CitrixPot: NetScaler / Citrix ADC Gateway honeypot (initial public release)

.env.example

@@ -0,0 +1,31 @@
+# Copy to .env (git-ignored) or set the same names in the systemd EnvironmentFile
+# (/etc/decoy.env). Never commit real addresses, keys or credentials.
+
+# --- Decoy listener (honeypot.py) ---
+HONEYPOT_BIND=0.0.0.0
+HONEYPOT_PORT=8443
+# Exact transport IP allowed to speak PROXY v1 (your source-preserving ingress). Empty disables.
+HONEYPOT_PROXY_PROTOCOL_FROM=
+# Comma-separated CIDRs whose CF-Connecting-IP / X-Forwarded-For may be trusted
+# (edge proxy and reverse-proxy hops only). Empty trusts no forwarded headers.
+HONEYPOT_TRUSTED_FORWARDED_FROM=
+HONEYPOT_LOG_DIR=/var/lib/decoy/http
+HONEYPOT_EVIDENCE_MIB=30720
+
+# --- Source-preserving ingress (ingress_proxy.py) ---
+INGRESS_BIND=127.0.0.1
+INGRESS_PORT=18443
+INGRESS_TARGET=127.0.0.1
+INGRESS_TARGET_PORT=19443
+# CIDRs allowed to open the origin. Empty = any (not recommended for public use).
+INGRESS_ALLOW_FROM=
+
+# --- Local read-only evidence viewer (viewer.py) ---
+VIEWER_BIND=127.0.0.1
+VIEWER_PORT=8787
+VIEWER_LOG_DIR=/var/lib/decoy/http
+# Extra client IPs to hide (the host's public IP is auto-detected). Comma-separated.
+VIEWER_HIDE_IP=
+
+# --- VM execution backend (optional, isolated guest only) ---
+DECOY_VM_CONFIG=/etc/decoy-vm.json