# Stops/removes deployment objects but intentionally leaves persistent data/log
# directories on the external disk. Review before importing.

/tool/sniffer/stop
:if ([:len [/container/find where name="suricata-ids"]] > 0) do={
    :local cid [/container/find where name="suricata-ids"]
    :if ([/container/get $cid status] = "running") do={
        /container/stop $cid
        :delay 3s
    }
    /container/remove $cid
}
/container/envs/remove [find where list="IDS_ENV"]
/container/mounts/remove [find where list="IDS_MOUNTS"]
/ip/firewall/filter/remove [find where comment="IDS-BLOCK source"]
/ip/firewall/filter/remove [find where comment="IDS-BLOCK destination"]
/ip/firewall/nat/remove [find where comment="Suricata IDS outbound NAT"]
/interface/bridge/port/remove [find where bridge="br-ids" and interface="veth-ids"]
/interface/veth/remove [find where name="veth-ids"]
/ip/address/remove [find where interface="br-ids" and address="172.31.255.1/30"]
/interface/bridge/remove [find where name="br-ids"]
# ids-rest group/user and disk1/containers/suricata-ids-* are intentionally not removed.