.envrc.example

# .envrc and .justfile can be used by direnv (https://github.com/direnv/direnv) and
#   just (https://github.com/casey/just) for quicker turnaround for ./scripts/install.py
#   and ./scripts/auth_setup. This will all likely be made obsolete when cisagov/Malcolm#395
#   is complete. This hasn't been exhaustively tested, so it's recommended more for
#   development convenience than it is for production use.

export MALCOLM_COMPOSE_FILE=$PWD/docker-compose.yml
export MALCOLM_CONFIG_DIR=$PWD/config
export MALCOLM_CONTAINER_RUNTIME=docker
export MALCOLM_URL=

# main configuration variables
export VERBOSE=
export MALCOLM_PROFILE=malcolm
export PUID=$(id -u)
export PGID=$(id -g)
export NODE_NAME=malcolm
export DARK_MODE=true
export HTTPS=true
export NGINX_RESOLVER_IPV4=true
export NGINX_RESOLVER_IPV6=false
export RESTART_MALCOLM=no
export REVERSE_PROXIED=false
export TRAEFIK_HOST=
export TRAEFIK_HOST_OPENSEARCH=
export TRAEFIK_ENTRYPOINT=
export TRAEFIK_RESOLVER=
export NETWORK_NAME=
export OPENSEARCH=opensearch-local
export OPENSEARCH_MEMORY=10g
export OPENSEARCH_URL=https://opensearch:9200
export OPENSEARCH_SSL_VERIFY=false
export OPENSEARCH_SECONDARY=
export OPENSEARCH_SECONDARY_URL=
export OPENSEARCH_SECONDARY_SSL_VERIFY=false
export DASHBOARDS_URL=http://dashboards:5601/dashboards
export LOGSTASH_HOST=
export LOGSTASH_MEMORY=3g
export LOGSTASH_WORKERS=2
export LOGSTASH_EXPOSE=false
export OPENSEARCH_EXPOSE=false
export FILEBEAT_TCP_EXPOSE=false
export SFTP_EXPOSE=false
export SYSLOG_PORT_UDP=0
export SYSLOG_PORT_TCP=0
export FILESCAN_PATH=
export OPENSEARCH_PATH=
export OPENSEARCH_SNAPSHOT_PATH=
export PCAP_PATH=
export SURICATA_PATH=
export ZEEK_PATH=
export DELETE_OLD_PCAP=false
export DELETE_PCAP_THRESHOLD=5%
export EXTRACTED_FILE_MAX_SIZE_THRESHOLD=25G
export EXTRACTED_FILE_TOTAL_DISK_USAGE_PERCENT_THRESHOLD=0
export DELETE_INDEX_THRESHOLD=500g
export INDEX_MANAGEMENT_ENABLE=false
export INDEX_MANAGEMENT_HOT_WARM_ENABLE=false
export INDEX_MANAGEMENT_OPTIMIZATION_TIME_PERIOD=
export INDEX_MANAGEMENT_SPI_DATA_RETENTION=
export INDEX_MANAGEMENT_REPLICAS=0
export INDEX_MANAGEMENT_WEEKS_OF_HISTORY=13
export INDEX_MANAGEMENT_SEGMENTS=1
export AUTO_ARKIME=true
export ARKIME_EXPOSE_WISE_GUI=true
export ARKIME_ALLOW_WISE_GUI_CONFIG=false
export ARKIME_WISE_SERVICE_URL=http://arkime:8081
export AUTO_SURICATA=true
export SURICATA_RULE_UPDATE=false
export SURICATA_DISABLE_SIDS=
export AUTO_ZEEK=true
export ZEEK_ICS=true
export ZEEK_ICS_BEST_GUESS=true
export ZEEK_INTEL_ON_STARTUP=true
export ZEEK_INTEL_LIVE=true
export ZEEK_INTEL_OFFLINE=true
export ZEEK_INTEL_FEED_SINCE="24 hours ago"
export ZEEK_INTEL_CRON_EXPRESSION='0 0 * * *'
export ZEEK_INTEL_ITEM_EXPIRATION="-1min"
export REVERSE_DNS=false
export AUTO_OUI=true
export AUTO_FREQ=true
export AUTO_COMMUNITY_ID=true
export PIPELINE_ENABLED=true
export PIPELINE_WORKERS=1
export STRELKA_SCANNERS=default
export FILE_EXTRACTION=interesting
export FILE_PRESERVATION=quarantined
export EXTRACTED_FILE_SERVER=true
export EXTRACTED_FILE_SERVER_ZIP=true
export EXTRACTED_FILE_SERVER_PASSWORD=infected
export FILE_SCAN_RULE_UPDATE=true
export NETBOX=local
export NETBOX_URL=
export NETBOX_ENRICH=true
export NETBOX_AUTOPOPULATE=false
export NETBOX_AUTO_PREFIXES=false
export NETBOX_SITE_NAME=Malcolm
export NETBOX_AUTO_POPULATE_SUBNETS=
export LOGSTASH_NETBOX_ENRICHMENT_DATASETS=default
export LIVE_CAPTURE_IFACE=
export LIVE_CAPTURE_FILTER="not port 5044 and not port 5045 and not port 8005 and not port 8006 and not port 9200"
export LIVE_CAPTURE_IFACE_TWEAK=true
export LIVE_CAPTURE_STATS=true
export LIVE_CAPTURE_ARKIME_NODE_HOST=
export LIVE_CAPTURE_ARKIME=false
export LIVE_CAPTURE_ARKIME_COMPRESSION=none
export LIVE_CAPTURE_ARKIME_COMPRESSION_LEVEL=0
export LIVE_CAPTURE_TCPDUMP=false
export LIVE_CAPTURE_NETSNIFF=true
export LIVE_CAPTURE_ZEEK=true
export LIVE_CAPTURE_SURICATA=true
export EXTRA_TAGS=

