Cybersecurity-Projects/PROJECTS/advanced/monitor-the-situation-dashb.../backend/cmd/api/main.go

687 lines
19 KiB
Go

// ©AngelaMos | 2026
// main.go
package main
import (
"context"
"errors"
"flag"
"log/slog"
"net/http"
"os"
"os/signal"
"path/filepath"
"syscall"
"time"
"github.com/go-chi/chi/v5"
"golang.org/x/sync/errgroup"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/admin"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/alerts"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/auth"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/bus"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/collectors/cfradar"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/collectors/coinbase"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/collectors/cve"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/collectors/dshield"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/collectors/gdelt"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/collectors/heartbeat"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/collectors/iss"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/collectors/kev"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/collectors/ransomware"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/collectors/state"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/collectors/swpc"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/collectors/usgs"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/collectors/wikipedia"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/config"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/core"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/enrich/abuseipdb"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/enrich/greynoise"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/health"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/intel"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/middleware"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/notifications"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/redisring"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/server"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/snapshot"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/user"
"github.com/carterperez-dev/monitor-the-situation/backend/internal/ws"
)
const (
drainDelay = 5 * time.Second
)
type abuseipdbEnricher struct {
client *abuseipdb.Client
}
func (a abuseipdbEnricher) Lookup(
ctx context.Context,
ip string,
) (cfradar.Enrichment, error) {
v, err := a.client.Lookup(ctx, ip)
if err != nil {
return cfradar.Enrichment{}, err
}
return cfradar.Enrichment{
Country: v.CountryCode,
AbuseConfidence: v.AbuseConfidenceScore,
ISP: v.ISP,
}, nil
}
type compositeDshieldEnricher struct {
abuse *abuseipdb.Client
gn *greynoise.Cached
}
func (c compositeDshieldEnricher) Lookup(
ctx context.Context,
ip string,
) (dshield.DShieldEnrichment, error) {
out := dshield.DShieldEnrichment{}
if c.abuse != nil {
if v, err := c.abuse.Lookup(ctx, ip); err == nil {
out.Country = v.CountryCode
}
}
if c.gn != nil {
if v, err := c.gn.Lookup(ctx, ip); err == nil {
out.Classification = v.Classification
out.Actor = v.Name
}
}
return out, nil
}
func main() {
configPath := flag.String("config", "config.yaml", "path to config file")
healthcheck := flag.Bool(
"healthcheck",
false,
"probe local /healthz and exit 0 if healthy, 1 otherwise",
)
flag.Parse()
if *healthcheck {
os.Exit(runHealthcheck())
}
if err := run(*configPath); err != nil {
slog.Error("application error", "error", err)
os.Exit(1)
}
}
func runHealthcheck() int {
