Refactor web_scan.py for improved readability and maintainability; add cron job script for npm log backups; update start.ps1 for consistent formatting.

README.md

@@ -142,6 +142,19 @@ production can set the same variables via the OS and skip `.env` entirely.
 See `.env.example` for the complete list of supported variables (WHOIS
 tuning, scan thresholds, whitelist source URLs, and more).
 
+### Network context (2026-09-08)
+
+Connectivity provider switched Openfactory → Init7 on 2026-09-08:
+
+- WAN IPv4: `77.74.80.159/32` (init7 `77.74.80.0/24`, "Hybrid7-NET").
+- IPv6: delegated `/48` `2001:1620:549f::/48` (init7 allocation `2001:1620::/30`).
+- Upstream DNS: `77.109.128.2`, `213.144.129.20`.
+
+The `Openfactory` whitelist (old AS58299 geofeed) is obsolete and must be
+replaced with an `Init7` whitelist — see
+[`.github/instructions/TODO.md`](.github/instructions/TODO.md) for the
+switchover plan and the verified init7 CIDR ranges.
+
 ## Usage
 
 ```powershell

app/data/README.md

@@ -11,5 +11,5 @@ This directory contains data files used by the `allucanget-ids` Intrusion Detect
 - [MikroTik RouterOS IPv6 Firewall rules](./mikrotik/firewall_ipv6.json): Current MikroTik RouterOS IPv6 firewall rules.
 - [MikroTik RouterOS IPv4 address list](./mikrotik/address_list_ipv4.json): Current MikroTik RouterOS IPv4 address list.
 - [MikroTik RouterOS IPv6 address list](./mikrotik/address_list_ipv6.json): Current MikroTik RouterOS IPv6 address list.
-- [Openfactory Geofeed](./openfactory/geofeed.csv): Contains Openfactory IP addresses and associated geolocation data from `https://openfactory.net/geofeed.csv`. Used for identifying and whitelisting traffic from known Openfactory sources.
+- [Openfactory Geofeed](./openfactory/geofeed.csv): **Obsolete since 2026-09-08** (provider switched to Init7). Kept for historical reference; the replacement `Init7` ranges are documented in the switchover plan (`.github/instructions/TODO.md`).
 - [PaloAlto Scanner IP list](./paloalto/scanner-ips.txt): List of known PaloAlto scanner IP addresses from `https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity`, used for whitelisting traffic from PaloAlto scanners. !NOTE: This list can not be scraped easily (Javascript-based), so it is maintained manually and may be outdated. Please verify the list against the official source if needed.

copy_npm_logs.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+# Shell script to be run as cron job to copy npm logs to backup location.
+
+# Stop npm service to ensure logs are not being written to while copying.
+systemctl stop npm
+
+# Only copy new/changed log files to avoid re-copying existing backups.
+# --ignore-existing: never overwrite files already present in the destination.
+# -c: compare files by checksum so matching files are not re-written.
+# -P: preserve permissions + show progress.
+rsync -qcP --ignore-existing /data/logs/*access* /data/logs/*error* /mnt/backups/npm/
+
+# Start npm service again after copying logs.
+systemctl start npm