Settings & Configuration — 44 Sub-Pages, Hot-Reload, Zero Restarts

Most SOC + NOC platforms ask you to edit YAML and SIGHUP a daemon — or worse, redeploy — for every threshold tweak. RoutePulse exposes **44 settings sub-pages** under `src/app/settings/` with over 130 configurable parameters, every one of them hot-reloaded into the running process. The Behaviour Diary’s per-class decay constants τ can be retuned at 14:32:07 and the 14:35 inference cycle uses the new value — no `systemctl restart routepulse` required. Behind the UI: `collector_config` JSONB rows + a 5-min reload tick + service-level `getX()` accessors that always read the latest cached value. Catalog-driven design means the operator owns the platform, not the other way around.

Layout: seven groups — Infrastructure, Routing & Peering, Detection & Security, Notifications, Traffic & Analytics, Compliance & Audit, Administration. New v4.32.100 sections: **`/settings/diary`** (per-Suricata-SID-class decay τ editor + diary cursor visibility + top-20 dangerous hosts), **`/settings/role-catalog`** (39 catalog roles + 16 PROFILE_* + Pending Review tab), **`/settings/ai-firewall`** (AI policy gating + per-action Thompson Beta posteriors), **`/settings/probes`** (synthetic probe scheduling for own-AS reachability + RPKI sanity). All credential fields encrypted at rest with AES-256-GCM; backup & restore packs 9 tables into a ZIP with atomic transactions and a preview panel before import; RBAC distinguishes Admin / Viewer with 24h session TTL and email-invitation flows.

New v4.32.100 surfaces — diary, role-catalog, ai-firewall, probes

**`/settings/diary`** (doc 119 §11.10) — per-Suricata-SID-class decay τ editor with hot-reload via `collector_config.dangerTaxonomy.decayHours` JSONB. 18 default classes (scan, exploit, malware-CnC, policy-violation, dns-tunnel, etc.). Operator can override per-class or reset all; the next danger-score recompute uses the new τ. **`/settings/role-catalog`** — 39 catalog roles + 16 PROFILE_* per security zone + Pending Review tab with SNMP ifAlias one-click suggestion (top-5 confidence-ranked). **`/settings/ai-firewall`** — AI policy gating + per-action Thompson Sampling Beta posteriors visible. **`/settings/probes`** — synthetic probe scheduling.

Infrastructure + Routing & Peering

BMP collector (port 11019, routers, peers, authorised/disabled lists), BGP-4 collector, router management (locations, SNMP/SSH/API credentials), FortiGate integration. Announced prefixes (own IP ranges 185.54.80.0/22), RPKI source/URL/refresh interval, CAIDA + PeeringDB API keys, community dictionaries, AS enrichment sources, ASPA (RFC 9234) validation toggle.

Detection & Security

Anomaly detection (MOAS whitelist, notification level, scope, mass-withdrawal grace, iBGP skip), cybersecurity engine (60+ fields), ML configuration (18-model ensemble weights, training schedules), 39 threat feeds (Spamhaus DROP, Emerging Threats, FireHOL, custom GOLINE), 8-Gate Blackhole Pipeline thresholds, Conviction Engine v2 SPRT alpha/beta parameters.

Notifications + Traffic & Analytics + Administration

Telegram bot, webhook URLs (Slack / Discord / PagerDuty / Jira recipes), email SMTP, scheduled reports (Daily / Weekly / Monthly tri-daily ANIE handovers at 06/14/22 UTC). Flow collector retention, DPI app registry (1,575 apps CRUD), billing P95 models (IXP + transit), per-table retention 1–365 days. RBAC Admin / Viewer, AES-256-GCM credential encryption, API-key management, visitor whitelist, 9-table backup ZIP, service control panel, Ed25519 + SHA-256 hash-chained audit manifest.

Key Capabilities

• 44 settings sub-pages organised in 7 groups: Infrastructure, Routing & Peering, Detection & Security, Notifications, Traffic & Analytics, Compliance & Audit, Administration
• New v4.32.100: `/settings/diary` (per-class τ decay editor) + `/settings/role-catalog` + `/settings/ai-firewall` + `/settings/probes`
• Hot-reload everywhere — collector_config JSONB + 5-min reload tick, **no `systemctl restart` needed** for any threshold tweak
• Behaviour Diary τ editor with 18 Suricata SID classes (scan, exploit, malware-CnC, dns-tunnel, etc.) and per-class override + reset-all
• Role Catalog: 39 catalog roles + 16 PROFILE_* per security zone + Pending Review tab with SNMP ifAlias one-click suggestion
• 130+ configurable parameters covering BMP/BGP-4/router/FortiGate/RPKI/CAIDA/PeeringDB/ML/feeds/notifications/retention/RBAC
• 3 delivery channels: Telegram (HTML, rate-limited 20msg/60s), Email (GOLINE branded), Webhook (Slack/Discord/PagerDuty/Jira recipes)
• 39 threat feeds (Spamhaus DROP, Emerging Threats, FireHOL, custom GOLINE) with per-feed enable/URL/interval
• DPI app registry: 1,575 apps with full CRUD; billing P95 models for IXP + transit; per-table retention 1–365 days
• RBAC Admin / Viewer with 24h session TTL, email-invitation flows, API key management, visitor whitelist
• AES-256-GCM credential encryption at rest; Ed25519-signed audit entry for every settings mutation
• Backup & restore v2 — 9-table ZIP export with atomic transactions and preview panel before import

Engineered and operated by the GOLINE SOC & Network Engineering team.

Explore all RoutePulse features →