# ---------------------------------------------------------------------------
# Intrusion Detection System — environment template
# ---------------------------------------------------------------------------
# Copy this file to `.env` for local development and fill in your values:
#
#     copy .env.example .env
#
# Precedence: real system environment variables win over values in `.env`,
# so production deployments can set these via the OS and skip `.env`.
# `.env` is git-ignored — never commit real secrets to it.

# --- Web server (localhost only) -------------------------------------------------

# The Flask web UI binds to localhost so it is only reachable from this machine. 
# Do not expose WEB_HOST beyond 127.0.0.1!
WEB_HOST=127.0.0.1
# Please choose a very high port number (e.g. 54666) to avoid conflicts with other services.
WEB_PORT=54666

# --- Log sources -----------------------------------------------------------

# Directory containing copyparty access logs (YYYY-MM-DD.txt files).
COPYPARTY_LOG_PATH=P:\copyparty

# Directory containing Nginx Proxy Manager proxy logs (.log / .gz files).
NPM_LOG_PATH=Y:\npm\logs

# --- MikroTik RouterOS connection -----------------------------------------

# IP/hostname of the router to sync the blocklist to.
ROUTER_IP=192.168.88.1

# SSH user for the router.
ROUTER_USER=admin

# SSH password for the router (required when --update-firewall is used).
ROUTER_PASSWORD=change-me

# Address list on the router that holds blocked IPs/subnets.
BLOCKLIST_NAME=Blocked

# Comma-separated address lists that are treated as whitelisted (never blocked).
WHITELIST_NAMES=Cloudflare,Init7

# --- WHOIS subnet consolidation --------------------------------------------

WHOIS_SERVER=whois.radb.net
WHOIS_PORT=43
WHOIS_TIMEOUT=3.0

# Minimum number of same-subnet IPs before blocking the whole subnet.
SUBNET_THRESHOLD=3

# --- Report retention ------------------------------------------------------

# Each subdirectory under /reports/ keeps at most REPORT_RETENTION_MAX_FILES
# files, all newer than REPORT_RETENTION_DAYS days. Older timestamped reports
# are pruned automatically after each consolidated scan. The blocklist files
# in reports/app/data/ are always protected.
REPORT_RETENTION_DAYS=30
REPORT_RETENTION_MAX_FILES=10

# --- Scan / flagging defaults ----------------------------------------------

# Rows in the top-IP report tables.
DEFAULT_TOP=30

# copyparty: minimum denied hits before flagging an IP.
DEFAULT_MIN_DENIED=1

# npm: minimum error responses before flagging an IP.
DEFAULT_MIN_ERRORS=5

# npm: minimum error ratio before flagging an IP.
DEFAULT_ERROR_RATIO=0.5

# Rows in the "top error paths" report section.
DEFAULT_TOP_PATHS=20

# --- Whitelist sources -----------------------------------------------------

CLOUDFLARE_URL_V4=https://www.cloudflare.com/ips-v4
CLOUDFLARE_URL_V6=https://www.cloudflare.com/ips-v6
PALOALTO_URL=https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity