- Add conditional execution to export-malicious-ips task: only runs
when honeypot was accessed in last 5 minutes
- Add since_minutes parameter to get_access_logs() for time filtering
- Optimize analyze-ips task to only process IPs with activity in the
last minute, fetching full history per-IP instead of all logs
- Exclude RFC1918 private addresses and non-routable IPs from IP
reputation enrichment (10.x, 172.16-31.x, 192.168.x, 127.x, 169.254.x)
- Add missing session.commit() and cleanup to update_ip_rep_infos() **bugfix**
- Enable SQLite WAL mode and 30s busy timeout for better concurrency **race condition prevention**
- Add get_unenriched_ips() method to only fetch IPs needing enrichment **don't enrich what's already done*
- Rewrite fetch_ip_rep task to process only unenriched IPs (limit 50) **API kindness**
- Change task frequency from every 1 minute to every 5 minutes **API kindness**
- Add request timeout (10s) and proper error handling **can update to longer if needed**
- Implement export-malicious-ips task that queries distinct IPs flagged
as is_suspicious from database and writes to exports/malicious_ips.txt
- Add exports volume mount to docker-compose.yaml for host persistence
- Update entrypoint.sh to fix ownership of exports directory for krawl user
- Update Dockerfile to create /app/exports directory during build
Other tasks can be added by creating them in the tasks dir using the same setup as this task.
All tasks *MUST* include a TASK_CONFIG dict and a main method in the file to work correctly.
