Expand capture-only NetScaler NITRO simulation and crash recovery

deploy/decoy-viewer.service

@@ -3,7 +3,7 @@ Description=Local read-only honeypot evidence viewer (loopback only)
 After=network-online.target
 [Service]
 EnvironmentFile=/etc/decoy.env
-ExecStart=/usr/bin/python3 /opt/decoy/viewer.py --bind=${VIEWER_BIND} --port=${VIEWER_PORT} --log-dir=${VIEWER_LOG_DIR}
+ExecStart=/usr/bin/python3 /opt/decoy/viewer.py --no-hide-public-ip --bind=${VIEWER_BIND} --port=${VIEWER_PORT} --log-dir=${VIEWER_LOG_DIR}
 WorkingDirectory=/opt/decoy
 UMask=0077
 NoNewPrivileges=true
@@ -14,6 +14,7 @@ ReadOnlyPaths=/var/lib/decoy
 RestrictAddressFamilies=AF_INET
 MemoryMax=256M
 TasksMax=32
-Restart=no
+Restart=on-failure
+RestartSec=5
 [Install]
 WantedBy=multi-user.target

deploy/decoy.service

@@ -1,16 +1,19 @@
 [Unit]
 Description=NetScaler decoy HTTP and evidence collector
-After=network-online.target decoy-network.service
-Requires=decoy-network.service
+After=network-online.target
+StartLimitIntervalSec=300
+StartLimitBurst=10
 [Service]
 EnvironmentFile=/etc/decoy.env
 # Simulation only: attacker commands are parsed, stored and answered, never executed.
 # Real execution additionally requires --vm-config + --allow-real-execution and an isolated guest;
 # never enable it on an internet-facing listener. All values come from /etc/decoy.env.
-ExecStart=/usr/bin/python3 /opt/decoy/honeypot.py --bind=${HONEYPOT_BIND} --port=${HONEYPOT_PORT} --proxy-protocol-from=${HONEYPOT_PROXY_PROTOCOL_FROM} --hide-guest-files --trusted-forwarded-from=${HONEYPOT_TRUSTED_FORWARDED_FROM} --fetch-payloads --log-dir=${HONEYPOT_LOG_DIR} --evidence-mib=${HONEYPOT_EVIDENCE_MIB}
+ExecStart=/usr/bin/python3 /opt/decoy/honeypot.py --simulation-only --bind=${HONEYPOT_BIND} --port=${HONEYPOT_PORT} --proxy-protocol-from=${HONEYPOT_PROXY_PROTOCOL_FROM} --hide-guest-files --trusted-forwarded-from=${HONEYPOT_TRUSTED_FORWARDED_FROM} --log-dir=${HONEYPOT_LOG_DIR} --evidence-mib=${HONEYPOT_EVIDENCE_MIB}
 WorkingDirectory=/opt/decoy
 UMask=0077
-Restart=no
+Restart=on-failure
+RestartSec=5
+RestartPreventExitStatus=78
 NoNewPrivileges=true
 PrivateTmp=true
 ProtectSystem=strict