You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
| ↪️ **redirect**| Gets forwarded to a real URL | Looks like a totally normal short link |
53
53
| 🪞 **clone**| The cloned preview of a target, then forwarded to it | Making a link unfurl exactly like the real thing |
54
-
| 🎨 **custom**| Your hand-crafted preview + a redirect *or* your own HTML | Suggesting a believable fake page |
54
+
| 🎨 **custom**| Your hand-crafted preview plus a redirect *or* your own HTML | Suggesting a believable fake page |
55
55
| 🎭 **decoy**| A friendly "loading…" page | A soft landing that reveals nothing |
56
56
57
57
> [!NOTE]
58
-
> 🔔 Whatever the type, every single open is logged with the full metadata — the visitor just never
59
-
> notices a thing.
58
+
> 🔔 Whatever the type, every single open is logged with the full metadata, and the visitor just
59
+
> never notices a thing.
60
60
61
61
62
62
# 🔍 What Gets Captured
63
63
64
64
Every hit records the juicy details:
65
65
66
-
- 🌐 **Full IP chain** —`X-Forwarded-For`, `CF-Connecting-IP`, `X-Real-IP`, and the socket address
67
-
- 📍 **Geo & network** — country, city, region, ISP, org, ASN (via [ip-api.com](https://ip-api.com), can be turned off)
68
-
- 🧭 **Client fingerprint** — browser, version, OS, device, engine (parsed from the User-Agent)
69
-
- 🗣️ **Headers & hints** — referer, `Accept-Language`, and the complete raw request headers
70
-
- 🤖 **Bot verdict** — human or bot, plus the heuristic reason it decided that
66
+
- 🌐 **Full IP chain**:`X-Forwarded-For`, `CF-Connecting-IP`, `X-Real-IP`, and the socket address
67
+
- 📍 **Geo & network**: country, city, region, ISP, org, ASN (via [ip-api.com](https://ip-api.com), can be turned off)
68
+
- 🧭 **Client fingerprint**: browser, version, OS, device, engine (parsed from the User-Agent)
69
+
- 🗣️ **Headers & hints**: referer, `Accept-Language`, and the complete raw request headers
70
+
- 🤖 **Bot verdict**: human or bot, plus the heuristic reason it decided that
71
71
72
72
73
73
# 📦 Installation
74
74
75
-
Two easy ways to get going — grab the container, or run it from source. 🎉
75
+
Two easy ways to get going: grab the container, or run it from source. 🎉
76
76
77
77
78
78
# 🐳 Docker (the easy way)
@@ -91,7 +91,7 @@ docker run -d --name honey \
91
91
Then open **http://localhost:3000** and start setting traps! 🍯
92
92
93
93
- 🔌 Listens on `:3000` (change with `-e PORT=`), binds `0.0.0.0`, runs as a non-root user
94
-
- 💾 Trap & hit data lives in `/app/.data` — mount a volume to keep it across restarts
94
+
- 💾 Trap & hit data lives in `/app/.data`, so mount a volume to keep it across restarts
95
95
- ❤️ Built-in healthcheck hits `/api/traps` so your orchestrator knows when it's ready
96
96
- 🏷️ Tags available: `latest`, `sha-<short>`, and semver (`1.2.3`, `1.2`) on `v*` releases
97
97
@@ -123,7 +123,7 @@ node .output/server/index.mjs
123
123
124
124
> [!IMPORTANT]
125
125
> Put hon.ey behind a reverse proxy (nginx / Caddy / Traefik) so `X-Forwarded-For` carries the
126
-
> *real* client IP — otherwise every hit looks like it came from your proxy. 🤷
126
+
> *real* client IP. Otherwise every hit looks like it came from your proxy. 🤷
127
127
128
128
129
129
# ⚙️ Configuration
@@ -132,8 +132,8 @@ A couple of environment variables, that's all:
132
132
133
133
| Variable | Default | What it does |
134
134
|----------|---------|--------------|
135
-
