Attacker → Nginx → FastAPI → SQLite ← Sandbox Worker (Docker)
                   (capture)            (polls jobs, writes IOCs)

git clone https://github.com/HelgeSverre/livewire-honeypot.git
cd livewire-honeypot

# Install dependencies
uv sync

# Start the web server (capture-only, no Docker needed)
DATA_DIR=./data uv run uvicorn honeypot.main:app --reload --port 8000

# In a second terminal — start the sandbox worker (requires Docker)
DATA_DIR=./data uv run python -m honeypot.worker

# Run tests
uv run pytest tests/ -v

# 1. Provision a $6/mo droplet (Ubuntu 24.04, 1 GB RAM is enough).
#    On DigitalOcean:
doctl compute droplet create veritron-honeypot \
    --size s-1vcpu-1gb \
    --image ubuntu-24-04-x64 \
    --region fra1 \
    --ssh-keys "$(doctl compute ssh-key list --format ID --no-header | head -1)" \
    --wait

# 2. Point your domain's A record at the droplet IP.
#    Wait for DNS to resolve before continuing.
dig +short your-domain.example   # should return the droplet IP

# 3. Copy the project onto the droplet.
rsync -az --exclude='.git' --exclude='.venv' --exclude='data' \
    ./ root@<droplet-ip>:/opt/honeypot/

# 4. Run the bootstrap script. Passing your domain enables TLS via certbot.
ssh root@<droplet-ip> 'cd /opt/honeypot && [email protected] \
    bash deploy/setup.sh your-domain.example'

# View logs
journalctl -u honeypot -f
journalctl -u honeypot-worker -f

# Restart services
systemctl restart honeypot honeypot-worker

# Upgrade
cd /opt/honeypot && git pull && uv sync
docker build -t honeypot-sandbox sandbox/
systemctl restart honeypot honeypot-worker

# Recent requests
sqlite3 /var/honeypot/captures.db \
  "SELECT timestamp, source_ip, method, path, matched_trap
   FROM requests ORDER BY id DESC LIMIT 20;"

# Unique payloads by frequency
sqlite3 /var/honeypot/captures.db \
  "SELECT sha256, filename, payload_type, times_seen, sandbox_status
   FROM payloads ORDER BY times_seen DESC;"

# Top attacker IPs
sqlite3 /var/honeypot/captures.db \
  "SELECT ip, total_requests, first_seen, last_seen
   FROM attackers ORDER BY total_requests DESC LIMIT 10;"

# Sandbox results with extracted IOCs (JSON)
sqlite3 /var/honeypot/captures.db \
  "SELECT payload_id, exit_code, duration_seconds, c2_urls_found, iocs
   FROM sandbox_runs ORDER BY id DESC LIMIT 5;"

# Pending sandbox jobs
sqlite3 /var/honeypot/captures.db \
  "SELECT id, payload_sha256, status, created_at
   FROM sandbox_jobs ORDER BY id DESC LIMIT 10;"

src/honeypot/
  main.py              # FastAPI web app (capture-only, no Docker)
  worker.py            # Standalone sandbox worker (polls SQLite, needs Docker)
  config.py            # Settings from environment variables
  capture/
    database.py        # Async SQLite — requests, payloads, sandbox_jobs queue
    logger.py          # ASGI middleware — logs every request
    payloads.py        # SHA-256 dedup storage + payload classification
  facade/
    routes.py          # Laravel-fingerprinted pages (login, register, etc.)
    templates/         # Jinja2 HTML with Livewire wire: attributes
    static/            # Fake livewire.js (v3.5.1 fingerprint)
  traps/
    livewire.py        # POST /livewire/message, /upload-file, /preview-file
    php_catchall.py    # Catch-all for *.php probing
  sandbox/
    orchestrator.py    # Docker container lifecycle + hardening
    analyzer.py        # Artifact parsing + IOC extraction + C2 scoring
deploy/
  nginx.conf           # Reverse-proxy with rate limiting
  honeypot.service     # systemd unit (web)
  honeypot-worker.service  # systemd unit (sandbox worker)
  setup.sh             # VPS bootstrap script
sandbox/
  Dockerfile           # Sandbox container image (PHP 8.3 + attacker tools)
  entrypoint.sh        # Container entry-point with LD_PRELOAD network shim