687 lines
19 KiB
Go
687 lines
19 KiB
Go
// ©AngelaMos | 2026
|
|
// main.go
|
|
|
|
package main
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"flag"
|
|
"log/slog"
|
|
"net/http"
|
|
"os"
|
|
"os/signal"
|
|
"path/filepath"
|
|
"syscall"
|
|
"time"
|
|
|
|
"github.com/go-chi/chi/v5"
|
|
"golang.org/x/sync/errgroup"
|
|
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/admin"
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/alerts"
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/auth"
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/bus"
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/collectors/cfradar"
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/collectors/coinbase"
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/collectors/cve"
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/collectors/dshield"
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/collectors/gdelt"
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/collectors/heartbeat"
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/collectors/iss"
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/collectors/kev"
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/collectors/ransomware"
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/collectors/state"
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/collectors/swpc"
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/collectors/usgs"
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/collectors/wikipedia"
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/config"
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/core"
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/enrich/abuseipdb"
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/enrich/greynoise"
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/health"
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/intel"
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/middleware"
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/notifications"
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/redisring"
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/server"
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/snapshot"
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/user"
|
|
"github.com/carterperez-dev/monitor-the-situation/backend/internal/ws"
|
|
)
|
|
|
|
const (
|
|
drainDelay = 5 * time.Second
|
|
)
|
|
|
|
type abuseipdbEnricher struct {
|
|
client *abuseipdb.Client
|
|
}
|
|
|
|
func (a abuseipdbEnricher) Lookup(
|
|
ctx context.Context,
|
|
ip string,
|
|
) (cfradar.Enrichment, error) {
|
|
v, err := a.client.Lookup(ctx, ip)
|
|
if err != nil {
|
|
return cfradar.Enrichment{}, err
|
|
}
|
|
return cfradar.Enrichment{
|
|
Country: v.CountryCode,
|
|
AbuseConfidence: v.AbuseConfidenceScore,
|
|
ISP: v.ISP,
|
|
}, nil
|
|
}
|
|
|
|
type compositeDshieldEnricher struct {
|
|
abuse *abuseipdb.Client
|
|
gn *greynoise.Cached
|
|
}
|
|
|
|
func (c compositeDshieldEnricher) Lookup(
|
|
ctx context.Context,
|
|
ip string,
