.env.example

# ============================================================================
# AI-SOC Environment Configuration Template
# ============================================================================
# IMPORTANT: Copy this file to .env and replace placeholder values
# NEVER commit .env to version control (already in .gitignore)
#
# Quick Setup:
#   cp .env.example .env
#   # Edit .env with your secure passwords
#   # On Linux: openssl rand -base64 32
#   # On Windows: [System.Convert]::ToBase64String((1..32|%{Get-Random -Max 256}))
# ============================================================================

# ============================================================================
# WAZUH CONFIGURATION
# ============================================================================
# Wazuh Indexer (OpenSearch) Credentials
INDEXER_USERNAME=admin
INDEXER_PASSWORD=CHANGE_ME_SecurePassword123!

# Wazuh API Credentials
API_USERNAME=wazuh-wui
API_PASSWORD=CHANGE_ME_SecurePassword456!

# ============================================================================
# NETWORK CONFIGURATION
# ============================================================================
# Network Interface for Packet Capture (Suricata/Zeek)
# Linux: eth0, ens33, etc. | Windows: Use adapter name from 'ipconfig'
MONITOR_INTERFACE=eth0

# Docker Network Subnets (avoid conflicts with existing networks)
BACKEND_SUBNET=172.20.0.0/24
FRONTEND_SUBNET=172.21.0.0/24
DEV_BACKEND_SUBNET=172.22.0.0/24
DEV_FRONTEND_SUBNET=172.23.0.0/24

# ============================================================================
# POSTGRESQL CONFIGURATION
# ============================================================================
# Database credentials for metadata storage
POSTGRES_USER=aisoc
POSTGRES_PASSWORD=CHANGE_ME_PostgresPassword789!
POSTGRES_DB=aisoc_metadata
POSTGRES_PORT=5432

# PostgreSQL Performance Tuning (adjust based on available RAM)
# Default settings assume 8GB RAM available for PostgreSQL
# For 16GB+ systems, increase shared_buffers to 4GB and effective_cache_size to 12GB

# ============================================================================
# REDIS CONFIGURATION
# ============================================================================
# Redis cache credentials
REDIS_PASSWORD=CHANGE_ME_RedisPassword012!
REDIS_PORT=6379

# Redis memory limit (MB) - adjust based on available RAM
REDIS_MAX_MEMORY=512

# ============================================================================
# JUPYTER LAB CONFIGURATION
# ============================================================================
# Jupyter authentication token (generate with: openssl rand -hex 32)
JUPYTER_TOKEN=CHANGE_ME_JupyterToken345678901234567890ab
JUPYTER_USER=jovyan
JUPYTER_PORT=8888

# ============================================================================
# PORTAINER CONFIGURATION
# ============================================================================
# Portainer admin password (bcrypt hash or plain text)
# Generate hash: htpasswd -nb -B admin your_password | cut -d ":" -f 2
# Or use plain text and Portainer will hash on first run
PORTAINER_ADMIN_PASSWORD=CHANGE_ME_PortainerPassword678!
PORTAINER_HTTP_PORT=9000
PORTAINER_HTTPS_PORT=9443

# ============================================================================
# SOAR / MINIO CONFIGURATION
# ============================================================================
# MinIO S3-compatible storage (used by TheHive for artifact storage)
MINIO_ROOT_USER=minioadmin
MINIO_ROOT_PASSWORD=CHANGE_ME_MinioPassword567!

# ============================================================================
# OPTIONAL SERVICES CONFIGURATION
# ============================================================================
# Adminer (PostgreSQL Web UI)
ADMINER_PORT=8080

# Redis Commander (Redis Web UI)
REDIS_COMMANDER_PORT=8081
REDIS_COMMANDER_USER=admin
REDIS_COMMANDER_PASSWORD=CHANGE_ME_RedisCommanderPass901!

# ============================================================================
# RESOURCE LIMITS
# ============================================================================
# CPU and memory limits for Docker containers
# Adjust based on total system resources
# Minimum system: 16GB RAM, 4 CPU cores
# Recommended system: 32GB RAM, 8 CPU cores

