68 lines
2.2 KiB
Bash
68 lines
2.2 KiB
Bash
# ---------------------------------------------------------------------------
|
|
# Intrusion Detection System — environment template
|
|
# ---------------------------------------------------------------------------
|
|
# Copy this file to `.env` for local development and fill in your values:
|
|
#
|
|
# copy .env.example .env
|
|
#
|
|
# Precedence: real system environment variables win over values in `.env`,
|
|
# so production deployments can set these via the OS and skip `.env`.
|
|
# `.env` is git-ignored — never commit real secrets to it.
|
|
|
|
# --- Log sources -----------------------------------------------------------
|
|
|
|
# Directory containing copyparty access logs (YYYY-MM-DD.txt files).
|
|
COPYPARTY_LOG_PATH=P:\copyparty
|
|
|
|
# Directory containing Nginx Proxy Manager proxy logs (.log / .gz files).
|
|
NPM_LOG_PATH=Y:\npm\logs
|
|
|
|
# --- MikroTik RouterOS connection -----------------------------------------
|
|
|
|
# IP/hostname of the router to sync the blocklist to.
|
|
ROUTER_IP=192.168.88.1
|
|
|
|
# SSH user for the router.
|
|
ROUTER_USER=admin
|
|
|
|
# SSH password for the router (required when --update-firewall is used).
|
|
ROUTER_PASSWORD=change-me
|
|
|
|
# Address list on the router that holds blocked IPs/subnets.
|
|
BLOCKLIST_NAME=Blocked
|
|
|
|
# Comma-separated address lists that are treated as whitelisted (never blocked).
|
|
WHITELIST_NAMES=Cloudflare,Openfactory
|
|
|
|
# --- WHOIS subnet consolidation --------------------------------------------
|
|
|
|
WHOIS_SERVER=whois.radb.net
|
|
WHOIS_PORT=43
|
|
WHOIS_TIMEOUT=3.0
|
|
|
|
# Minimum number of same-subnet IPs before blocking the whole subnet.
|
|
SUBNET_THRESHOLD=3
|
|
|
|
# --- Scan / flagging defaults ----------------------------------------------
|
|
|
|
# Rows in the top-IP report tables.
|
|
DEFAULT_TOP=30
|
|
|
|
# copyparty: minimum denied hits before flagging an IP.
|
|
DEFAULT_MIN_DENIED=1
|
|
|
|
# npm: minimum error responses before flagging an IP.
|
|
DEFAULT_MIN_ERRORS=5
|
|
|
|
# npm: minimum error ratio before flagging an IP.
|
|
DEFAULT_ERROR_RATIO=0.5
|
|
|
|
# Rows in the "top error paths" report section.
|
|
DEFAULT_TOP_PATHS=20
|
|
|
|
# --- Whitelist sources -----------------------------------------------------
|
|
|
|
OPENFACTORY_URL=https://openfactory.net/geofeed.csv
|
|
CLOUDFLARE_URL_V4=https://www.cloudflare.com/ips-v4
|
|
CLOUDFLARE_URL_V6=https://www.cloudflare.com/ips-v6
|
|
PALOALTO_URL=https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity |