# License heartbeat / portal back-channel
# Use an internal portal URL here because portal.example.com is routed through Core.
license_heartbeat_enabled=true
license_heartbeat_required=true
license_portal_url=http://portal-app:8080
portal_url=http://portal-app:8080
license_activation_token_env=VNETARMOR_ACTIVATION_TOKEN
license_heartbeat_interval_seconds=60
license_heartbeat_failures_before_exit=15
heartbeat_portal_url=http://portal-app:8080

# Startup refresh is best-effort only in single-Core/self-hosted deployments.
# Heartbeat remains the enforcement path after Core is serving traffic.
# In HA deployments, this can be revisited and made strict once Portal is
# reachable independently of this Core instance.
license_startup_refresh_required=true

http_enabled=true
http_port=8100
https_enabled=true
https_port=8443
http_redirect_to_https=true
http_redirect_status=308
frontend_tls_min_version=TLS1.2
frontend_tls_ciphers=
#tls_enabled=true
tls_cert_file=/opt/vnetarmor/ssl-certs-live/fullchain.pem
tls_key_file=/opt/vnetarmor/ssl-certs-live/key.pem

waf_enabled=true
rate_limit_enabled=true
traffic_log_enabled=true
trace_enabled=false

modules_enabled=rate,geo,routes,waf,l4
modules_disabled=

log_headers=true
log_body=true
log_json=true
log_body_enabled=true
pci_redaction_enabled=true
log_query_string=true

log_module_l4_decisions=true
log_module_rate_decisions=true
log_module_geo_decisions=true
log_module_routes_decisions=true
log_module_waf_decisions=true
log_module_body_decisions=true

l4_acls=l4_rules.conf
rate_limits_file=rate_limits.conf
geo_rules_file=geo_rules.conf
routes_file=waf_routes.conf
waf_custom_rule_files=waf_rules.conf
waf_modsec_rule_files=

# GEO resolution order:
#   1) Trusted proxy/CDN country headers, only when remote peer matches trusted_proxy_cidrs
#   2) Local MMDB GeoIP country DB for direct-to-Core traffic
#   3) geo_ip_map.conf manual override/fallback for lab/private/emergency mappings
#   4) UNKNOWN
geo_mmdb_file=/opt/vnetarmor/geo/GeoLite2-Country.mmdb
geo_mmdb_enabled=true
geo_mmdb_path=/opt/vnetarmor/geo/GeoLite2-Country.mmdb
# Optional but recommended for ASN/cloud-provider/datacentre filtering.
# Download GeoLite2-ASN.mmdb separately from MaxMind.
geo_asn_mmdb_file=/opt/vnetarmor/geo/GeoLite2-ASN.mmdb
geo_trust_proxy_headers=true
geo_country_header=X-Country-Code
geo_trusted_proxy_cidrs=127.0.0.1/32,172.16.0.0/12

# -------------------------------------------------
# Protocol / HTTP hardening
# -------------------------------------------------
protocol_hardening_enabled=true

app_log=app.log
data_log=data.log
trace_log=app-trace.log

trusted_proxy_cidrs=
global_default_action=BLOCK

waf_default_action=BLOCK
waf_use_priority_sort=true
waf_re2_enabled=true
waf_prefer_re2=true
waf_regex_engine=auto

backend_pool_file=backends.conf
load_balancing_enabled=true
backend_health_file=backend_health.json

sensitive_headers=authorization,cookie,set-cookie,x-api-key,x-auth-token,proxy-authorization,x-test-card,x-activation-token,activation-token
sensitive_query_keys=token,access_token,id_token,refresh_token,apikey,api_key,key,secret,client_secret,password,passwd,pwd,cvv,cvc,pan,card,cardnumber,session,sessionid,activation_token,x_activation_token,license_token
sensitive_body_keys=cardnumber,pan,card,cvv,cvc,securitycode,track,password,passwd,pwd,secret,pin,token,access_token,refresh_token,client_secret,api_key,apikey,activation_token,x_activation_token,license_token
sensitive_content_types=multipart/form-data,application/octet-stream,application/grpc,application/protobuf
body_log_allow_content_types=application/json,application/x-www-form-urlencoded,text/plain

log_rotate_bytes=10485760
log_retention_days=7
log_retention_days_max=90
log_max_rotated_files=2000
log_flush_each_line=true
log_syslog_style_dirs=false
syslog_forward_enabled=false
syslog_host=127.0.0.1
syslog_port=514
max_body_bytes=1048576
max_request_body_bytes=1048576
max_response_body_bytes=0
body_prefix_cap=4096
body_hex_cap=256
headers_cap=200

rl_client_rps=2
rl_client_burst=2
rl_global_rps=5
rl_global_burst=5
config_poll_ms=1000

waf_body_inspect_bytes=4096
waf_all_headers_max_bytes=16384
waf_prefer_re2=true
waf_use_priority_sort=false
waf_re2_enabled=true

waf_response_mode=both
waf_custom_response_message=Request blocked by security policy