docs: publish Preview 19 dogfood evidence
Export the reviewed allowlisted snapshot from private source commit 05928cebd01b586cf9e9d4b8c8537a7605a6068c. This records the exact candidate, bounded capacity result, stateful migration scratch requirement, authenticated batch identity proof, and immediate live acceptance evidence. AI-Assisted: OpenAI Codex Signed-off-by: Cole Speelman <crspeelman@gmail.com>
This commit is contained in:
@@ -0,0 +1,43 @@
|
||||
# SPDX-License-Identifier: 0BSD
|
||||
#
|
||||
# Explicit richer-evidence example. Replace the origin, upstream, paths, and
|
||||
# query-key deny list only after reviewing the application's privacy policy.
|
||||
|
||||
example.com {
|
||||
log application_sensitive_access {
|
||||
output file /var/log/caddy/example-sensitive-access.jsonl {
|
||||
mode 0640
|
||||
roll_size 100mb
|
||||
roll_keep 10
|
||||
roll_keep_for 720h
|
||||
}
|
||||
format filter {
|
||||
request>uri query {
|
||||
delete access_token
|
||||
delete api_key
|
||||
delete authorization
|
||||
delete code
|
||||
delete credential
|
||||
delete key
|
||||
delete password
|
||||
delete secret
|
||||
delete session
|
||||
delete session_id
|
||||
delete token
|
||||
}
|
||||
client_ip ip_mask 24 56
|
||||
request>remote_ip delete
|
||||
request>remote_port delete
|
||||
request>client_ip delete
|
||||
request>headers delete
|
||||
resp_headers delete
|
||||
user_id delete
|
||||
wrap json
|
||||
}
|
||||
}
|
||||
log_append request_id {http.response.header.X-Request-ID}
|
||||
log_append client_ip {http.request.client_ip}
|
||||
log_append referrer {http.request.header.Referer}
|
||||
log_append user_agent {http.request.header.User-Agent}
|
||||
reverse_proxy 127.0.0.1:8080
|
||||
}
|
||||
@@ -0,0 +1,12 @@
|
||||
Zero-Clause BSD
|
||||
|
||||
Permission to use, copy, modify, and/or distribute this software for any
|
||||
purpose with or without fee is hereby granted.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
||||
REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
||||
OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
PERFORMANCE OF THIS SOFTWARE.
|
||||
@@ -0,0 +1,23 @@
|
||||
<!-- SPDX-License-Identifier: 0BSD -->
|
||||
|
||||
# Examples
|
||||
|
||||
Copy these files into your own deployment repository and adapt them. Production configuration belongs at `/etc/gamertan-observatory/`, must be root-owned mode `0600`, and should reference secrets stored in separate root-owned files. The example systemd unit uses `LoadCredential=` so the agent can consume runtime copies while remaining an unprivileged service.
|
||||
|
||||
The optional `web_push` block expects a private key created on the server with
|
||||
`observatory admin web-push generate-key --output-file /etc/gamertan-observatory/web-push.json`.
|
||||
Remove the block when browser notifications are not wanted. Never commit the
|
||||
generated file.
|
||||
|
||||
`agent.json` demonstrates the privacy-minimized collection default. If an
|
||||
application's privacy policy and operating purpose permit collection of client
|
||||
addresses, queries, referrers, user agents, or anonymous session identifiers,
|
||||
select those names explicitly in that source's `sensitive_fields` array. The
|
||||
agent will not retain them merely because they exist in the producer log.
|
||||
|
||||
`Caddyfile.sensitive-access-log` is an intentionally richer edge-log example.
|
||||
It still deletes request and response header maps, filters common credential
|
||||
query keys, masks client addresses, and keeps the application request ID as a
|
||||
correlation field. Its deny list cannot know an application's vocabulary:
|
||||
review and extend it before use. Treat the resulting file as sensitive source
|
||||
evidence with narrow read permissions and a documented retention period.
