# BigBrother Master Configuration
# Non-sensitive defaults only. Keys, auth tokens, engagement data
# stored in storage/config/ inside LUKS container.
#
# Platform: Orange Pi Zero 3 (primary), RPi Zero 2W (jumpbox), Debian host
# See hardware_tiers.yaml for tier-specific limits.

device:
  platform: "auto"                  # auto | opi_zero3 | pi_zero | generic
  hostname: "iot-sensor-03"         # Matches selected MAC profile
  install_path: "/opt/.cache/bb"    # OPSEC: innocuous install path

network:
  primary_interface: "auto"         # auto-detect active interface
  bridge:
    enabled: false
    internal: "eth0"                # LAN-side (target network)
    external: "eth1"                # WAN-side (uplink)
  wifi:
    interface: "wlan0"
  cellular:
    enabled: false
    modem_device: "/dev/ttyUSB0"    # SIM7600/EC25 via 13-pin header USB
  scope_enforcement: false          # Enforce scope.yaml restrictions
  scope_file: null                  # Path to scope.yaml override

connectivity:
  # WireGuard primary: zero traffic when idle (PersistentKeepalive=0),
  # instant access when operator sends a packet. No beacons, no heartbeats,
  # no coordination servers. Completely silent while idle.
  primary: "wireguard"
  failover_chain:
    - wireguard
    - tailscale
    - reverse_ssh
    - cellular
  wireguard:
    endpoint: ""                    # operator-controlled WG endpoint (host:port)
    private_key_file: "storage/config/wg_private.key"
    peer_public_key: ""
    allowed_ips: "10.99.0.0/24"
  tailscale:
    auth_key: ""                    # Per-engagement auth key
    hostname: ""                    # Matches MAC profile hostname
  reverse_ssh:
    relay_host: ""
    relay_port: 22
    relay_user: "operator"
    key_file: "storage/config/ssh_relay.key"

security:
  encryption: "aes-256-gcm"        # PCAP + credential encryption
  encryption_key_derive: "argon2id" # argon2id | pbkdf2 (RPi Zero 2W)
  luks_container: "storage/encrypted.luks"
  kill_switch_enabled: true
  dead_man_switch:
    enabled: false
    interval_hours: 72              # Auto-wipe if no operator checkin

capture:
  interface: "auto"                 # auto-detect or explicit interface
  snap_length: 65535                # Full packet capture
  pcap_rotation_hours: 1            # Rotate PCAP every hour
  pcap_compression: "zstd"
  pcap_compression_level: 19        # OPi Zero 3: -19 (max). RPi Zero 2W: auto-downgrade to -3
  pcap_format: "pcapng"
  pcap_encryption: true             # AES-256-GCM post-compression
  bpf_filter: "full_capture"        # Reference to data/bpf_filters/<name>.bpf
  disk_max_pct: 85                  # Auto-purge oldest PCAPs above this threshold

stealth:
  mac_profile: "auto"              # auto | streaming | printer | iot | <specific device_name>
  mac_network_type: "auto"         # auto | business | home
  process_disguise: true           # Rename all processes to system service names
  log_suppression: true            # Suppress syslog/auditd/journald evidence
  overlayfs: true                  # Read-only root + tmpfs overlay (SD protection)
  traffic_mimicry: true            # Shape exfil to match baseline patterns

baseline:
  duration_hours: 48               # Traffic baseline collection period
  auto_start: true                 # Begin baseline on first boot

engagement_phase:
  mode: "passive_only"             # passive_only | active_allowed
  passive_days: 7                  # Minimum passive-only observation period
  auto_transition: true            # Auto-allow active after passive_days
  active_allowed_after: null       # ISO timestamp override (manual scheduling)

bettercap:
  binary: "/usr/local/bin/bettercap"
  api_address: "127.0.0.1"        # Localhost only -- never network-visible
  api_port: 8083
  api_user: "admin"
  # api_password generated per-session, stored in memory only
  default_caplet: "passive_recon"
  caplets_path: "config/caplets"