Release / Plan (reuse the published image?) (push) Successful in 3s
CI / Docker image (build and smoke test) (push) Skipped
CI / Format and clippy (push) Successful in 4m32s
CI / Dependency audit (push) Successful in 11s
CI / Tests (Linux) (push) Successful in 9m15s
Release / ci (push) Successful in 9m18s
Release / Build image (arm64) (push) Failing after 7m7s
Release / Build image (amd64) (push) Failing after 13m53s
Release / Publish tags (push) Skipped
Release / Gitea release (push) Skipped
Acaua is a collective SOC daemon consuming only Zeek log files, not a single-user tool needing local hardware like its siblings. Drop the Tauri desktop shell, installers and self-update entirely; the server and its web dashboard ship as a container, updated by pulling a new image tag. Link against the official prebuilt libduckdb instead of compiling it from source via the bundled feature, cutting image build time from 15+ minutes to about 3. Fix a real bug found along the way: as PID 1 in a container, the daemon ignored SIGTERM and was always killed after the stop timeout; it now shuts down gracefully. Also corrects the Pillar 1 beaconing score: the period estimate had a harmonic alias (a perfectly periodic 4h series resolved to 600s), and the old score formula flagged pure random traffic as suspicious (p95 = 0.839 on Poisson noise). The new formula was validated against 300 samples per scenario. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD
171 lines
4.6 KiB
Rust
171 lines
4.6 KiB
Rust
use acaua_core::fusion::Alert;
|
|
use acaua_core::storage::{DatasetSummary, Storage};
|
|
use acaua_core::update::UpdateStatus;
|
|
use acaua_core::zeek::{self, AnalysisReport};
|
|
use acaua_core::{update, Result};
|
|
use axum::body::Body;
|
|
use axum::extract::State;
|
|
use axum::http::{header, StatusCode, Uri};
|
|
use axum::response::{IntoResponse, Response};
|
|
use axum::routing::{get, post};
|
|
use axum::{Json, Router};
|
|
use rust_embed::RustEmbed;
|
|
use serde::{Deserialize, Serialize};
|
|
use std::path::PathBuf;
|
|
use std::sync::Arc;
|
|
use tokio::net::TcpListener;
|
|
use tower_http::compression::CompressionLayer;
|
|
use tower_http::cors::CorsLayer;
|
|
use tower_http::trace::TraceLayer;
|
|
|
|
const LOGO: &[u8] = include_bytes!("../../../logo.png");
|
|
|
|
#[derive(RustEmbed)]
|
|
#[folder = "../../apps/gui/ui/"]
|
|
struct Assets;
|
|
|
|
#[derive(Clone)]
|
|
struct AppState {
|
|
storage: Arc<Storage>,
|
|
}
|
|
|
|
#[derive(Serialize)]
|
|
struct Health {
|
|
status: &'static str,
|
|
version: &'static str,
|
|
}
|
|
|
|
#[derive(Serialize)]
|
|
struct Status {
|
|
version: &'static str,
|
|
mode: &'static str,
|
|
dataset: DatasetSummary,
|
|
}
|
|
|
|
#[derive(Serialize)]
|
|
struct ErrorBody {
|
|
error: String,
|
|
}
|
|
|
|
#[derive(Deserialize)]
|
|
struct AnalyzeRequest {
|
|
path: String,
|
|
}
|
|
|
|
async fn health() -> Json<Health> {
|
|
Json(Health {
|
|
status: "ok",
|
|
version: env!("CARGO_PKG_VERSION"),
|
|
})
|
|
}
|
|
|
|
async fn status(State(state): State<AppState>) -> Json<Status> {
