Cloudflare issues the certificates.

api_tokenAPI tokenRequiredCredential

In Cloudflare, go to My Profile, API Tokens, Create Token, Create Custom Token. Permissions: Account / Cloudflare Tunnel / Edit; Zone / DNS / Edit; Zone / Zone / Read. Account Resources: your account. Zone Resources: the zone below. Pando uses it to create the tunnel and to point each app's hostname at it.

string

account_idAccount IDRequired

Shown on the account's overview page in Cloudflare's dashboard.

string · For example 0123456789abcdef0123456789abcdef

zoneZoneRequired

Your domain in Cloudflare. Apps are served at <app>.<zone>.

string · For example example.com

console_hostnameConsole hostname

Where the console is served, and the hostname apps on a path are served under. Empty is the zone itself.

string · For example pando.example.com

tunnel_idExisting tunnelAdvanced

Leave empty and Pando creates a tunnel of its own. Or give a tunnel's ID to use that one: Pando adds its rules and leaves the rest alone.

string · Default A tunnel of Pando's own

imagecloudflared imageAdvanced

Set to run a different cloudflared release than this Pando ships with.

string · Default cloudflare/cloudflared:2025.1.0

Built inloopback

Serves apps from Pando itself, on a path or a port.

base_urlBase URL

The address apps are reached at.

string · Default The address each request arrives on

Traefiktraefik

Gives apps their own hostnames through a Traefik Pando runs on ports 80 and 443, with certificates.

base_domainBase domain

Apps are served at <app>.<base domain>. Point this domain and *.<base domain> at this machine.

string · For example apps.example.com

console_hostnameConsole hostname

Where the console is served over HTTPS. Any hostname pointed at this machine that is not an app's shows the console; this is the one a certificate is issued for.

string · For example pando.example.com

certificatesCertificates

http One per hostname — Let's Encrypt checks each hostname over port 80, which has to be reachable from the internet.
dns One wildcard for the base domain — Covers every app before it exists. Needs your DNS provider's credentials.
none None — Apps are served over plain HTTP on port 80.

one of the values above · Default none

acme_emailCertificate email

The address Let's Encrypt registers the certificates to.

string · For example [email protected] · Used when certificates is http or dns

dns_providerDNS provider

Who hosts the base domain's DNS. Choose Other for any provider Traefik supports, and enter its code, such as gcloud or ovh.

cloudflare Cloudflare
route53 Amazon Route 53
digitalocean DigitalOcean
porkbun Porkbun
namecheap Namecheap
or another value

one of the values above · Used when certificates is dns

dns_credentialsDNS provider credentialsCredential

One NAME=value per line. Cloudflare: CF_DNS_API_TOKEN, or CF_API_EMAIL and CF_API_KEY. Amazon Route 53: AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. DigitalOcean: DO_AUTH_TOKEN. Porkbun: PORKBUN_API_KEY and PORKBUN_SECRET_API_KEY. Namecheap: NAMECHEAP_API_USER and NAMECHEAP_API_KEY. For another provider, the variables Traefik's documentation lists for it.

string · Used when certificates is dns

managedPando runs Traefik

Off if this machine already runs a Traefik that should serve Pando's apps. Pando then only writes route files into the directory that Traefik watches.

bool · Default true

http_portHTTP portAdvanced

The host port Traefik takes for HTTP.

int · Default 80 · Used when managed is true

https_portHTTPS portAdvanced

The host port Traefik takes for HTTPS.

int · Default 443 · Used when managed is true

imageTraefik imageAdvanced

Set to run a different Traefik release than this Pando ships with.

string · Default traefik:v3.2 · Used when managed is true

deliveryRoute deliveryAdvanced

How routes reach Traefik. Use IngressRoutes with the Kubernetes runtime.

shared_mount Files — Route files in a directory Traefik mounts. The Docker runtime.
kubernetes_api IngressRoutes — IngressRoute objects Traefik watches in the cluster's API. The Kubernetes runtime.

one of the values above · Default shared_mount

namespaceIngressRoute namespaceAdvanced

The namespace Pando writes IngressRoute objects to, which Traefik watches.

string · Default pando-edge · Used when delivery is kubernetes_api

kubeconfigKubeconfig fileAdvanced

A kubeconfig file, for reaching the cluster from outside it.

string · Default The cluster Pando runs in · Used when delivery is kubernetes_api

api_qpsAPI requests a secondAdvanced

The most requests a second each Pando replica makes to the cluster's API for routes.

int · Default 100 · Used when delivery is kubernetes_api

api_burstAPI request burstAdvanced

How many requests a replica may make at once above that rate. At least the requests a second.

int · Default 200 · Used when delivery is kubernetes_api

dirConfiguration directoryAdvanced

Where Pando writes Traefik's route files.

string · Default /etc/traefik/dynamic

entrypointEntry pointAdvanced

The entry point of your Traefik that apps are served on.

string · Default websecure · Used when managed is false

cert_resolverCertificate resolver

The certificate resolver your Traefik has configured.

string · For example letsencrypt · Used when managed is false

Builder

BuildKitbuildkit

Builds images from source in an isolated BuildKit daemon.

