poc3

app/config.py

@@ -18,6 +18,12 @@ def _int(name: str, default: int) -> int:
     return int(value)
 
 
+
+def _choice(name: str, default: str, allowed: set[str]) -> str:
+    value = (os.getenv(name, default) or default).strip().lower()
+    return value if value in allowed else default
+
+
 def _float(name: str, default: float) -> float:
     value = os.getenv(name)
     if value is None or not value.strip():
@@ -46,6 +52,11 @@ class Config:
     db_path: str
     eve_path: str
     suricata_log_max_mb: int
+    forensic_pcap_mode: str
+    forensic_pcap_window_seconds: int
+    forensic_pcap_memory_mb: int
+    forensic_pcap_max_files: int
+    forensic_pcap_max_total_mb: int
     alert_retention_days: int
     alert_max_severity: int
     alert_dedup_window_seconds: int
@@ -121,12 +132,17 @@ class Config:
                 "SURICATA_PERSIST_LIB_DIR", "/data/lib/suricata"
             ),
             update_rules_on_start=_bool("UPDATE_RULES_ON_START", False),
-            rule_update_interval_hours=_int("RULE_UPDATE_INTERVAL_HOURS", 24),
+            rule_update_interval_hours=max(0, _int("RULE_UPDATE_INTERVAL_HOURS", 24)),
             web_bind=os.getenv("WEB_BIND", "0.0.0.0"),
             web_port=_int("WEB_PORT", 8080),
             db_path=os.getenv("DB_PATH", "/data/ids.db"),
             eve_path=os.getenv("EVE_PATH", "/data/logs/suricata/eve.json"),
             suricata_log_max_mb=_int("SURICATA_LOG_MAX_MB", 512),
+            forensic_pcap_mode=_choice("FORENSIC_PCAP_MODE", "blocks", {"blocks", "alerts", "all", "off"}),
+            forensic_pcap_window_seconds=max(5, _int("FORENSIC_PCAP_WINDOW_SECONDS", 60)),
+            forensic_pcap_memory_mb=max(1, _int("FORENSIC_PCAP_MEMORY_MB", 64)),
+            forensic_pcap_max_files=max(1, _int("FORENSIC_PCAP_MAX_FILES", 32)),
+            forensic_pcap_max_total_mb=max(1, _int("FORENSIC_PCAP_MAX_TOTAL_MB", 512)),
             alert_retention_days=_int("ALERT_RETENTION_DAYS", 14),
             # Suricata severity uses 1 as the most important value. Keeping
             # 1-2 by default removes low-priority informational noise from the
@@ -191,6 +207,10 @@ class Config:
             "rule_update_interval_hours": self.rule_update_interval_hours,
             "alert_retention_days": self.alert_retention_days,
             "suricata_log_max_mb": self.suricata_log_max_mb,
+            "forensic_pcap_mode": self.forensic_pcap_mode,
+            "forensic_pcap_window_seconds": self.forensic_pcap_window_seconds,
+            "forensic_pcap_max_files": self.forensic_pcap_max_files,
+            "forensic_pcap_max_total_mb": self.forensic_pcap_max_total_mb,
             "alert_max_severity": self.alert_max_severity,
             "alert_dedup_window_seconds": self.alert_dedup_window_seconds,
             "alert_ignore_sids": self.alert_ignore_sids,