first commit

2026-08-13 15:58:52 +02:00
commit adfdb0b86c
100 changed files with 6216 additions and 0 deletions
@@ -0,0 +1,95 @@
+from __future__ import annotations
+
+import os
+from dataclasses import dataclass
+
+
+def _bool(name: str, default: bool = False) -> bool:
+    value = os.getenv(name)
+    if value is None:
+        return default
+    return value.strip().lower() in {"1", "true", "yes", "on"}
+
+
+def _int(name: str, default: int) -> int:
+    value = os.getenv(name)
+    if value is None or not value.strip():
+        return default
+    return int(value)
+
+
+@dataclass(frozen=True)
+class Config:
+    tzsp_bind: str
+    tzsp_port: int
+    tap_name: str
+    tap_mtu: int
+    suricata_config: str
+    suricata_home_net: str
+    update_rules_on_start: bool
+    web_bind: str
+    web_port: int
+    db_path: str
+    eve_path: str
+    alert_retention_days: int
+    auto_block: bool
+    auto_block_max_severity: int
+    monitored_networks: str
+    never_block: str
+    block_timeout: str
+    routeros_url: str
+    routeros_user: str
+    routeros_password: str
+    routeros_verify_tls: bool
+    routeros_address_list: str
+    routeros_http_timeout: int
+
+    @classmethod
+    def from_env(cls) -> "Config":
+        return cls(
+            tzsp_bind=os.getenv("TZSP_BIND", "0.0.0.0"),
+            tzsp_port=_int("TZSP_PORT", 37008),
+            tap_name=os.getenv("TAP_NAME", "suritap0"),
+            tap_mtu=_int("TAP_MTU", 9000),
+            suricata_config=os.getenv("SURICATA_CONFIG", "/etc/suricata/suricata.yaml"),
+            suricata_home_net=os.getenv(
+                "SURICATA_HOME_NET",
+                "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]",
+            ),
+            update_rules_on_start=_bool("UPDATE_RULES_ON_START", False),
+            web_bind=os.getenv("WEB_BIND", "0.0.0.0"),
+            web_port=_int("WEB_PORT", 8080),
+            db_path=os.getenv("DB_PATH", "/data/ids.db"),
+            eve_path=os.getenv("EVE_PATH", "/var/log/suricata/eve.json"),
+            alert_retention_days=_int("ALERT_RETENTION_DAYS", 14),
+            auto_block=_bool("AUTO_BLOCK", False),
+            auto_block_max_severity=_int("AUTO_BLOCK_MAX_SEVERITY", 1),
+            monitored_networks=os.getenv("MONITORED_NETWORKS", "192.168.100.0/24"),
+            never_block=os.getenv("NEVER_BLOCK", ""),
+            block_timeout=os.getenv("BLOCK_TIMEOUT", "1h"),
+            routeros_url=os.getenv("ROUTEROS_URL", "https://172.31.255.1").rstrip("/"),
+            routeros_user=os.getenv("ROUTEROS_USER", "suricata-api"),
+            routeros_password=os.getenv("ROUTEROS_PASSWORD", "CHANGE_ME"),
+            routeros_verify_tls=_bool("ROUTEROS_VERIFY_TLS", False),
+            routeros_address_list=os.getenv("ROUTEROS_ADDRESS_LIST", "IDS-BLOCK"),
+            routeros_http_timeout=_int("ROUTEROS_HTTP_TIMEOUT", 5),
+        )
+
+    def public_dict(self) -> dict:
+        return {
+            "tzsp_bind": self.tzsp_bind,
+            "tzsp_port": self.tzsp_port,
+            "tap_name": self.tap_name,
+            "tap_mtu": self.tap_mtu,
+            "suricata_home_net": self.suricata_home_net,
+            "web_port": self.web_port,
+            "auto_block": self.auto_block,
+            "auto_block_max_severity": self.auto_block_max_severity,
+            "monitored_networks": self.monitored_networks,
+            "never_block": self.never_block,
+            "block_timeout": self.block_timeout,
+            "routeros_url": self.routeros_url,
+            "routeros_user": self.routeros_user,
+            "routeros_verify_tls": self.routeros_verify_tls,
+            "routeros_address_list": self.routeros_address_list,
+        }