example.env

# Path to the Tempesta config file with predefined TFT-blocked hashes.
# This file is also used to add new blocking hashes.
PATH_TO_TFT_CONFIG="/etc/tempesta/fw/tft/blocked.conf"

# Path to the Tempesta config file with predefined TFH-blocked hashes.
# This file is also used to add new blocking hashes.
PATH_TO_TFH_CONFIG="/etc/tempesta/fw/tfh/blocked.conf"

# ClickHouse server host where Tempesta FW stores access logs.
CLICKHOUSE_HOST="127.0.0.1"

# Clickhouse server port
CLICKHOUSE_PORT=8123

# Clickhouse server user
CLICKHOUSE_USER="default"

# Clickhouse server password
CLICKHOUSE_PASSWORD=""

# Clickhouse access log table name
CLICKHOUSE_TABLE_NAME="access_log"

# Clickhouse server database
CLICKHOUSE_DATABASE="default"

# Allow to load persistent users
PERSISTENT_USERS_ALLOW=True

# Defines how far back (in minutes) to look when loading persistent users.
# For example: 60 means starting from 60 minutes ago.
PERSISTENT_USERS_WINDOW_OFFSET_MIN=60

# Defines the window size (in minutes) for loading persistent users.
# For example: 60
# Used together with 'PERSISTENT_USERS_WINDOW_OFFSET_MIN'.
# Example: setting both 'PERSISTENT_USERS_WINDOW_OFFSET_MIN = 60' and
# 'PERSISTENT_USERS_WINDOW_DURATION_MIN = 60' will load users active during the last hour.
PERSISTENT_USERS_WINDOW_DURATION_MIN=60

# The activated detector shold be used. Each of one define the way how to dermine
# risky users.
#
# ip_rps        - Fetch users by IP who generate the highest RPS (requests per second) traffic.
# ip_time       - Fetch users by IP who generate traffic with the highest accumulated response time.
# ip_errors     - Fetch users by IP who generate traffic with the highest number of response errors.
# tft_rps      - Fetch users by TFT-hashes who generate the highest RPS (requests per second) traffic.
# tft_time     - Fetch users by TFT-hashes who generate traffic with the highest accumulated response time.
# tft_errors   - Fetch users by TFT-hashes who generate traffic with the highest number of response errors.
# tfh_rps      - Fetch users by TFH-hashes who generate the highest RPS (requests per second) traffic.
# tfh_time     - Fetch users by TFH-hashes who generate traffic with the highest accumulated response time.
# tfh_errors   - Fetch users by TFH-hashes who generate traffic with the highest number of response errors.
# geoip         - Fetch users by cities who generate traffic with the highest RPS and block all users from those cities.
DETECTORS=["tft_rps","tft_time","tft_errors"]

# Defines how the WebShield should block users. Multiple values can be set.
# Possible values: tft, tfh, ipset, nftables
#
# tft      – Blocks users by their TFT fingerprint based on TLS connection data.
# tfh      – Blocks users by their TFH fingerprint based on HTTP request data.
# ipset     – Blocks users by IP using IPSet and iptables.
# nftables  – Blocks users by IP using nftables.
BLOCKING_TYPES=["tft"]

# The duration of the time interval during which users are fetched
# for traffic analysis. Used in combination with the `start_at` position.
# For example, if start_at = 2025-01-01 00:00:00 and BLOCKING_WINDOW_DURATION_SEC = 10,
# users should be fetched for the period 2025-01-01 00:00:00 to 2025-01-01 00:00:10
BLOCKING_WINDOW_DURATION_SEC=10

# The name of the blocked IPs group in IPSet,
# and the corresponding group name for blocked IPs in nftables.
BLOCKING_IPSET_NAME="tempesta_blocked_ips"

# The minimum time (in minutes) a user should remain blocked.
# The block will be lifted after this time has elapsed.
BLOCKING_TIME_MIN=60

# The time interval (in minutes) for checking whether blocked users
# should be released.
BLOCKING_RELEASE_TIME_MIN=1

# Defines training mode.
# Possible values: off / historical / real
#
# off        – Disables training mode and immediately starts protection
#              using default thresholds from the config.
#
# historical – Calculates thresholds based on a historical time period.
#
# real       – Waits to collect live client activity,
#              then calculates thresholds.
TRAINING_MODE="off"

# Defines duration of the waiting period in "real" mode,
# during which the WebShield collects data before calculating thresholds.
TRAINING_MODE_DURATION_MIN=10

