Add centralized constants module and .env configuration support

app/scan.py

@@ -8,19 +8,25 @@ and outputs a single consolidated MikroTik RouterOS blocklist script.
 from __future__ import annotations
 
 import argparse
-import os
-from datetime import datetime
 
-from . import utils
+from .constants import (
+    COPYPARTY_LOG_PATH,
+    COPYPARTY_REPORT_DIR,
+    DEFAULT_ERROR_RATIO,
+    DEFAULT_MIN_DENIED,
+    DEFAULT_MIN_ERRORS,
+    DEFAULT_TOP,
+    NPM_LOG_PATH,
+    NPM_REPORT_DIR,
+    REPORT_DIR,
+    SUBNET_THRESHOLD,
+)
 from .firewall import MikrotikFirewall
-from .copyparty import CopypartyAnalyzer, DEFAULT_LOG_PATH as CP_DEFAULT_LOG, DEFAULT_REPORT_DIR as CP_DEFAULT_REPORT
-from .npm import NpmAnalyzer, DEFAULT_LOG_PATH as NPM_DEFAULT_LOG, DEFAULT_REPORT_DIR as NPM_DEFAULT_REPORT
+from .copyparty import CopypartyAnalyzer
+from .npm import NpmAnalyzer
 from .ip_utils import is_whitelisted, split_versions
 from .whois import consolidate_by_subnet
 
-DEFAULT_CONSOLIDATED_REPORT_DIR = os.path.join(
-    os.path.dirname(os.path.dirname(os.path.abspath(__file__))), "reports")
-
 
 def main() -> None:
     parser = argparse.ArgumentParser(
@@ -28,28 +34,28 @@ def main() -> None:
     )
 
     # copyparty arguments
-    parser.add_argument("--copyparty-log-path", default=CP_DEFAULT_LOG,
-                        help=f"copyparty log directory (default: {CP_DEFAULT_LOG})")
-    parser.add_argument("--copyparty-report-dir", default=CP_DEFAULT_REPORT,
-                        help=f"copyparty report directory (default: {CP_DEFAULT_REPORT})")
-    parser.add_argument("--min-denied", type=int, default=1,
-                        help="minimum copyparty denied hits before flagging (default: 1)")
+    parser.add_argument("--copyparty-log-path", default=COPYPARTY_LOG_PATH,
+                        help=f"copyparty log directory (default: {COPYPARTY_LOG_PATH})")
+    parser.add_argument("--copyparty-report-dir", default=COPYPARTY_REPORT_DIR,
+                        help=f"copyparty report directory (default: {COPYPARTY_REPORT_DIR})")
+    parser.add_argument("--min-denied", type=int, default=DEFAULT_MIN_DENIED,
+                        help=f"minimum copyparty denied hits before flagging (default: {DEFAULT_MIN_DENIED})")
 
     # NPM arguments
-    parser.add_argument("--npm-log-path", default=NPM_DEFAULT_LOG,
-                        help=f"NPM log directory (default: {NPM_DEFAULT_LOG})")
-    parser.add_argument("--npm-report-dir", default=NPM_DEFAULT_REPORT,
-                        help=f"NPM report directory (default: {NPM_DEFAULT_REPORT})")
-    parser.add_argument("--min-errors", type=int, default=5,
-                        help="minimum NPM error responses to flag (default: 5)")
-    parser.add_argument("--error-ratio", type=float, default=0.5,
-                        help="minimum NPM error ratio to flag (default: 0.5)")
+    parser.add_argument("--npm-log-path", default=NPM_LOG_PATH,
+                        help=f"NPM log directory (default: {NPM_LOG_PATH})")
+    parser.add_argument("--npm-report-dir", default=NPM_REPORT_DIR,
+                        help=f"NPM report directory (default: {NPM_REPORT_DIR})")
+    parser.add_argument("--min-errors", type=int, default=DEFAULT_MIN_ERRORS,
+                        help=f"minimum NPM error responses to flag (default: {DEFAULT_MIN_ERRORS})")
+    parser.add_argument("--error-ratio", type=float, default=DEFAULT_ERROR_RATIO,
+                        help=f"minimum NPM error ratio to flag (default: {DEFAULT_ERROR_RATIO})")
 
     # Shared arguments
-    parser.add_argument("--report-dir", default=DEFAULT_CONSOLIDATED_REPORT_DIR,
-                        help=f"consolidated reports directory (default: {DEFAULT_CONSOLIDATED_REPORT_DIR})")
-    parser.add_argument("--top", type=int, default=30,
-                        help="rows in the top-IP tables (default: 30)")
+    parser.add_argument("--report-dir", default=REPORT_DIR,
+                        help=f"consolidated reports directory (default: {REPORT_DIR})")
+    parser.add_argument("--top", type=int, default=DEFAULT_TOP,
+                        help=f"rows in the top-IP tables (default: {DEFAULT_TOP})")
     parser.add_argument("--quiet", action="store_true",
                         help="write files, suppress console reports")
     parser.add_argument("--update-firewall", action="store_true",
@@ -68,7 +74,6 @@ def main() -> None:
         report_dir=args.copyparty_report_dir,
         top=args.top,
         quiet=args.quiet,
-        write_rsc=False,
         min_denied=args.min_denied,
     )
 
@@ -77,7 +82,6 @@ def main() -> None:
         report_dir=args.npm_report_dir,
         top=args.top,
         quiet=args.quiet,
-        write_rsc=False,
         min_errors=args.min_errors,
         error_ratio=args.error_ratio,
     )
@@ -115,10 +119,10 @@ def main() -> None:
     final_blocked_ips = {
         ip for ip in consolidated_candidates if not is_whitelisted(ip)}
 
-    # Group into subnets via WHOIS if multiple malicious IPs in same subnet (threshold = 3)
+    # Group into subnets via WHOIS if multiple malicious IPs in same subnet (threshold = SUBNET_THRESHOLD)
     print("\nGrouping blocked IPs into subnets using WHOIS...")
     final_blocked_targets = consolidate_by_subnet(
-        final_blocked_ips, threshold=3)
+        final_blocked_ips, threshold=SUBNET_THRESHOLD)
     blocked_ipv4, blocked_ipv6 = split_versions(final_blocked_targets)
 
     print("\n=== Consolidated Summary ===")