addressBuildKit addressAdvanced

Where the BuildKit daemon listens. PANDO_BUILDKIT_ADDRESS is used when this is empty.

string · Default tcp://buildkit:1234

Runtime

Dockerdocker

Runs apps as containers on a Docker host.

hostDocker hostAdvanced

The Docker endpoint. Empty uses the environment, which the bundled Compose file relies on.

string · Default DOCKER_HOST, or the local socket

total_cpu_millisCPU availableAdvanced

Thousandths of a core Pando may allocate.

int · Default The whole machine

total_memory_bytesMemory availableAdvanced

Bytes Pando may allocate.

int · Default The whole machine

total_disk_bytesDisk availableAdvanced

Bytes of disk Pando may allocate.

int · Default No limit

network_poolApp network rangeAdvanced

The IPv4 range each app's private network takes its addresses from. A /16 holds about 4,000 apps; a wider range such as 10.208.0.0/12 holds more. "off" uses Docker's own pool, which holds about 30 networks.

string · Default 10.213.0.0/16

network_block_bitsApp network sizeAdvanced

The size of each app's private network, as a prefix length from 24 to 29. 28 holds 13 containers; an app with more workloads than fit gets a larger network.

int · Default 28

egress_gateway_imageEgress gateway imageAdvanced

The image an app's egress gateway runs from when its egress rules restrict anything: any image with Pando's binary at /usr/local/bin/pando. Without one, and with Pando not running in a container, apps whose egress is restricted cannot be deployed.

string · Default The image Pando's own container runs

oci_runtimeContainer runtimeAdvanced

The runtime Docker starts apps with, by the name it is registered under in daemon.json. "runsc" (gVisor) or a Kata runtime makes this a sandboxed runtime, which host policy can require; the port and file-write checks when an app is added then cannot see inside the sandbox, so Pando asks for the port instead.

string · Default Docker's default, runc

Docker on several hostsdocker-hosts

Runs apps as containers on several Docker hosts. Each app is placed on one host and stays there: a new app goes to the host with the most free memory that fits it. Pando reaches each host's apps through a forwarding agent it runs there, which accepts only Pando's certificate. Built images reach the hosts through the install's image registry.

hostsHostsRequired

The hosts as a JSON list. Each has a name; an endpoint (unix:///var/run/docker.sock, tcp://host:2376 with the Docker TLS credential, or ssh://user@host with the SSH key and the host's ssh_host_key); an agent_address where Pando reaches the host's agent; and optionally no_placement to keep new apps off it. Exactly one is "control": true, the host Pando runs on.

string · For example [{"name":"control","control":true,"agent_address":"10.0.0.5:7443"},{"name":"app-1","endpoint":"tcp://10.0.0.6:2376"}]

agent_authorityAgent certificate authorityRequiredCredential

The output of pando host-agent new-authority. Pando issues its own certificate and each agent's from it.

string

docker_tlsDocker TLS client certificateCredential

For tcp:// hosts: the CA (ca.pem), the client certificate (cert.pem) and its key (key.pem), pasted together.

string

ssh_keySSH private keyCredential

For ssh:// hosts: an unencrypted private key for a user in the docker group, or root.

string

agent_imageAgent imageAdvanced

The image of Pando each host's agent and each restricted app's egress gateway run. Every host must be able to pull it.

string · Default The image Pando's own container runs

agent_portAgent portAdvanced

The one port each host publishes, for its agent. Restrict it to the control host's address with the host's firewall.

int · Default 7443

network_poolApp network rangeAdvanced

The IPv4 range each host's app networks take their addresses from. Each host uses the whole range for its own apps. Cannot be "off" here.

string · Default 10.213.0.0/16

network_block_bitsApp network sizeAdvanced

The size of each app's private network, as a prefix length from 24 to 29.

int · Default 28

oci_runtimeContainer runtimeAdvanced

The runtime every host's Docker starts apps with, by the name it is registered under in daemon.json, such as runsc.

string · Default Docker's default, runc

Kuberneteskubernetes

Runs apps as pods on the Kubernetes cluster Pando runs in, one namespace per app.

pod_cidrPod address rangeRequired

The range the cluster gives pods. Apps may open connections out of the cluster, never into this range.

string · For example 10.244.0.0/16

service_cidrService address rangeRequired

The range the cluster gives Services. Apps may not open connections into it.

string · For example 10.96.0.0/12

egress_gateway_imageEgress gateway image

An image with Pando's binary at /usr/local/bin/pando, run in front of an app whose egress rules restrict anything. Without one, such apps cannot be deployed.

string · For example ghcr.io/trypando/pando:latest

kubeconfigKubeconfig fileAdvanced

A kubeconfig file, for running Pando outside the cluster during development. Pando's proxy reaches apps by cluster DNS names, so in production Pando runs inside the cluster.

string · Default The cluster Pando runs in

contextKubeconfig contextAdvanced

The context in the kubeconfig file to use.

string · Default The file's current context

pando_namespacePando's namespaceAdvanced

Where Pando's server pods run. Apps admit connections only from Pando's server pods in this namespace.

