refactor: distribute Acaua as a Docker image instead of a desktop app

Acaua is a collective SOC daemon consuming only Zeek log files, not a
single-user tool needing local hardware like its siblings. Drop the
Tauri desktop shell, installers and self-update entirely; the server
and its web dashboard ship as a container, updated by pulling a new
image tag.

Link against the official prebuilt libduckdb instead of compiling it
from source via the bundled feature, cutting image build time from
15+ minutes to about 3. Fix a real bug found along the way: as PID 1
in a container, the daemon ignored SIGTERM and was always killed
after the stop timeout; it now shuts down gracefully.

Also corrects the Pillar 1 beaconing score: the period estimate had a
harmonic alias (a perfectly periodic 4h series resolved to 600s), and
the old score formula flagged pure random traffic as suspicious
(p95 = 0.839 on Poisson noise). The new formula was validated against
300 samples per scenario.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD

crates/acaua-cli/src/main.rs

@@ -25,6 +25,8 @@ enum Command {
     },
     Analyze {
         directory: PathBuf,
+        #[arg(long, default_value = ".acaua")]
+        data_dir: PathBuf,
         #[arg(long)]
         json: bool,
     },
@@ -32,10 +34,7 @@ enum Command {
         #[arg(long)]
         json: bool,
     },
-    Update {
-        #[arg(long)]
-        apply: bool,
-    },
+    Update,
 }
 
 #[tokio::main]
@@ -50,8 +49,12 @@ async fn main() {
 async fn run(cli: Cli) -> acaua_core::Result<()> {
     match cli.command {
         Command::Serve { bind, data_dir } => web::serve(&bind, data_dir).await,
-        Command::Analyze { directory, json } => {
-            let report = zeek::analyze_dir(&directory)?;
+        Command::Analyze {
+            directory,
+            data_dir,
+            json,
+        } => {
+            let report = zeek::analyze_dir(&directory, &data_dir)?;
             if json {
                 println!("{}", serde_json::to_string_pretty(&report)?);
             } else {
@@ -59,6 +62,9 @@ async fn run(cli: Cli) -> acaua_core::Result<()> {
                 println!("logs lidos: {}", report.logs_seen);
                 println!("registros: {}", report.records);
                 println!("alertas: {}", report.alerts.len());
+                for alert in &report.alerts {
+                    println!("  [{:.3}] {}", alert.score, alert.summary);
+                }
                 println!("estado: {}", report.status);
             }
             Ok(())
@@ -80,26 +86,27 @@ async fn run(cli: Cli) -> acaua_core::Result<()> {
             }
             Ok(())
         }
-        Command::Update { apply } => {
-            if apply {
-                let executable = std::env::current_exe()?;
-                let tag = update::apply(&executable)?;
-                println!("atualizado para {tag}");
-            } else {
-                let status = update::check(env!("CARGO_PKG_VERSION"))?;
-                println!(
-                    "versão atual: {} | última: {}",
-                    status.current_version,
-                    status.latest_version.as_deref().unwrap_or("desconhecida")
-                );
-                println!(
-                    "atualização disponível: {}",
-                    if status.update_available {
-                        "sim"
-                    } else {
-                        "não"
-                    }
-                );
+        Command::Update => {
+            let status = update::check(env!("CARGO_PKG_VERSION"))?;
+            println!(
+                "versão atual: {} | última: {}",
+                status.current_version,
+                status.latest_version.as_deref().unwrap_or("desconhecida")
+            );
+            println!(
+                "atualização disponível: {}",
+                if status.update_available {
+                    "sim"
+                } else {
+                    "não"
+                }
+            );
+            if status.update_available {
+                if std::env::var("ACAUA_RUNTIME").as_deref() == Ok("container") {
+                    println!("para atualizar: docker compose pull && docker compose up -d");
+                } else {
+                    println!("para atualizar: baixe a nova imagem ou recompile a partir da tag");
+                }
             }
             Ok(())
         }

crates/acaua-cli/src/web.rs

@@ -75,16 +75,19 @@ async fn alerts() -> Json<Vec<Alert>> {
 }
 
 async fn analyze(
+    State(state): State<AppState>,
     Json(request): Json<AnalyzeRequest>,
 ) -> std::result::Result<Json<AnalysisReport>, (StatusCode, Json<ErrorBody>)> {
-    zeek::analyze_dir(&request.path).map(Json).map_err(|error| {
-        (
-            StatusCode::BAD_REQUEST,
-            Json(ErrorBody {
-                error: error.to_string(),
-            }),
-        )
-    })
+    zeek::analyze_dir(&request.path, state.storage.root())
+        .map(Json)
+        .map_err(|error| {
+            (
+                StatusCode::BAD_REQUEST,
+                Json(ErrorBody {
+                    error: error.to_string(),
+                }),
+            )
+        })
 }
 
 async fn update_check() -> std::result::Result<Json<UpdateStatus>, (StatusCode, Json<ErrorBody>)> {
@@ -100,15 +103,6 @@ async fn update_check() -> std::result::Result<Json<UpdateStatus>, (StatusCode,
         })
 }
 
-async fn update_apply() -> (StatusCode, Json<ErrorBody>) {
-    (
-        StatusCode::NOT_IMPLEMENTED,
-        Json(ErrorBody {
-            error: "update --apply is only available through the acaua CLI".to_string(),
-        }),
-    )
-}
-
 async fn logo() -> impl IntoResponse {
     ([(header::CONTENT_TYPE, "image/png")], Body::from(LOGO))
 }
@@ -129,21 +123,38 @@ async fn asset(uri: Uri) -> Response {
 }
 
 async fn shutdown_signal() {
-    let _ = tokio::signal::ctrl_c().await;
+    let interrupt = async {
+        let _ = tokio::signal::ctrl_c().await;
+    };
+    #[cfg(unix)]
+    let terminate = async {
+        match tokio::signal::unix::signal(tokio::signal::unix::SignalKind::terminate()) {
+            Ok(mut stream) => {
+                stream.recv().await;
+            }
+            Err(_) => std::future::pending::<()>().await,
+        }
+    };
+    #[cfg(not(unix))]
+    let terminate = std::future::pending::<()>();
+    tokio::select! {
+        _ = interrupt => {}
+        _ = terminate => {}
+    }
 }
 
 pub async fn serve(bind: &str, data_dir: PathBuf) -> Result<()> {
     let _ = tracing_subscriber::fmt().try_init();
     std::fs::create_dir_all(&data_dir)?;
     let state = AppState {
-        storage: Arc::new(Storage::open(&data_dir)),
+        storage: Arc::new(Storage::open(&data_dir)?),
     };
     let app = Router::new()
         .route("/api/health", get(health))
         .route("/api/status", get(status))
         .route("/api/alerts", get(alerts))
         .route("/api/analyze", post(analyze))
-        .route("/api/update", get(update_check).post(update_apply))
+        .route("/api/update", get(update_check))
         .route("/logo.png", get(logo))
         .fallback(asset)
         .with_state(state)