client := &http.Client{Timeout: 3 * time.Second}
resp, err := client.Get("http://127.0.0.1:8080/healthz")
if err != nil {
return 1
}
defer func() { _ = resp.Body.Close() }()
if resp.StatusCode != http.StatusOK {
return 1
}
return 0
}
//nolint:funlen // bootstrap code is inherently verbose
func run(configPath string) error {
ctx, stop := signal.NotifyContext(
context.Background(),
syscall.SIGINT,
syscall.SIGTERM,
)
defer stop()
cfg, err := config.Load(configPath)
if err != nil {
return err
}
logger := setupLogger(cfg.Log)
slog.SetDefault(logger)
logger.Info("starting application",
"name", cfg.App.Name,
"version", cfg.App.Version,
"environment", cfg.App.Environment,
)
var telemetry *core.Telemetry
if cfg.Otel.Enabled {
tel, telErr := core.NewTelemetry(ctx, cfg.Otel, cfg.App)
if telErr != nil {
logger.Warn("failed to initialize telemetry", "error", telErr)
} else {
telemetry = tel
logger.Info("OpenTelemetry tracer initialized",
"endpoint", cfg.Otel.Endpoint,
)
}
}
db, err := core.NewDatabase(ctx, cfg.Database)
if err != nil {
return err
}
logger.Info("database connected",
"max_open_conns", cfg.Database.MaxOpenConns,
"max_idle_conns", cfg.Database.MaxIdleConns,
)
redis, err := core.NewRedis(ctx, cfg.Redis)
if err != nil {
return err
}
logger.Info("redis connected",
"pool_size", cfg.Redis.PoolSize,
)
if keyErr := ensureJWTKeys(cfg.JWT, logger); keyErr != nil {
return keyErr
}
jwtManager, err := auth.NewJWTManager(cfg.JWT)
if err != nil {
return err
}
logger.Info("JWT manager initialized",
"algorithm", "ES256",
"key_id", jwtManager.GetKeyID(),
)
userRepo := user.NewRepository(db.DB)
userSvc := user.NewService(userRepo)
userHandler := user.NewHandler(userSvc)
authRepo := auth.NewRepository(db.DB)
authSvc := auth.NewServiceWithConfig(auth.ServiceConfig{
Repo: authRepo,
JWT: jwtManager,
UserProvider: userSvc,
Redis: redis.Client,
AdminEmail: cfg.App.AdminEmail,
})
authVerifier := auth.NewVerifier(jwtManager, authSvc, userSvc)
authHandler := auth.NewHandlerWithConfig(auth.HandlerConfig{
Service: authSvc,
TrustedProxyHops: cfg.Server.TrustedProxyHops,
SecureCookies: cfg.IsProduction(),
})
var notifHandler *notifications.Handler
var notifBridge *notifications.Bridge
if cfg.Notifications.EncryptionKey != "" {
enc, encErr := notifications.NewEncryptor(
cfg.Notifications.EncryptionKey,
)
if encErr != nil {
logger.Warn(
"notifications disabled: invalid encryption key",
"error", encErr,
)
} else {
notifRepo := notifications.NewRepository(db.DB)
notifSender := notifications.NewSender()
notifSvc := notifications.NewService(
notifRepo,
enc,
notifSender,
cfg.App.PublicURL,
logger.With("service", "notifications"),
)
notifHandler = notifications.NewHandler(notifSvc)
notifBridge = notifications.NewBridge(
notifRepo,
enc,
notifSender,
logger.With("service", "alerts"),
)
}
} else {
logger.Warn(
"notifications disabled: NOTIFICATION_ENCRYPTION_KEY not set",
)
}
alertsRepo := alerts.NewRepository(db.DB)
authSvc.SetRuleSeeder(func(ctx context.Context, userID string) error {
return alertsRepo.SeedDefaults(ctx, userID)
})
alertsHandler := alerts.NewHandler(alertsRepo)
healthHandler := health.NewHandler(db, redis)
adminHandler := admin.NewHandler(admin.HandlerConfig{
DBStats: db.Stats,
RedisStats: redis.PoolStats,
DBPing: db.Ping,
RedisPing: redis.Ping,
})
snapStore := snapshot.NewStore(redis.Client)
snapHandler := snapshot.NewHandler(snapStore)
cveRepo := cve.NewRepo(db.DB)
kevRepo := kev.NewRepo(db.DB)
cfradarRepo := cfradar.NewRepo(db.DB)
ransomwareRepo := ransomware.NewRepo(db.DB)
usgsRepo := usgs.NewRepo(db.DB)
intelHandler := intel.NewHandler(intel.HandlerConfig{
