# ==============================================================================
# JA4proxy v2.0 — Environment Template
# ==============================================================================
# This file serves as the blueprint for your .env file.
# Run 'make init' to generate a secure, project-specific .env automatically.

# ── 1. PROJECT IDENTITY ───────────────────────────────────────────────────────
# Unique name for this instance (prefixes Docker resources).
COMPOSE_PROJECT_NAME=ja4proxy

# ── 2. UPSTREAM BACKEND ───────────────────────────────────────────────────────
# The real server protected by JA4proxy.
BACKEND_HOST=backend
BACKEND_PORT=443

# ── 3. OPERATIONAL MODES ──────────────────────────────────────────────────────
# development | staging | production
ENVIRONMENT=development
# DEBUG | INFO | WARNING | ERROR
LOG_LEVEL=INFO

# ── 4. PERFORMANCE TUNING ─────────────────────────────────────────────────────
# (Reserved for future use)

# ── 5. NETWORK BINDINGS ───────────────────────────────────────────────────────
# Bind address for host port mappings (default: 127.0.0.1).
AGENT_BIND_IP=127.0.0.1

# Default Ingress Ports
HOST_PORT_INGRESS=443
HOST_PORT_DIRECT=8081

# Management & Analytics
HOST_PORT_MANAGEMENT=8090
# HTTPS port for management Caddy TLS sidecar (phase-511). Loopback-only by
# default — access via SSH tunnel. Caddy auto-generates a self-signed cert.
MGMT_TLS_PORT=8444
HOST_PORT_ANALYTICS=8085

# Monitoring (Prometheus/Grafana)
HOST_PORT_STATS=8404
HOST_PORT_METRICS=9090
HOST_PORT_PROMETHEUS=9091
HOST_PORT_ALERTMANAGER=9093
HOST_PORT_GRAFANA=3000

# Host interface the passive JA4 tap listens on (docker-compose.prod.yml only).
# This is NOT a secret, but it IS deployment-specific: point it at the SPAN /
# mirror port carrying the traffic you want fingerprinted. The placeholder
# below keeps `docker compose config` valid for a fresh clone; change it before
# running the prod tap, or the tap will listen on the wrong interface and see
# nothing.
TAP_INTERFACE=eth0

# ── 6. SECURITY SECRETS (Placeholders — generated by init) ────────────────────
# Replace every REPLACE_ME_SECURELY below, or run the setup wizard (`ja4p init`)
# which generates them. Suggested: `openssl rand -hex 32` (or -base64 32 for JWT).
REDIS_PASSWORD=REPLACE_ME_SECURELY
# Password for the dedicated analytics Redis user (phase-236; required by the
# analytics service in docker-compose.{poc,prod}.yml). Must be set or compose
# build/up fails: `ANALYTICS_REDIS_PASSWORD is required`.
ANALYTICS_REDIS_PASSWORD=REPLACE_ME_SECURELY
# Password for the dedicated management Redis ACL user. The console used to
# connect as `default`, which the ACL config turns off — so it authenticated
# with the wrong credential and every page 500'd. It now connects as
# `management`, which makes this variable required by
# docker-compose.{poc,prod}.yml: compose fails with
# `MANAGEMENT_REDIS_PASSWORD is required` if it is unset.
MANAGEMENT_REDIS_PASSWORD=REPLACE_ME_SECURELY
# Shared HMAC-SHA256 secret the proxy uses to sign connection events on the
# events:connection stream and the analytics node uses to verify them
# (phase-826). Both services must have the SAME value: a mismatch is not a
# crash, it silently discards 100% of events and the console's Intelligence
# panel stays empty while everything reports healthy.
ANALYTICS_HMAC_SECRET=REPLACE_ME_SECURELY
# Password for the dedicated `exporter` Redis ACL user, used by redis-exporter
# in docker-compose.monitoring.yml. Required there — without it the monitoring
# stack cannot start from a fresh clone.
EXPORTER_REDIS_PASSWORD=REPLACE_ME_SECURELY
REDIS_SIGNING_KEY=REPLACE_ME_SECURELY
MANAGEMENT_JWT_SECRET=REPLACE_ME_SECURELY
MANAGEMENT_ADMIN_USER=admin
MANAGEMENT_ADMIN_PASSWORD=REPLACE_ME_SECURELY
GRAFANA_PASSWORD=REPLACE_ME_SECURELY
# HAProxy stats auth — REQUIRED by docker-compose.monitoring.yml (the HAProxy
# exporter authenticates with these). Phase 301: previously missing from this
# template, so `cp template.env .env` without the wizard broke the monitoring
# stack. Generate: `openssl rand -hex 16`.
HAPROXY_STATS_USER=ja4proxy
HAPROXY_STATS_PASSWORD=REPLACE_ME_SECURELY

# ── 7. OPTIONAL: threat-intel providers (leave unset/commented to disable) ────
# Each provider is disabled when its key is unset. Uncomment + set to enable.
# ABUSEIPDB_API_KEY=
# OTX_API_KEY=
# GREYNOISE_API_KEY=
# VIRUSTOTAL_API_KEY=
# MISP_API_KEY=

# ── 8. OPTIONAL: debug/forensic modes ────────────────────────────────────────
# Enable trace logging (default: false).
# JA4PROXY_TRACE=false
# Enable forensic mode (default: false).
# JA4PROXY_FORENSIC=false