.env.example

# ─────────────────────────────────────────────────────────────
#  Ghost Reaper — Environment Configuration
#  Copy this file to .env and fill in your values.
# ─────────────────────────────────────────────────────────────

# ── LLM Configuration (REQUIRED) ──────────────────────────────
# Provider options: openai, deepseek, groq, together, mistral, anthropic, ollama, custom
LLM_PROVIDER=openai
LLM_API_KEY=sk-your-api-key-here
LLM_MODEL=gpt-4o

# For custom/self-hosted providers, set the base URL:
# LLM_BASE_URL=http://localhost:11434/v1

# ── Threat Intelligence Feeds (OPTIONAL) ──────────────────────
# Leave blank to disable. Feeds degrade gracefully if missing.
ABUSEIPDB_API_KEY=
VIRUSTOTAL_API_KEY=
SHODAN_API_KEY=

# ── Agent Tuning (OPTIONAL) ───────────────────────────────────
# How often each agent runs its scan (seconds)
SENTINEL_INTERVAL=15
ENTROPY_INTERVAL=30
BEHAVIOR_INTERVAL=20
HONEYPOT_INTERVAL=10

# Extra directories for entropy scanning (comma-separated)
# ENTROPY_WATCH_DIRS=/home/user/uploads,/var/www/html

# Directory where canary files are deployed
# HONEYPOT_DIR=/home/user/.ghost-reaper/canaries

# Decoy ports for the honeypot listener (comma-separated)
# HONEYPOT_PORTS=21,23,3389