worked poc

deploy-routeros.env.example

@@ -5,16 +5,12 @@ ROUTER_PORT=22
 # Optional private key. Empty means use normal ssh/scp authentication.
 ROUTER_IDENTITY_FILE=
 
-# auto = detect RouterOS architecture through SSH.
-# Supported image targets: arm64, amd64/x86_64, arm (armv7/armhf only).
-ROUTER_ARCH=auto
-
-# RouterOS external storage. Containers should not live on internal flash.
+# Persistent data/log/rules storage. The versioned container root is always
+# /containers/suricata_<VERSION>/root as requested.
 ROUTER_DISK=disk1
-# SCP-visible path. Normally the same as ROUTER_DISK. Change to /disk1 if your client requires it.
-ROUTER_SCP_DIR=disk1
+# Upload directory used by upload-routeros-image.sh and generated deploy .rsc files.
+ROUTER_SCP_DIR=/
 
-CONTAINER_NAME=suricata-ids
 CONTAINER_IP=172.31.255.2/30
 CONTAINER_GATEWAY=172.31.255.1
 CONTAINER_SUBNET=172.31.255.0/30
@@ -34,6 +30,15 @@ AUTO_BLOCK=false
 AUTO_BLOCK_MAX_SEVERITY=1
 BLOCK_TIMEOUT=1h
 UPDATE_RULES_ON_START=false
+RULE_UPDATE_INTERVAL_HOURS=24
+ALERT_RETENTION_DAYS=14
+ALERT_MAX_SEVERITY=2
+ALERT_DEDUP_WINDOW_SECONDS=300
+# SID 1000001 is the payload-marked pipeline self-test; keep it out of production incidents.
+ALERT_IGNORE_SIDS=1000001
+ALERT_IGNORE_CATEGORIES=
+# Long random alphanumeric value. Empty disables admin maintenance/rule editing.
+ADMIN_TOKEN=
 
 # RouterOS REST. Not required for observation-only testing.
 CREATE_REST_USER=false
@@ -43,9 +48,5 @@ ROUTEROS_REST_PASSWORD=CHANGE_ME
 ROUTEROS_VERIFY_TLS=false
 ROUTEROS_ADDRESS_LIST=IDS-BLOCK
 
-# Re-deploy behavior. Persistent /data and Suricata logs are mounted separately.
-REPLACE_EXISTING=true
-KEEP_REMOTE_TAR=true
-
-# Optional build engine: docker or podman. Empty = auto-detect.
-ENGINE=
+# Generated deployment scripts may contain credentials and are removed by default.
+KEEP_REMOTE_RSC=false