Action is the result of a matching rule.

Cond wraps a matcher function.

Config represents the top-level configuration file.

Defaults holds optional values inherited by listeners.

Engine evaluates incoming requests against loaded rules.

New rule engine structures inspired by HCL based DSL. Expr represents a boolean expression node.

FieldGetter returns zero or more values for a field.

GalahConfig holds configuration for the Galah deception service.

GalahInfo holds details about a Galah-generated response.

Hub delivers published events to multiple subscribers.

ListenerConfig defines a single listener instance.

Loader manages rule engines and Suricata rule sets.

Logger writes JSONL events to a file or stdout.

Option configures a Parser.

Overrides contains CLI override values applied when a main config is loaded. Zero-value fields are ignored unless the corresponding Set flag is true.

Parser extracts ClientHello records from QUIC Initial packets.

RequestCtx contains request metadata needed for rule evaluation.

Rule is a compiled rule from the HCL file.

RuleSet is a set of compiled rules.

RuleSetInfo describes a rule file and the listeners referencing it.

Server wraps proxyserver.Server and holds minimal configuration.

Server exposes events over Server-Sent Events.

Server exposes administrative endpoints.

Event represents a single request log entry.

TLSConfig holds optional TLS certificate paths.

TarpitConfig configures the tarpit handler.

countingConn wraps a net.Conn and counts the number of times Close is called.

flusherErr wraps http.Flusher with an error-returning FlushErr.

parsedFlags groups additional command line options passed to the runtime.

proxyCache implements a basic LRU cache for HTTP handlers.

ruleHandler evaluates requests using the rule engine before forwarding.

tarpitHandler serves slow drip responses to frustrate scanners.