CVE: cveRepo,
KEV: kevRepo,
CFRadar: cfradarRepo,
Ransomware: ransomwareRepo,
USGS: usgsRepo,
})
hub := ws.NewHub(ws.HubConfig{
Logger: logger,
MaxSubscribers: cfg.Server.WSMaxSubscribers,
})
wsHandler := ws.NewHandlerWithConfig(ws.HandlerConfig{
Hub: hub,
MaxConnsPerIP: cfg.Server.WSMaxConnsPerIP,
TrustedProxyHops: cfg.Server.TrustedProxyHops,
})
eventBus := bus.New(bus.Config{
BufferSize: 512,
Persister: snapshot.StorePersister{Store: snapStore},
Broadcaster: ws.HubBroadcaster{Hub: hub},
Logger: logger,
})
beat := heartbeat.New(heartbeat.Config{
Interval: 5 * time.Second,
Emitter: eventBus,
})
collectorState := state.NewRepo(db.DB)
collectorGroup, collectorCtx := errgroup.WithContext(ctx)
collectorGroup.Go(func() error { return eventBus.Run(collectorCtx) })
collectorGroup.Go(func() error { return beat.Run(collectorCtx) })
if notifBridge != nil {
alertsEngine, err := alerts.NewEngine(alerts.EngineConfig{
Repo: alertsRepo,
Notifier: notifBridge,
Loader: notifBridge,
Cooldowns: alerts.NewRedisCooldown(redis.Client),
Logger: logger.With("component", "alerts.engine"),
})
if err != nil {
return err
}
dispatcher := alerts.NewDispatcher(
eventBus.Subscribe(),
alertsEngine,
logger.With("component", "alerts.dispatcher"),
)
collectorGroup.Go(
func() error { return alertsEngine.RefreshLoop(collectorCtx) },
)
collectorGroup.Go(func() error { return dispatcher.Run(collectorCtx) })
} else {
logger.Info(
"alerts engine disabled (notifications module not configured)",
)
}
if cfg.Collectors.DShield.Enabled {
var dsEnricher dshield.Enricher
var abuseClient *abuseipdb.Client
var gnCached *greynoise.Cached
if cfg.Collectors.AbuseIPDB.Enabled &&
cfg.Collectors.AbuseIPDB.APIKey != "" {
abuseClient = abuseipdb.NewClient(
abuseipdb.ClientConfig{APIKey: cfg.Collectors.AbuseIPDB.APIKey},
)
}
if cfg.Collectors.GreyNoise.Enabled &&
cfg.Collectors.GreyNoise.APIKey != "" {
gnCached = greynoise.NewCached(
greynoise.NewClient(
greynoise.ClientConfig{
APIKey: cfg.Collectors.GreyNoise.APIKey,
},
),
redis.Client,
)
}
if abuseClient != nil || gnCached != nil {
dsEnricher = compositeDshieldEnricher{
abuse: abuseClient,
gn: gnCached,
}
}
coll := dshield.NewCollector(dshield.CollectorConfig{
Interval: cfg.Collectors.DShield.Interval,
Fetcher: dshield.NewClient(dshield.ClientConfig{}),
Persister: dshield.NewRepo(db.DB),
Emitter: eventBus,
State: collectorState,
Enricher: dsEnricher,
Logger: logger.With("collector", "dshield"),
})
collectorGroup.Go(func() error { return coll.Run(collectorCtx) })
}
if cfg.Collectors.CFRadar.Enabled {
var enricher cfradar.Enricher
if cfg.Collectors.AbuseIPDB.Enabled &&
cfg.Collectors.AbuseIPDB.APIKey != "" {
enricher = abuseipdbEnricher{
client: abuseipdb.NewClient(
abuseipdb.ClientConfig{
APIKey: cfg.Collectors.AbuseIPDB.APIKey,
},
),
}
}
coll := cfradar.NewCollector(cfradar.CollectorConfig{
Interval: cfg.Collectors.CFRadar.Interval,
MinConfidence: cfg.Collectors.CFRadar.MinConfidence,
Fetcher: cfradar.NewClient(
cfradar.ClientConfig{
BearerToken: cfg.Collectors.CFRadar.BearerToken,
},
),
Repo: cfradar.NewRepo(db.DB),
Emitter: eventBus,
State: collectorState,
Enricher: enricher,
Logger: logger.With("collector", "cfradar"),
})
collectorGroup.Go(func() error { return coll.Run(collectorCtx) })
}
if cfg.Collectors.CVE.Enabled {
coll := cve.NewCollector(cve.CollectorConfig{
Interval: cfg.Collectors.CVE.Interval,
Window: cfg.Collectors.CVE.Window,
NVD: cve.NewNVDClient(
cve.NVDClientConfig{APIKey: cfg.Collectors.CVE.NVDAPIKey},
),
EPSS: cve.NewEPSSClient(cve.EPSSClientConfig{}),
Repo: cve.NewRepo(db.DB),
Emitter: eventBus,
