# RouterOS v7.22+ custom App template.
# Replace the image with a registry path you control. Manual .tar import is the recommended path for this project.
name: routeros-suricata-tzsp
descr: TZSP receiver with Suricata IDS and local dashboard
category: monitoring
default-credentials: none
services:
  ids:
    image: docker.io/CHANGE_ME/routeros-suricata-tzsp:latest
    ports:
      - 8080:8080:tcp
      - 37008:37008:udp
    devices:
      - /dev/net/tun:/dev/net/tun
    environment:
      TZSP_PORT: "37008"
      SURICATA_LOG_MAX_MB: "512"
      FORENSIC_PCAP_MODE: blocks
      FORENSIC_PCAP_WINDOW_SECONDS: "60"
      FORENSIC_PCAP_MEMORY_MB: "64"
      FORENSIC_PCAP_MAX_FILES: "32"
      FORENSIC_PCAP_MAX_TOTAL_MB: "512"
      TAP_NAME: suritap0
      AUTO_BLOCK: "false"
      MONITORED_NETWORKS: 192.168.0.0/16,10.0.0.0/8,172.16.0.0/12
      ALERT_MAX_SEVERITY: "2"
      ALERT_DEDUP_WINDOW_SECONDS: "300"
      ALERT_IGNORE_SIDS: ""
      ALERT_IGNORE_CATEGORIES: ""
      RULE_UPDATE_INTERVAL_HOURS: "24"
      SURICATA_PERSIST_LIB_DIR: /data/lib/suricata
      REDIS_URL: redis://127.0.0.1:6379/0
      REDIS_MANAGED: "true"
      REDIS_DATA_DIR: /data/redis
      REDIS_PORT: "6379"
      REDIS_MAXMEMORY_MB: "0"
      REDIS_SNAPSHOT_SECONDS: "1800"
      TRAFFIC_RETENTION_HOURS: "24"
      TRAFFIC_MAX_EVENTS: "0"
      TRAFFIC_MEMORY_EVENTS: "0"
      WEBSOCKET_QUEUE_SIZE: "512"
      LIVE_FLOW_UPDATE_SECONDS: "2.0"
      ADMIN_USERNAME: admin
      ADMIN_PASSWORD: ""
      SESSION_HOURS: "168"
      SESSION_COOKIE_SECURE: "false"
      ANALYTICS_SNAPSHOT_INTERVAL_SECONDS: "60"