# Copy to .env or set in ~/.hermes/config.yaml under mcp_servers.opnsense.env
# Create keys in OPNsense: System → Access → Users → API keys

OPNSENSE_URL=https://10.77.30.1:40443
OPNSENSE_API_KEY=REPLACE_WITH_YOUR_API_KEY
OPNSENSE_API_SECRET=REPLACE_WITH_YOUR_API_SECRET
OPNSENSE_VERIFY_SSL=false
OPNSENSE_TIMEOUT=60

# Safety — enable writes only when ready
OPNSENSE_ALLOW_WRITES=false
OPNSENSE_DRY_RUN=false
OPNSENSE_REQUIRE_DESCRIPTION_PREFIX=mcp:
OPNSENSE_BLOCK_WAN_INBOUND_ANY=true
OPNSENSE_AUDIT_LOG_PATH=/root/.hermes/logs/opnsense-mcp-audit.jsonl