worked poc

scripts/entrypoint.sh

@@ -1,25 +1,54 @@
 #!/bin/sh
 set -eu
 
-mkdir -p /data /var/log/suricata /var/lib/suricata/rules /run/suricata
+mkdir -p /data /data/suricata /var/log/suricata /var/lib/suricata/rules /run/suricata
+
+if ! id -u suricata >/dev/null 2>&1 || ! getent group suricata >/dev/null 2>&1; then
+  echo "[entrypoint] FATAL: missing suricata user/group in the image; rebuild the image from the current Dockerfile" >&2
+  exit 70
+fi
+
+init_file() {
+  src="$1"
+  dst="$2"
+  if [ ! -e "$dst" ]; then
+    cp "$src" "$dst"
+  fi
+  chmod 0644 "$dst"
+}
+
+cp /opt/ids/suricata/local.rules /data/suricata/local.rules
+chmod 0644 /data/suricata/local.rules
+init_file /opt/ids/suricata/custom.rules.default /data/suricata/custom.rules
+init_file /opt/ids/suricata/threshold.config /data/suricata/threshold.config
+init_file /opt/ids/suricata/disable.conf /data/suricata/disable.conf
+init_file /opt/ids/suricata/enable.conf /data/suricata/enable.conf
+init_file /opt/ids/suricata/modify.conf /data/suricata/modify.conf
+
+# RouterOS mounts /var/lib/suricata from persistent storage. On the first
+# deployment that mount is empty, so seed it from the ET/Open snapshot baked
+# into the image before optional online updates run.
+if [ ! -s /var/lib/suricata/rules/suricata.rules ] && [ -d /opt/ids/vendor-rules-seed ]; then
+  echo "[entrypoint] seeding baseline vendor rules into persistent storage"
+  cp -a /opt/ids/vendor-rules-seed/. /var/lib/suricata/
+fi
 
 case "${UPDATE_RULES_ON_START:-false}" in
   1|true|TRUE|yes|YES|on|ON)
-    echo "[entrypoint] updating ET Open rules"
-    if ! suricata-update; then
-      echo "[entrypoint] WARNING: suricata-update failed; continuing with existing/local rules" >&2
+    echo "[entrypoint] updating managed rules"
+    if ! /opt/ids/scripts/update-rules.sh --no-reload; then
+      echo "[entrypoint] WARNING: suricata-update failed; continuing with existing rules" >&2
     fi
     ;;
 esac
 
 RULES=/var/lib/suricata/rules/suricata.rules
-LOCAL=/opt/ids/suricata/local.rules
 [ -f "$RULES" ] || : > "$RULES"
-if ! grep -q 'sid:1000001;' "$RULES"; then
-  printf '\n# ---- local project rules ----\n' >> "$RULES"
-  cat "$LOCAL" >> "$RULES"
-fi
 
 chown -R suricata:suricata /var/log/suricata /var/lib/suricata /run/suricata
+# Rule state is edited by the root Python supervisor but must remain readable by
+# the Suricata process after it drops privileges.
+chmod 0755 /data /data/suricata || true
+chmod 0644 /data/suricata/* 2>/dev/null || true
 
 exec python3 -m app.main