Configuration

The published config/sentinel.php documents every key, and the common knobs are env-driven, so you rarely need to publish it. The default ring’s key material, for example, comes entirely from the environment:

SENTINEL_KEY_ID=default-20261002-k3f9qa
SENTINEL_ALGORITHM=hmac-sha256
SENTINEL_KEY="base64:…"
SENTINEL_PUBLIC_KEY="base64:…"                  # asymmetric keys; alone = verify-only
SENTINEL_PREVIOUS_KEYS="default-20250901-a1b2c3|hmac-sha256|base64:…"   # verify-only, comma-separated

Every key

Frequencies are everyMinute, everyTwoMinutes, everyFiveMinutes, everyTenMinutes, everyFifteenMinutes, everyThirtyMinutes, hourly, everyTwoHours, everyThreeHours, everyFourHours, everySixHours, daily and weekly — or off to disable a task (a blank value is not set, so the task keeps its default). Each task runs without overlapping and on one server.

Ring, profile, anchor and store names follow [a-z][a-z0-9_-]{0,63}. Add rings under keys.rings.<ring> (driver and algorithms required; for a config-driver ring, sentinel:key:generate --ring=<ring> prints SENTINEL_<RING>_* lines — read them in the ring’s section with env()) and inbound signature policies under signatures.profiles.<name>.

How values are read

Every setting is validated at first use, and an invalid one throws InvalidSentinelConfigurationException naming the key — it never falls back to a default. A key that is not set — absent, null or blank ('' or whitespace, what SENTINEL_LEDGER= in .env gives) — takes its default from the table above. Booleans accept true/false, on/off, yes/no, 1/0 (any case); any other value throws, and the message names the key and the value it got — SENTINEL_ALLOW_SUSPENSION=disabled is an error, never “allowed”. A value out of range, an unknown enum case, a malformed list or a non-string name (a log channel, an ability, a store, an anchor disk, a signature ring) throws the same way; a blank optional name is not set, so it reads as unset. A blank schedule.* frequency keeps its default — only off (or null) switches a task off.

php artisan about shows a Sentinel section — rings, driver, signing key present or missing, flags, anchors, stores, sealable models and schedule, never key material — and sentinel:check reports every invalid setting at once.

Translations

English and Slovak ship with the package; publish them with the sentinel-translations tag to reword them or add a locale: