d4e7e674d8
- 4-container stack: ClickHouse, platform (Rocky 9), bot-detector, dashboard - Platform builds sentinel on Rocky (CGO+libpcap native), correlator static - mod-reqin-log compiled with apxs on Rocky (matching RPM build target) - ClickHouse init script patches credentials for test env (sed-based) - 8-phase test runner: schema, traffic gen, pipeline, dashboard API, bot-detector, sentinel - All 13 checks pass, 3 non-blocking warnings (empty dicts, log paths) SQL schema fixes discovered during integration: - 02_dictionaries: IPv6CIDR → String (not a valid ClickHouse type) - 03_anubis_tables: dict_anubis_ua missing has_ip/rule_id/category attrs - 03_anubis_tables: dict_anubis_country FLAT() → COMPLEX_KEY_HASHED() (String key) - 09_audit_table: CODEC before DEFAULT → DEFAULT before CODEC Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
60 lines
1.9 KiB
Bash
Executable File
60 lines
1.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# =============================================================================
|
|
# Platform entrypoint — starts correlator, Apache, sentinel in order
|
|
# =============================================================================
|
|
set -eo pipefail
|
|
|
|
log() { echo "[entrypoint] $(date +%H:%M:%S) $*"; }
|
|
|
|
CORRELATOR_PID=""
|
|
HTTPD_PID=""
|
|
SENTINEL_PID=""
|
|
|
|
cleanup() {
|
|
log "Shutting down..."
|
|
[ -n "$SENTINEL_PID" ] && kill "$SENTINEL_PID" 2>/dev/null || true
|
|
[ -n "$CORRELATOR_PID" ] && kill "$CORRELATOR_PID" 2>/dev/null || true
|
|
httpd -k stop 2>/dev/null || true
|
|
wait 2>/dev/null || true
|
|
log "All processes stopped."
|
|
}
|
|
trap cleanup EXIT SIGTERM SIGINT
|
|
|
|
# -- 1. Start correlator (creates Unix sockets) ------------------------------
|
|
log "Starting correlator..."
|
|
correlator -config /etc/logcorrelator/correlator.yml &
|
|
CORRELATOR_PID=$!
|
|
|
|
# Wait for correlator to create its sockets
|
|
for i in $(seq 1 30); do
|
|
if [ -S /var/run/logcorrelator/http.socket ] && [ -S /var/run/logcorrelator/network.socket ]; then
|
|
log "Correlator sockets ready."
|
|
break
|
|
fi
|
|
sleep 0.5
|
|
done
|
|
|
|
if [ ! -S /var/run/logcorrelator/http.socket ]; then
|
|
log "ERROR: correlator sockets not created after 15s"
|
|
exit 1
|
|
fi
|
|
|
|
# -- 2. Start Apache (with mod-reqin-log writing to http.socket) -------------
|
|
log "Starting Apache..."
|
|
httpd -DFOREGROUND &
|
|
HTTPD_PID=$!
|
|
sleep 2
|
|
|
|
# -- 3. Start sentinel (captures network traffic) ----------------------------
|
|
log "Starting sentinel..."
|
|
sentinel -config /etc/ja4sentinel/config.yml &
|
|
SENTINEL_PID=$!
|
|
|
|
log "All services started. PIDs: correlator=$CORRELATOR_PID httpd=$HTTPD_PID sentinel=$SENTINEL_PID"
|
|
|
|
# -- Wait for any process to exit (indicates failure) -------------------------
|
|
wait -n "$CORRELATOR_PID" "$HTTPD_PID" "$SENTINEL_PID" 2>/dev/null || true
|
|
EXIT_CODE=$?
|
|
log "A process exited with code $EXIT_CODE — triggering shutdown."
|
|
exit $EXIT_CODE
|