47 lines
1.9 KiB
Plaintext
47 lines
1.9 KiB
Plaintext
# --- AI Configuration ---
|
|
OLLAMA_API_URL=http://localhost:11434/api/generate
|
|
OLLAMA_MODEL=llama3.2:1b
|
|
# How long to wait for the (CPU-only) model to respond before giving up
|
|
OLLAMA_TIMEOUT_SECONDS=300
|
|
|
|
# The script now feeds the AI pre-extracted, structured facts (not raw log
|
|
# lines), so this prompt only needs to tell it HOW to write, not what to look
|
|
# for -- the analysis itself happens in Python before the AI ever runs.
|
|
# A sensible default is baked into daily_summary.py; override here only if
|
|
# you want different tone/length.
|
|
# AI_SYSTEM_PROMPT="..."
|
|
|
|
# --- Email Reporting Configuration ---
|
|
REPORT_TO_EMAIL=admin@yourdomain.com
|
|
REPORT_FROM_EMAIL=system@yourdomain.com
|
|
SMTP_SERVER=mail.yourdomain.com
|
|
SMTP_PORT=587
|
|
SMTP_USER=
|
|
SMTP_PASS=
|
|
|
|
# --- Log Analysis Configuration ---
|
|
JOURNAL_UNIT=mailserver
|
|
# Comma-separated CIDR ranges allowed to log in to mailboxes. Logins from
|
|
# outside these ranges are flagged in the report as noteworthy.
|
|
TRUSTED_LOGIN_NETWORKS=10.0.0.0/24
|
|
|
|
# --- Multi-day repeat-offender tracking ---
|
|
# Requires the /data mount added to the systemd unit (bind-mounted, read-write)
|
|
# so this state survives across container restarts/daily runs.
|
|
STATE_FILE=/data/offender_state.json
|
|
# An IP gets called out as a repeat offender once seen on this many distinct days
|
|
REPEAT_OFFENDER_THRESHOLD_DAYS=3
|
|
# IPs not seen again within this many days are dropped from tracking
|
|
OFFENDER_RETENTION_DAYS=30
|
|
|
|
# --- Execution Options ---
|
|
# Set to 'true' to see detailed background processes, 'false' for clean logs
|
|
DEBUG=true
|
|
# Set to 'true' to run also immediately when the container starts, 'false' to wait for the schedule
|
|
# NOTE: leave this 'false' in production. Combined with the systemd unit's
|
|
# Restart=always, an immediate run on every container (re)start can cause
|
|
# duplicate/rapid-fire reports if the container is restarting frequently.
|
|
RUN_NOW=true
|
|
# Time format must be HH:MM in 24-hour format
|
|
REPORT_TIME=08:00
|