|
|
) (dshield.DShieldEnrichment, error) {
|
|
out := dshield.DShieldEnrichment{}
|
|
if c.abuse != nil {
|
|
if v, err := c.abuse.Lookup(ctx, ip); err == nil {
|
|
out.Country = v.CountryCode
|
|
}
|
|
}
|
|
if c.gn != nil {
|
|
if v, err := c.gn.Lookup(ctx, ip); err == nil {
|
|
out.Classification = v.Classification
|
|
out.Actor = v.Name
|
|
}
|
|
}
|
|
return out, nil
|
|
}
|
|
|
|
func main() {
|
|
configPath := flag.String("config", "config.yaml", "path to config file")
|
|
healthcheck := flag.Bool(
|
|
"healthcheck",
|
|
false,
|
|
"probe local /healthz and exit 0 if healthy, 1 otherwise",
|
|
)
|
|
flag.Parse()
|
|
|
|
if *healthcheck {
|
|
os.Exit(runHealthcheck())
|
|
}
|
|
|
|
if err := run(*configPath); err != nil {
|
|
slog.Error("application error", "error", err)
|
|
os.Exit(1)
|
|
}
|
|
}
|
|
|
|
func runHealthcheck() int {
|
|
client := &http.Client{Timeout: 3 * time.Second}
|
|
resp, err := client.Get("http://127.0.0.1:8080/healthz")
|
|
if err != nil {
|
|
return 1
|
|
}
|
|
defer func() { _ = resp.Body.Close() }()
|
|
if resp.StatusCode != http.StatusOK {
|
|
return 1
|
|
}
|
|
return 0
|
|
}
|
|
|
|
//nolint:funlen // bootstrap code is inherently verbose
|
|
func run(configPath string) error {
|
|
ctx, stop := signal.NotifyContext(
|
|
context.Background(),
|
|
syscall.SIGINT,
|
|
syscall.SIGTERM,
|
|
)
|
|
defer stop()
|
|
|
|
cfg, err := config.Load(configPath)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
logger := setupLogger(cfg.Log)
|
|
slog.SetDefault(logger)
|
|
|
|
logger.Info("starting application",
|
|
"name", cfg.App.Name,
|
|
"version", cfg.App.Version,
|
|
"environment", cfg.App.Environment,
|
|
)
|
|
|
|
var telemetry *core.Telemetry
|
|
if cfg.Otel.Enabled {
|
|
tel, telErr := core.NewTelemetry(ctx, cfg.Otel, cfg.App)
|
|
if telErr != nil {
|
|
logger.Warn("failed to initialize telemetry", "error", telErr)
|
|
} else {
|
|
telemetry = tel
|
|
logger.Info("OpenTelemetry tracer initialized",
|
|
"endpoint", cfg.Otel.Endpoint,
|
|
)
|
|
}
|
|
}
|
|
|
|
db, err := core.NewDatabase(ctx, cfg.Database)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
logger.Info("database connected",
|
|
"max_open_conns", cfg.Database.MaxOpenConns,
|
|
"max_idle_conns", cfg.Database.MaxIdleConns,
|
|
)
|
|
|
|
redis, err := core.NewRedis(ctx, cfg.Redis)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
logger.Info("redis connected",
|
|
"pool_size", cfg.Redis.PoolSize,
|
|
)
|
|
|
|
if keyErr := ensureJWTKeys(cfg.JWT, logger); keyErr != nil {
|
|
return keyErr
|
|
}
|
|
|
|
jwtManager, err := auth.NewJWTManager(cfg.JWT)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
logger.Info("JWT manager initialized",
|
|
"algorithm", "ES256",
|
|
"key_id", jwtManager.GetKeyID(),
|
|
)
|
|
|
|
userRepo := user.NewRepository(db.DB)
|
|
userSvc := user.NewService(userRepo)
|
|
userHandler := user.NewHandler(userSvc)
|
|
|
|
authRepo := auth.NewRepository(db.DB)
|
|
authSvc := auth.NewServiceWithConfig(auth.ServiceConfig{
|
|
Repo: authRepo,
|
|
JWT: jwtManager,
|
|
UserProvider: userSvc,