# Wazuh Indexer (OpenSearch)
INDEXER_MEMORY_MIN=2g
INDEXER_MEMORY_MAX=4g
INDEXER_CPU_LIMIT=2.0

# Wazuh Manager
MANAGER_MEMORY_MIN=2g
MANAGER_MEMORY_MAX=4g
MANAGER_CPU_LIMIT=2.0

# Wazuh Dashboard
DASHBOARD_MEMORY_MIN=1g
DASHBOARD_MEMORY_MAX=2g
DASHBOARD_CPU_LIMIT=1.0

# Suricata
SURICATA_MEMORY_MIN=2g
SURICATA_MEMORY_MAX=4g
SURICATA_CPU_LIMIT=2.0

# Zeek
ZEEK_MEMORY_MIN=2g
ZEEK_MEMORY_MAX=4g
ZEEK_CPU_LIMIT=2.0

# ============================================================================
# SSL/TLS CONFIGURATION
# ============================================================================
# Certificate paths (relative to docker-compose directory)
# Generate certificates with: ./scripts/generate-certs.sh

# Wazuh Indexer Certificates
INDEXER_CERT_PATH=./config/wazuh-indexer/certs
INDEXER_ROOT_CA=root-ca.pem
INDEXER_CERT=indexer.pem
INDEXER_KEY=indexer-key.pem

# Wazuh Manager Certificates
MANAGER_CERT_PATH=./config/wazuh-manager/certs
MANAGER_ROOT_CA=root-ca.pem
MANAGER_CERT=filebeat.pem
MANAGER_KEY=filebeat-key.pem

# Wazuh Dashboard Certificates
DASHBOARD_CERT_PATH=./config/wazuh-dashboard/certs
DASHBOARD_CERT=dashboard.pem
DASHBOARD_KEY=dashboard-key.pem

# ============================================================================
# LOG RETENTION AND STORAGE
# ============================================================================
# Log retention policies (days)
WAZUH_LOG_RETENTION=90
SURICATA_LOG_RETENTION=30
ZEEK_LOG_RETENTION=30

# Storage paths (for custom volume mounts)
# Leave commented to use Docker volumes
# WAZUH_DATA_PATH=/opt/ai-soc/wazuh/data
# SURICATA_LOGS_PATH=/opt/ai-soc/suricata/logs
# ZEEK_LOGS_PATH=/opt/ai-soc/zeek/logs

# ============================================================================
# ALERTING AND NOTIFICATIONS
# ============================================================================
# Email SMTP Configuration (for alert notifications)
SMTP_HOST=smtp.gmail.com
SMTP_PORT=587
SMTP_USERNAME=your-email@example.com
SMTP_PASSWORD=CHANGE_ME_SmtpPassword234!
SMTP_FROM=ai-soc@example.com
SMTP_TO=security-team@example.com

# Slack Webhook (optional)
SLACK_WEBHOOK_URL=https://hooks.slack.com/services/YOUR/WEBHOOK/URL

# ============================================================================
# DATASET CONFIGURATION
# ============================================================================
# Paths to security datasets (for replay and training)
CICIDS2017_PATH=./datasets/CICIDS2017
UNSW_NB15_PATH=./datasets/UNSW-NB15
LOGHUB_PATH=./datasets/LogHub-2.0

# ============================================================================
# SYSTEM TUNING (Linux Only)
# ============================================================================
# OpenSearch/Elasticsearch requirement
# Run before deployment: sudo sysctl -w vm.max_map_count=262144
# Permanent: echo "vm.max_map_count=262144" | sudo tee -a /etc/sysctl.conf
VM_MAX_MAP_COUNT=262144

# ============================================================================
# DEPLOYMENT MODE
# ============================================================================
# Environment: development, staging, production
DEPLOYMENT_ENV=development

# Enable debug logging (true/false)
DEBUG_MODE=true

# Timezone for logs and timestamps
TZ=America/Los_Angeles

# ============================================================================
# BACKUP CONFIGURATION
# ============================================================================
# Backup directory for database dumps and configurations
BACKUP_DIR=./backups

# Automated backup schedule (cron format)
# Default: Daily at 2 AM
BACKUP_SCHEDULE=0 2 * * *

# ============================================================================
# SECURITY BEST PRACTICES
# ============================================================================
# 1. Generate strong passwords (32+ characters, alphanumeric + symbols)
# 2. Use unique passwords for each service
# 3. Rotate passwords every 90 days
# 4. Enable 2FA where supported
# 5. Restrict network access with firewall rules
# 6. Enable SSL/TLS for all services
# 7. Regular security audits and updates
# 8. Monitor logs for suspicious activity
# 9. Backup .env file securely (encrypted storage)
# 10. Never commit .env to version control
#
# Password Generation Commands:
# - Linux/Mac: openssl rand -base64 32
# - Windows PowerShell: [System.Convert]::ToBase64String((1..32|%{Get-Random -Max 256}))
# - Python: python -c "import secrets; print(secrets.token_urlsafe(32))"
#
# ============================================================================
# END OF CONFIGURATION
# ============================================================================