Self-host netgoat

netgoat README

How to install netgoat

MONGO_INITDB_ROOT_USERNAME, MONGO_INITDB_ROOT_PASSWORD

NETGOAT_BOOTSTRAP_USERNAME, NETGOAT_BOOTSTRAP_PASSWORD, API_STREAM_KEY, NETGOAT_ACME_CACHE_KEY, CLOUDFLARE_API_TOKEN, NETGOAT_CHALLENGE_SECRET

go test ./...
go run .

How to configure netgoat

• acmeAutomatic certificate issuance block under ssl: disabled by default, requires accept_tos, an email, an explicit domains allow-list, and NETGOAT_ACME_CACHE_KEY; HTTP-01 via http_port :80.

  Automatic certificate issuance block under ssl: disabled by default, requires accept_tos, an email, an explicit domains allow-list, and NETGOAT_ACME_CACHE_KEY; HTTP-01 via http_port :80.

• allow_insecure_public_http=falseExplicit opt-in for plaintext HTTP on a public address.

  Explicit opt-in for plaintext HTTP on a public address.

  values: true / false

• anomalyOptional local GoatAI inference worker (Keras model + Python script), disabled by default with threshold 0.7.

  Optional local GoatAI inference worker (Keras model + Python script), disabled by default with threshold 0.7.

• apiControl-plane URL, key, poll interval, timeout, and maximum retry interval.

  Control-plane URL, key, poll interval, timeout, and maximum retry interval.

• API_STREAM_KEYEnvironment override for the YAML control-plane key.

  Environment override for the YAML control-plane key.

• api.urlControl-plane URL for configuration streaming; set empty for a fully offline deployment.

  Control-plane URL for configuration streaming; set empty for a fully offline deployment.

• auth.enabled=falseEnable local authentication (cookie or Basic) using bootstrap users.

  Enable local authentication (cookie or Basic) using bootstrap users.

  values: true / false

• bandwidthUpload/download throttling defaults, bytes_per_second 1048576 and burst_bytes 1048576, keyed by ip, host, route, or global; per-route overrides allowed.

  Upload/download throttling defaults, bytes_per_second 1048576 and burst_bytes 1048576, keyed by ip, host, route, or global; per-route overrides allowed.

• bot_authPinned https Web Bot Auth directory allowlist; empty pins fail open to session-bound PoW.

  Pinned https Web Bot Auth directory allowlist; empty pins fail open to session-bound PoW.

• bytes_per_second=1048576Throttle rate in bytes per second (under bandwidth).

  Throttle rate in bytes per second (under bandwidth).

• cacheBounded shared response cache for explicitly public responses; ttl_seconds default 60, max_entries default 1024, max_body_bytes default 1048576, disabled by default; per-route overrides allowed.

  Bounded shared response cache for explicitly public responses; ttl_seconds default 60, max_entries default 1024, max_body_bytes default 1048576, disabled by default; per-route overrides allowed.

• cloudflareOptional Access JWT enforcement and explicit DNS/tunnel startup reconciliation; reconciliation defaults to dry-run.

  Optional Access JWT enforcement and explicit DNS/tunnel startup reconciliation; reconciliation defaults to dry-run.

• cloudflare.access.enabled=falseWhen true, every request to the agent's main listener must carry a valid signed Cloudflare Access assertion.

  When true, every request to the agent's main listener must carry a valid signed Cloudflare Access assertion.

  values: true / false

• CLOUDFLARE_API_TOKENRequired environment-only token for Cloudflare DNS/tunnel reconciliation.

  Required environment-only token for Cloudflare DNS/tunnel reconciliation.

• custom_error_page=public/error.htmlCustom error page served for 403/404/500 responses.

  Custom error page served for 403/404/500 responses.

• dry_run=trueReconciliation writes nothing unless set false (under cloudflare.reconciliation).

  Reconciliation writes nothing unless set false (under cloudflare.reconciliation).

  values: true / false

• dynamic_rulesOrdered administrator-managed TypeScript/JavaScript request decisions; disabled by default, max_execution_milliseconds 25.