|
||||
@@ -0,0 +1,4 @@
|
||||
{
|
||||
"credential": "replace-with-the-single-enrollment-result"
|
||||
}
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
SPDX-License-Identifier: 0BSD
|
||||
@@ -0,0 +1,3 @@
|
||||
{
|
||||
"enrollment_token": "replace-with-the-single-use-enrollment-token"
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
SPDX-License-Identifier: 0BSD
|
||||
@@ -0,0 +1,42 @@
|
||||
{
|
||||
"schema": 1,
|
||||
"server_url": "https://observatory.example.com",
|
||||
"credential_file": "/etc/gamertan-observatory/agent-credential.json",
|
||||
"spool_dir": "/var/lib/gamertan-observatory-agent",
|
||||
"state_file": "/var/lib/gamertan-observatory-agent/state.json",
|
||||
"max_spool_bytes": 5368709120,
|
||||
"max_spool_age": "72h",
|
||||
"batch_records": 5000,
|
||||
"flush_interval": "1s",
|
||||
"sources": [
|
||||
{
|
||||
"kind": "caddy_json",
|
||||
"path": "/var/log/caddy/example-access.jsonl",
|
||||
"stream_id": "caddy-access"
|
||||
},
|
||||
{
|
||||
"kind": "requestlog_jsonl",
|
||||
"path": "/var/log/example/request.jsonl",
|
||||
"stream_id": "application-request"
|
||||
},
|
||||
{
|
||||
"kind": "tend_events_jsonl",
|
||||
"path": "/opt/example/deployment-events.jsonl",
|
||||
"stream_id": "tend-deployments"
|
||||
},
|
||||
{
|
||||
"kind": "linux_metrics",
|
||||
"stream_id": "host-metrics",
|
||||
"linux_metrics": {
|
||||
"proc_root": "/proc",
|
||||
"cgroup_root": "/sys/fs/cgroup",
|
||||
"filesystems": [
|
||||
{ "name": "root", "path": "/" }
|
||||
],
|
||||
"cgroups": [
|
||||
{ "name": "example-service", "path": "system.slice/example.service" }
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
SPDX-License-Identifier: 0BSD
|
||||
@@ -0,0 +1,31 @@
|
||||
# SPDX-License-Identifier: 0BSD
|
||||
|
||||
[Unit]
|
||||
Description=Gamertan Observatory agent
|
||||
After=network-online.target
|
||||
Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=observatory-agent
|
||||
Group=observatory-agent
|
||||
LoadCredential=agent.json:/etc/gamertan-observatory/agent.json
|
||||
LoadCredential=agent-credential.json:/etc/gamertan-observatory/agent-credential.json
|
||||
ExecStart=/usr/local/bin/observatory agent --systemd-credentials --config %d/agent.json --credential-file %d/agent-credential.json
|
||||
Restart=on-failure
|
||||
RestartSec=5s
|
||||
NoNewPrivileges=yes
|
||||
PrivateTmp=yes
|
||||
ProtectSystem=strict
|
||||
ProtectHome=yes
|
||||
ProtectKernelTunables=yes
|
||||
ProtectKernelModules=yes
|
||||
ProtectControlGroups=yes
|
||||
RestrictSUIDSGID=yes
|
||||
LockPersonality=yes
|
||||
MemoryDenyWriteExecute=yes
|
||||
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
||||
ReadWritePaths=/var/lib/gamertan-observatory-agent
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,30 @@
|
||||
{
|
||||
"schema": 1,
|
||||
"listen": "127.0.0.1:9010",
|
||||
"public_url": "https://observatory.example.com",
|
||||
"data_dir": "/var/lib/gamertan-observatory",
|
||||
"max_body_bytes": 33554432,
|
||||
"max_concurrent_ingest": 8,
|
||||
"session_lifetime": "12h",
|
||||
"query": {
|
||||
"max_duration": "5s",
|
||||
"max_rows": 10000,
|
||||
"max_scanned_bytes": 268435456,
|
||||
"max_memory_bytes": 134217728
|
||||
},
|
||||
"retention": {
|
||||
"raw_logs_days": 30,
|
||||
"raw_traces_days": 30,
|
||||
"raw_metrics_days": 14,
|
||||
"cold_raw_days": 400,
|
||||
"delete_cold_raw": false,
|
||||
"metric_rollups_days": 400,
|
||||
"evidence_days": 400
|
||||
},
|
||||
"web_push": {
|
||||
"private_key_file": "/etc/gamertan-observatory/web-push.json",
|
||||
"subject": "mailto:security@example.com",
|
||||
"queue_capacity": 64,
|
||||
"request_timeout": "10s"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
SPDX-License-Identifier: 0BSD
|
||||
Reference in New Issue
Block a user