chore(home): mirror from kalinamall (9883e6a) with papatramp URLs

deploy/systemd/render-sac-daily-report-timer.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# Генерирует sac-daily-report.timer из SAC_DAILY_REPORT_HOUR и SAC_DAILY_REPORT_TIMEZONE.
+# Usage: sudo deploy/systemd/render-sac-daily-report-timer.sh [config.env] [output.timer]
+
+set -euo pipefail
+
+CONFIG_FILE="${1:-/opt/security-alert-center/config/sac-api.env}"
+OUTPUT="${2:-/etc/systemd/system/sac-daily-report.timer}"
+
+HOUR=9
+TZ_NAME="Europe/Moscow"
+
+if [ -f "${CONFIG_FILE}" ]; then
+ set -a
+ # shellcheck source=/dev/null
+ source "${CONFIG_FILE}"
+ set +a
+fi
+
+HOUR="${SAC_DAILY_REPORT_HOUR:-9}"
+TZ_NAME="${SAC_DAILY_REPORT_TIMEZONE:-Europe/Moscow}"
+
+if ! [[ "${HOUR}" =~ ^[0-9]+$ ]] || [ "${HOUR}" -lt 0 ] || [ "${HOUR}" -gt 23 ]; then
+ printf 'render-sac-daily-report-timer: invalid SAC_DAILY_REPORT_HOUR=%s\n' "${HOUR}" >&2
+ exit 1
+fi
+
+HOUR_PADDED="$(printf '%02d' "${HOUR}")"
+
+cat >"${OUTPUT}" <<EOF
+[Unit]
+Description=Daily SAC report aggregation and notify
+
+[Timer]
+OnCalendar=*-*-* ${HOUR_PADDED}:00:00
+Timezone=${TZ_NAME}
+Persistent=true
+
+[Install]
+WantedBy=timers.target
+EOF
+
+printf 'render-sac-daily-report-timer: wrote %s (OnCalendar=%s:00:00 Timezone=%s)\n' \
+ "${OUTPUT}" "${HOUR_PADDED}" "${TZ_NAME}"

deploy/systemd/sac-api-start.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# Uvicorn launcher: SAC_UVICORN_WORKERS из sac-api.env (без systemd EnvironmentFile).
+set -euo pipefail
+
+APP_ROOT="${SAC_APP_ROOT:-/opt/security-alert-center}"
+CONFIG_FILE="${SAC_CONFIG_FILE:-${APP_ROOT}/config/sac-api.env}"
+VENV="${APP_ROOT}/backend/.venv"
+HOST="127.0.0.1"
+PORT="8000"
+WORKERS=4
+
+_read_env_int() {
+	local key="$1" default="$2" line val
+	[ -f "$CONFIG_FILE" ] || {
+		printf '%s\n' "$default"
+		return 0
+	}
+	line="$(grep -E "^[[:space:]]*${key}=" "$CONFIG_FILE" 2>/dev/null | tail -1)" || {
+		printf '%s\n' "$default"
+		return 0
+	}
+	val="${line#*=}"
+	val="${val#"${val%%[![:space:]]*}"}"
+	val="${val%"${val##*[![:space:]]}"}"
+	val="${val#\"}"
+	val="${val%\"}"
+	val="${val#\'}"
+	val="${val%\'}"
+	if [[ "$val" =~ ^[0-9]+$ ]] && [ "$val" -ge 1 ]; then
+		printf '%s\n' "$val"
+	else
+		printf '%s\n' "$default"
+	fi
+}
+
+WORKERS="$(_read_env_int SAC_UVICORN_WORKERS 4)"
+
+exec "${VENV}/bin/uvicorn" app.main:app \
+	--host "$HOST" \
+	--port "$PORT" \
+	--workers "$WORKERS" \
+	--timeout-graceful-shutdown 30

deploy/systemd/sac-api.service

@@ -0,0 +1,24 @@
+[Unit]
+Description=Security Alert Center API (FastAPI)
+Documentation=https://git.papatramp.ru/PapaTramp/security-alert-center
+After=network-online.target postgresql.service
+Wants=network-online.target
+Requires=postgresql.service
+
+[Service]
+Type=simple
+User=sac
+Group=sac
+WorkingDirectory=/opt/security-alert-center/backend
+# Конфиг читает само приложение (pydantic), не systemd — иначе ломаются пароли с #, $ и т.д.
+Environment=SAC_CONFIG_FILE=/opt/security-alert-center/config/sac-api.env
+Environment=PYTHONPATH=/opt/security-alert-center/backend
+ExecStart=/usr/bin/bash /opt/security-alert-center/deploy/systemd/sac-api-start.sh
+Restart=on-failure
+RestartSec=5
+TimeoutStopSec=20
+TimeoutStartSec=30
+NoNewPrivileges=true
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/sac-daily-report.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Security Alert Center daily report generation (F-NOT-05)
+After=network-online.target postgresql.service
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+User=sac
+Group=sac
+WorkingDirectory=/opt/security-alert-center/backend
+EnvironmentFile=/opt/security-alert-center/config/sac-api.env
+ExecStart=/opt/security-alert-center/backend/.venv/bin/python -m app.jobs.daily_report
+Nice=10
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/sac-daily-report.timer

@@ -0,0 +1,12 @@
+[Unit]
+Description=Daily SAC report aggregation and notify
+
+[Timer]
+# Шаблон по умолчанию (hour=9, Europe/Moscow). На prod timer перегенерируется
+# из config/sac-api.env: deploy/systemd/render-sac-daily-report-timer.sh или sac-deploy.sh
+OnCalendar=*-*-* 09:00:00
+Timezone=Europe/Moscow
+Persistent=true
+
+[Install]
+WantedBy=timers.target

deploy/systemd/sac-host-silence-scan.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Security Alert Center host silence scan (stale heartbeat)
+After=network-online.target postgresql.service
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+User=sac
+Group=sac
+WorkingDirectory=/opt/security-alert-center/backend
+EnvironmentFile=/opt/security-alert-center/config/sac-api.env
+ExecStart=/opt/security-alert-center/backend/.venv/bin/python -m app.jobs.host_silence_scan
+Nice=10
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/sac-host-silence-scan.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=Periodic SAC host silence scan (stale agent.heartbeat)
+
+[Timer]
+OnBootSec=3min
+OnUnitActiveSec=5min
+RandomizedDelaySec=30
+Persistent=true
+
+[Install]
+WantedBy=timers.target

deploy/systemd/sac-retention.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Security Alert Center data retention
+After=network-online.target postgresql.service
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+User=sac
+Group=sac
+WorkingDirectory=/opt/security-alert-center/backend
+EnvironmentFile=/opt/security-alert-center/config/sac-api.env
+ExecStart=/opt/security-alert-center/backend/.venv/bin/python -m app.jobs.retention
+Nice=10
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/sac-retention.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Daily SAC retention purge
+
+[Timer]
+OnCalendar=daily
+RandomizedDelaySec=900
+Persistent=true
+
+[Install]
+WantedBy=timers.target