31 lines
1.2 KiB
Bash
31 lines
1.2 KiB
Bash
|
# Copy to .env (git-ignored) or set the same names in the systemd EnvironmentFile
|
||
|
|
# (/etc/decoy.env). Never commit real addresses, keys or credentials.
|
||
|
|
|
||
|
|
# --- Decoy listener (honeypot.py) ---
|
||
|
|
HONEYPOT_BIND=0.0.0.0
|
||
|
|
HONEYPOT_PORT=8443
|
||
|
|
# Exact transport IP allowed to speak PROXY v1 (your source-preserving ingress). Empty disables.
|
||
|
|
HONEYPOT_PROXY_PROTOCOL_FROM=
|
||
|
|
# Comma-separated CIDRs whose CF-Connecting-IP / X-Forwarded-For may be trusted
|
||
|
|
# (edge proxy and reverse-proxy hops only). Empty trusts no forwarded headers.
|
||
|
|
HONEYPOT_TRUSTED_FORWARDED_FROM=
|
||
|
|
HONEYPOT_LOG_DIR=/var/lib/decoy/http
|
||
|
|
HONEYPOT_EVIDENCE_MIB=30720
|
||
|
|
|
||
|
|
# --- Source-preserving ingress (ingress_proxy.py) ---
|
||
|
|
INGRESS_BIND=127.0.0.1
|
||
|
|
INGRESS_PORT=18443
|
||
|
|
INGRESS_TARGET=127.0.0.1
|
||
|
|
INGRESS_TARGET_PORT=19443
|
||
|
|
# CIDRs allowed to open the origin. Empty = any (not recommended for public use).
|
||
|
|
INGRESS_ALLOW_FROM=
|
||
|
|
|
||
|
|
# --- Local read-only evidence viewer (viewer.py) ---
|
||
|
|
VIEWER_BIND=127.0.0.1
|
||
|
|
VIEWER_PORT=8787
|
||
|
|
VIEWER_LOG_DIR=/var/lib/decoy/http
|
||
|
|
# Extra client IPs to hide (the host's public IP is auto-detected). Comma-separated.
|
||
|
|
VIEWER_HIDE_IP=
|
||
|
|
|
||
|
|
# --- VM execution backend (optional, isolated guest only) ---
|
||
|
|
DECOY_VM_CONFIG=/etc/decoy-vm.json
|