serverguard:
  minecraft:
    service-name: minecraft
    process-name: paper-1.21.11.jar
    jar-file: paper-1.21.11.jar
    working-dir: /opt/minecraft
    java-opts: -Xms4G -Xmx4G
    check-interval-seconds: 5
    rcon:
      enabled: true
      host: localhost
      port: 25575
      password: ${RCON_PASSWORD:}

  monitor:
    tps-threshold: 15
    cpu-threshold: 80.0
    memory-threshold: 85.0
    connection-threshold: 50
    log-watch-lines: 100
    log-path: /opt/minecraft/logs/latest.log

  alert:
    enabled: true
    email:
      smtp-host: smtp.qq.com
      smtp-port: 587
      username: ${ALUER_ALERT_SMTP_USERNAME:}
      password: ${ALUER_ALERT_SMTP_PASSWORD:}
      to:
        - ${ALUER_ALERT_EMAIL_PRIMARY:}
        - ${ALUER_ALERT_EMAIL_SECONDARY:}
      rate-limit:
        per-type-seconds: 300
        max-emails-per-minute: 10

  ai:
    enabled: true
    use-isolation-forest: true
    use-prediction: true
    sliding-window-size: 100
    anomaly-threshold: 0.7
    prediction-horizon-minutes: 60
    deepseek:
      enabled: true
      api-key: ${DEEPSEEK_API_KEY:}
      base-url: ${DEEPSEEK_BASE_URL:https://api.deepseek.com}
      model: ${DEEPSEEK_MODEL:deepseek-chat}
      max-tokens: 1000
      temperature: 0.35
      auto-analyze-alerts: true
      analysis-interval-seconds: 45
      auto-execute:
        enabled: true
        ban-ip: true
        kill-entity: true
        clear-lag: true
        set-spawn-rate: true
        kick-player: true
        whitelist: true
        min-confidence: 88

  security:
    enabled: true
    auto-ban-vpn: true
    check-on-login: true
    max-connections-per-ip: 3
    block-common-exploits: true
    log-all-commands: true
    anti-intrusion:
      enabled: true
      monitor-commands: true
      monitor-processes: true
      monitor-files: true
      monitor-plugins: true
      monitor-systemd: true
      monitor-rcon: true
      file-integrity:
        enabled: true
        max-depth: 5
    host-enforcement:
      enabled: true
      dry-run: true
      preferred-backend: auto
      default-block-minutes: 60
      default-rate-limit-per-minute: 120
      mirror-to-cloud-edge: true
    cloud-edge:
      enabled: false
      dry-run: true
      provider: cloudflare
      zone-id: ${ALUER_CLOUDFLARE_ZONE_ID:}
      api-key: ${ALUER_CLOUDFLARE_API_KEY:}
      api-email: ${ALUER_CLOUDFLARE_EMAIL:}
      default-block-mode: block
      default-challenge-mode: challenge
      enable-under-attack-on-critical: true
    orchestration:
      enabled: true
      allow-local-block: true
      allow-edge-challenge: true
      allow-minecraft-defense: true
      notify-on-critical: true
    autonomy:
      enabled: true
      deepseek-dominant: true
      quiet-console: true
      loop-interval-seconds: 45
      min-risk-score-for-action: 70
      critical-risk-score: 90
      workflow-cooldown-seconds: 180
      max-actions-per-hour: 12
      require-second-signal-for-containment: true
    shield:
      enabled: true
      auto-mode: true
      auto-enable-under-attack: true
      heat-trigger: 78
      resonance-trigger: 72
      threat-score-trigger: 85
      edge-challenge-offender-limit: 6
      shelter-rate-limit-per-minute: 45
      attacker-notice-enabled: true
      deterrence-message: Your source has been identified, recorded, and isolated by Aluer.
    kernel:
      enabled: true
      pulse-interval-seconds: 30
      pulse-history-size: 180
      journal-size: 300
      echo-retention-minutes: 180
      adaptive-weights: true
      directive-heat-threshold: 60
      lockdown-heat-threshold: 82
    task-bus:
      enabled: true
      auto-dispatch: true
      dispatch-interval-seconds: 10
      queue-limit: 200
      history-limit: 300
    self-healing:
      enabled: true
      dry-run: true
      loop-interval-seconds: 45
      auto-backup-before-recovery: true
      auto-whitelist-on-swarm: true
      allow-soft-restart: true
      tps-emergency-threshold: 12
      cpu-emergency-threshold: 92.0
      memory-emergency-threshold: 95.0
      max-recovery-actions-per-hour: 8