|
|
Redis: redis.Client,
|
|
AdminEmail: cfg.App.AdminEmail,
|
|
})
|
|
authVerifier := auth.NewVerifier(jwtManager, authSvc, userSvc)
|
|
authHandler := auth.NewHandlerWithConfig(auth.HandlerConfig{
|
|
Service: authSvc,
|
|
TrustedProxyHops: cfg.Server.TrustedProxyHops,
|
|
SecureCookies: cfg.IsProduction(),
|
|
})
|
|
|
|
var notifHandler *notifications.Handler
|
|
var notifBridge *notifications.Bridge
|
|
if cfg.Notifications.EncryptionKey != "" {
|
|
enc, encErr := notifications.NewEncryptor(
|
|
cfg.Notifications.EncryptionKey,
|
|
)
|
|
if encErr != nil {
|
|
logger.Warn(
|
|
"notifications disabled: invalid encryption key",
|
|
"error", encErr,
|
|
)
|
|
} else {
|
|
notifRepo := notifications.NewRepository(db.DB)
|
|
notifSender := notifications.NewSender()
|
|
notifSvc := notifications.NewService(
|
|
notifRepo,
|
|
enc,
|
|
notifSender,
|
|
cfg.App.PublicURL,
|
|
logger.With("service", "notifications"),
|
|
)
|
|
notifHandler = notifications.NewHandler(notifSvc)
|
|
notifBridge = notifications.NewBridge(
|
|
notifRepo,
|
|
enc,
|
|
notifSender,
|
|
logger.With("service", "alerts"),
|
|
)
|
|
}
|
|
} else {
|
|
logger.Warn(
|
|
"notifications disabled: NOTIFICATION_ENCRYPTION_KEY not set",
|
|
)
|
|
}
|
|
|
|
alertsRepo := alerts.NewRepository(db.DB)
|
|
authSvc.SetRuleSeeder(func(ctx context.Context, userID string) error {
|
|
return alertsRepo.SeedDefaults(ctx, userID)
|
|
})
|
|
alertsHandler := alerts.NewHandler(alertsRepo)
|
|
|
|
healthHandler := health.NewHandler(db, redis)
|
|
|
|
adminHandler := admin.NewHandler(admin.HandlerConfig{
|
|
DBStats: db.Stats,
|
|
RedisStats: redis.PoolStats,
|
|
DBPing: db.Ping,
|
|
RedisPing: redis.Ping,
|
|
})
|
|
|
|
snapStore := snapshot.NewStore(redis.Client)
|
|
snapHandler := snapshot.NewHandler(snapStore)
|
|
|
|
cveRepo := cve.NewRepo(db.DB)
|
|
kevRepo := kev.NewRepo(db.DB)
|
|
cfradarRepo := cfradar.NewRepo(db.DB)
|
|
ransomwareRepo := ransomware.NewRepo(db.DB)
|
|
usgsRepo := usgs.NewRepo(db.DB)
|
|
intelHandler := intel.NewHandler(intel.HandlerConfig{
|
|
CVE: cveRepo,
|
|
KEV: kevRepo,
|
|
CFRadar: cfradarRepo,
|
|
Ransomware: ransomwareRepo,
|
|
USGS: usgsRepo,
|
|
})
|
|
|
|
hub := ws.NewHub(ws.HubConfig{
|
|
Logger: logger,
|
|
MaxSubscribers: cfg.Server.WSMaxSubscribers,
|
|
})
|
|
wsHandler := ws.NewHandlerWithConfig(ws.HandlerConfig{
|
|
Hub: hub,
|
|
MaxConnsPerIP: cfg.Server.WSMaxConnsPerIP,
|
|
TrustedProxyHops: cfg.Server.TrustedProxyHops,
|
|
})
|
|
|
|
eventBus := bus.New(bus.Config{
|
|
BufferSize: 512,
|
|
Persister: snapshot.StorePersister{Store: snapStore},
|
|
Broadcaster: ws.HubBroadcaster{Hub: hub},
|
|
Logger: logger,
|
|
})
|
|
|
|
beat := heartbeat.New(heartbeat.Config{
|
|
Interval: 5 * time.Second,
|
|
Emitter: eventBus,
|
|
})
|
|
|
|
collectorState := state.NewRepo(db.DB)
|
|
|
|
collectorGroup, collectorCtx := errgroup.WithContext(ctx)
|
|
collectorGroup.Go(func() error { return eventBus.Run(collectorCtx) })
|
|
collectorGroup.Go(func() error { return beat.Run(collectorCtx) })
|
|
|
|
if notifBridge != nil {
|
|
