radegastedr/console repository overview

⁠Radegast EDR — Backend

Radegast EDR is a lightweight, privacy-focused Endpoint Detection and Response platform perfect for smaller teams, home labbers, and families. With complete end-to-end encryption (E2EE) using age encryption, your log data remains private and secure — even from the server itself. No custom infrastructure is required: the built-in SQLite database and self-contained deployment make it easy to get started without complex setup. You don't need to host any custom infrastructure if you don't want to.

⁠Quickstarts

• User Quickstart (Step-by-step guide with screenshots): First Steps with Radegast⁠
• Backend Quickstart: Deployment & Quick Start⁠

Built with FastAPI and SQLAlchemy, the backend handles device authorization, user configuration packs, encrypted log storage, alert status tracking, and key/session management.

⁠Features

• Device Management: Create and enroll EDR agent devices, assign them to groups, and generate secure authorization tokens
• Configuration Packs: Store and distribute YAML/binary endpoint detection policies and versions
• End-to-End Encrypted Log Storage: All logs are encrypted on the device using age before transmission; the server stores only encrypted data it cannot read
• Team Collaboration: Create teams, manage device group permissions, and receive email notifications for critical events
• Zero-Trust Architecture: All data is encrypted client-side; the server never has access to your private keys or decrypted log contents
• Self-Contained Deployment: Built-in SQLite database means no external database server required
• Agent Distribution: Serve the Rustinel eBPF sensor and provide single-command installation for Linux and Windows

⁠Deployment (Podman / Docker)

The recommended way to run Radegast EDR in production is via the published container image.

⁠Quick start

# Pull and start with podman-compose (reads podman-compose.yaml)
podman-compose up -d

# Or with plain podman / docker
podman run -d \
  --name radegast-edr \
  -p 8000:8000 \
  -e RADEGAST_SECRET_KEY=<your-secret> \
  -e RADEGAST_BASE_URL=https://your.domain \
  -e RADEGAST_CORS_ORIGINS=https://your.domain \
  -v radegast_db:/app/data/db \
  -v radegast_uploads:/app/data/uploads \
  -v radegast_releases:/app/data/releases \
  docker.io/radegastedr/console:latest

⁠Using podman-compose

Clone the repository and start all services with persistent named volumes:

git clone https://github.com/radegast-edr/radegast-backend.git
cd radegast-backend

# Edit the environment section in podman-compose.yaml first, then:
podman-compose up -d

Three named volumes are created automatically:

The API is available at http://localhost:8000⁠ and the interactive docs at http://localhost:8000/docs⁠.

⁠Using MySQL as Database

By default, the application runs on SQLite. If you want to use MySQL or MariaDB:

1. Ensure your MySQL database is created.
2. Run the Docker container with RADEGAST_DATABASE_URL pointed to your database using the mysql+aiomysql:// driver (the Docker image comes pre-installed with mysql extra/support):

   docker run -d \
     --name radegast-edr \
     -p 8000:8000 \
     -e RADEGAST_SECRET_KEY=<your-secret> \
     -e RADEGAST_DATABASE_URL="mysql+aiomysql://user:password@mysql-host:3306/db_name" \
     -e RADEGAST_BASE_URL=https://your.domain \
     -e RADEGAST_CORS_ORIGINS=https://your.domain \
     -v radegast_uploads:/app/data/uploads \
     -v radegast_releases:/app/data/releases \
     docker.io/radegastedr/console:latest
   

   Copy

⁠Local Development

⁠Prerequisites

• Python 3.11+
• uv⁠ (recommended) or standard pip

⁠Installation

1. Install project dependencies:

   uv sync
   # Or to install with MySQL support:
   # uv sync --group mysql
   
   # Or using standard pip with a virtual environment:
   # python -m venv .venv && source .venv/bin/activate && pip install .
   # Or with MySQL support:
   # pip install .[mysql]
   

   Copy

2. Install dev tools (test runner etc.):

   uv sync --dev
   # Or:
   # pip install .[dev]
   

   Copy

⁠Running the Backend

Start the development server with hot-reload:

uv run uvicorn app.main:app --reload --port 8000

The server runs on http://localhost:8000⁠. Interactive Swagger docs are available at http://localhost:8000/docs⁠.

⁠Running with the CLI

You can run the application directly via the CLI interface. In development, use:

uv run radegast-console run --host=127.0.0.1 --port=8000 --workers=4

Alternatively, you can install the tool globally using uv:

uv tool install radegast-edr-console

Once installed, start the console using:

radegast-console run --host=127.0.0.1 --port=8000 --workers=4

You can pass any configuration variable (e.g., --database-url, --enable-email-worker) to override defaults. Run radegast-console run --help to see a full list of options.

⁠Running Tests

uv run pytest

⁠Configuration

All settings are controlled via environment variables prefixed with RADEGAST_ (defined in app/config.py⁠):