# This is a config file with the default values commented out. If a modification
# is required, then uncomment the corresponding parameter, change its value and
# save the file without '.sample' extension
#
# Path to the unix socket for communication with the webshield
# socket=/var/run/imunify360/libiplists-daemon.sock

# Path to the unix socket for communication with the imunify360 (check ip lists)
# ip_list_socket=/var/run/defence360agent/iplist.sock
#
# Path to the unix socket for communication with the Agent
# agent_socket_path=/var/run/defence360agent/generic_sensor.sock.2
#
# Log file path
# WARNING! This option is DEPRECATED and does not change the path.
# log=/var/log/imunify360/imunify360-wafd.log

# Sentry error reporting endpoint
# It is expected to be as an URL or "off"
# sentry=https://4892d955ecd14fff8e49dccac045500e@im360.sentry.cloudlinux.com/13

# Path to imunify360 merged config. Capgcha keys and other corresponding wafd
# pieces of configuration are taken from there
# imunify_config_path=/etc/sysconfig/imunify360/imunify360-merged.config

# Path to imunify360 socket. It's used for sending captcha processing
# statistics to imunify360.
# imunify_socket_path=/var/run/defence360agent/protobuf.sock

# ipset lists. They processed according to priorities, from lowest to highest.
# Please pay attention to funny prefixes like 'ipv6://' or 'list://': they
# are expected to separate different types of ipsets in the code and actually
# is stripped later from the ipset name itself
#
# Remote proxies ipsets, which are known CDNs. These IPs are always allowed,
# priority 2
# remote_proxy_ipset=i360.ipv4.remote_proxy,i360.ipv4.remote_proxy_static,ipv6://i360.ipv6.remote_proxy,ipv6://i360.ipv6.remote_proxy_static
#
# IPSETs with locally whitelisted IP addresses, priorities from 4 to 8.
# whitelist_ipset=i360.ipv4.whitelist.full_access,i360.ipv4.whitelist.host_ips,i360.ipv4.i360_whitelist.static,i360.ipv4.whitelist.custom,i360.ipv4.whitelist,list://i360.ipv4.white.sync,ipv6://i360.ipv6.whitelist.full_access,ipv6://i360.ipv6.whitelist.host_ips,ipv6://i360.ipv6.i360_whitelist.static,ipv6://i360.ipv6.whitelist.custom,ipv6://i360.ipv6.whitelist,list://i360.ipv6.white.sync
#
# IPSETs with locally blacklisted IP addresses, priority 10.
# Access from these IPs is denied unless they are processed in ipsets with higher
# priorities
# blacklist_local_ipset=i360.ipv4.blacklist,i360.ipv4.blacklist.custom,ipv6://i360.ipv6.blacklist,ipv6://i360.ipv6.blacklist.custom
#
# IPSETs with globally whitelisted IP addresses, priority 12. They are allowed
# unless they are banned at the higher IPSET levels.
# whitelist_static_ipset=i360.ipv4.whitelist.static,ipv6://i360.ipv6.whitelist.static
#
# IPSETs with globally blacklisted IP addresses, priority 14. They are banned
# unless they are allowed at the higher IPSET levels.
# blacklist_ipset=list://i360.ipv4.drop.sync,list://i360.ipv6.drop.sync
#
# IPs in ignorelist IPSETs are completely ignored and passed to the destination
# unless banned at the higher IPSET levels. IP can get into ignorelist after
# it successfully passed the captcha challenge from the graylisted
# subnet: while the subnet itself stays in graylist, the IP gets would not face
# the challenge next time. Priority 20.
# ignorelist_ipset=i360.ipv4.ignorelist,ipv6://i360.ipv6.ignorelist
#
# IPs in graylist IPSETs are shown reCAPTCHA challenge. When they successfully
# pass the challenge, they get 'whitelisted' or 'ignorelisted'. Priority 20 but they
# are processed AFTER ignore lists.
# graylist_ipset=list://i360.ipv4.captcha.sync,i360.ipv4.graylist,list://i360.ipv6.captcha.sync,ipv6://i360.ipv6.graylist
#
# IPs in splash IPSETs are shown javascript challenge, which is processed
# automatically if a client has a decent JS engine. These IPs are not whitelisted
# afterwards. Priority 20 but they are processed AFTER graylist IPSETs.
# splash_ipset=list://i360.ipv4.splashscreen.sync,i360.ipv4.graysplashlist,list://i360.ipv6.splashscreen.sync,ipv6://i360.ipv6.graysplashlist

# The total IPSET response processing time (milliseconds). After this time
# goes out, the processing gets halted, request is considered failed and an error is returned.
# response_total_timeout_ms=1900

# Time to wait for the free connection from pool, ms
# query_batch_wait_ms=1000

# Even if the IPSET processing times out, it continues its awaiting of reply
# to eventually make use of it (e.g. to be put it into cache). This is the
# number of requests that are allowed to complete. After this number is exceeded,
# all new requests are cancelled immediately and an error returned.
# pending_requests_max=1000

# Number of worker threads to communicate to netlink. By default number of CPUs
# multipled by 10
# ipset_workers_num=

# Url for sending statistics
# stat_sending_url=https://api.imunify360.com/api/v2/send-message/GENERAL_METRICS

# Token file (used in sending statistics data)
# tokenPath=/var/imunify360/iaid-token

# Statistics send interfal, seconds
# stat_sending_interval=600

# Delay metrics slots. Predefined time slots to measure to split netlink response
# time into. Only four values are allowed, in milliseconds
# delay_metric_slots_ms=100,500,1000,2000

# The time we cache found country ipsets, in seconds
# country_check_interval=90

# Timeout in seconds before restarting socket listening after accept error
# socket_retry_timeout=5

# Number of listening restart attempts
# socket_retry_limit=10

# Google reCaptcha server URL
# captchaServerUrl=https://www.google.com/recaptcha/api/siteverify

# Static assets directory. Wafd keeps its templates, translations files there
# static_assets_path=/usr/share/imunify360-wafd

# Whitelist descriptions path is the JSON file that describes different whitelisted IP addresses
# whitelist_description_path=/var/imunify360/files/whitelist/v2/description.json

# Path for Unified Access Logger unix socket path. It's used for collecting statistics
# UAL_socket_path=/var/run/imunify360-webshield-unified_access_logger.socket

# Show splash screen instead of captcha for requests geolocated as China.
# splash_as_captcha=off

# Trust requests which comes from Ezoic CDN (which have 'x-middleton' in their headers).
# trust_ezoic=off

# Splash keys (trusted and untrusted) path
# splash_keys_path=/etc/imunify360-webshield/webshield-http.conf.d/wscheckdata.conf

# do not show splashscreen challenge for requests from CloudFlare (e.g. because of caching issues)
# disable_splash_for_cloudflare=no

# add random part to URL after passing JS challenge to prevent caching
# append_random_query=no

# do not show splashscreen imunify360 spinning logo
# disable_splash_screen_logo=no