      super-evolution:
        # === v3.1 超进化安全模块开关 ===
        jwt-auth: true                    # JWT身份认证与令牌管理
        brute-force: true                 # 暴力破解防护（多时间窗口检测）
        anti-bot: true                    # 反机器人检测（Bot名称/加入速率/IP关联）
        reverse-shell: true               # 反向Shell检测（50+ shell模式匹配）
        arp-spoof: true                   # ARP欺骗检测（MAC变更/网关伪造）
        dns-tunnel: true                  # DNS隧道检测（熵值/Base32编码/可疑TLD）
        exploit-signature: true           # 漏洞签名检测（Log4Shell/SQLi/RCE等15种）
        ssrf: true                        # SSRF防护（内网IP/云元数据/协议限制）
        xxe: true                         # XXE防护（实体注入/Billion Laughs检测）
        csp: true                         # CSP安全头强制执行（8种响应头）
        database-firewall: true           # 数据库防火墙（SQL注入/联合查询/时间盲注）
        dlp: true                         # 数据防泄漏（12种敏感信息规则+自动脱敏）
        memory-protection: true           # JVM内存保护（堆/GC/内存泄漏检测）
        process-injection: true           # 进程注入检测（/proc扫描/线程异常）
        secure-delete: true               # 安全文件删除（多道覆写DoD标准）
        forensics: true                   # 取证收集（进程/网络/日志快照）
        incident-response: true           # 事件响应（5种预定义响应剧本）
        threat-hunting: true              # 威胁狩猎（10种狩猎定义/5个类别）
        compliance: true                  # 合规扫描（7类20+检查项）
        anti-grief: true                  # 反破坏检测（方块破坏率/TNT/纵火/偷箱）
        # === v3.2 Minecraft专属模块开关 ===
        anti-xray: true                   # X-ray透视检测（钻石比/直线挖掘/暗处精准）
        anti-fly: true                    # 飞行外挂检测（垂直/水平速度/悬空时间）
        anti-dupe: true                   # 物品复制检测（堆叠异常/高价值暴涨/9种复制法）
        crash-exploit: true               # 崩溃漏洞防护（超大包/NBT炸弹/书与笔攻击）
        lag-machine: true                 # 卡服机检测（Observer链/TNT堆/红石密度）
        # === v3.3 新模块开关 ===
        geo-block: true                   # 地理IP封锁（按国家/地区拦截）
        session-validation: true          # 玩家会话验证（UUID伪造/正版/离线检测）
        plugin-verification: true         # 插件完整性校验（Hash对比/未授权修改）
        connection-throttle: true         # 连接速率限制（IP/时间窗口/递增延迟）
        backup-integrity: true            # 备份完整性校验（SHA-256/文件计数/大小对比）
        anti-skin-spoof: true             # 皮肤伪造检测（模型数据异常/皮肤URL检测）

  dashboard:
    enabled: true
    title: Aluer Nebula Console
    subtitle: PaperMC defense, recovery, and remote operations fabric
    refresh-interval-seconds: 6
    compact-terminal: true
    ssh-gateway:
      enabled: true
      session-timeout-minutes: 30
      max-sessions: 6
      command-timeout-seconds: 25
      strict-host-key-checking: false
      allow-private-key-paste: true
      require-engine-handshake: true
      handshake-ttl-seconds: 30

  webhook:
    enabled: false
    discord-url: ${ALUER_WEBHOOK_DISCORD:}
    slack-url: ${ALUER_WEBHOOK_SLACK:}

  report:
    dir: ./reports

server:
  port: 8080

spring:
  shell:
    interactive:
      enabled: true
    command:
      init:
        delay: 0

logging:
  level:
    root: INFO
    com.aluer: INFO
  file:
    name: /var/log/serverguard.log