Refactor web_scan.py for improved readability and maintainability; add cron job script for npm log backups; update start.ps1 for consistent formatting.
This commit is contained in:
zwitschi committed
1 parent
0d1cd21468
commit
c2eba88ac8
113 files changed
+772606
-772579
No files matched your search
+84
-84
@@ -1,85 +1,85 @@
|
||||
# ---------------------------------------------------------------------------
|
||||
# Intrusion Detection System — environment template
|
||||
# ---------------------------------------------------------------------------
|
||||
# Copy this file to `.env` for local development and fill in your values:
|
||||
#
|
||||
# copy .env.example .env
|
||||
#
|
||||
# Precedence: real system environment variables win over values in `.env`,
|
||||
# so production deployments can set these via the OS and skip `.env`.
|
||||
# `.env` is git-ignored — never commit real secrets to it.
|
||||
|
||||
# --- Web server (localhost only) -------------------------------------------------
|
||||
|
||||
# The Flask web UI binds to localhost so it is only reachable from this machine.
|
||||
# Do not expose WEB_HOST beyond 127.0.0.1!
|
||||
WEB_HOST=127.0.0.1
|
||||
# Please choose a very high port number (e.g. 54666) to avoid conflicts with other services.
|
||||
WEB_PORT=54666
|
||||
|
||||
# --- Log sources -----------------------------------------------------------
|
||||
|
||||
# Directory containing copyparty access logs (YYYY-MM-DD.txt files).
|
||||
COPYPARTY_LOG_PATH=P:\copyparty
|
||||
|
||||
# Directory containing Nginx Proxy Manager proxy logs (.log / .gz files).
|
||||
NPM_LOG_PATH=Y:\npm\logs
|
||||
|
||||
# --- MikroTik RouterOS connection -----------------------------------------
|
||||
|
||||
# IP/hostname of the router to sync the blocklist to.
|
||||
ROUTER_IP=192.168.88.1
|
||||
|
||||
# SSH user for the router.
|
||||
ROUTER_USER=admin
|
||||
|
||||
# SSH password for the router (required when --update-firewall is used).
|
||||
ROUTER_PASSWORD=change-me
|
||||
|
||||
# Address list on the router that holds blocked IPs/subnets.
|
||||
BLOCKLIST_NAME=Blocked
|
||||
|
||||
# Comma-separated address lists that are treated as whitelisted (never blocked).
|
||||
WHITELIST_NAMES=Cloudflare,Openfactory
|
||||
|
||||
# --- WHOIS subnet consolidation --------------------------------------------
|
||||
|
||||
WHOIS_SERVER=whois.radb.net
|
||||
WHOIS_PORT=43
|
||||
WHOIS_TIMEOUT=3.0
|
||||
|
||||
# Minimum number of same-subnet IPs before blocking the whole subnet.
|
||||
SUBNET_THRESHOLD=3
|
||||
|
||||
# --- Report retention ------------------------------------------------------
|
||||
|
||||
# Each subdirectory under /reports/ keeps at most REPORT_RETENTION_MAX_FILES
|
||||
# files, all newer than REPORT_RETENTION_DAYS days. Older timestamped reports
|
||||
# are pruned automatically after each consolidated scan. The blocklist files
|
||||
# in reports/app/data/ are always protected.
|
||||
REPORT_RETENTION_DAYS=30
|
||||
REPORT_RETENTION_MAX_FILES=10
|
||||
|
||||
# --- Scan / flagging defaults ----------------------------------------------
|
||||
|
||||
# Rows in the top-IP report tables.
|
||||
DEFAULT_TOP=30
|
||||
|
||||
# copyparty: minimum denied hits before flagging an IP.
|
||||
DEFAULT_MIN_DENIED=1
|
||||
|
||||
# npm: minimum error responses before flagging an IP.
|
||||
DEFAULT_MIN_ERRORS=5
|
||||
|
||||
# npm: minimum error ratio before flagging an IP.
|
||||
DEFAULT_ERROR_RATIO=0.5
|
||||
|
||||
# Rows in the "top error paths" report section.
|
||||
DEFAULT_TOP_PATHS=20
|
||||
|
||||
# --- Whitelist sources -----------------------------------------------------
|
||||
|
||||
OPENFACTORY_URL=https://openfactory.net/geofeed.csv
|
||||