  Ordered administrator-managed TypeScript/JavaScript request decisions; disabled by default, max_execution_milliseconds 25.

• healthProbe enablement, interval, timeout, and default path for upstream health checks.

  Probe enablement, interval, timeout, and default path for upstream health checks.

• honeypot=trueHoneypot handling for traffic control.

  Honeypot handling for traffic control.

  values: true / false

• koda_2Optional next-generation anomaly-detection worker; model files downloaded only when enabled.

  Optional next-generation anomaly-detection worker; model files downloaded only when enabled.

• koda_wafOptional ML-enhanced WAF attack classification worker; model files downloaded only when enabled.

  Optional ML-enhanced WAF attack classification worker; model files downloaded only when enabled.

• listen=127.0.0.1:8080Plaintext HTTP bind address when TLS is off; the sample uses loopback. A non-loopback address without TLS is refused unless allow_insecure_public_http is set.

  Plaintext HTTP bind address when TLS is off; the sample uses loopback. A non-loopback address without TLS is refused unless allow_insecure_public_http is set.

• max_concurrent=256Concurrent request ceiling in the queue (under request_queue).

  Concurrent request ceiling in the queue (under request_queue).

• metricsEnables JSON counters at the configured path and Prometheus format at <path>.prom; disabled by default.

  Enables JSON counters at the configured path and Prometheus format at <path>.prom; disabled by default.

• metrics.path=/__netgoat/metricsPath serving JSON metrics.

  Path serving JSON metrics.

• MONGO_INITDB_ROOT_PASSWORDRoot password export for the optional development MongoDB service.

  Root password export for the optional development MongoDB service.

• MONGO_INITDB_ROOT_USERNAMERoot username export for the optional development MongoDB service.

  Root username export for the optional development MongoDB service.

• NETGOAT_ACME_CACHE_KEYBase64-encoded 32-byte key that encrypts ACME account/certificate state.

  Base64-encoded 32-byte key that encrypts ACME account/certificate state.

• NETGOAT_BOOTSTRAP_PASSWORDBootstrap password (at least 12 characters) required with the username before first start.

  Bootstrap password (at least 12 characters) required with the username before first start.

• NETGOAT_BOOTSTRAP_USERNAMEBootstrap admin username, used only while the user table is empty.

  Bootstrap admin username, used only while the user table is empty.

• NETGOAT_CHALLENGE_SECRETHMAC key (alternative name DiamondKey) that binds proof-of-work commitments.

  HMAC key (alternative name DiamondKey) that binds proof-of-work commitments.

• pluginsRestart-only catalog selections for middleware compiled into this exact agent build; sha256 is the release descriptor fingerprint, not a downloaded artifact hash.

  Restart-only catalog selections for middleware compiled into this exact agent build; sha256 is the release descriptor fingerprint, not a downloaded artifact hash.

• poll_interval=5Seconds between control-plane snapshot polls (under api).

  Seconds between control-plane snapshot polls (under api).

• rate_limitGlobal rate-limiting default; each route can override it.

  Global rate-limiting default; each route can override it.

• request_queueBounded in-process request queue for backpressure during traffic spikes.

  Bounded in-process request queue for backpressure during traffic spikes.

• requests_per_minute=120Allowed requests per client per minute (under rate_limit).

  Allowed requests per client per minute (under rate_limit).

• sslStatic fallback TLS, per-domain certificate selection, and optional ACME issuance/renewal; TLS port default :8443.

  Static fallback TLS, per-domain certificate selection, and optional ACME issuance/renewal; TLS port default :8443.

• telemetryOpt-in operational telemetry, disabled by default; endpoint, shared ingestion key, and heartbeat interval.

  Opt-in operational telemetry, disabled by default; endpoint, shared ingestion key, and heartbeat interval.

• TELEMETRY_INGEST_KEYShared ingestion key on the telemetry-server that the agent's ingest_key must match.

  Shared ingestion key on the telemetry-server that the agent's ingest_key must match.

• ttl_seconds=60Cache entry lifetime in seconds (under cache).

  Cache entry lifetime in seconds (under cache).