Suricata

Would you then ship different suricata.yaml files or is it just a documentation thingy?

The idea is to ship multiple yamls for those different performance profiles.

A few thoughts here.

We should identify all the fields in the suricata.yaml that would need to be customized and put place_holder type values in them. Then using YAML, we could create a file with a list of named profiles to provide these values. A Python script (or even sed) could output a config with the place_holder values replaced. Idea for profiles could be AWS instance types, or suggested settings for certain requirements.

Would it make sense for a script to profile the system (memory size, etc) and auto-generate a profile?

Script could be part of suricatactl.

A script would make sense indeed - though the expectation would be that Suri only would be running on the system.
Long time ago I started this - https://github.com/pevma/AAIS as part of similar effort.

We could also set up couple of "hardcoded" configs that aim at covering 1Gbps setups - those should be pretty easy I think. A 10Gbps setup would be a bit more complex as it would depend actually also on NUMA/Intel/AMD architecture.