poc2_worked

tests/test_deploy_script.py

@@ -39,4 +39,30 @@ def test_upgrade_helper_reuses_existing_routeros_setup_only():
     assert '/ip/firewall/nat/add' not in script
     assert '/tool/sniffer/set' not in script
     assert '/container/envs/add' not in script
-    assert '/container/mounts/add' not in script
+    assert '/container/mounts/add list="${CONTAINER_MOUNTLIST}" src="${ROUTER_DISK}/containers/suricata-data" dst=/data' in script
+
+
+def test_routeros_deploy_uses_one_persistent_data_mount():
+    script = (ROOT / "scripts" / "deploy-routeros.sh").read_text()
+    assert '/container/mounts/add list=IDS_MOUNTS src="${DATA_DIR}" dst=/data' in script
+    assert 'suricata-logs' not in script
+    assert 'suricata-rules' not in script
+
+
+def test_compose_uses_one_named_volume():
+    compose = (ROOT / "docker-compose.yml").read_text()
+    assert compose.count(':/data') == 1
+    assert 'routeros-suricata-data' in compose
+    assert 'routeros-suricata-logs' not in compose
+    assert 'routeros-suricata-rules' not in compose
+
+
+def test_routeros_deploy_forwards_ndr_and_persistence_controls():
+    script = (ROOT / "scripts" / "deploy-routeros.sh").read_text()
+    for key in (
+        "REDIS_AOF", "NDR_ENABLED", "NDR_CORRELATION_WINDOW_SECONDS",
+        "BEHAVIOR_MIN_OBSERVATIONS", "NDR_AUTO_BLOCK", "NDR_AUTO_BLOCK_RISK",
+        "ROUTEROS_INVENTORY_INTERVAL_SECONDS", "NOTIFY_WEBHOOK_URL",
+        "NOTIFY_MIN_RISK", "NOTIFY_TIMEOUT_SECONDS",
+    ):
+        assert f"key={key}" in script