string · Default pando

pando_servicePando's ServiceAdvanced

The Service in front of Pando's server pods, in Pando's namespace. The edge sends traffic to it.

string · Default pando

service_accountPando's ServiceAccountAdvanced

The ServiceAccount Pando's server pods run as, in Pando's namespace. It is bound to the app namespace role in each app namespace.

string · Default pando

proxy_portProxy portAdvanced

The port Pando's proxy listens on in its pods.

int · Default 8080

app_roleApp namespace roleAdvanced

The ClusterRole bound to Pando's ServiceAccount in each app namespace.

string · Default pando-app-manager

cluster_domainCluster domainAdvanced

The cluster's DNS domain, which Service names end in.

string · Default cluster.local

api_server_cidrAPI server addressAdvanced

Only needed when the API server's address is inside the pod or Service range: the edge reads its routes from it.

string · Default Reached by the rule for addresses outside the cluster

storage_classStorage classAdvanced

The StorageClass app volumes are made with.

string · Default The cluster's default class

volume_size_bytesVolume sizeAdvanced

Bytes for a volume whose app does not say how large it is.

int · Default 10737418240 (10 GiB)

runtime_classRuntimeClassAdvanced

A RuntimeClass to run apps under. One whose handler is gVisor (runsc) or Kata makes this a sandboxed runtime, which host policy can require.

string · Default The cluster's default

node_selectorNode selectorAdvanced

Run apps only on nodes with these labels, as key=value pairs separated by commas.

string · Default Every schedulable node

helper_imageHelper imageAdvanced

Runs the network policy check, the port observer and volume backups. Any image with a shell, tar, wget and httpd.

string · Default busybox:1.37

api_qpsAPI requests a secondAdvanced

The most requests a second each Pando replica makes to the cluster's API.

int · Default 200

api_burstAPI request burstAdvanced

How many requests a replica may make at once above that rate. At least the requests a second.

int · Default 400

edge_namespaceEdge namespaceAdvanced

The namespace the edge runs in: the Traefik that takes ports 80 and 443 and passes traffic to Pando.

string · Default pando-edge

edge_replicasEdge replicasAdvanced

How many copies of the edge run, spread across nodes. At least 2.

int · Default 2

edge_service_typeEdge Service typeAdvanced

LoadBalancer — The cluster's load balancer publishes ports 80 and 443.
NodePort — Every node listens on the node ports below, and a load balancer outside the cluster points at them.

one of the values above · Default LoadBalancer

edge_http_node_portEdge HTTP node portAdvanced

The port every node listens on for the edge's HTTP.

int · Default 30080 · Used when edge_service_type is NodePort

edge_https_node_portEdge HTTPS node portAdvanced

The port every node listens on for the edge's HTTPS.

int · Default 30443 · Used when edge_service_type is NodePort

Secrets

Locallocal

Keeps secrets encrypted in Pando’s own database.

key_pathKey fileAdvanced

The file holding the encryption key.

string · Default /var/lib/pando/secrets.key

Services

Dockerdocker

Provisions the databases and caches apps declare, as containers.

Takes no settings.

Notifications

Consoleconsole

Shows notifications in the console.

retain_daysKeep forAdvanced

Days a notification is kept.

int · Default 30

Discorddiscord

Posts the events a subscription chooses to a Discord channel, through a channel webhook.

webhook_urlWebhook URLRequiredCredential

The webhook URL from the Discord channel's Integrations settings. Stored encrypted and never shown again.

string · For example https://discord.com/api/webhooks/…

timeout_secondsTimeoutAdvanced

Seconds to wait for Discord to answer.

int · Default 10

ntfyntfy

Publishes the events a subscription chooses to an ntfy topic, on ntfy.sh or your own server, for push notifications on a phone or desktop.

topicTopicRequiredCredential

The topic to publish to. On ntfy.sh anyone who knows a topic's name can read it, so pick one nobody would guess. Stored encrypted.

string · For example pando-alerts-7f3k

server_urlServer

The ntfy server.

string · Default https://ntfy.sh

access_tokenAccess tokenCredential

A token for a server that requires one. Stored encrypted and never shown again.

string

priorityPriorityAdvanced

How insistently the phone announces a message.

min Min
low Low
default Default
high High
urgent Urgent

one of the values above · Default default

timeout_secondsTimeoutAdvanced

Seconds to wait for the server to answer.

int · Default 10

Slackslack

Posts the events a subscription chooses to a Slack channel, through an incoming webhook.

webhook_urlWebhook URLRequiredCredential

The incoming webhook URL Slack gives you for the channel. Stored encrypted and never shown again.

string · For example https://hooks.slack.com/services/…

timeout_secondsTimeoutAdvanced

Seconds to wait for Slack to answer.

int · Default 10

Email (SMTP)smtp

Emails Pando's notifications to the people they are for, at the address on their account, through any SMTP server — SendGrid, Mailgun and Amazon SES included. Event subscriptions can send to it too.

hostServerRequired

The mail server's host name.

string · For example smtp.sendgrid.net

fromFromRequired

The address email comes from.

string · For example Pando <[email protected]>

usernameUsername

For SendGrid, apikey.

string

passwordPasswordCredential

For SendGrid, an API key. Stored encrypted and never shown again.

string

securitySecurityAdvanced

How the connection is encrypted.

starttls STARTTLS
tls TLS
none None

one of the values above · Default starttls

portPortAdvanced

587 for STARTTLS, 465 for TLS.

int · Default 587

timeout_secondsTimeoutAdvanced

Seconds to wait for the server.

int · Default 15

Microsoft Teamsteams

Posts the events a subscription chooses to a Microsoft Teams channel, as an adaptive card, through a Workflows webhook.

webhook_urlWebhook URLRequiredCredential

The URL of a Teams workflow that posts a webhook's adaptive card to the channel. Stored encrypted and never shown again.

string · For example https://….logic.azure.com/workflows/…

timeout_secondsTimeoutAdvanced

Seconds to wait for Microsoft Teams to answer.

int · Default 10

Backup

Local disklocal

Writes backups to a directory on the host.

pathDirectory

Where backups are written.

string · Default /var/lib/pando/backups

Scanner

Trivytrivy

Scans source and images for known vulnerabilities and gives each app a security score.

imageImageAdvanced

The Trivy image to run.

string · Default aquasec/trivy:0.74.0 (pinned)

hostDocker hostAdvanced

Where to run it.

string · Default DOCKER_HOST, or the local socket

timeout_secondsTimeoutAdvanced

Seconds a scan may take.

int · Default 600

AI

Anthropicanthropic

Performs the AI functions assigned to it: repairing a failed plan, answering detection's questions, revising a plan on request, drafting access and policy, searching the audit log, and answering from the reference. Needs an Anthropic API key.

api_keyAPI keyCredential

An Anthropic API key. Stored encrypted and never shown again. Leave empty to use ANTHROPIC_API_KEY from Pando’s environment.

string · For example sk-ant-…

modelModel

The Claude model each function uses unless its assignment names another.

string · Default claude-opus-5-5

base_urlBase URLAdvanced

A gateway or proxy in front of the Anthropic API. Empty is the API itself.

string · Default https://api.anthropic.com

api_key_envAPI key variableAdvanced

The environment variable to read the key from, instead of a stored one.

string · Default ANTHROPIC_API_KEY

Local modellocal

Performs the AI functions assigned to it with a model on your own hardware, through any server that speaks the OpenAI API: Ollama, LM Studio, llama.cpp or vLLM. Nothing is sent to a provider.

base_urlServer URL

The server’s OpenAI-compatible address, ending in /v1. The default is Ollama on the machine running Pando’s container.

string · Default http://host.docker.internal:11434/v1

modelModelRequired

The model each function uses unless its assignment names another, as the server names it.

string · For example qwen2.5:7b

api_keyAPI keyCredential

Only if your server asks for one. Stored encrypted and never shown again.

string

timeout_secondsTimeout, in secondsAdvanced

How long one request may take. Local models are slower than hosted ones.

int · Default 300

OpenAIopenai

Performs the AI functions assigned to it with OpenAI's models. Uses OpenAI's Responses API, which stores each conversation on OpenAI's servers under OpenAI's retention terms; Pando does not store it. Needs an OpenAI API key.

api_keyAPI keyCredential

An OpenAI API key. Stored encrypted and never shown again. Leave empty to use OPENAI_API_KEY from Pando’s environment.

string · For example sk-…

modelModel

The model each function uses unless its assignment names another.

string · Default gpt-5.5

base_urlBase URLAdvanced

A gateway or proxy in front of the OpenAI API. Empty is the API itself.

string · Default https://api.openai.com/v1

api_key_envAPI key variableAdvanced

The environment variable to read the key from, instead of a stored one.

string · Default OPENAI_API_KEY

Source connections

Azure DevOpsazuredevops

Clone from Azure DevOps Services or Azure DevOps Server with a personal access token, Microsoft Entra ID or an SSH key, and pick repositories from a list.

methodHow Pando signs inRequired

token Personal access token — A token with Code (Read) scope. Works with Azure DevOps Services and Server.
oauth Microsoft Entra ID sign-in — A person authorizes Pando with their Microsoft account, by device code or in the browser. Azure DevOps Services only.
service_principal Service principal — An app registration signs in with its client secret. It must be added to the organization. Azure DevOps Services only.
ssh SSH key — A key added to a user's SSH public keys. Repositories are entered by address.

one of the values above · Default token

hostHost

The host repositories are on. Change it for a self-managed server.

string · Default dev.azure.com

scopeOrganization

The organization, or organization/project to limit the connection to one project. On Azure DevOps Server, the collection, or collection/project.

string · For example acme or acme/Payments

tokenPersonal access tokenCredential

A personal access token with the Code (Read) scope.

string · Used when method is token

tenant_idDirectory (tenant) ID

The Microsoft Entra tenant. A service principal needs its own tenant's ID; a person's sign-in can use organizations.

string · Default organizations · Used when method is oauth or service_principal

client_idApplication (client) ID

The app registration's application (client) ID, from Microsoft Entra ID.

