# Host-side agent config for the web UI's host network settings page
# (spec §15, FR-15.2.7). Used by `wago-sim hostnet-agent --config ...`.
#
# This file lives on the DOCKER HOST (not inside the container), e.g.
# /etc/wago-sim/hostnet.yaml. The agent must run as root or with
# CAP_NET_ADMIN; the whitelist is the safety rail that keeps the
# privileged surface as small as the FAT bench needs.
#
# socket: the Unix domain socket the container connects through.
#   docker-compose.yml mounts /run/wago-sim read-write into the
#   simulator container, which is why this path is fixed by default.
#   The agent refuses to start with an empty whitelist.
socket: /run/wago-sim/hostnet.sock

# whitelist: interfaces the settings page may manipulate. Operations
#   on any other interface are refused by the agent and surfaced as
#   errors on the page (FR-15.2.5). List the bench NIC(s) only.
whitelist:
  - enp3s0
  - eth0

# backend: how the agent performs changes on the host.
#   iproute2 — the `ip` tool (+ pyroute2 for reads when installed);
#              the production backend for Linux bench hosts (v1)
#   fake    — in-memory model: rehearses FAT cases and demos the page
#              without touching any real interface
backend: iproute2

# audit_path: optional file for the single-line audit trail in
#   addition to the service log (stdout/journald, FR-12.2.6). The
#   directory is created if missing; leave out to log only.
audit_path: /var/log/wago-sim/hostnet-audit.log