State: collectorState,
Logger: logger.With("collector", "cve"),
})
collectorGroup.Go(func() error { return coll.Run(collectorCtx) })
}
if cfg.Collectors.KEV.Enabled {
coll := kev.NewCollector(kev.CollectorConfig{
Interval: cfg.Collectors.KEV.Interval,
Fetcher: kev.NewClient(kev.ClientConfig{}),
Repo: kev.NewRepo(db.DB),
Emitter: eventBus,
State: collectorState,
Logger: logger.With("collector", "kev"),
})
collectorGroup.Go(func() error { return coll.Run(collectorCtx) })
}
if cfg.Collectors.Ransomware.Enabled {
coll := ransomware.NewCollector(ransomware.CollectorConfig{
Interval: cfg.Collectors.Ransomware.Interval,
Fetcher: ransomware.NewClient(ransomware.ClientConfig{}),
Repo: ransomware.NewRepo(db.DB),
Emitter: eventBus,
State: collectorState,
Logger: logger.With("collector", "ransomware"),
})
collectorGroup.Go(func() error { return coll.Run(collectorCtx) })
}
if cfg.Collectors.Coinbase.Enabled {
coll := coinbase.NewCollector(coinbase.CollectorConfig{
URL: cfg.Collectors.Coinbase.URL,
ProductIDs: cfg.Collectors.Coinbase.ProductIDs,
Repo: coinbase.NewRepo(db.DB),
Emitter: eventBus,
State: collectorState,
Throttle: cfg.Collectors.Coinbase.Throttle,
Logger: logger.With("collector", "coinbase"),
})
collectorGroup.Go(func() error { return coll.Run(collectorCtx) })
}
if cfg.Collectors.USGS.Enabled {
coll := usgs.NewCollector(usgs.CollectorConfig{
Interval: cfg.Collectors.USGS.Interval,
Fetcher: usgs.NewClient(usgs.ClientConfig{}),
Repo: usgs.NewRepo(db.DB),
Emitter: eventBus,
State: collectorState,
Logger: logger.With("collector", "usgs"),
})
collectorGroup.Go(func() error { return coll.Run(collectorCtx) })
}
if cfg.Collectors.SWPC.Enabled {
ring := redisring.New(
redis.Client,
redisring.Config{Retention: 24 * time.Hour},
)
coll := swpc.NewCollector(swpc.CollectorConfig{
FastInterval: cfg.Collectors.SWPC.FastInterval,
SlowInterval: cfg.Collectors.SWPC.SlowInterval,
Fetcher: swpc.NewClient(swpc.ClientConfig{}),
Ring: ring,
Emitter: eventBus,
State: collectorState,
Logger: logger.With("collector", "swpc"),
})
collectorGroup.Go(func() error { return coll.Run(collectorCtx) })
}
if cfg.Collectors.Wikipedia.Enabled {
coll := wikipedia.NewCollector(wikipedia.CollectorConfig{
Interval: cfg.Collectors.Wikipedia.Interval,
Fetcher: wikipedia.NewClient(wikipedia.ClientConfig{}),
Repo: wikipedia.NewRepo(db.DB, redis.Client),
Emitter: eventBus,
State: collectorState,
Logger: logger.With("collector", "wikipedia"),
})
collectorGroup.Go(func() error { return coll.Run(collectorCtx) })
}
if cfg.Collectors.GDELT.Enabled {
coll := gdelt.NewCollector(gdelt.CollectorConfig{
Interval: cfg.Collectors.GDELT.Interval,
Fetcher: gdelt.NewClient(gdelt.ClientConfig{}),
Repo: gdelt.NewRepo(db.DB),
Emitter: eventBus,
State: collectorState,
Logger: logger.With("collector", "gdelt"),
})
collectorGroup.Go(func() error { return coll.Run(collectorCtx) })
}
if cfg.Collectors.ISS.Enabled {
coll := iss.NewCollector(iss.CollectorConfig{
PositionInterval: cfg.Collectors.ISS.PositionInterval,
TLEInterval: cfg.Collectors.ISS.TLEInterval,
Fetcher: iss.NewClient(iss.ClientConfig{}),
TLEStore: iss.NewTLEStore(redis.Client),
Emitter: eventBus,
State: collectorState,
Logger: logger.With("collector", "iss"),
})
collectorGroup.Go(func() error { return coll.Run(collectorCtx) })
}
logger.Info("collectors started",
"heartbeat", true,
"dshield", cfg.Collectors.DShield.Enabled,
"cfradar", cfg.Collectors.CFRadar.Enabled,
"cve", cfg.Collectors.CVE.Enabled,
"kev", cfg.Collectors.KEV.Enabled,
"ransomware", cfg.Collectors.Ransomware.Enabled,
"coinbase", cfg.Collectors.Coinbase.Enabled,