string · Used when method is oauth or service_principal

client_secretClient secretCredential

The app registration's client secret. Required for a service principal and for browser authorization; device authorization works without one.

string · Used when method is oauth or service_principal

ssh_private_keySSH private keyCredential

The private half of a deploy key or access key added to the repository. Pando reads the repository with it and never writes.

string · Used when method is ssh

ssh_passphraseKey passphraseCredential

Only if the key has one.

string · Used when method is ssh

known_hostsKnown hosts

The host's public key, as ssh-keyscan ssh.dev.azure.com (or your server's host) prints it.

string · Used when method is ssh

api_urlAPI addressAdvanced

Where the host's API is, if not where Pando would look for it.

string · Default https://dev.azure.com/{organization}, or https://HOST/{collection} on Azure DevOps Server

ca_bundleCertificate authorityAdvanced

PEM certificates to trust for a self-managed host on a private certificate authority, beside the system's.

string · Default The system's trusted certificates

Bitbucketbitbucket

Clone from Bitbucket Cloud or Bitbucket Data Center with an access token, an OAuth consumer or an SSH access key, and pick repositories from a list.

methodHow Pando signs inRequired

token Access token — Bitbucket Cloud: a workspace, project or repository access token, or an API token. Data Center: an HTTP access token.
oauth OAuth consumer — A person authorizes Pando in the browser. Bitbucket Cloud only.
ssh SSH access key — A key added to a repository or project as an access key. Repositories are entered by address.

one of the values above · Default token

hostHost

The host repositories are on. Change it for a self-managed server.

string · Default bitbucket.org

scopeWorkspace or project

Bitbucket Cloud: the workspace ID, such as acme. Data Center: the project key, such as PAY. Empty is every repository the credential can read.

string · For example acme

token_typeToken type

Bitbucket Cloud only. Data Center takes an HTTP access token whichever is chosen.

access_token Access token — A workspace, project or repository access token.
api_token API token — An Atlassian account's API token, with your Bitbucket username.

one of the values above · Default access_token · Used when method is token

usernameUsername

Bitbucket Cloud API token: your Bitbucket username. Data Center: the account the token belongs to, if git should sign in as it; x-token-auth otherwise.

string · For example alice · Used when method is token

emailAtlassian account email

Bitbucket Cloud API token only: the email of the Atlassian account the token was created under, which Bitbucket's API signs in with. The username when empty.

string · For example [email protected] · Used when method is token

tokenTokenCredential

Read access to repositories is enough.

string · Used when method is token

client_idOAuth consumer key

From the workspace's settings → OAuth consumers. Give the consumer Pando's callback address and the Repositories: Read permission.

string · Used when method is oauth

client_secretOAuth consumer secretCredential

The consumer's secret, shown beside its key.

string · Used when method is oauth

ssh_private_keySSH private keyCredential

The private half of a deploy key or access key added to the repository. Pando reads the repository with it and never writes.

string · Used when method is ssh

ssh_passphraseKey passphraseCredential

Only if the key has one.

string · Used when method is ssh

known_hostsKnown hosts

The host's public key, as ssh-keyscan bitbucket.org prints it. For Data Center, ssh-keyscan -p 7999 HOST, whose lines begin [HOST]:7999.

string · Used when method is ssh

ssh_portSSH portAdvanced

Bitbucket Data Center's SSH port, for turning an HTTPS address into an SSH one. Not used on Bitbucket Cloud.

string · Default 7999 · Used when method is ssh

api_urlAPI addressAdvanced

Where the host's API is, if not where Pando would look for it.

string · Default https://api.bitbucket.org/2.0 on Bitbucket Cloud, https://HOST/rest/api/1.0 on Data Center

ca_bundleCertificate authorityAdvanced

PEM certificates to trust for a self-managed host on a private certificate authority, beside the system's.

string · Default The system's trusted certificates

Any git hostgit

Clone from any git server with a username and token over HTTPS, or an SSH key. Repositories are entered by address.

methodHow Pando signs inRequired

token Username and token — HTTPS, with an access token or password as the password.
ssh SSH key — A deploy key. The host's public key is pinned.

one of the values above · Default token

hostHostRequired

The host repositories are on. Change it for a self-managed server.

string · For example git.example.com

scopePath prefix

Limit the connection to repositories under this path, such as acme. Empty is every repository on the host.

string · For example acme

usernameUsername

The account the token belongs to. Defaults to git.

string · For example git · Used when method is token

tokenToken or passwordCredential

Read access to the repositories is enough.

string · Used when method is token

ssh_private_keySSH private keyCredential

The private half of a deploy key or access key added to the repository. Pando reads the repository with it and never writes.

string · Used when method is ssh

ssh_passphraseKey passphraseCredential

Only if the key has one.

string · Used when method is ssh

known_hostsKnown hosts

The host's public key, as ssh-keyscan <host> prints it.

string · Used when method is ssh

ca_bundleCertificate authorityAdvanced

PEM certificates to trust for a self-managed host on a private certificate authority, beside the system's.