alertsEngine, err := alerts.NewEngine(alerts.EngineConfig{
|
|
Repo: alertsRepo,
|
|
Notifier: notifBridge,
|
|
Loader: notifBridge,
|
|
Cooldowns: alerts.NewRedisCooldown(redis.Client),
|
|
Logger: logger.With("component", "alerts.engine"),
|
|
})
|
|
if err != nil {
|
|
return err
|
|
}
|
|
dispatcher := alerts.NewDispatcher(
|
|
eventBus.Subscribe(),
|
|
alertsEngine,
|
|
logger.With("component", "alerts.dispatcher"),
|
|
)
|
|
collectorGroup.Go(
|
|
func() error { return alertsEngine.RefreshLoop(collectorCtx) },
|
|
)
|
|
collectorGroup.Go(func() error { return dispatcher.Run(collectorCtx) })
|
|
} else {
|
|
logger.Info(
|
|
"alerts engine disabled (notifications module not configured)",
|
|
)
|
|
}
|
|
|
|
if cfg.Collectors.DShield.Enabled {
|
|
var dsEnricher dshield.Enricher
|
|
var abuseClient *abuseipdb.Client
|
|
var gnCached *greynoise.Cached
|
|
if cfg.Collectors.AbuseIPDB.Enabled &&
|
|
cfg.Collectors.AbuseIPDB.APIKey != "" {
|
|
abuseClient = abuseipdb.NewClient(
|
|
abuseipdb.ClientConfig{APIKey: cfg.Collectors.AbuseIPDB.APIKey},
|
|
)
|
|
}
|
|
if cfg.Collectors.GreyNoise.Enabled &&
|
|
cfg.Collectors.GreyNoise.APIKey != "" {
|
|
gnCached = greynoise.NewCached(
|
|
greynoise.NewClient(
|
|
greynoise.ClientConfig{
|
|
APIKey: cfg.Collectors.GreyNoise.APIKey,
|
|
},
|
|
),
|
|
redis.Client,
|
|
)
|
|
}
|
|
if abuseClient != nil || gnCached != nil {
|
|
dsEnricher = compositeDshieldEnricher{
|
|
abuse: abuseClient,
|
|
gn: gnCached,
|
|
}
|
|
}
|
|
coll := dshield.NewCollector(dshield.CollectorConfig{
|
|
Interval: cfg.Collectors.DShield.Interval,
|
|
Fetcher: dshield.NewClient(dshield.ClientConfig{}),
|
|
Persister: dshield.NewRepo(db.DB),
|
|
Emitter: eventBus,
|
|
State: collectorState,
|
|
Enricher: dsEnricher,
|
|
Logger: logger.With("collector", "dshield"),
|
|
})
|
|
collectorGroup.Go(func() error { return coll.Run(collectorCtx) })
|
|
}
|
|
|
|
if cfg.Collectors.CFRadar.Enabled {
|
|
var enricher cfradar.Enricher
|
|
if cfg.Collectors.AbuseIPDB.Enabled &&
|
|
cfg.Collectors.AbuseIPDB.APIKey != "" {
|
|
enricher = abuseipdbEnricher{
|
|
client: abuseipdb.NewClient(
|
|
abuseipdb.ClientConfig{
|
|
APIKey: cfg.Collectors.AbuseIPDB.APIKey,
|
|
},
|
|
),
|
|
}
|
|
}
|
|
coll := cfradar.NewCollector(cfradar.CollectorConfig{
|
|
Interval: cfg.Collectors.CFRadar.Interval,
|
|
MinConfidence: cfg.Collectors.CFRadar.MinConfidence,
|
|
Fetcher: cfradar.NewClient(
|
|
cfradar.ClientConfig{
|
|
BearerToken: cfg.Collectors.CFRadar.BearerToken,
|
|
},
|
|
),
|
|
Repo: cfradar.NewRepo(db.DB),
|
|
Emitter: eventBus,
|
|
State: collectorState,
|
|
Enricher: enricher,
|
|
Logger: logger.With("collector", "cfradar"),
|
|
})
|
|
collectorGroup.Go(func() error { return coll.Run(collectorCtx) })
|
|
}
|
|
|
|
if cfg.Collectors.CVE.Enabled {
|
|
coll := cve.NewCollector(cve.CollectorConfig{
|
|
Interval: cfg.Collectors.CVE.Interval,
|
|
Window: cfg.Collectors.CVE.Window,
|
|
NVD: cve.NewNVDClient(
|
|
cve.NVDClientConfig{APIKey: cfg.Collectors.CVE.NVDAPIKey},
|
|
),
|
|
EPSS: cve.NewEPSSClient(cve.EPSSClientConfig{}),