CLOUDFLARE_URL_V4=https://www.cloudflare.com/ips-v4
|
||||
CLOUDFLARE_URL_V6=https://www.cloudflare.com/ips-v6
|
||||
# ---------------------------------------------------------------------------
|
||||
# Intrusion Detection System — environment template
|
||||
# ---------------------------------------------------------------------------
|
||||
# Copy this file to `.env` for local development and fill in your values:
|
||||
#
|
||||
# copy .env.example .env
|
||||
#
|
||||
# Precedence: real system environment variables win over values in `.env`,
|
||||
# so production deployments can set these via the OS and skip `.env`.
|
||||
# `.env` is git-ignored — never commit real secrets to it.
|
||||
|
||||
# --- Web server (localhost only) -------------------------------------------------
|
||||
|
||||
# The Flask web UI binds to localhost so it is only reachable from this machine.
|
||||
# Do not expose WEB_HOST beyond 127.0.0.1!
|
||||
WEB_HOST=127.0.0.1
|
||||
# Please choose a very high port number (e.g. 54666) to avoid conflicts with other services.
|
||||
WEB_PORT=54666
|
||||
|
||||
# --- Log sources -----------------------------------------------------------
|
||||
|
||||
# Directory containing copyparty access logs (YYYY-MM-DD.txt files).
|
||||
COPYPARTY_LOG_PATH=P:\copyparty
|
||||
|
||||
# Directory containing Nginx Proxy Manager proxy logs (.log / .gz files).
|
||||
NPM_LOG_PATH=Y:\npm\logs
|
||||
|
||||
# --- MikroTik RouterOS connection -----------------------------------------
|
||||
|
||||
# IP/hostname of the router to sync the blocklist to.
|
||||
ROUTER_IP=192.168.88.1
|
||||
|
||||
# SSH user for the router.
|
||||
ROUTER_USER=admin
|
||||
|
||||
# SSH password for the router (required when --update-firewall is used).
|
||||
ROUTER_PASSWORD=change-me
|
||||
|
||||
# Address list on the router that holds blocked IPs/subnets.
|
||||
BLOCKLIST_NAME=Blocked
|
||||
|
||||
# Comma-separated address lists that are treated as whitelisted (never blocked).
|
||||
WHITELIST_NAMES=Cloudflare,Openfactory
|
||||
|
||||
# --- WHOIS subnet consolidation --------------------------------------------
|
||||
|
||||
WHOIS_SERVER=whois.radb.net
|
||||
WHOIS_PORT=43
|
||||
WHOIS_TIMEOUT=3.0
|
||||
|
||||
# Minimum number of same-subnet IPs before blocking the whole subnet.
|
||||
SUBNET_THRESHOLD=3
|
||||
|
||||
# --- Report retention ------------------------------------------------------
|
||||
|
||||
# Each subdirectory under /reports/ keeps at most REPORT_RETENTION_MAX_FILES
|
||||
# files, all newer than REPORT_RETENTION_DAYS days. Older timestamped reports
|
||||
# are pruned automatically after each consolidated scan. The blocklist files
|
||||
# in reports/app/data/ are always protected.
|
||||
REPORT_RETENTION_DAYS=30
|
||||
REPORT_RETENTION_MAX_FILES=10
|
||||
|
||||
# --- Scan / flagging defaults ----------------------------------------------
|
||||
|
||||
# Rows in the top-IP report tables.
|
||||
DEFAULT_TOP=30
|
||||
|
||||
# copyparty: minimum denied hits before flagging an IP.
|
||||
DEFAULT_MIN_DENIED=1
|
||||
|
||||
# npm: minimum error responses before flagging an IP.
|
||||
DEFAULT_MIN_ERRORS=5
|
||||
|
||||
# npm: minimum error ratio before flagging an IP.
|
||||
DEFAULT_ERROR_RATIO=0.5
|
||||
|
||||
# Rows in the "top error paths" report section.
|
||||
DEFAULT_TOP_PATHS=20
|
||||
|
||||
# --- Whitelist sources -----------------------------------------------------
|
||||
|
||||
OPENFACTORY_URL=https://openfactory.net/geofeed.csv
|
||||
CLOUDFLARE_URL_V4=https://www.cloudflare.com/ips-v4
|
||||
CLOUDFLARE_URL_V6=https://www.cloudflare.com/ips-v6
|
||||
PALOALTO_URL=https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity
|
||||
Reference in new issue
Block a user