"usgs", cfg.Collectors.USGS.Enabled,
"swpc", cfg.Collectors.SWPC.Enabled,
"wikipedia", cfg.Collectors.Wikipedia.Enabled,
"gdelt", cfg.Collectors.GDELT.Enabled,
"iss", cfg.Collectors.ISS.Enabled,
)
srv := server.New(server.Config{
ServerConfig: cfg.Server,
HealthHandler: healthHandler,
Logger: logger,
})
router := srv.Router()
router.Use(middleware.RequestID)
router.Use(middleware.Logger(logger))
router.Use(
middleware.NewRateLimiter(redis.Client, middleware.RateLimitConfig{
Limit: middleware.PerWindow(
cfg.RateLimit.Requests,
cfg.RateLimit.Burst,
cfg.RateLimit.Window,
),
KeyFunc: middleware.KeyByClientIP(cfg.Server.TrustedProxyHops),
FailOpen: true,
}).Handler,
)
router.Use(middleware.SecurityHeaders(cfg.App.Environment == "production"))
router.Use(middleware.CORS(cfg.CORS))
healthHandler.RegisterRoutes(router)
router.Get("/.well-known/jwks.json", jwtManager.GetJWKSHandler())
authenticator := middleware.Authenticator(authVerifier)
adminOnly := middleware.RequireAdmin
router.Route("/v1", func(r chi.Router) {
r.Get("/healthz", healthHandler.Liveness)
r.Get("/readyz", healthHandler.Readiness)
r.Get("/snapshot", snapHandler.ServeHTTP)
r.Get("/ws", wsHandler.ServeHTTP)
intelHandler.RegisterRoutes(r)
authHandler.RegisterRoutes(r, authenticator)
userHandler.RegisterRoutes(r, authenticator)
userHandler.RegisterAdminRoutes(r, authenticator, adminOnly)
adminHandler.RegisterRoutes(r, authenticator, adminOnly)
if notifHandler != nil {
notifHandler.RegisterRoutes(r, authenticator)
}
if alertsHandler != nil {
alertsHandler.RegisterRoutes(r, authenticator)
}
})
errChan := make(chan error, 1)
go func() {
errChan <- srv.Start()
}()
select {
case err := <-errChan:
return err
case <-ctx.Done():
logger.Info("shutdown signal received")
}
shutdownCtx, cancel := context.WithTimeout(
context.Background(),
cfg.Server.ShutdownTimeout+drainDelay+5*time.Second,
)
defer cancel()
if err := srv.Shutdown(shutdownCtx, drainDelay); err != nil {
logger.Error("server shutdown error", "error", err)
}
if telemetry != nil {
if err := telemetry.Shutdown(shutdownCtx); err != nil {
logger.Error("telemetry shutdown error", "error", err)
}
}
if err := collectorGroup.Wait(); err != nil &&
!errors.Is(err, context.Canceled) &&
!errors.Is(err, context.DeadlineExceeded) {
logger.Error("collector group exit", "error", err)
}
if err := redis.Close(); err != nil {
logger.Error("redis close error", "error", err)
}
if err := db.Close(); err != nil {
logger.Error("database close error", "error", err)
}
logger.Info("application stopped")
return nil
}
func ensureJWTKeys(cfg config.JWTConfig, logger *slog.Logger) error {
if _, err := os.Stat(cfg.PrivateKeyPath); err == nil {
return nil
} else if !errors.Is(err, os.ErrNotExist) {
return err
}
if dir := filepath.Dir(cfg.PrivateKeyPath); dir != "" && dir != "." {
if err := os.MkdirAll(dir, 0o700); err != nil {
return err
}
}
if dir := filepath.Dir(cfg.PublicKeyPath); dir != "" && dir != "." {
if err := os.MkdirAll(dir, 0o700); err != nil {
return err
}
}
logger.Warn("JWT keys missing, generating",
"private", cfg.PrivateKeyPath,
"public", cfg.PublicKeyPath,
)
return auth.GenerateKeyPair(cfg.PrivateKeyPath, cfg.PublicKeyPath)
}
func setupLogger(cfg config.LogConfig) *slog.Logger {
var handler slog.Handler
level := slog.LevelInfo
switch cfg.Level {
case "debug":
level = slog.LevelDebug
case "warn":
level = slog.LevelWarn
case "error":
level = slog.LevelError
}
opts := &slog.HandlerOptions{Level: level}
if cfg.Format == "json" {
handler = slog.NewJSONHandler(os.Stdout, opts)
} else {
handler = slog.NewTextHandler(os.Stdout, opts)
}
return slog.New(handler)
}