infynon --version

# Recommended (all platforms — no Rust required)
npm install -g infynon

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/d4rkNinja/infynon-cli/main/scripts/install.sh | bash

# Windows (PowerShell)
irm https://raw.githubusercontent.com/d4rkNinja/infynon-cli/main/scripts/install.ps1 | iex

# Build from source (requires Rust)
cargo install --git https://github.com/d4rkNinja/infynon-cli

# 1. Initialize config
infynon init --port 8080 --upstream 127.0.0.1 --upstream-port 3000

# 2. Start the firewall
infynon start

# Architecture:
# Internet → INFYNON :8080 → [IP Filter → Rate Limiter → WAF → Rules] → Backend :3000

infynon start                              # With TUI dashboard
infynon start --headless                   # Without TUI (for servers)
infynon start --config /path/to/infynon.toml  # Custom config
infynon start --port 9090                  # Override port

infynon monitor                            # Open TUI dashboard
infynon logs                               # View recent logs
infynon logs --follow                      # Stream live
infynon logs --verdict block --since 1h    # Recent blocks
infynon logs --ip 10.0.0.1                # Filter by IP

infynon block 10.0.0.1                    # Block immediately
infynon unblock 10.0.0.1                  # Remove from blocklist
# Also available in TUI: view 4 (IP Inspector), keys b/u

infynon rules list                         # List all rules + hit counts
infynon rules enable <name>                # Enable a rule
infynon rules disable <name>               # Disable a rule

infynon status                             # Show current settings
infynon config check                       # Validate config file
infynon config show                        # Show effective config with defaults

# === Server ===
listen = "0.0.0.0"
port = 8080
upstream = "127.0.0.1:3000"

# === Multi-Upstream Routing ===
# Route specific paths to different backends
[[upstreams]]
path_prefix = "/api/v2"
target = "127.0.0.1:4000"
strip_prefix = true

[[upstreams]]
path_prefix = "/static"
target = "127.0.0.1:8001"
strip_prefix = false

# === WAF (Web Application Firewall) ===
[waf]
enabled = true
max_url_length = 2048              # Block URLs longer than this
max_body_size = 1048576            # 1MB max body
allowed_methods = ["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS", "HEAD"]
blocked_extensions = [".php", ".asp", ".jsp", ".cgi"]
blocked_paths = ["/admin", "/.env", "/wp-login", "/.git", "/phpMyAdmin"]
allowed_content_types = ["application/json", "application/x-www-form-urlencoded", "multipart/form-data"]

# Built-in WAF patterns (42 compiled regex patterns):
# - SQLi: 13 patterns (UNION SELECT, OR 1=1, etc.)
# - XSS: 12 patterns (<script>, javascript:, onerror, etc.)
# - Path Traversal: 10 patterns (../, %2e%2e, etc.)
# - Command Injection: 4 patterns (;ls, |cat, etc.)
# - Header Injection: 3 patterns (\r\n, %0d%0a, etc.)

# === Rate Limiting ===
[rate_limit]
requests_per_second = 100          # Global limit
per_ip_per_second = 10             # Per source IP
per_path_per_second = 50           # Per URL path

# === IP Filtering ===
[ip_filter]
blocked_ips = ["10.0.0.1"]        # Specific IPs
allowed_ips = ["192.168.1.0/24"]  # CIDR ranges
auto_ban_threshold = 50            # Auto-block after N blocked requests

# === Custom Rules ===
[[rules]]
name = "block-scanners"
priority = 1
action = "Block"
conditions = [
  { type = "UserAgent", pattern = ".*sqlmap.*" }
]

[[rules]]
name = "rate-limit-api"
priority = 2
action = "RateLimit"
conditions = [
  { type = "PathPrefix", value = "/api" },
  { type = "Method", value = "POST" }
]

[[rules]]
name = "allow-healthcheck"
priority = 0
action = "Allow"
conditions = [
  { type = "PathExact", value = "/health" },
  { type = "IP", value = "10.0.0.0/8" }
]

# === Email Alerts ===
[email]
enabled = true
smtp_host = "smtp.gmail.com"
smtp_port = 587
smtp_user = "you@gmail.com"
smtp_pass = "app-password"
from = "firewall@yourdomain.com"
to = ["admin@yourdomain.com"]
block_threshold = 100              # Alert after N blocks