# The configuration parameter of the IP_RPS detector. Installs the default RPS threshold.
DETECTOR_IP_RPS_DEFAULT_THRESHOLD=10

# The configuration parameter of the IP_RPS detector. Defines the difference between two user groups.
# If the last users group generates DETECTOR_IP_RPS_INTERSECTION_PERCENT times more traffic than the previous one,
# some of those users should be blocked.
DETECTOR_IP_RPS_INTERSECTION_PERCENT=10

# The configuration parameter of the IP_RPS detector. Defines the number of
# users that can be blocked per check.
DETECTOR_IP_RPS_BLOCK_USERS_PER_ITERATION=100

# The configuration parameter of the IP_TIME detector. Installs the default
# accumulative time threshold.
DETECTOR_IP_TIME_DEFAULT_THRESHOLD=10

# The configuration parameter of the IP_TIME detector. Defines the difference between two user groups.
# If the last users group generates DETECTOR_IP_TIME_INTERSECTION_PERCENT times more traffic than the previous one,
# some of those users should be blocked.
DETECTOR_IP_TIME_INTERSECTION_PERCENT=10

# The configuration parameter of the IP_TIME detector. Defines the number of
# users that can be blocked per check.
DETECTOR_IP_TIME_BLOCK_USERS_PER_ITERATION=100

# The configuration parameter of the IP_ERRORS detector. Installs the default error responses threshold.
DETECTOR_IP_ERRORS_DEFAULT_THRESHOLD=10

# The configuration parameter of the IP_ERRORS detector. Defines the difference between two user groups.
# If the last users group generates DETECTOR_IP_ERRORS_INTERSECTION_PERCENT times more traffic than the previous one,
# some of those users should be blocked.
DETECTOR_IP_ERRORS_INTERSECTION_PERCENT=10

# The configuration parameter of the IP_ERRORS detector. Defines the number of
# users that can be blocked per check.
DETECTOR_IP_ERRORS_BLOCK_USERS_PER_ITERATION=100

# The configuration parameter of the IP_ERRORS detector. Defines the list of whitelisted response
# status codes that should be ignored by the filters.
DETECTOR_IP_ERRORS_ALLOWED_STATUSES=[100,101,200,201,204,300,301,302,303,304,305,307,308,400,401,403]

# The configuration parameter of the TFT_RPS detector. Installs the default RPS threshold.
DETECTOR_TFT_RPS_DEFAULT_THRESHOLD=10

# The configuration parameter of the TFT_RPS detector. Defines the difference between two user groups.
# If the last users group generates DETECTOR_TFT_RPS_INTERSECTION_PERCENT times more traffic than the previous one,
# some of those users should be blocked.
DETECTOR_TFT_RPS_INTERSECTION_PERCENT=10

# The configuration parameter of the TFT_RPS detector. Defines the number of
# users that can be blocked per check.
DETECTOR_TFT_RPS_BLOCK_USERS_PER_ITERATION=100

# The configuration parameter of the TFT_TIME detector. Installs the default
# accumulative time threshold.
DETECTOR_TFT_TIME_DEFAULT_THRESHOLD=10

# The configuration parameter of the TFT_TIME detector. Defines the difference between two user groups.
# If the last users group generates DETECTOR_TFT_TIME_INTERSECTION_PERCENT times more traffic than the previous one,
# some of those users should be blocked.
DETECTOR_TFT_TIME_INTERSECTION_PERCENT=10

# The configuration parameter of the TFT_TIME detector. Defines the number of
# users that can be blocked per check.
DETECTOR_TFT_TIME_BLOCK_USERS_PER_ITERATION=100

# The configuration parameter of the TFT_ERRORS detector. Installs the default error responses threshold.
DETECTOR_TFT_ERRORS_DEFAULT_THRESHOLD=10

# The configuration parameter of the TFT_ERRORS detector. Defines the difference between two user groups.
# If the last users group generates DETECTOR_TFT_ERRORS_INTERSECTION_PERCENT times more traffic than the previous one,
# some of those users should be blocked.
DETECTOR_TFT_ERRORS_INTERSECTION_PERCENT=10

# The configuration parameter of the TFT_ERRORS detector. Defines the number of
# users that can be blocked per check.
DETECTOR_TFT_ERRORS_BLOCK_USERS_PER_ITERATION=100

# The configuration parameter of the TFT_ERRORS detector. Defines the list of whitelisted response
# status codes that should be ignored by the filters.
DETECTOR_TFT_ERRORS_ALLOWED_STATUSES=[100,101,200,201,204,300,301,302,303,304,305,307,308,400,401,403]