|`NUXT_PUBLIC_BASE_URL`|*(empty)*| The public base URL for your tracking links. Set it to your domain (e.g. `https://honey.example.com`) so copied URLs point at the right place. Empty → falls back to the browser's current origin. |
136
-
|`NUXT_GEO_LOOKUP`|`true`| Outbound IP → geo enrichment via ip-api.com. Set `false` to stay 100% local with zero outbound calls. |
135
+
|`NUXT_PUBLIC_BASE_URL`|*(empty)*| The public base URL for your tracking links. Set it to your domain (e.g. `https://honey.example.com`) so copied URLs point at the right place. If empty, it falls back to the browser's current origin. |
136
+
|`NUXT_GEO_LOOKUP`|`true`| Outbound IP to geo enrichment via ip-api.com. Set `false` to stay 100% local with zero outbound calls. |
137
137
|`PORT`|`3000`| Port the server listens on. |
138
138
|`HOST`|`0.0.0.0`| Bind address. |
139
139
@@ -144,23 +144,23 @@ There's a ready-to-copy [`.env.example`](.env.example) too. 📝
144
144
145
145
hon.ey ships with three friendly screens:
146
146
147
-
- 🪤 **Traps** — your command center. Create traps, copy their URLs, see hit counts at a glance.
148
-
- 📡 **Live Feed** — every recent visitor across all traps, auto-refreshing so you don't have to.
149
-
- 🔎 **Trap Detail** — the full hit timeline with expandable metadata, plus the link-preview card for clone/custom traps.
147
+
- 🪤 **Traps**: your command center. Create traps, copy their URLs, see hit counts at a glance.
148
+
- 📡 **Live Feed**: every recent visitor across all traps, auto-refreshing so you don't have to.
149
+
- 🔎 **Trap Detail**: the full hit timeline with expandable metadata, plus the link-preview card for clone/custom traps.
150
150
151
151
Want to design a fake preview? The **Custom Preview Builder** lets you type a title, description and
152
-
image URL and watch the social-card preview update live — then pick whether humans get redirected or
152
+
image URL and watch the social-card preview update live, then pick whether humans get redirected or
153
153
shown your own HTML. 🪄
154
154
155
155
156
156
# 🛠️ Tech Stack
157
157
158
158
Built with the good stuff:
159
159
160
-
- ⚡ **[Nuxt 4](https://nuxt.com) + [Vue 3](https://vuejs.org)** — SSR app & Nitro server in one
160
+
- ⚡ **[Nuxt 4](https://nuxt.com) + [Vue 3](https://vuejs.org)**: SSR app & Nitro server in one
161
161
- 🎀 **[@nuxt/icon](https://github.com/nuxt/icon)** with the [Lucide](https://lucide.dev) set (bundled locally, no CDN)
162
-
- 🧩 **[unstorage](https://unstorage.unjs.io)** — file-based persistence, nothing else to install
163
-
- 🐳 **Multi-stage Docker**+ GitHub Actions → GHCR
162
+
- 🧩 **[unstorage](https://unstorage.unjs.io)**: file-based persistence, nothing else to install
163
+
- 🐳 **Multi-stage Docker**plus GitHub Actions to GHCR
164
164
165
165
166
166
# ⚠️ Legal & Ethical Note
@@ -169,9 +169,9 @@ hon.ey is a **defensive** instrument. Only deploy it on assets and networks you
169
169
explicitly authorized to monitor. The geo lookup sends visitor IPs to a third-party API (disable it
170
170
if that's a concern), the `clone` and `custom` traps can reproduce or fabricate link previews, and
171
171
the `custom` trap renders operator-authored HTML verbatim. Don't use any of this to deceive or
172
-
impersonate third parties — that crosses into phishing and is illegal in most places. 🙏
172
+
impersonate third parties, because that crosses into phishing and is illegal in most places. 🙏
0 commit comments