string · Default The system's trusted certificates

Gitea or Forgejogitea

Clone from a Gitea or Forgejo server, Codeberg included, with an access token, an OAuth2 application, or a deploy key, optionally limited to one owner.

methodHow Pando signs inRequired

token Access token — An access token with read permission on repositories. Repositories can be picked from a list.
oauth OAuth2 application — Authorize once in the browser. Needs an address the host can send you back to.
ssh Deploy key — An SSH key added to the repository as a deploy key. Repositories are entered by address.

one of the values above · Default token

hostHostRequired

The host repositories are on. Change it for a self-managed server.

string · For example git.example.com

scopeOwner

Limit the connection to one user's or organization's repositories, such as acme. Empty is every repository the credential can read.

string · For example acme

usernameUsername

The account the token belongs to. Defaults to oauth2, which Gitea and Forgejo accept beside a token.

string · For example oauth2 · Used when method is token

tokenAccess tokenCredential

Create one under Settings → Applications with read permission on repositories.

string · Used when method is token

client_idOAuth2 client ID

The client ID of an OAuth2 application created under Settings → Applications, with Pando's callback as its redirect URI.

string · Used when method is oauth

client_secretOAuth2 client secretCredential

The application's client secret. Gitea and Forgejo authorize only in the browser, so it is required.

string · Used when method is oauth

ssh_private_keySSH private keyCredential

The private half of a deploy key or access key added to the repository. Pando reads the repository with it and never writes.

string · Used when method is ssh

ssh_passphraseKey passphraseCredential

Only if the key has one.

string · Used when method is ssh

known_hostsKnown hosts

The host's public key, as ssh-keyscan <host> prints it.

string · Used when method is ssh

api_urlAPI addressAdvanced

Where the host's API is, if not where Pando would look for it.

string · Default https://<host>/api/v1

ca_bundleCertificate authorityAdvanced

PEM certificates to trust for a self-managed host on a private certificate authority, beside the system's.

string · Default The system's trusted certificates

Presets

Codeberg Create an access token on Codeberg under Settings → Applications, with read permission on repositories.

GitHubgithub

Clone private repositories from github.com or GitHub Enterprise Server, and pick them from a list, with a GitHub App, an OAuth application, a personal access token or a deploy key.

methodHow Pando signs inRequired

app GitHub App — An App installed on an organization or user. Tokens are short-lived and limited to the repositories the installation allows.
oauth OAuth application — Authorize as a GitHub user, with a code entered on GitHub or in the browser.
token Personal access token — A fine-grained or classic token with read access to repository contents.
ssh Deploy key — An SSH key added to one repository. Repositories are entered by address.

one of the values above · Default app

hostHost

The host repositories are on. Change it for a self-managed server.

string · Default github.com

scopeOwner

The organization or user on GitHub. Empty is every repository the credential can read.

string · For example acme

app_idApp ID

The App's ID, shown on its settings page in GitHub under General → About.

string · For example 123456 · Used when method is app

installation_idInstallation ID

The number at the end of the installation's settings address. Empty looks it up from the owner.

string · For example 45678901 · Used when method is app

app_private_keyApp private keyCredential

The PEM private key generated on the App's settings page, beginning -----BEGIN RSA PRIVATE KEY-----.

string · Used when method is app

client_idOAuth client ID

From the OAuth application registered in GitHub under Settings → Developer settings → OAuth Apps, with device flow enabled.

string · Used when method is oauth

client_secretOAuth client secretCredential

Needed for browser authorization. Device authorization works without one.

string · Used when method is oauth

tokenPersonal access tokenCredential

A fine-grained token with read access to contents and metadata, or a classic token with the repo scope.

string · Used when method is token

ssh_private_keySSH private keyCredential

The private half of a deploy key or access key added to the repository. Pando reads the repository with it and never writes.

string · Used when method is ssh

ssh_passphraseKey passphraseCredential

Only if the key has one.

string · Used when method is ssh

known_hostsKnown hosts

The host's public key, as ssh-keyscan <host> prints it. For github.com it may be left empty: Pando uses the keys GitHub publishes.

string · Used when method is ssh

api_urlAPI addressAdvanced

Where the host's API is, if not where Pando would look for it.

string · Default https://api.github.com for github.com, https://<host>/api/v3 for GitHub Enterprise Server

ca_bundleCertificate authorityAdvanced

PEM certificates to trust for a self-managed host on a private certificate authority, beside the system's.

string · Default The system's trusted certificates

Presets

GitHub.com Install a GitHub App on the organization, or create a personal access token under Settings → Developer settings.
GitHub Enterprise Server Enter the server's host. Its API is at https://<host>/api/v3 unless it was moved.

