Intrusion detection #1

Open

devrandom wants to merge 7 commits from intrusion-detection into main

pull from: intrusion-detection

merge into: devrandom:main

devrandom:main

devrandom:local-ai-proxy-per-user-concurrency

devrandom:model-redirects

Conversation 0 Commits 7 Files changed 46 +3596 -71

devrandom commented 2026-10-26 13:36:15 +00:00

Owner

• Copy link

No description provided.

devrandom added 2 commits 2026-10-26 13:36:15 +00:00

Add ids-forwarder and deploy playbooks ... 3a6a2523a4

Implement the in-repo Go forwarder from the intrusion detection design:
tails the Tetragon JSON events file (offset-tracked, rotation- and
truncation-safe, partial-line buffering), accepts CrowdSec
notification-http POSTs on localhost, redacts IPv4/IPv6 (compressed,
full, bracketed, mapped, zoned, CIDR, URL-embedded) via netip
validation, dedupes atomically, keeps a bounded queue with
re-queue-on-failure, and posts to Alertmanager v2 with localhost
metrics.

Includes build/install playbooks (buildhost source build, hardened
systemd unit with a dedicated system user), wiring into just test and
just lint-go, metrics-gate support for multiple Go modules with a
scoped initial baseline, and a work-on-issue policy note that the
metrics stop-gate applies before merging to main, not before starting
work.

Fix ty diagnostic in clean_quota_value ... c69940dc8f

Narrow Decimal.as_tuple().exponent with isinstance before comparing to
-4: the type is str for NaN/Infinity, and ty (pinned 0.0.77 in CI)
cannot infer the is_finite() guard. Behavior is unchanged; the existing
'nan' test case exercises the earlier validation branch.

devrandom added 1 commit 2026-10-26 13:52:40 +00:00

Add Tetragon build and observe-only deployment ... daf60b19b3

Implements the sensor layer of the intrusion detection design: Tetragon
v1.7.1 built from source (pinned SHA) with locally compiled eBPF
objects, deployed observe-only with gRPC on a unix socket, metrics on
loopback, and JSON events exported for ids-forwarder to consume.

Pinned tracing policies cover exec of shells/package managers, writes
to /etc and systemd unit paths, capability and credential changes, and
TCP connects with process context. No enforcement hooks.

devrandom added 1 commit 2026-10-26 14:18:40 +00:00

Add CrowdSec build and local-only deployment ... ee91527df6

Implements the log-detection layer: CrowdSec v1.8.1 built from source
(pinned SHA, includes fixes for CVE-2026-44981/44982 and two DoS
advisories), deployed local-only on every Linux node.

Local-only posture: LAPI bound to 127.0.0.1, no console enrollment, no
Central API or community blocklist, no bouncers. Detection sources are
sshd, nginx access logs, and Authentik logs; pinned scenarios cover SSH
brute force, aggressive crawling, and HTTP 40x bursts. Alerts are
delivered via the notification-http plugin to ids-forwarder's localhost
receiver. DB retention is capped at the access-log window.

devrandom added 1 commit 2026-10-26 16:00:00 +00:00

Fix CrowdSec review findings: paths, hub, parsers, delivery ... b628f37622

- Build: verify binaries under cmd/ (v1.8.1 layout) and install
  pkg-config + libre2-dev for the default RE2 backend.
- Hub: write a minimal .index.json so crowdsec starts with an empty
  local-only hub.
- Parsers: install into parsers/s01-parse/ with required identity
  metadata; key nginx off evt.Line.Labels.type instead of the unset
  program field; extract file_name as the path only.
- Delivery: profile filter matches our alert-only scenarios
  (Alert.Remediation == false, no decisions) instead of the unreachable
  Remediation == true; enable the ids-forwarder loopback receiver
  (127.0.0.1:9201) so notification-http POSTs have a listener.
- Log access: add the crowdsec user to the adm group so it can read
  auth.log and nginx logs; create the patterns directory crowdsec
  expects during parser init.

devrandom force-pushed intrusion-detection from b628f37622 to c43cdf8c9d 2026-10-26 16:28:57 +00:00 Compare

Some checks failed

Hide checks

CI / python-lint (push) Has been cancelled

Details

CI / jinja-lint (push) Has been cancelled

Details

CI / ansible-lint (push) Has been cancelled

Details

CI / go-lint (push) Has been cancelled

Details

CI / python-tests (push) Has been cancelled

Details

CI / go-tests (push) Has been cancelled

Details

CI / python-lint (pull_request) Has been cancelled

Details

CI / jinja-lint (pull_request) Has been cancelled

Details

CI / ansible-lint (pull_request) Has been cancelled

Details

CI / go-lint (pull_request) Has been cancelled

Details

CI / python-tests (pull_request) Has been cancelled

Details

CI / go-tests (pull_request) Has been cancelled

Details

This pull request has changes conflicting with the target branch.

• .opencode/skills/work-on-issue/SKILL.md
• config/ansible/app/build-tetragon.yml
• config/ansible/app/files/crowdsec-parsers/nginx.yaml
• config/ansible/app/files/crowdsec-parsers/sshd.yaml
• config/ansible/app/files/tetragon-policies/exec-and-sensitive-file-writes.yaml
• config/ansible/app/files/tetragon-policies/tcp-connect.yaml
• config/ansible/monitoring/install-crowdsec.yml
• config/ansible/monitoring/install-ids-forwarder.yml
• config/ansible/monitoring/install-tetragon.yml
• config/ansible/monitoring/templates/crowdsec-config.yaml.j2
• config/ansible/monitoring/templates/crowdsec-notifications-http.yaml.j2
• config/ansible/monitoring/templates/ids-forwarder.service.j2
• config/ansible/monitoring/templates/tetragon.service.j2
• config/ansible/monitoring/templates/tetragon.yaml.j2
• docs/design/intrusion-detection.md
• ids-forwarder/alert.go
• ids-forwarder/consume.go
• ids-forwarder/forwarder.go
• ids-forwarder/forwarder_test.go
• ids-forwarder/gates_test.go
• ids-forwarder/go.mod
• ids-forwarder/integration_test.go
• ids-forwarder/main.go
• ids-forwarder/map.go
• ids-forwarder/models.go
• ids-forwarder/tailer.go
• just.d/tests.just
• scripts/metrics/check.py
• todo/security/intrusion-detection.md

View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Merge commit title Merge pull request 'Intrusion detection' (#1) from intrusion-detection into main

Merge commit body Reviewed-on: https://git.dev1.ycluster.net/devrandom/ycluster/pulls/1

Merge pull request 'Intrusion detection' (#1) from intrusion-detection into main Reviewed-on: https://git.dev1.ycluster.net/devrandom/ycluster/pulls/1 Copy merge commit message

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin "intrusion-detection:intrusion-detection"

git switch "intrusion-detection"

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch "main"

git merge --no-ff "intrusion-detection"

git switch "intrusion-detection"

git rebase "main"

git switch "main"

git merge --ff-only "intrusion-detection"

git switch "intrusion-detection"

git rebase "main"

git switch "main"

git merge --no-ff "intrusion-detection"

git switch "main"

git merge --squash "intrusion-detection"

git switch "main"

git merge --ff-only "intrusion-detection"

git switch "main"

git merge "intrusion-detection"

git push origin "main"

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

devrandom/ycluster!1

No description provided.