# Creates a minimal REST-capable user group and disabled firewall rules.
# It intentionally does NOT create the user/password.

:if ([:len [/user/group/find where name="ids-rest"]] = 0) do={
    /user/group/add name=ids-rest policy=read,write,rest-api comment="Suricata IDS REST-only group"
}

# Create the REST user manually with a strong password and restrict it to the container IP:
# /user/add name=suricata-api group=ids-rest address=172.31.255.2/32 password="CHANGE_THIS_TO_A_LONG_RANDOM_PASSWORD"

# HTTPS REST requires www-ssl. Do not enable plain HTTP for production.
# /ip/service/enable www-ssl

# Rules are created DISABLED. Enable only after observation-mode testing.
:if ([:len [/ip/firewall/filter/find where comment="IDS-BLOCK source"]] = 0) do={
    /ip/firewall/filter/add chain=forward action=drop src-address-list=IDS-BLOCK disabled=yes comment="IDS-BLOCK source"
}
:if ([:len [/ip/firewall/filter/find where comment="IDS-BLOCK destination"]] = 0) do={
    /ip/firewall/filter/add chain=forward action=drop dst-address-list=IDS-BLOCK disabled=yes comment="IDS-BLOCK destination"
}