2026-09-28 19:44:37 +02:00
|
|
|
# Copy to .env (git-ignored) or set the same names in the systemd EnvironmentFile
|
|
|
|
|
# (/etc/decoy.env). Never commit real addresses, keys or credentials.
|
|
|
|
|
|
|
|
|
|
# --- Decoy listener (honeypot.py) ---
|
|
|
|
|
HONEYPOT_BIND=0.0.0.0
|
|
|
|
|
HONEYPOT_PORT=8443
|
2026-10-04 06:16:31 +02:00
|
|
|
# Synthetic NITRO identity only; does not change any installed appliance.
|
|
|
|
|
HONEYPOT_VERSION="NetScaler NS14.1: Build 29.63.nc"
|
2026-09-28 19:44:37 +02:00
|
|
|
# Exact transport IP allowed to speak PROXY v1 (your source-preserving ingress). Empty disables.
|
|
|
|
|
HONEYPOT_PROXY_PROTOCOL_FROM=
|
|
|
|
|
# Comma-separated CIDRs whose CF-Connecting-IP / X-Forwarded-For may be trusted
|
|
|
|
|
# (edge proxy and reverse-proxy hops only). Empty trusts no forwarded headers.
|
|
|
|
|
HONEYPOT_TRUSTED_FORWARDED_FROM=
|
|
|
|
|
HONEYPOT_LOG_DIR=/var/lib/decoy/http
|
|
|
|
|
HONEYPOT_EVIDENCE_MIB=30720
|
|
|
|
|
|
|
|
|
|
# --- Source-preserving ingress (ingress_proxy.py) ---
|
|
|
|
|
INGRESS_BIND=127.0.0.1
|
|
|
|
|
INGRESS_PORT=18443
|
|
|
|
|
INGRESS_TARGET=127.0.0.1
|
|
|
|
|
INGRESS_TARGET_PORT=19443
|
|
|
|
|
# CIDRs allowed to open the origin. Empty = any (not recommended for public use).
|
|
|
|
|
INGRESS_ALLOW_FROM=
|
|
|
|
|
|
|
|
|
|
# --- Local read-only evidence viewer (viewer.py) ---
|
|
|
|
|
VIEWER_BIND=127.0.0.1
|
|
|
|
|
VIEWER_PORT=8787
|
|
|
|
|
VIEWER_LOG_DIR=/var/lib/decoy/http
|
2026-10-04 06:16:31 +02:00
|
|
|
# Extra client IPs to hide. Comma-separated. The supplied service disables public-IP discovery.
|
2026-09-28 19:44:37 +02:00
|
|
|
VIEWER_HIDE_IP=
|
|
|
|
|
|
|
|
|
|
# --- VM execution backend (optional, isolated guest only) ---
|
2026-10-04 06:16:31 +02:00
|
|
|
DECOY_VM_CONFIG=
|
|
|
|
|
# Strict --simulation-only mode refuses a configured execution backend.
|