# The configuration parameter of the TFH_RPS detector. Installs the default RPS threshold.
DETECTOR_TFH_RPS_DEFAULT_THRESHOLD=10

# The configuration parameter of the TFH_RPS detector. Defines the difference between two user groups.
# If the last users group generates DETECTOR_TFH_RPS_INTERSECTION_PERCENT times more traffic than the previous one,
# some of those users should be blocked.
DETECTOR_TFH_RPS_INTERSECTION_PERCENT=10

# The configuration parameter of the TFH_RPS detector. Defines the number of
# users that can be blocked per check.
DETECTOR_TFH_RPS_BLOCK_USERS_PER_ITERATION=100

# The configuration parameter of the TFH_TIME detector. Installs the default
# accumulative time threshold.
DETECTOR_TFH_TIME_DEFAULT_THRESHOLD=10

# The configuration parameter of the TFH_TIME detector. Defines the difference between two user groups.
# If the last users group generates DETECTOR_TFH_TIME_INTERSECTION_PERCENT times more traffic than the previous one,
# some of those users should be blocked.
DETECTOR_TFH_TIME_INTERSECTION_PERCENT=10

# The configuration parameter of the TFH_TIME detector. Defines the number of
# users that can be blocked per check.
DETECTOR_TFH_TIME_BLOCK_USERS_PER_ITERATION=100

# The configuration parameter of the TFH_ERRORS detector. Installs the default error responses threshold.
DETECTOR_TFH_ERRORS_DEFAULT_THRESHOLD=10

# The configuration parameter of the TFH_ERRORS detector. Defines the difference between two user groups.
# If the last users group generates DETECTOR_TFH_ERRORS_INTERSECTION_PERCENT times more traffic than the previous one,
# some of those users should be blocked.
DETECTOR_TFH_ERRORS_INTERSECTION_PERCENT=10

# The configuration parameter of the TFH_ERRORS detector. Defines the number of
# users that can be blocked per check.
DETECTOR_TFH_ERRORS_BLOCK_USERS_PER_ITERATION=100

# The configuration parameter of the TFH_ERRORS detector. Defines the list of whitelisted response
# status codes that should be ignored by the filters.
DETECTOR_TFH_ERRORS_ALLOWED_STATUSES=[100,101,200,201,204,300,301,302,303,304,305,307,308,400,401,403]

# The configuration parameter of the GEOIP detector. Installs the default RPS threshold.
DETECTOR_GEOIP_RPS_DEFAULT_THRESHOLD=10

# The configuration parameter of the GEOIP detector. Defines the difference between two user groups.
# If the last users group generates DETECTOR_TF_RPS_INTERSECTION_PERCENT times more traffic than the previous one,
# some of those users should be blocked.
DETECTOR_GEOIP_INTERSECTION_PERCENT=10

# The configuration parameter of the GEOIP detector. Defines the number of
# users that can be blocked per check.
DETECTOR_GEOIP_BLOCK_USERS_PER_ITERATION=100

# The GeoIP detector config parameter that defines the path to the MaxMind City GeoIP database.
DETECTOR_GEOIP_PATH_TO_DB='/etc/tempesta/webshield/city.db'

# The GeoIP detector config parameter that defines path to the text file with the whitelisted city names
DETECTOR_GEOIP_PATH_ALLOWED_CITIES_LIST="/etc/tempesta/webshield/allowed_cities.txt"

# Path to the Tempesta executable file, if it was installed manually
# or in a non-default directory. By default, the WebShield
# reloads Tempesta FW using systemctl.
TEMPESTA_EXECUTABLE_PATH=""

# Path to the Tempesta Config file, if it was install manually
TEMPESTA_CONFIG_PATH=""

# Path to the file containing a list of protected User-Agents.
# Requests with these User-Agents should be ignored during a DDoS attack.
# One User-Agent per line.
ALLOWED_USER_AGENTS_FILE_PATH="/etc/tempesta/webshield/allow_user_agents.txt"

# List of public whitelist bots (e.g. Google Crawler).
# Load them into the database and skip by detectors.
# Assume that traffic from these sources is legitimate.
# Currently only "google" is supported.
BOTS_WHITE_LIST_ALLOWED=["google"]

# List of Python source files that define custom
# whitelist bot network parsers. Example:
# BOTS_WHITE_LIST_EXTERNAL_SOURCES=["/home/ubuntu/parser.py"]
BOTS_WHITE_LIST_EXTERNAL_SOURCES=[]

# Application logging level
LOG_LEVEL="INFO"