From 1928e68088ca11c7c9c0ba89436bb05f55bdd7d0 Mon Sep 17 00:00:00 2001
From: PTah <papatramp@gmail.com>
Date: Wed, 27 May 2026 12:22:10 +1000
Subject: [PATCH] fix: POST ingest to /api/v1/events when SAC_URL is host root

Health already used sac_base_url(); ingest used raw SAC_URL and got
HTTP 405 when config had only https://host without /api/v1/events.
---
 sac-client.sh            | 13 ++++++++++++-
 ssh-monitor.conf.example |  3 ++-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/sac-client.sh b/sac-client.sh
index 86a9d61..a1dd5d8 100644
--- a/sac-client.sh
+++ b/sac-client.sh
@@ -17,6 +17,14 @@ sac_base_url() {
  printf '%s' "${url%/}"
 }
 
+# URL ingest (POST): всегда .../api/v1/events, даже если в конфиге указан только хост
+sac_ingest_url() {
+ local base
+ base="$(sac_base_url)"
+ [ -n "$base" ] || return 1
+ printf '%s/api/v1/events' "$base"
+}
+
 sac_agent_instance_id() {
  local id_file="${SAC_AGENT_ID_FILE:-/var/lib/ssh-monitor/agent_instance_id}"
  local dir
@@ -145,7 +153,7 @@ PY
  resp="$(mktemp)"
  printf '%s' "$payload" >"$tmp"
  http_code="$(curl -sS -o "$resp" -w '%{http_code}' \
-  -X POST "${SAC_URL}" \
+  -X POST "$(sac_ingest_url)" \
   -H "Authorization: Bearer ${SAC_API_KEY}" \
   -H "Content-Type: application/json" \
   -H "Idempotency-Key: ${event_id}" \
@@ -220,6 +228,9 @@ run_check_sac() {
  printf 'Проверка SAC (ssh-monitor)\n'
  printf 'UseSAC=%s\n' "${UseSAC:-off}"
  printf 'SAC_URL=%s\n' "${SAC_URL:-}"
+ if sac_is_configured; then
+  printf 'SAC ingest URL=%s\n' "$(sac_ingest_url)"
+ fi
  if ! sac_is_configured; then
  printf 'SAC: SAC_URL или SAC_API_KEY не заданы\n' >&2
  return 1
diff --git a/ssh-monitor.conf.example b/ssh-monitor.conf.example
index 0bd69bf..934af9f 100644
--- a/ssh-monitor.conf.example
+++ b/ssh-monitor.conf.example
@@ -28,7 +28,8 @@ NOTIFY_ORDER=""
 # --- Security Alert Center (SAC) ---
 # off | exclusive | dual | fallback — см. docs в security-alert-center (agent-integration.md)
 UseSAC="off"
-SAC_URL="https://sac.kalinamall.ru/api/v1/events"
+# Допустимо и корень хоста (ingest всё равно пойдёт на /api/v1/events):
+SAC_URL="https://sac.kalinamall.ru"
 SAC_API_KEY=""
 SAC_SPOOL_DIR="/var/lib/ssh-monitor/sac-spool"
 SAC_TIMEOUT_SEC="12"