GitLabgitlab

Clone from gitlab.com or a self-managed GitLab with an OAuth application, an access or deploy token, or a deploy key, optionally limited to one group.

methodHow Pando signs inRequired

oauth OAuth application — Authorize once in the browser or with a device code. Repositories can be picked from a list.
token Access token or deploy token — A personal, project or group access token, or a deploy token over HTTPS.
ssh Deploy key — An SSH key added to the project as a deploy key. Repositories are entered by address.

one of the values above · Default oauth

hostHost

The host repositories are on. Change it for a self-managed server.

string · Default gitlab.com

scopeGroup

Limit the connection to projects in this group and its subgroups, such as acme or acme/platform. Empty is every project the credential can read.

string · For example acme/platform

client_idOAuth client ID

The Application ID of a GitLab OAuth application with the read_repository and read_api scopes. Create one under Preferences → Applications, or on a group's or the instance's Applications page.

string · Used when method is oauth

client_secretOAuth client secretCredential

Needed for browser authorization. Device authorization works without one.

string · Used when method is oauth

token_typeToken type

access_token Access token — A personal, project or group access token with read_repository and read_api. Repositories can be picked from a list.
deploy_token Deploy token — A deploy token with read_repository. It cannot list repositories, so they are entered by address.

one of the values above · Default access_token · Used when method is token

usernameUsername

For a deploy token, the username GitLab shows beside it, such as gitlab+deploy-token-12. Not used with an access token.

string · For example gitlab+deploy-token-12 · Used when method is token

tokenTokenCredential

Read access to repositories is enough: read_repository, and read_api to pick repositories from a list.

string · Used when method is token

ssh_private_keySSH private keyCredential

The private half of a deploy key or access key added to the repository. Pando reads the repository with it and never writes.

string · Used when method is ssh

ssh_passphraseKey passphraseCredential

Only if the key has one.

string · Used when method is ssh

known_hostsKnown hosts

The host's public key, as ssh-keyscan <host> prints it. Leave empty for gitlab.com; Pando knows its key.

string · Used when method is ssh

api_urlAPI addressAdvanced

Where the host's API is, if not where Pando would look for it.

string · Default https://<host>/api/v4

ca_bundleCertificate authorityAdvanced

PEM certificates to trust for a self-managed host on a private certificate authority, beside the system's.

string · Default The system's trusted certificates

Image registries

Amazon ECRecr

An ECR repository you created. Every build goes into it, tagged by app and deployment, and Pando gets a registry password from the access key before each push and pull.

urlRegistry addressRequired

The repository's address, as ECR shows it. It has to exist already.

string · For example 123456789012.dkr.ecr.us-east-1.amazonaws.com/pando

access_key_idAccess key IDRequired

An AWS access key that can push to and pull from the repository.

string · For example AKIA…

secret_access_keySecret access keyRequiredCredential

Stored encrypted, and never shown again.

string

alwaysSend every build through the registryAdvanced

Even on a runtime that can take a built image directly, such as Docker on one host.

bool · Default false

OCI registryoci

A registry that signs in with a username and password, or not at all: Distribution, Harbor, GitHub Container Registry, Artifact Registry, Zot. Each app gets a repository of its own.

urlRegistry addressRequired

The registry, and a path to push under if you want one.

string · For example https://registry.internal:5000

usernameUsername

What the registry signs Pando in with. Empty for a registry Pando reaches anonymously.

string

passwordPasswordCredential

Stored encrypted, and never shown again.

string

layoutWhere images goAdvanced

per_app A repository per app — Each app has its own, so a deleted app's images are found and removed together.
single One repository for everything — For a registry where a repository has to exist before anything is pushed to it.

one of the values above · Default per_app

insecureAllow plain HTTPAdvanced

Only for a registry on a private network. Every host that pulls must also list it as an insecure registry.

bool · Default false

alwaysSend every build through the registryAdvanced

Even on a runtime that can take a built image directly, such as Docker on one host.

bool · Default false

Audit sinks

HTTPShttps

Posts every audit event, in batches as it is written, to a SIEM's HTTPS ingest endpoint: Splunk, Datadog, Elastic, Sumo Logic, Microsoft Sentinel, or anything that takes JSON with a token. A copy of the audit log leaves this installation.

urlURL

The destination's ingest endpoint. Leave empty when the URL itself is the credential, and set secret_url instead.

string · For example https://siem.example.com/ingest

secret_urlSecret URLCredential

For a destination whose URL carries its token, such as a Sumo Logic HTTP source: the whole URL, stored encrypted. Only its host is ever shown.

string

tokenTokenCredential

The API key or token the destination checks. Stored encrypted and never shown again.

string

bodyBody

The shape of each POST's body.

ndjson NDJSON — One event per line.
json_array JSON array — The batch as one array.
splunk_hec Splunk HEC — Each event in a HEC envelope with a sourcetype.
elastic_bulk Elastic bulk — A create action before each event, for a data stream's _bulk endpoint.

one of the values above · Default ndjson

auth_headerAuth header

The header the token is sent in.

string · Default Authorization

auth_schemeAuth scheme

The word before the token in the header.

