kyle
099b94979c
Block 6to4/Teredo/NAT64-local/site-local/benchmarking/reserved ranges from the IANA registries (families, not decoded embeds). Guard.DenyPrefixes / -deny-prefix covers hairpin WAN /32s; home addresses stay on-box, not in git. Control is tcp/tcp4/tcp6 only.
21 lines
686 B
TOML
21 lines
686 B
TOML
# sift configuration. P0 uses -listen and -deny-prefix; remaining keys are P1+.
|
|
# This file is an example: the service does not assume Nix store paths.
|
|
|
|
listen = "127.0.0.1:8890"
|
|
|
|
# Extra CIDRs blocked by the SSRF guard (pre-check + Control). Home WAN /32s
|
|
# belong here so a fetch of the public IP cannot hairpin into the LAN.
|
|
# Set on-box; do not commit residential addresses to git.
|
|
# deny_prefixes = ["203.0.113.0/24"]
|
|
|
|
# [upstreams]
|
|
# searxng = "http://127.0.0.1:8888"
|
|
# dixie = "http://dixie.scylla-hammerhead.ts.net:11434/v1"
|
|
# honcho = "http://rift.scylla-hammerhead.ts.net:8000"
|
|
|
|
# user_agent = "sift/dev"
|
|
|
|
# [digest]
|
|
# model = "ornith-1.5-9b-uncensored"
|
|
# thinking = false
|