routeros-suricata-tzsp/Dockerfile

ARG BASE_IMAGE=debian:trixie-slim

FROM ${BASE_IMAGE} AS rust-builder
ARG DEBIAN_FRONTEND=noninteractive
RUN apt-get update \
    && apt-get install -y --no-install-recommends cargo rustc \
    && rm -rf /var/lib/apt/lists/*
WORKDIR /build/tzsp-receiver
COPY rust/tzsp-receiver/Cargo.toml ./Cargo.toml
COPY rust/tzsp-receiver/src ./src
RUN cargo test --release \
    && cargo build --release

FROM ${BASE_IMAGE}

ARG DEBIAN_FRONTEND=noninteractive

# Keep the runtime image small: no recommends, docs, man pages or apt cache.
RUN printf '%s\n' \
      'path-exclude=/usr/share/doc/*' \
      'path-exclude=/usr/share/man/*' \
      'path-exclude=/usr/share/info/*' \
      'path-exclude=/usr/share/locale/*' \
      > /etc/dpkg/dpkg.cfg.d/01_nodoc \
    && printf '%s\n' 'deb http://deb.debian.org/debian trixie-backports main' > /etc/apt/sources.list.d/trixie-backports.list \
    && apt-get update \
    && apt-get install -y --no-install-recommends \
       ca-certificates \
       iproute2 \
       passwd \
       python3 \
       redis-server \
       suricata-update \
       tini \
    && apt-get install -y --no-install-recommends -t trixie-backports suricata \
    && if ! getent group suricata >/dev/null 2>&1; then groupadd --system suricata; fi \
    && if ! id -u suricata >/dev/null 2>&1; then useradd --system --gid suricata --home-dir /var/lib/suricata --no-create-home --shell /usr/sbin/nologin suricata; fi \
    && getent passwd suricata >/dev/null \
    && getent group suricata >/dev/null \
    && suricata --build-info >/dev/null \
    && suricata-update -V \
    && suricata-update update-sources \
    && suricata-update \
    && mkdir -p /opt/ids/vendor-rules-seed \
    && cp -a /var/lib/suricata/. /opt/ids/vendor-rules-seed/ \
    && apt-get clean \
    && rm -rf \
       /var/lib/apt/lists/* \
       /var/cache/apt/* \
       /usr/share/doc/* \
       /usr/share/man/* \
       /usr/share/info/* \
       /usr/share/locale/*

WORKDIR /opt/ids

COPY --from=rust-builder /build/tzsp-receiver/target/release/mikrosuricata-tzsp /usr/local/bin/mikrosuricata-tzsp
COPY app /opt/ids/app
COPY scripts /opt/ids/scripts
COPY suricata /opt/ids/suricata

RUN chmod +x /opt/ids/scripts/*.sh \
    && mkdir -p /data /var/log/suricata /var/lib/suricata/rules /run/suricata /run/mikrosuricata /tmp/suricata-build-test \
    && suricata -T \
       -c /etc/suricata/suricata.yaml \
       --include /opt/ids/suricata/ids-output.yaml \
       -l /tmp/suricata-build-test \
       -s /opt/ids/suricata/local.rules \
       --set 'vars.address-groups.HOME_NET=[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]' \
       --set 'app-layer.protocols.tls.ja3-fingerprints=yes' \
       --set 'app-layer.protocols.tls.ja4-fingerprints=yes' \
       --set 'app-layer.protocols.ssh.hassh=yes' \
    && rm -rf /tmp/suricata-build-test \
    && chown -R suricata:suricata /var/log/suricata /var/lib/suricata /run/suricata

ENV PYTHONUNBUFFERED=1 \
    TZSP_BIND=0.0.0.0 \
    TZSP_PORT=37008 \
    TZSP_RECEIVER_BIN=/usr/local/bin/mikrosuricata-tzsp \
    TZSP_TELEMETRY_SOCKET=/run/mikrosuricata/tzsp-telemetry.sock \
    TZSP_RCVBUF_BYTES=33554432 \
    TZSP_BATCH_SIZE=256 \
    TZSP_QUEUE_MB=64 \
    TZSP_DATAGRAM_BYTES=12288 \
    TAP_NAME=suritap0 \
    TAP_MTU=9000 \
    WEB_BIND=0.0.0.0 \
    WEB_PORT=8080 \
    DB_PATH=/data/ids.db \
    EVE_PATH=/data/logs/suricata/eve.json \
    SURICATA_LOG_MAX_MB=512 \
    FORENSIC_PCAP_MODE=alerts \
    FORENSIC_PCAP_WINDOW_SECONDS=60 \
    FORENSIC_PCAP_MEMORY_MB=64 \
    FORENSIC_PCAP_MAX_FILES=32 \
    FORENSIC_PCAP_MAX_TOTAL_MB=512 \
    SURICATA_OUTPUT_CONFIG=/opt/ids/suricata/ids-output.yaml \
    SURICATA_LOCAL_RULES=/data/suricata/local.rules \
    SURICATA_EXTRA_RULES_GLOB=/data/suricata/*.rules \
    SURICATA_CUSTOM_RULES=/data/suricata/custom.rules \
    SURICATA_THRESHOLD_CONFIG=/data/suricata/threshold.config \
    SURICATA_PERSIST_LIB_DIR=/data/lib/suricata \
    ALERT_MAX_SEVERITY=2 \
    ALERT_DEDUP_WINDOW_SECONDS=300 \
    ALERT_IGNORE_SIDS=1000001 \
    ADMIN_USERNAME=admin \
    ADMIN_PASSWORD= \
    METRICS_ALLOWED_IPS=127.0.0.1/32,::1/128 \
    METRICS_BASIC_AUTH_USERNAME= \
    METRICS_BASIC_AUTH_PASSWORD= \
    SESSION_HOURS=168 \
    SESSION_COOKIE_SECURE=false \
    ANALYTICS_SNAPSHOT_INTERVAL_SECONDS=120 \
    AUTO_BLOCK=false \
    UPDATE_RULES_ON_START=false \
    RULE_UPDATE_INTERVAL_HOURS=24 \
    REDIS_URL=redis://127.0.0.1:6379/0 \
    REDIS_MANAGED=true \
    REDIS_DATA_DIR=/data/redis \
    REDIS_PORT=6379 \
    REDIS_MAXMEMORY_MB=128 \
    REDIS_SNAPSHOT_SECONDS=0 \
    REDIS_AOF=false \
    TRAFFIC_RETENTION_HOURS=24 \
    TRAFFIC_MAX_EVENTS=50000 \
    TRAFFIC_MEMORY_EVENTS=0 \
    WEBSOCKET_QUEUE_SIZE=512 \
    LIVE_FLOW_UPDATE_SECONDS=2.0 \
    NDR_ENABLED=true \
    NDR_CORRELATION_WINDOW_SECONDS=1800 \
    BEHAVIOR_MIN_OBSERVATIONS=50 \
    NDR_AUTO_BLOCK=false \
    NDR_AUTO_BLOCK_RISK=92 \
    ROUTEROS_INVENTORY_INTERVAL_SECONDS=300 \
    NOTIFY_MIN_RISK=80 \
    NOTIFY_TIMEOUT_SECONDS=5

EXPOSE 37008/udp 8080/tcp

HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 CMD ["python3", "/opt/ids/scripts/healthcheck.py"]

ENTRYPOINT ["/usr/bin/tini", "--", "/opt/ids/scripts/entrypoint.sh"]