# /etc/opsec/opsec.conf — Central OPSEC Configuration
# Shell-sourceable KEY="value" format. All scripts source this file.
# Edit via: sudo opsec-config.sh (interactive TUI)
# Manual edits: source /usr/local/lib/opsec/opsec-lib.sh && opsec_set_value KEY "value"

# ─── ACTIVE PROFILE ────────────────────────────────────────────────────────────
PROFILE_NAME="default"

# ─── TOR SETTINGS ──────────────────────────────────────────────────────────────
TOR_CIRCUIT_ROTATION="30"
TOR_BLACKLIST=""
TOR_STRICT_NODES="1"
TOR_ISOLATION="1"
TOR_PADDING="1"
TOR_SOCKS_PORT="9050"
TOR_DNS_PORT="5353"
TOR_NUM_GUARDS="3"
TOR_SAFE_LOGGING="1"

# ─── DNS SETTINGS ──────────────────────────────────────────────────────────────
# Mode: tor | quad9 | cloudflare | doh | dot | custom
DNS_MODE="tor"
DNS_CUSTOM_SERVERS=""

# ─── KILL SWITCH ───────────────────────────────────────────────────────────────
KILLSWITCH_ALLOW_DHCP="1"
KILLSWITCH_ALLOW_OPENVPN="1"
KILLSWITCH_ALLOW_WIREGUARD="1"
KILLSWITCH_EXTRA_PORTS=""

# ─── MAC ADDRESS ───────────────────────────────────────────────────────────────
# Interfaces: auto (all non-lo) or comma-separated list (e.g. "eth0,wlan0")
MAC_INTERFACES="auto"
# Vendor spoof: empty for random, or OUI prefix (e.g. "00:1A:2B" for specific vendor)
MAC_VENDOR_SPOOF=""

# ─── HOSTNAME ──────────────────────────────────────────────────────────────────
# Pattern: desktop | random | custom
HOSTNAME_PATTERN="desktop"
HOSTNAME_CUSTOM_PREFIX=""

# ─── SYSTEM HARDENING ──────────────────────────────────────────────────────────
HARDEN_IPV6="1"
HARDEN_SWAP="1"
HARDEN_CORE_DUMPS="1"
HARDEN_CLIPBOARD_CLEAR="0"
HARDEN_SCREEN_LOCK="1"
HARDEN_SCREEN_LOCK_TIMEOUT="300"
HARDEN_TIMEZONE_SPOOF="0"
HARDEN_TIMEZONE_VALUE="UTC"
HARDEN_LOCALE_SPOOF="0"
HARDEN_LOCALE_VALUE="en_US.UTF-8"

# ─── LEAK PREVENTION ──────────────────────────────────────────────────────────
LEAK_WEBRTC_BLOCK="1"
LEAK_USB_BLOCK="0"

# ─── MONITORING ────────────────────────────────────────────────────────────────
MONITOR_PROCESSES="0"
MONITOR_LOG_ROTATION="1"
LOG_ROTATION_HOURS="4"

# ─── TRAFFIC SHAPING ──────────────────────────────────────────────────────────
TRAFFIC_JITTER_ENABLED="0"
TRAFFIC_JITTER_MS="50"

# ─── LEVEL TYPE ───────────────────────────────────────────────────────────────
# standard = privacy base, ghost mode toggle available
# paranoid = ghost mode always on, cannot disable
LEVEL_TYPE="standard"

# ─── BASE STATE (always active in standard mode) ─────────────────────────────
BASE_DNS="quad9"
BASE_MAC_RANDOMIZE="1"
BASE_IPV6_DISABLE="1"

# ─── TOR BRIDGES ──────────────────────────────────────────────────────────────
# Mode: off | obfs4 | meek-azure | snowflake
TOR_BRIDGE_MODE="off"
TOR_BRIDGE_RELAY=""

# ─── SECURE DELETION ──────────────────────────────────────────────────────────
# Method: auto | shred | fstrim | luks
WIPE_METHOD="auto"

# ─── DEPLOYMENT LEVEL ─────────────────────────────────────────────────────────
# Level: bare-metal-standard | bare-metal-paranoid | cloud-normal | cloud-paranoid
DEPLOYMENT_LEVEL="bare-metal-standard"

# ─── TERMINAL BANNER ──────────────────────────────────────────────────────────
# Mode: compact | full | auto | off
OPSEC_BANNER="compact"

# ─── WIDGET THEME ────────────────────────────────────────────────────────────
# Theme: default | aurora | ember | slate | cyberpunk | frost | terminal
WIDGET_THEME="default"