# Copy to .env (git-ignored) or set the same names in the systemd EnvironmentFile
# (/etc/decoy.env). Never commit real addresses, keys or credentials.

# --- Decoy listener (honeypot.py) ---
HONEYPOT_BIND=0.0.0.0
HONEYPOT_PORT=8443
# Exact transport IP allowed to speak PROXY v1 (your source-preserving ingress). Empty disables.
HONEYPOT_PROXY_PROTOCOL_FROM=
# Comma-separated CIDRs whose CF-Connecting-IP / X-Forwarded-For may be trusted
# (edge proxy and reverse-proxy hops only). Empty trusts no forwarded headers.
HONEYPOT_TRUSTED_FORWARDED_FROM=
HONEYPOT_LOG_DIR=/var/lib/decoy/http
HONEYPOT_EVIDENCE_MIB=30720

# --- Source-preserving ingress (ingress_proxy.py) ---
INGRESS_BIND=127.0.0.1
INGRESS_PORT=18443
INGRESS_TARGET=127.0.0.1
INGRESS_TARGET_PORT=19443
# CIDRs allowed to open the origin. Empty = any (not recommended for public use).
INGRESS_ALLOW_FROM=

# --- Local read-only evidence viewer (viewer.py) ---
VIEWER_BIND=127.0.0.1
VIEWER_PORT=8787
VIEWER_LOG_DIR=/var/lib/decoy/http
# Extra client IPs to hide (the host's public IP is auto-detected). Comma-separated.
VIEWER_HIDE_IP=

# --- VM execution backend (optional, isolated guest only) ---
DECOY_VM_CONFIG=/etc/decoy-vm.json