# Capture
TZSP_BIND=0.0.0.0
TZSP_PORT=37008
TAP_NAME=suritap0
TAP_MTU=9000

# Suricata
SURICATA_CONFIG=/etc/suricata/suricata.yaml
SURICATA_HOME_NET=[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]
UPDATE_RULES_ON_START=false

# App / dashboard
WEB_BIND=0.0.0.0
WEB_PORT=8080
DB_PATH=/data/ids.db
EVE_PATH=/var/log/suricata/eve.json
ALERT_RETENTION_DAYS=14

# Policy. Keep AUTO_BLOCK=false until observation mode is validated.
AUTO_BLOCK=false
AUTO_BLOCK_MAX_SEVERITY=1
MONITORED_NETWORKS=192.168.100.0/24
NEVER_BLOCK=1.1.1.1/32,8.8.8.8/32
BLOCK_TIMEOUT=1h

# RouterOS REST - only needed when AUTO_BLOCK=true
ROUTEROS_URL=https://172.31.255.1
ROUTEROS_USER=suricata-api
ROUTEROS_PASSWORD=CHANGE_ME
ROUTEROS_VERIFY_TLS=false
ROUTEROS_ADDRESS_LIST=IDS-BLOCK
ROUTEROS_HTTP_TIMEOUT=5