Skip to content
SecBeat

CLI & Environment Reference

Overview

Section titled “Overview”

SecBeat uses environment variables for runtime configuration. There are no command-line flags.

Mitigation Node

Section titled “Mitigation Node”

Basic Usage

Section titled “Basic Usage”
Terminal window
# Run with default config detection
./mitigation-node


# Run with specific config
SECBEAT_CONFIG=config.prod ./mitigation-node

Environment Variables

Section titled “Environment Variables”
VariableDescriptionDefault
SECBEAT_CONFIGConfig file name (without .toml extension)Auto-detect
MITIGATION_CONFIGLegacy config name (fallback)DEPLOYMENT_ENV detection
DEPLOYMENT_ENVEnvironment (production or development)Auto-detect
RUST_LOGLog level filterinfo
SYN_COOKIE_SECRETSecret for SYN cookie generationRequired in production
MANAGEMENT_API_KEYAPI authentication keyRequired in production
SECBEAT_AUTO_GENERATE_CERTSAuto-generate TLS certs (dev only)false
SECBEAT_HOSTNAMEHostname for generated certslocalhost

Configuration File Resolution

Section titled “Configuration File Resolution”

The mitigation node searches for config files in this order:

  1. {SECBEAT_CONFIG}.toml (root directory)
  2. mitigation-node/config/{SECBEAT_CONFIG}.toml
  3. mitigation-node/config/default.toml (final fallback)

Operation Modes

Section titled “Operation Modes”

Set via [platform].mode or [mitigation].operation_mode in config:

ModeDescriptionRequirements
tcpBasic TCP proxyNone
synSYN flood protectionLinux, CAP_NET_RAW
l7Full HTTP/TLS/WAFNone
autoAuto-detect from featuresNone

Examples

Section titled “Examples”
Terminal window
# Development
SECBEAT_CONFIG=config.dev RUST_LOG=debug ./mitigation-node


# Production
SECBEAT_CONFIG=config.prod \
  SYN_COOKIE_SECRET=$(cat /etc/secbeat/secrets/syn-cookie) \
  MANAGEMENT_API_KEY=$(cat /etc/secbeat/secrets/api-key) \
  RUST_LOG=info \
  ./mitigation-node


# Docker
docker run -d \
  -e SECBEAT_CONFIG=config.prod \
  -e SYN_COOKIE_SECRET=your-secret \
  -e RUST_LOG=info \
  secbeat/mitigation-node:latest

Orchestrator

Section titled “Orchestrator”

Basic Usage

Section titled “Basic Usage”
Terminal window
./orchestrator-node

Configuration

Section titled “Configuration”

The orchestrator currently uses hardcoded defaults. Configuration via environment variables or files is planned for a future release.

SettingDefault Value
API bind address127.0.0.1:3030
Metrics address127.0.0.1:9091
NATS URLnats://127.0.0.1:4222
Heartbeat timeout30 seconds
Min fleet size1
Scale up CPU threshold80%
Scale down CPU threshold30%

Environment Variables

Section titled “Environment Variables”
VariableDescription
RUST_LOGLog level filter

:::caution Work in Progress The orchestrator is under active development. External configuration support will be added in a future release. :::

Logging Configuration

Section titled “Logging Configuration”

RUST_LOG Syntax

Section titled “RUST_LOG Syntax”
Terminal window
# Global level
RUST_LOG=debug


# Module-specific
RUST_LOG=mitigation_node=debug,hyper=warn


# Trace specific components
RUST_LOG=mitigation_node::syn_proxy=trace,mitigation_node::waf=debug

Log Levels

Section titled “Log Levels”
LevelDescription
errorCritical errors only
warnWarnings and errors
infoStandard operational logs
debugDetailed debugging info
traceVery verbose tracing

Systemd Service

Section titled “Systemd Service”

Service File

Section titled “Service File”
[Unit]
Description=SecBeat Mitigation Node
After=network.target nats.service


[Service]
Type=simple
User=secbeat
Group=secbeat
WorkingDirectory=/opt/secbeat
ExecStart=/usr/local/bin/mitigation-node


# Environment
Environment="SECBEAT_CONFIG=config.prod"
Environment="RUST_LOG=info"
EnvironmentFile=/etc/secbeat/secrets.env


# Security
AmbientCapabilities=CAP_NET_RAW CAP_NET_ADMIN
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ReadWritePaths=/var/log/secbeat


Restart=always
RestartSec=10


[Install]
WantedBy=multi-user.target

Secrets File

Section titled “Secrets File”

Create /etc/secbeat/secrets.env:

Terminal window
SYN_COOKIE_SECRET=your-32-byte-hex-secret
MANAGEMENT_API_KEY=your-api-key
ORCHESTRATOR_API_KEY=your-orchestrator-key

Service Management

Section titled “Service Management”
Terminal window
# Start service
sudo systemctl start secbeat-mitigation


# Enable on boot
sudo systemctl enable secbeat-mitigation


# Check status
sudo systemctl status secbeat-mitigation


# View logs
sudo journalctl -u secbeat-mitigation -f

Docker Commands

Section titled “Docker Commands”

Build Image

Section titled “Build Image”
Terminal window
docker build -t secbeat/mitigation-node:latest .

Run Container

Section titled “Run Container”
Terminal window
docker run -d \
  --name secbeat \
  -p 8443:8443 \
  -p 9090:9090 \
  -p 9191:9191 \
  -p 9999:9999 \
  -v /path/to/config.prod.toml:/app/config.prod.toml:ro \
  -v /path/to/certs:/app/certs:ro \
  -e SECBEAT_CONFIG=config.prod \
  -e RUST_LOG=info \
  -e SYN_COOKIE_SECRET=your-secret \
  secbeat/mitigation-node:latest

Docker Compose

Section titled “Docker Compose”
Terminal window
# Start all services
docker-compose up -d


# View logs
docker-compose logs -f mitigation-node


# Stop services
docker-compose down

Troubleshooting

Section titled “Troubleshooting”

Check Listening Ports

Section titled “Check Listening Ports”
Terminal window
sudo lsof -i :8443
sudo netstat -tlnp | grep mitigation-node

Verify Capabilities

Section titled “Verify Capabilities”
Terminal window
# Check capabilities
getcap /usr/local/bin/mitigation-node


# Set capabilities for SYN proxy
sudo setcap cap_net_raw,cap_net_admin+ep /usr/local/bin/mitigation-node

Test Endpoints

Section titled “Test Endpoints”
Terminal window
# Health check
curl http://localhost:9999/api/v1/status


# Metrics
curl http://localhost:9191/metrics


# HTTPS proxy
curl -k https://localhost:8443/

Debug Logging

Section titled “Debug Logging”
Terminal window
# Maximum verbosity
RUST_LOG=trace SECBEAT_CONFIG=config.dev ./mitigation-node 2>&1 | tee debug.log

Next Steps

Section titled “Next Steps”