# auth configuration variables
export AUTH_METHOD=basic
export ROLE_BASED_ACCESS=false
export AUTH_ADMIN_USERNAME=maltest
export AUTH_ADMIN_PASSWORD=M@lc0lm
export AUTH_ARKIME_PASSWORD=Malcolm
export AUTH_ARKIME_WISE_PIN=WISE2019
export AUTH_KEYCLOAK_BOOTSTRAP_USERNAME=bootstrap
export AUTH_KEYCLOAK_BOOTSTRAP_PASSWORD=M@lc0lm
export AUTH_GENERATE_WEBCERTS=true
export AUTH_GENERATE_FWCERTS=true
export AUTH_GENERATE_OPENSEARCH_CREDS=true
export AUTH_GENERATE_NETBOX_PASSWORDS=true
export AUTH_GENERATE_VALKEY_PASSWORD=true
export AUTH_GENERATE_POSTGRES_PASSWORD=true
export AUTH_GENERATE_KEYCLOAK_DB_PASSWORD=true
export AUTH_KEYCLOAK_REALM=master
export AUTH_KEYCLOAK_REDIRECT_URI=/index.html
export AUTH_KEYCLOAK_URL=
export AUTH_KEYCLOAK_CLIENT_ID=
export AUTH_KEYCLOAK_CLIENT_SECRET=
export AUTH_REQUIRE_GROUP=
export AUTH_REQUIRE_ROLE=
export NETBOX_TOKEN=

# kubernetes
export MALCOLM_K8S_DELETE_NAMESPACE=false
export MALCOLM_K8S_IMAGE_SOURCE=ghcr.io/idaholab/malcolm
export MALCOLM_K8S_IMAGE_TAG=main
export MALCOLM_K8S_INJECT_RESOURCES=false
export MALCOLM_K8S_NAMESPACE=malcolm
export MALCOLM_K8S_NO_CAPABILITIES=false
export MALCOLM_K8S_NO_CAPTURE_PODS=false
export MALCOLM_K8S_SKIP_PERSISTENT_VOLUME_CHECKS=false
export MALCOLM_K8S_DRY_RUN=false
export MALCOLM_K8S_SEPARATE_HEAVY_WORKLOADS=false
export MALCOLM_NAMESPACE="$MALCOLM_K8S_NAMESPACE"
export MALCOLM_IMAGE_SOURCE=$MALCOLM_K8S_IMAGE_SOURCE
export MALCOLM_IMAGE_TAG=$MALCOLM_K8S_IMAGE_TAG

# extra configuration variables
export ARKIME_AUTO_ANALYZE_PCAP_THREADS=2
export ARKIME_ROTATE_INDEX=daily
export ARKIME_SPI_DATA_MAX_INDICES=7
export CSRF_TRUSTED_ORIGINS=https://*
export FILESCAN_HTTP_SERVER_MAGIC=true
export FILEBEAT_PREPARE_PROCESS_COUNT=2
export LOGSTASH_ZEEK_IGNORED_LOGS=loaded_scripts,png,stderr,stdout
export MALCOLM_API_DEBUG=false
export MALCOLM_NETWORK_INDEX_ALIAS=malcolm_network
export MALCOLM_NETWORK_INDEX_SUFFIX=%{%y%m%d}
export MALCOLM_OTHER_INDEX_ALIAS=malcolm_other
export MALCOLM_OTHER_INDEX_SUFFIX=%{%y%m%d}
export NETBOX_ENRICHMENT_DEBUG=false
export NETBOX_ENRICHMENT_DEBUG_TIMINGS=false
export NGINX_ERROR_LOG_LEVEL=
export NGINX_KEYCLOAK_BASIC_AUTH=false
export NGINX_LOG_ACCESS_AND_ERRORS=true
export PCAP_PIPELINE_IGNORE_PREEXISTING=true
export SURICATA_AUTO_ANALYZE_PCAP_PROCESSES=2
export SURICATA_AUTO_ANALYZE_PCAP_THREADS=0
export ZEEK_AUTO_ANALYZE_PCAP_THREADS=2
export ZEEK_DISABLE_ICS_GE_SRTP=
export ZEEK_DISABLE_ICS_GENISYS=
export ZEEK_SYNCHROPHASOR_DETAILED=false