Bearer
Splunk
ApiKey
none None — The token is the whole header value.
or another value

one of the values above · Default Bearer

ca_certificateCA certificate

PEM certificates to trust for a destination on a private certificate authority. Empty trusts the system's.

string

extra_headersExtra headers

Headers to add, one per line as Name: value. Not encrypted, so not for anything secret.

string · For example X-Source: pando

sourcetypeSplunk sourcetypeAdvanced

The sourcetype each HEC envelope names.

string · Default pando:audit · Used when body is splunk_hec

allow_httpAllow httpAdvanced

Post over plain http, unencrypted. Only for a destination on a trusted network.

bool

timeout_secondsTimeoutAdvanced

Seconds to wait for the destination to answer a batch.

int · Default 15

actionsActions

Comma-separated action prefixes to send. Empty sends every event.

string · For example deploy, install.

excludeExclude

Comma-separated action prefixes not to send. app.use, a record of each request to an app, is usually most of the volume; exclude it if your SIEM bills by ingest.

string · For example app.use

formatEvent formatAdvanced

How each event is encoded.

native Native — The event as Pando stores it.
ocsf OCSF — OCSF 1.3.0, for a SIEM that maps it.

one of the values above · Default native

max_batchBatch sizeAdvanced

The most events sent in one delivery.

int · Default 500

startStartAdvanced

Where a new destination's first delivery begins. Read once, when Pando first sends to it.

oldest The oldest event in the live log
now Only events from now on

one of the values above · Default oldest

Presets

Splunk HTTP Event Collector In Splunk, Settings > Data inputs > HTTP Event Collector: create a token and copy its value. The URL is your Splunk host on the HEC port, usually 8088, ending /services/collector/event. On Splunk Cloud the host is http-inputs-<stack>.splunkcloud.com on port 443.
Datadog Logs In Datadog, Organization Settings > API Keys: create an API key and set it as the token. The URL is for the US1 site; for another site use its intake host, such as http-intake.logs.datadoghq.eu for EU or http-intake.logs.us5.datadoghq.com for US5.
Elastic In Kibana, Stack Management > API keys: create a key that may write to the data stream and set its encoded value as the token. The URL is your Elasticsearch endpoint, then a data stream name such as logs-pando.audit-default, then /_bulk.
Sumo Logic HTTP source In Sumo Logic, Manage Data > Collection: add an HTTP Logs and Metrics source to a hosted collector and copy its URL. The URL contains the source's token, so set it as the secret URL credential and leave url and token empty.
Microsoft Sentinel (Azure Monitor Logs ingestion) In Azure, create a data collection endpoint and a data collection rule with a stream named Custom-PandoAudit_CL whose columns match the events, then use the endpoint's logs ingestion URL and the rule's immutable ID in the URL. The token is a Microsoft Entra ID access token for the https://monitor.azure.com scope. This adapter sends a static token and does not mint or refresh one, so a token that expires stops delivery until it is replaced.
Generic NDJSON (Google SecOps and others) Any endpoint that takes newline-delimited JSON with a token in a header. Set the URL, the header and scheme it expects, and the token.

Syslogsyslog

Sends every audit event, as it is written, to a syslog collector as an RFC 5424 message over TCP, encrypted with TLS unless you turn it off. A copy of the audit log leaves this installation.

addressAddressRequired

The collector's host and port. Without a port, 6514 with TLS and 514 without.

string · For example siem.example.com:6514

tlsTLS

Whether the connection is encrypted. Off sends the audit log across the network in the clear.

on On — TLS, as RFC 5425 describes.
off Off — Plain TCP, for a collector on the same host or a trusted network.

one of the values above · Default on

ca_certificateCA certificate

PEM certificates to trust for a collector on a private certificate authority. Empty trusts the system's.

string · Used when tls is on or

client_certificateClient certificateCredential

A PEM certificate Pando presents, for a collector that requires mutual TLS. Set with its key, or not at all. Stored encrypted.

string · Used when tls is on or

client_keyClient keyCredential

The PEM private key for the client certificate. Stored encrypted and never shown again.

string · Used when tls is on or

server_nameServer nameAdvanced

The name the collector's certificate must carry, when it differs from the address.

string · Default the address's host

app_nameApp nameAdvanced

The APP-NAME each message carries.

string · Default pando

facilityFacilityAdvanced

The syslog facility messages are sent as. authpriv is for security messages a collector keeps apart from the general log.

authpriv
auth
daemon
user
local0
local1
local2
local3
local4
local5
local6
local7

one of the values above · Default authpriv

hostnameHostnameAdvanced

The HOSTNAME each message carries.

string · Default this machine's hostname

timeout_secondsTimeoutAdvanced

Seconds to wait to connect, and for a batch to be written.

int · Default 10

actionsActions

Comma-separated action prefixes to send. Empty sends every event.

string · For example deploy, install.

excludeExclude

Comma-separated action prefixes not to send. app.use, a record of each request to an app, is usually most of the volume; exclude it if your SIEM bills by ingest.

string · For example app.use

formatEvent formatAdvanced

How each event is encoded.

native Native — The event as Pando stores it.
ocsf OCSF — OCSF 1.3.0, for a SIEM that maps it.

one of the values above · Default native

max_batchBatch sizeAdvanced

The most events sent in one delivery.

int · Default 200

startStartAdvanced

Where a new destination's first delivery begins. Read once, when Pando first sends to it.

oldest The oldest event in the live log
now Only events from now on

one of the values above · Default oldest