96 lines
3.4 KiB
Python
96 lines
3.4 KiB
Python
from __future__ import annotations
|
|
|
|
import os
|
|
from dataclasses import dataclass
|
|
|
|
|
|
def _bool(name: str, default: bool = False) -> bool:
|
|
value = os.getenv(name)
|
|
if value is None:
|
|
return default
|
|
return value.strip().lower() in {"1", "true", "yes", "on"}
|
|
|
|
|
|
def _int(name: str, default: int) -> int:
|
|
value = os.getenv(name)
|
|
if value is None or not value.strip():
|
|
return default
|
|
return int(value)
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class Config:
|
|
tzsp_bind: str
|
|
tzsp_port: int
|
|
tap_name: str
|
|
tap_mtu: int
|
|
suricata_config: str
|
|
suricata_home_net: str
|
|
update_rules_on_start: bool
|
|
web_bind: str
|
|
web_port: int
|
|
db_path: str
|
|
eve_path: str
|
|
alert_retention_days: int
|
|
auto_block: bool
|
|
auto_block_max_severity: int
|
|
monitored_networks: str
|
|
never_block: str
|
|
block_timeout: str
|
|
routeros_url: str
|
|
routeros_user: str
|
|
routeros_password: str
|
|
routeros_verify_tls: bool
|
|
routeros_address_list: str
|
|
routeros_http_timeout: int
|
|
|
|
@classmethod
|
|
def from_env(cls) -> "Config":
|
|
return cls(
|
|
tzsp_bind=os.getenv("TZSP_BIND", "0.0.0.0"),
|
|
tzsp_port=_int("TZSP_PORT", 37008),
|
|
tap_name=os.getenv("TAP_NAME", "suritap0"),
|
|
tap_mtu=_int("TAP_MTU", 9000),
|
|
suricata_config=os.getenv("SURICATA_CONFIG", "/etc/suricata/suricata.yaml"),
|
|
suricata_home_net=os.getenv(
|
|
"SURICATA_HOME_NET",
|
|
"[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]",
|
|
),
|
|
update_rules_on_start=_bool("UPDATE_RULES_ON_START", False),
|
|
web_bind=os.getenv("WEB_BIND", "0.0.0.0"),
|
|
web_port=_int("WEB_PORT", 8080),
|
|
db_path=os.getenv("DB_PATH", "/data/ids.db"),
|
|
eve_path=os.getenv("EVE_PATH", "/var/log/suricata/eve.json"),
|
|
alert_retention_days=_int("ALERT_RETENTION_DAYS", 14),
|
|
auto_block=_bool("AUTO_BLOCK", False),
|
|
auto_block_max_severity=_int("AUTO_BLOCK_MAX_SEVERITY", 1),
|
|
monitored_networks=os.getenv("MONITORED_NETWORKS", "192.168.100.0/24"),
|
|
never_block=os.getenv("NEVER_BLOCK", ""),
|
|
block_timeout=os.getenv("BLOCK_TIMEOUT", "1h"),
|
|
routeros_url=os.getenv("ROUTEROS_URL", "https://172.31.255.1").rstrip("/"),
|
|
routeros_user=os.getenv("ROUTEROS_USER", "suricata-api"),
|
|
routeros_password=os.getenv("ROUTEROS_PASSWORD", "CHANGE_ME"),
|
|
routeros_verify_tls=_bool("ROUTEROS_VERIFY_TLS", False),
|
|
routeros_address_list=os.getenv("ROUTEROS_ADDRESS_LIST", "IDS-BLOCK"),
|
|
routeros_http_timeout=_int("ROUTEROS_HTTP_TIMEOUT", 5),
|
|
)
|
|
|
|
def public_dict(self) -> dict:
|
|
return {
|
|
"tzsp_bind": self.tzsp_bind,
|
|
"tzsp_port": self.tzsp_port,
|
|
"tap_name": self.tap_name,
|
|
"tap_mtu": self.tap_mtu,
|
|
"suricata_home_net": self.suricata_home_net,
|
|
"web_port": self.web_port,
|
|
"auto_block": self.auto_block,
|
|
"auto_block_max_severity": self.auto_block_max_severity,
|
|
"monitored_networks": self.monitored_networks,
|
|
"never_block": self.never_block,
|
|
"block_timeout": self.block_timeout,
|
|
"routeros_url": self.routeros_url,
|
|
"routeros_user": self.routeros_user,
|
|
"routeros_verify_tls": self.routeros_verify_tls,
|
|
"routeros_address_list": self.routeros_address_list,
|
|
}
|