.env.example

# =============================================================================
# go — LLM honeypot persona
# =============================================================================
# An SSH frontend terminates attacker connections and forwards each typed
# command as an ARCP job; an LLM agent hallucinates plausible shell output and
# streams it back. Per-attacker persona state survives reconnects via
# ARCP's session.resume + on-disk job store.
# -----------------------------------------------------------------------------

# --- LLM ---------------------------------------------------------------------
OLLAMA_MODEL=qwen2.5:1.5b-instruct
OLLAMA_URL=http://ollama:11434
OLLAMA_KEEP_ALIVE=5m
OLLAMA_HOST_PORT=11434

# --- ARCP --------------------------------------------------------------------
ARCP_SDK_VERSION=latest
ARCP_RUNTIME_HOST=0.0.0.0
ARCP_RUNTIME_PORT=8080
ARCP_RUNTIME_PATH=/arcp
ARCP_AUTH_TOKEN=dev-token-change-me
ARCP_CLIENT_NAME=honeypot-dashboard
ARCP_CLIENT_VERSION=1.0.0
ARCP_AGENT_NAME=honeypot.shell

# --- Honeypot ----------------------------------------------------------------
HONEYPOT_SSH_PORT=2222
HONEYPOT_HOSTNAME=debian-prod-04
HONEYPOT_PERSONA=ubuntu-22.04-stale
HONEYPOT_IDLE_TTL=24h
# Per-attacker USD budget. 0.00 disables enforcement (do not deploy that way).
HONEYPOT_PER_SESSION_BUDGET_USD=0.10
HONEYPOT_MAX_TOKENS=256
HONEYPOT_DROP_DIR=/loot

# Runtime storage so persona survives resume.
RUNTIME_STORE_DIR=/data

LOG_LEVEL=info