Lucas RayanandClaude Sonnet 5
8a80504c45
Release / Plan (reuse the published image?) (push) Successful in 3s
CI / Docker image (build and smoke test) (push) Skipped
CI / Format and clippy (push) Successful in 4m32s
CI / Dependency audit (push) Successful in 11s
CI / Tests (Linux) (push) Successful in 9m15s
Release / ci (push) Successful in 9m18s
Release / Build image (arm64) (push) Failing after 7m7s
Release / Build image (amd64) (push) Failing after 13m53s
Release / Publish tags (push) Skipped
Release / Gitea release (push) Skipped
Acaua is a collective SOC daemon consuming only Zeek log files, not a single-user tool needing local hardware like its siblings. Drop the Tauri desktop shell, installers and self-update entirely; the server and its web dashboard ship as a container, updated by pulling a new image tag. Link against the official prebuilt libduckdb instead of compiling it from source via the bundled feature, cutting image build time from 15+ minutes to about 3. Fix a real bug found along the way: as PID 1 in a container, the daemon ignored SIGTERM and was always killed after the stop timeout; it now shuts down gracefully. Also corrects the Pillar 1 beaconing score: the period estimate had a harmonic alias (a perfectly periodic 4h series resolved to 600s), and the old score formula flagged pure random traffic as suspicious (p95 = 0.839 on Poisson noise). The new formula was validated against 300 samples per scenario. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD
46 lines
1.2 KiB
YAML
46 lines
1.2 KiB
YAML
# Acauã stack: Zeek captures traffic and writes hourly-rotated logs; Acauã
|
|
# reads them read-only and serves the API and the web dashboard.
|
|
#
|
|
# cp .env.example .env # set ZEEK_INTERFACE (authorized network only)
|
|
# docker compose pull && docker compose up -d # operators: published image
|
|
# docker compose up -d --build # developers: build locally
|
|
name: acaua
|
|
|
|
services:
|
|
zeek:
|
|
image: ${ZEEK_IMAGE:-zeek/zeek:9.0.1}
|
|
network_mode: host
|
|
cap_drop: [ALL]
|
|
cap_add: [NET_RAW, NET_ADMIN]
|
|
working_dir: /logs
|
|
command:
|
|
- zeek
|
|
- -i
|
|
- ${ZEEK_INTERFACE:-eth0}
|
|
- Log::default_logdir=/logs
|
|
- Log::default_rotation_interval=1hr
|
|
- Log::default_rotation_dir=/logs/archive
|
|
volumes:
|
|
- zeek-logs:/logs
|
|
restart: unless-stopped
|
|
|
|
acaua:
|
|
image: ${ACAUA_IMAGE:-git.lucasrguerra.dev.br/ciberfauna/acaua}:${ACAUA_VERSION:-latest}
|
|
build: .
|
|
ports:
|
|
- "${ACAUA_PUBLISH:-127.0.0.1:8787}:8787"
|
|
volumes:
|
|
- zeek-logs:/data/zeek:ro
|
|
- acaua-data:/data/acaua
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp
|
|
cap_drop: [ALL]
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
zeek-logs:
|
|
acaua-data:
|