|
|
Json(Status {
|
|
version: env!("CARGO_PKG_VERSION"),
|
|
mode: "serve",
|
|
dataset: state
|
|
.storage
|
|
.summary()
|
|
.unwrap_or_else(|_| DatasetSummary::empty()),
|
|
})
|
|
}
|
|
|
|
async fn alerts() -> Json<Vec<Alert>> {
|
|
Json(Vec::new())
|
|
}
|
|
|
|
async fn analyze(
|
|
State(state): State<AppState>,
|
|
Json(request): Json<AnalyzeRequest>,
|
|
) -> std::result::Result<Json<AnalysisReport>, (StatusCode, Json<ErrorBody>)> {
|
|
zeek::analyze_dir(&request.path, state.storage.root())
|
|
.map(Json)
|
|
.map_err(|error| {
|
|
(
|
|
StatusCode::BAD_REQUEST,
|
|
Json(ErrorBody {
|
|
error: error.to_string(),
|
|
}),
|
|
)
|
|
})
|
|
}
|
|
|
|
async fn update_check() -> std::result::Result<Json<UpdateStatus>, (StatusCode, Json<ErrorBody>)> {
|
|
update::check(env!("CARGO_PKG_VERSION"))
|
|
.map(Json)
|
|
.map_err(|error| {
|
|
(
|
|
StatusCode::BAD_GATEWAY,
|
|
Json(ErrorBody {
|
|
error: error.to_string(),
|
|
}),
|
|
)
|
|
})
|
|
}
|
|
|
|
async fn logo() -> impl IntoResponse {
|
|
([(header::CONTENT_TYPE, "image/png")], Body::from(LOGO))
|
|
}
|
|
|
|
async fn asset(uri: Uri) -> Response {
|
|
let path = uri.path().trim_start_matches('/');
|
|
let path = if path.is_empty() { "index.html" } else { path };
|
|
match Assets::get(path) {
|
|
Some(file) => {
|
|
let mime = mime_guess::from_path(path).first_or_octet_stream();
|
|
Response::builder()
|
|
.header(header::CONTENT_TYPE, mime.as_ref())
|
|
.body(Body::from(file.data.into_owned()))
|
|
.unwrap_or_else(|_| StatusCode::INTERNAL_SERVER_ERROR.into_response())
|
|
}
|
|
None => (StatusCode::NOT_FOUND, "not found").into_response(),
|
|
}
|
|
}
|
|
|
|
async fn shutdown_signal() {
|
|
let interrupt = async {
|
|
let _ = tokio::signal::ctrl_c().await;
|
|
};
|
|
#[cfg(unix)]
|
|
let terminate = async {
|
|
match tokio::signal::unix::signal(tokio::signal::unix::SignalKind::terminate()) {
|
|
Ok(mut stream) => {
|
|
stream.recv().await;
|
|
}
|
|
Err(_) => std::future::pending::<()>().await,
|
|
}
|
|
};
|
|
#[cfg(not(unix))]
|
|
let terminate = std::future::pending::<()>();
|
|
tokio::select! {
|
|
_ = interrupt => {}
|
|
_ = terminate => {}
|
|
}
|
|
}
|
|
|
|
pub async fn serve(bind: &str, data_dir: PathBuf) -> Result<()> {
|
|
let _ = tracing_subscriber::fmt().try_init();
|
|
std::fs::create_dir_all(&data_dir)?;
|
|
let state = AppState {
|
|
storage: Arc::new(Storage::open(&data_dir)?),
|
|
};
|
|
let app = Router::new()
|
|
.route("/api/health", get(health))
|
|
.route("/api/status", get(status))
|
|
.route("/api/alerts", get(alerts))
|
|
.route("/api/analyze", post(analyze))
|
|
.route("/api/update", get(update_check))
|
|
.route("/logo.png", get(logo))
|
|
.fallback(asset)
|
|
.with_state(state)
|
|
.layer(CompressionLayer::new())
|
|
.layer(CorsLayer::new())
|
|
.layer(TraceLayer::new_for_http());
|
|
let listener = TcpListener::bind(bind).await?;
|
|
println!("Acauã listening on http://{bind}");
|
|
axum::serve(listener, app)
|
|
.with_graceful_shutdown(shutdown_signal())
|
|
.await?;
|
|
Ok(())
|
|
}
|