Operations
Deployment, hardening, configuration and runbooks for the honeypot system
Operations covers the parts that decide whether detection survives a bad day: how the two stacks are
placed, which credentials isolate the pools, what the router does when state is missing, and how to
recover without guessing. The defaults below match ids/.env.example and are safe to start
from, not to leave unchanged.
Operational Domains
- Deployment: Two-host and single-host topologies.
- Deception layer: Choosing the honeypot layer — reverse-proxy pools (default, isolates file/upload/RCE as well as data-layer attacks) or the lighter database layer (one eshop, DB swapped per request).
- Monitoring: Observability, dashboards, alerting.
- Hardening: Production security recommendations.
- Runbooks: Troubleshooting and incident procedures.
- Routing & Pooling: Router decision pipeline, honeypot pool assignment, session management.
Deployment Topologies
Routing, Pooling and Identity
How a request is routed, how a session is bound to a pool and how the consent-gated signature works are described once, where they are designed:
- Request Pipeline — the routing stages in
router.lua, in order. - Pooling System and Honeypot Engine — exclusive assignment, spare provisioning, borrowing, reuse at the resource limit and idle retirement.
- Lua Internals → Pool Assignment — the Redis keys and atomic claim behind it.
- Device & GDPR Signature — the full consent-gated identity flow and its settings.
Configuration Reference (from init.lua)
| Section | Key | Default | Description |
|---|---|---|---|
| threat | honeypot_threshold | 80 | Minimum score for honeypot routing |
| threat | max_risk_score | 100 | Hard cap on accumulated score |
| threat | ip_reputation_cap | 10 | Max reputation contribution on shared addresses |
| threat | score_decay_half_life_seconds | 300s | Half-life for score decay (0 = disabled) |
| threat | decay_offense_slowdown | 0.75 | Half-life multiplier per offense |
| threat | permaflag_offenses | 5 | Offenses at/above this → no decay |
| threat | permaflag_score | 100 | Score at/above this → permaflag |
| session | max_idle_time | 3600s | Session TTL |
| session | tamper_score | 50 | Score added for tampered cookies |
| abuseipdb | confidence_minimum | 90 | Bulk feed confidence threshold |
| abuseipdb | daily_check_limit | 1000 | Free-tier daily cap on on-demand checks |
| abuseipdb | blacklist_enabled | false | Bulk blacklist pull opt-in |
| internal_test_secret | — | from env | Gates diagnostic headers (fail closed when unset) |
Honest Assessment
Strengths: Explainable detection, pure/adapter split, per-adversary isolation, elastic pools, no tarpit, privacy-preserving identity, honeytoken injection.
Limitations: Same-host testing gap, decay complexity, NAT protection trade-off, admin-ajax complexity, pool scaling limits, threshold tuning, no dashboard health monitoring, honeytoken coverage (5 types), rule-based detection, Redis dependency, GDPR key requirement.