84 lines
3.0 KiB
Bash
84 lines
3.0 KiB
Bash
# ---------------------------------------------------------------------------
|
|
# Intrusion Detection System — environment template
|
|
# ---------------------------------------------------------------------------
|
|
# Copy this file to `.env` for local development and fill in your values:
|
|
#
|
|
# copy .env.example .env
|
|
#
|
|
# Precedence: real system environment variables win over values in `.env`,
|
|
# so production deployments can set these via the OS and skip `.env`.
|
|
# `.env` is git-ignored — never commit real secrets to it.
|
|
|
|
# --- Web server (localhost only) -------------------------------------------------
|
|
|
|
# The Flask web UI binds to localhost so it is only reachable from this machine.
|
|
# Do not expose WEB_HOST beyond 127.0.0.1!
|
|
WEB_HOST=127.0.0.1
|
|
# Please choose a very high port number (e.g. 54666) to avoid conflicts with other services.
|
|
WEB_PORT=54666
|
|
|
|
# --- Log sources -----------------------------------------------------------
|
|
|
|
# Directory containing copyparty access logs (YYYY-MM-DD.txt files).
|
|
COPYPARTY_LOG_PATH=P:\copyparty
|
|
|
|
# Directory containing Nginx Proxy Manager proxy logs (.log / .gz files).
|
|
NPM_LOG_PATH=Y:\npm\logs
|
|
|
|
# --- MikroTik RouterOS connection -----------------------------------------
|
|
|
|
# IP/hostname of the router to sync the blocklist to.
|
|
ROUTER_IP=192.168.88.1
|
|
|
|
# SSH user for the router.
|
|
ROUTER_USER=admin
|
|
|
|
# SSH password for the router (required when --update-firewall is used).
|
|
ROUTER_PASSWORD=change-me
|
|
|
|
# Address list on the router that holds blocked IPs/subnets.
|
|
BLOCKLIST_NAME=Blocked
|
|
|
|
# Comma-separated address lists that are treated as whitelisted (never blocked).
|
|
WHITELIST_NAMES=Cloudflare,Init7
|
|
|
|
# --- WHOIS subnet consolidation --------------------------------------------
|
|
|
|
WHOIS_SERVER=whois.radb.net
|
|
WHOIS_PORT=43
|
|
WHOIS_TIMEOUT=3.0
|
|
|
|
# Minimum number of same-subnet IPs before blocking the whole subnet.
|
|
SUBNET_THRESHOLD=3
|
|
|
|
# --- Report retention ------------------------------------------------------
|
|
|
|
# Each subdirectory under /reports/ keeps at most REPORT_RETENTION_MAX_FILES
|
|
# files, all newer than REPORT_RETENTION_DAYS days. Older timestamped reports
|
|
# are pruned automatically after each consolidated scan. The blocklist files
|
|
# in reports/app/data/ are always protected.
|
|
REPORT_RETENTION_DAYS=30
|
|
REPORT_RETENTION_MAX_FILES=10
|
|
|
|
# --- Scan / flagging defaults ----------------------------------------------
|
|
|
|
# Rows in the top-IP report tables.
|
|
DEFAULT_TOP=30
|
|
|
|
# copyparty: minimum denied hits before flagging an IP.
|
|
DEFAULT_MIN_DENIED=1
|
|
|
|
# npm: minimum error responses before flagging an IP.
|
|
DEFAULT_MIN_ERRORS=5
|
|
|
|
# npm: minimum error ratio before flagging an IP.
|
|
DEFAULT_ERROR_RATIO=0.5
|
|
|
|
# Rows in the "top error paths" report section.
|
|
DEFAULT_TOP_PATHS=20
|
|
|
|
# --- Whitelist sources -----------------------------------------------------
|
|
|
|
CLOUDFLARE_URL_V4=https://www.cloudflare.com/ips-v4
|
|
CLOUDFLARE_URL_V6=https://www.cloudflare.com/ips-v6
|
|
PALOALTO_URL=https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity |