# Connection from your Linux/macOS build host to RouterOS.
ROUTER_HOST=192.168.88.1
ROUTER_USER=admin
ROUTER_PORT=22
# Optional private key. Empty means use normal ssh/scp authentication.
ROUTER_IDENTITY_FILE=

# Persistent data/log/rules storage. The versioned container root is always
# /containers/suricata_<VERSION>/root as requested.
ROUTER_DISK=disk1
# Upload directory used by upload-routeros-image.sh and generated deploy .rsc files.
ROUTER_SCP_DIR=/

CONTAINER_IP=172.31.255.2/30
CONTAINER_GATEWAY=172.31.255.1
CONTAINER_SUBNET=172.31.255.0/30
CONTAINER_BRIDGE=br-ids
CONTAINER_VETH=veth-ids

# Packet Sniffer -> TZSP
VLAN_ID=100
TZSP_PORT=37008
CONFIGURE_SNIFFER=true
START_SNIFFER=true

# Suricata/app
SURICATA_HOME_NET=[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]
SURICATA_LOG_MAX_MB=512
MONITORED_NETWORKS=192.168.0.0/16,10.0.0.0/8,172.16.0.0/12
AUTO_BLOCK=false
AUTO_BLOCK_MAX_SEVERITY=1
BLOCK_TIMEOUT=1h
UPDATE_RULES_ON_START=false
SURICATA_PERSIST_LIB_DIR=/data/lib/suricata
RULE_UPDATE_INTERVAL_HOURS=24
ALERT_RETENTION_DAYS=14

# Bounded live-traffic history. Managed Redis runs inside the same RouterOS container.
REDIS_MANAGED=true
REDIS_DATA_DIR=/data/redis
REDIS_PORT=6379
REDIS_MAXMEMORY_MB=0
REDIS_SNAPSHOT_SECONDS=1800
REDIS_AOF=true
TRAFFIC_RETENTION_HOURS=24
TRAFFIC_MAX_EVENTS=0
TRAFFIC_MEMORY_EVENTS=0
WEBSOCKET_QUEUE_SIZE=512
LIVE_FLOW_UPDATE_SECONDS=2.0
ALERT_MAX_SEVERITY=2
ALERT_DEDUP_WINDOW_SECONDS=300
# SID 1000001 is the payload-marked pipeline self-test; keep it out of production incidents.
ALERT_IGNORE_SIDS=1000001
ALERT_IGNORE_CATEGORIES=
# Dashboard login. Use a long random password. Empty ADMIN_PASSWORD keeps the UI read-only.
ADMIN_USERNAME=admin
ADMIN_PASSWORD=
SESSION_HOURS=168
SESSION_COOKIE_SECURE=false
ANALYTICS_SNAPSHOT_INTERVAL_SECONDS=60

# MikroSuricata NDR / correlation. Keep NDR_AUTO_BLOCK=false while baselining.
NDR_ENABLED=true
NDR_CORRELATION_WINDOW_SECONDS=1800
BEHAVIOR_MIN_OBSERVATIONS=50
NDR_AUTO_BLOCK=false
NDR_AUTO_BLOCK_RISK=92
ROUTEROS_INVENTORY_INTERVAL_SECONDS=300

# Optional high-risk incident webhook. Empty keeps telemetry local.
NOTIFY_WEBHOOK_URL=
NOTIFY_MIN_RISK=80
NOTIFY_TIMEOUT_SECONDS=5

# RouterOS REST. Not required for observation-only testing.
CREATE_REST_USER=false
ENABLE_WWW_SSL=false
ROUTEROS_REST_USER=suricata-api
ROUTEROS_REST_PASSWORD=CHANGE_ME
ROUTEROS_VERIFY_TLS=false
ROUTEROS_ADDRESS_LIST=IDS-BLOCK

# Generated deployment scripts may contain credentials and are removed by default.
KEEP_REMOTE_RSC=false