packetyeeter-analyzer.default

# PacketYeeter Analyzer Configuration
# Copy to /etc/default/packetyeeter-analyzer

# gRPC listen address for collectors
LISTEN_ADDR=0.0.0.0:9090

# Prometheus metrics HTTP listen address. Bind to loopback or a trusted
# management network unless Prometheus reaches this host over protected links.
METRICS_ADDR=:9091

# GeoIP ASN database path
GEOIP_ASN_PATH=/var/lib/GeoIP/GeoLite2-ASN.mmdb

# Optional: GeoLite2-Country.mmdb or GeoLite2-City.mmdb for country-level
# enrichment (powers the Inspector's "Threats by Country" panel). Not set by
# default since it requires a separate MaxMind download; add it via
# EXTRA_ARGS below if you have one, e.g.:
#   EXTRA_ARGS=-geoip-country /var/lib/GeoIP/GeoLite2-Country.mmdb

# Threat intelligence uses the free, keyless Shodan InternetDB API (no API key required)

# All optional/conditional analyzer flags go through EXTRA_ARGS. The unit
# file's ExecStart uses plain systemd variable substitution only (no bash
# ${VAR:+...} conditionals - systemd does not run ExecStart through a shell
# and does not support that syntax), so combine every optional flag you want
# into a single EXTRA_ARGS line, e.g.:
#   EXTRA_ARGS=-dry-run -reputation-threshold 75 -v
#
# Operational safety: start new deployments with -dry-run, keep the inspector
# on loopback or behind trusted access controls, and enable pprof only briefly.
# EXTRA_ARGS=-dry-run -inspect-addr 127.0.0.1:9092

# Reputation thresholds
# EXTRA_ARGS=-reputation-threshold 75

# Enable verbose logging
# EXTRA_ARGS=-v