PTah
9b177c145b
Migration 006, email config DB/env, smtplib sender, settings API, Settings UI section, and dispatch on event/problem ingest. Co-authored-by: Cursor <cursoragent@cursor.com>
66 lines
2.0 KiB
Plaintext
66 lines
2.0 KiB
Plaintext
# Native: /opt/security-alert-center/config/sac-api.env
|
|
# sudo chown sac:sac ... && sudo chmod 600 ...
|
|
# Пароль в URL — в двойных кавычках. Символ # в пароле допустим только внутри кавычек.
|
|
# systemd НЕ парсит этот файл — читает приложение (SAC_CONFIG_FILE).
|
|
|
|
DATABASE_URL=postgresql+psycopg2://sac:CHANGE_ME_POSTGRES_PASSWORD@127.0.0.1:5432/sac
|
|
|
|
SAC_PUBLIC_URL=https://sac.kalinamall.ru
|
|
JWT_SECRET=CHANGE_ME_openssl_rand_hex_32
|
|
|
|
# API key для агентов: Authorization: Bearer <ключ>
|
|
# python3.12 -c "import secrets; print('sac_'+secrets.token_urlsafe(32))"
|
|
SAC_BOOTSTRAP_API_KEY=sac_replace_with_generated_key
|
|
|
|
EVENT_SCHEMA_PATH=/opt/security-alert-center/schemas/event-schema-v1.json
|
|
|
|
SAC_ADMIN_USERNAME=admin
|
|
SAC_ADMIN_PASSWORD=
|
|
|
|
# Telegram notifications from SAC (phase 1C.4)
|
|
# При UseSAC=exclusive на агентах — основной канал для оператора; см. docs/agent-integration.md §1.3.1
|
|
TELEGRAM_ENABLED=false
|
|
TELEGRAM_BOT_TOKEN=
|
|
TELEGRAM_CHAT_ID=
|
|
# exclusive: warning (failed login, problems); prod noise-only: high
|
|
TELEGRAM_MIN_SEVERITY=high
|
|
|
|
# Generic webhook (JSON POST), F-NOT-01
|
|
WEBHOOK_ENABLED=false
|
|
WEBHOOK_URL=
|
|
WEBHOOK_SECRET_HEADER=
|
|
WEBHOOK_SECRET=
|
|
WEBHOOK_MIN_SEVERITY=high
|
|
|
|
# SMTP email (F-NOT-01)
|
|
SMTP_ENABLED=false
|
|
SMTP_HOST=
|
|
SMTP_PORT=587
|
|
SMTP_USER=
|
|
SMTP_PASSWORD=
|
|
SMTP_FROM=
|
|
SMTP_TO=
|
|
SMTP_STARTTLS=true
|
|
SMTP_SSL=false
|
|
SMTP_MIN_SEVERITY=high
|
|
|
|
# Статус хоста по agent.heartbeat
|
|
SAC_HEARTBEAT_STALE_MINUTES=780
|
|
|
|
# Корреляция Problems: host + type + rule в одном open Problem (минуты)
|
|
SAC_PROBLEM_CORRELATION_WINDOW_MINUTES=60
|
|
|
|
# rule:brute_force_burst (ssh.login.failed / rdp.login.failed)
|
|
SAC_BRUTE_FORCE_WINDOW_MINUTES=15
|
|
SAC_BRUTE_FORCE_THRESHOLD=30
|
|
|
|
# rule:privilege_spike (privilege.sudo.command)
|
|
SAC_PRIVILEGE_SPIKE_WINDOW_MINUTES=10
|
|
SAC_PRIVILEGE_SPIKE_THRESHOLD=10
|
|
|
|
# Retention (systemd sac-retention.timer)
|
|
SAC_EVENTS_RETENTION_DAYS=90
|
|
SAC_PROBLEMS_RETENTION_DAYS=180
|
|
|
|
CORS_ORIGINS=*
|