Prepare first stable release

Author: U039b

debian/changelog

@@ -0,0 +1,5 @@
+mongoose (1.0.0) bookworm; urgency=medium
+
+  * Initial release
+
+ -- U+039b <hello@pts-project.org>  Fri, 6 Feb 2026 09:55:52 +0100

debian/control

@@ -0,0 +1,29 @@
+Source: mongoose
+Section: misc
+Priority: optional
+Maintainer: U+039b <hello@pts-project.org>
+Build-Depends:
+ debhelper-compat (= 13),
+ dh-python,
+ python3-all,
+ python3-setuptools,
+ quilt,
+Standards-Version: 4.5.1
+Homepage: https://github.com/PiRogueToolSuite/mongoose
+Rules-Requires-Root: no
+
+Package: mongoose
+Architecture: all
+Depends:
+ geoipupdate,
+ python3-communityid,
+ python3-geoip2,
+ python3-nfstream
+ python3-pydantic,
+ python3-yaml,
+ python3-requests,
+ python3-sqlalchemy
+ ${python3:Depends},
+ ${misc:Depends},
+Description: A lightweight dead-simple Python library and daemon to collect, enrich, store and forward
+network events such as Suricata alerts and Deep Packet Inspection flows.

debian/copyright

@@ -0,0 +1,25 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: mongoose
+Upstream-Contact: U+039b hello@pts-project.org
+Source: https://github.com/PiRogueToolSuite/mongoose
+
+Files: *
+Copyright: 2026   U+039b <hello@pts-project.org>
+                  Defensive Lab Agency <contact@defensive-lab.agency>
+
+License: GPL-3.0+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+ .
+ This package is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU General Public License for more details.
+ .
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <https://www.gnu.org/licenses/>.
+ .
+ On Debian systems, the complete text of the GNU General
+ Public License version 3 can be found in "/usr/share/common-licenses/GPL-3".

debian/mongoose.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Collect, enrich and store network events
+Wants=networking.service
+
+[Service]
+ExecStart=/usr/sbin/mongoosed -c /etc/mongoose/mongoose.yaml
+Environment=PYTHONUNBUFFERED=1
+Restart=on-failure
+RestartSec=2
+Type=notify
+KillSignal=SIGTERM
+TimeoutStopSec=30
+KillMode=control-group
+
+[Install]
+WantedBy=default.target

debian/mongoose.yaml

@@ -0,0 +1,57 @@
+configuration:
+  database_path: "/var/lib/mongoose/mongoose.db"
+  extra_configuration_dir: "/var/lib/mongoose/"
+
+  history:
+    max_duration_days: 14
+
+  collector:
+    suricata:
+      socket_path: "/run/suricata.socket"  # unix_dgram
+      collect_alerts: true
+      collect_netflow: false
+      enable: true
+
+    nf_stream:
+      interface: "eth0"
+      active_timeout: 60  # 60 seconds
+      max_nflows: 0
+      enable: true
+
+  enrichment:
+    geoip:
+      maxmind_db_path: "/var/lib/GeoIP"
+      maxmind_db:
+        "GeoLite2-ASN.mmdb"
+        "GeoLite2-City.mmdb"
+        "GeoLite2-Country.mmdb"
+      enable: true
+
+  forwarder:
+    file:  # grows indefinitely
+      output_dir: /var/log/mongoose
+      topics: [ "enriched-network-dpi", "enriched-network-alert" ]
+      prefix: mongoose-
+      enable: false
+
+    discord:
+      - url: https://discord.com/api/webhooks/...
+        username: mongoose-bot
+        avatar_url: https://example.org/avatar.png
+        allowed_mentions:
+          parse: [ ]
+        enable: false
+
+    webhooks:
+      - url: https://example.org/hook
+        headers:
+          X-API-Key: secret
+        auth_type: header
+        auth_token: s3cr3t
+        auth_header_name: X-API-Key
+        verify_ssl: true
+        retry_count: 3
+        retry_delay: 5.0
+        timeout: 10.0
+        topics: ["enriched-network-dpi", "enriched-network-alert"]
+        enable: false

debian/source/format

@@ -0,0 +1 @@
+3.0 (native)

mongoose/entrypoints/cmd.py

@@ -13,20 +13,27 @@
 import threading
 from pathlib import Path
 from typing import Optional
+from mongoose.core.engine import Engine
+
 
+# Systemd
 try:
-    # systemd's python library exposes notify() which we can call
-    # when running under systemd to report readiness and stopping.
     from systemd.daemon import notify  # type: ignore
 except (Exception,):
 
     def notify(message: str) -> None:  # type: ignore
-        """Fallback notify no-op when systemd libraries are unavailable."""
-        # No-op when systemd notification isn't available.
         return
 
 
-from mongoose.core.engine import Engine
+# PiRogue
+pirogue_isolated_iface: Optional[str] = None
+try:
+    from pirogue_admin_client import PirogueAdminClientAdapter
+
+    admin_client = PirogueAdminClientAdapter()
+    pirogue_isolated_iface = admin_client.get_configuration().get("ISOLATED_INTERFACE")
+except (Exception,):
+    pass
 
 
 def parse_args(argv: Optional[list[str]] = None) -> argparse.Namespace:
@@ -95,6 +102,8 @@ def main(argv: Optional[list[str]] = None) -> int:
         log.warning("Configuration file %s does not exist; attempting to continue", config_path)
         return 1
 
+    network_interface = args.interface or pirogue_isolated_iface or None
+
     try:
         engine = Engine(str(config_path), args.interface)
     except Exception as e:

pyproject.toml

@@ -3,8 +3,11 @@ build-backend = "hatchling.build"
 
 requires = [ "hatchling", "uv-dynamic-versioning" ]
 
+[tool.hatch.build.targets.wheel]
+packages = ["mongoose"]
+
 [project]
-name = "mongoose"
+name = "pts-mongoose"
 description = "Helpers to collect, enrich and store Suricata events and network flows."
 readme = "README.md"
 license = "GPL-3.0-or-later"