Add centralized constants module and .env configuration support

README.md

@@ -40,6 +40,7 @@ intrusion-detection/
 ├── app.py               unified entry point
 ├── app/                 application package
 │   ├── __init__.py
+│   ├── constants.py     all config constants (paths, env vars, thresholds)
 │   ├── scan.py          consolidated scanner
 │   ├── copyparty.py     copyparty log adapter (~150 lines)
 │   ├── npm.py           NPM proxy log adapter (~150 lines)
@@ -77,6 +78,7 @@ Core responsibilities by module:
 
 | Module                | Owns                                                                             |
 | --------------------- | -------------------------------------------------------------------------------- |
+| `app/constants.py`    | all config constants — paths, env vars, network/scan thresholds                  |
 | `app/models.py`       | `Request`, `IPStats`, `aggregate()`                                              |
 | `app/ip_utils.py`     | `parse_ip`, `whitelist_of`, `is_whitelisted`, `sort_ips`, `split_versions`       |
 | `app/flags.py`        | `flag_scanners`, `flag_denied_only`, `flag_malicious_patterns`, `by_total`       |
@@ -94,7 +96,39 @@ Console output and saved reports are the **same string** (`Analyzer.text_report(
 ## Requirements
 
 - Python 3.10+
-- stdlib only, no dependencies
+- `paramiko` (MikroTik SSH), `python-dotenv` (`.env` loading)
+
+```powershell
+pip install -r requirements.txt
+```
+
+## Configuration
+
+All tunable settings live in `app/constants.py` and can be overridden per
+deployment via environment variables. For local development, copy
+`.env.example` to `.env` and fill in your values:
+
+```powershell
+copy .env.example .env
+```
+
+`app/constants.py` loads `.env` with `python-dotenv` at startup. Real system
+environment variables always take precedence over `.env` values, so
+production can set the same variables via the OS and skip `.env` entirely.
+`.env` is git-ignored — do not commit secrets to it.
+
+| Env var              | Default                  | Used by               |
+| -------------------- | ------------------------ | --------------------- |
+| `COPYPARTY_LOG_PATH` | `P:\copyparty`           | copyparty scanner     |
+| `NPM_LOG_PATH`       | `Y:\npm\logs`            | npm scanner           |
+| `ROUTER_IP`          | `192.168.88.1`           | MikroTik connection   |
+| `ROUTER_USER`        | `admin`                  | MikroTik connection   |
+| `ROUTER_PASSWORD`    | _(set in .env)_          | MikroTik connection   |
+| `BLOCKLIST_NAME`     | `Blocked`                | MikroTik address list |
+| `WHITELIST_NAMES`    | `Cloudflare,Openfactory` | MikroTik whitelists   |
+
+See `.env.example` for the complete list of supported variables (WHOIS
+tuning, scan thresholds, whitelist source URLs, and more).
 
 ## Usage
 
@@ -128,16 +162,6 @@ All scripts accept CLI overrides:
 `--copyparty-report-dir`, `--npm-log-path`, `--npm-report-dir`, and
 `--report-dir` for the consolidated output.
 
-Default log paths (overridable by `.env`):
-
-| Script             | Env var              | Default         |
-| ------------------ | -------------------- | --------------- |
-| `app/copyparty.py` | `COPYPARTY_LOG_PATH` | `P:\copyparty`  |
-| `app/npm.py`       | `NPM_LOG_PATH`       | `Y:\npm\logs`   |
-| `app/firewall.py`  | `ROUTER_IP`          | `192.168.88.1`  |
-|                    | `ROUTER_USER`        | `admin`         |
-|                    | `ROUTER_PASSWORD`    | _(set in .env)_ |
-
 Examples:
 
 ```powershell