|
|
Repo: cve.NewRepo(db.DB),
|
|
Emitter: eventBus,
|
|
State: collectorState,
|
|
Logger: logger.With("collector", "cve"),
|
|
})
|
|
collectorGroup.Go(func() error { return coll.Run(collectorCtx) })
|
|
}
|
|
|
|
if cfg.Collectors.KEV.Enabled {
|
|
coll := kev.NewCollector(kev.CollectorConfig{
|
|
Interval: cfg.Collectors.KEV.Interval,
|
|
Fetcher: kev.NewClient(kev.ClientConfig{}),
|
|
Repo: kev.NewRepo(db.DB),
|
|
Emitter: eventBus,
|
|
State: collectorState,
|
|
Logger: logger.With("collector", "kev"),
|
|
})
|
|
collectorGroup.Go(func() error { return coll.Run(collectorCtx) })
|
|
}
|
|
|
|
if cfg.Collectors.Ransomware.Enabled {
|
|
coll := ransomware.NewCollector(ransomware.CollectorConfig{
|
|
Interval: cfg.Collectors.Ransomware.Interval,
|
|
Fetcher: ransomware.NewClient(ransomware.ClientConfig{}),
|
|
Repo: ransomware.NewRepo(db.DB),
|
|
Emitter: eventBus,
|
|
State: collectorState,
|
|
Logger: logger.With("collector", "ransomware"),
|
|
})
|
|
collectorGroup.Go(func() error { return coll.Run(collectorCtx) })
|
|
}
|
|
|
|
if cfg.Collectors.Coinbase.Enabled {
|
|
coll := coinbase.NewCollector(coinbase.CollectorConfig{
|
|
URL: cfg.Collectors.Coinbase.URL,
|
|
ProductIDs: cfg.Collectors.Coinbase.ProductIDs,
|
|
Repo: coinbase.NewRepo(db.DB),
|
|
Emitter: eventBus,
|
|
State: collectorState,
|
|
Throttle: cfg.Collectors.Coinbase.Throttle,
|
|
Logger: logger.With("collector", "coinbase"),
|
|
})
|
|
collectorGroup.Go(func() error { return coll.Run(collectorCtx) })
|
|
}
|
|
|
|
if cfg.Collectors.USGS.Enabled {
|
|
coll := usgs.NewCollector(usgs.CollectorConfig{
|
|
Interval: cfg.Collectors.USGS.Interval,
|
|
Fetcher: usgs.NewClient(usgs.ClientConfig{}),
|
|
Repo: usgs.NewRepo(db.DB),
|
|
Emitter: eventBus,
|
|
State: collectorState,
|
|
Logger: logger.With("collector", "usgs"),
|
|
})
|
|
collectorGroup.Go(func() error { return coll.Run(collectorCtx) })
|
|
}
|
|
|
|
if cfg.Collectors.SWPC.Enabled {
|
|
ring := redisring.New(
|
|
redis.Client,
|
|
redisring.Config{Retention: 24 * time.Hour},
|
|
)
|
|
coll := swpc.NewCollector(swpc.CollectorConfig{
|
|
FastInterval: cfg.Collectors.SWPC.FastInterval,
|
|
SlowInterval: cfg.Collectors.SWPC.SlowInterval,
|
|
Fetcher: swpc.NewClient(swpc.ClientConfig{}),
|
|
Ring: ring,
|
|
Emitter: eventBus,
|
|
State: collectorState,
|
|
Logger: logger.With("collector", "swpc"),
|
|
})
|
|
collectorGroup.Go(func() error { return coll.Run(collectorCtx) })
|
|
}
|
|
|
|
if cfg.Collectors.Wikipedia.Enabled {
|
|
coll := wikipedia.NewCollector(wikipedia.CollectorConfig{
|
|
Interval: cfg.Collectors.Wikipedia.Interval,
|
|
Fetcher: wikipedia.NewClient(wikipedia.ClientConfig{}),
|
|
Repo: wikipedia.NewRepo(db.DB, redis.Client),
|
|
Emitter: eventBus,
|
|
State: collectorState,
|
|
Logger: logger.With("collector", "wikipedia"),
|
|
})
|
|
collectorGroup.Go(func() error { return coll.Run(collectorCtx) })
|
|
}
|
|
|
|
if cfg.Collectors.GDELT.Enabled {
|
|
coll := gdelt.NewCollector(gdelt.CollectorConfig{
|
|
Interval: cfg.Collectors.GDELT.Interval,
|
|
Fetcher: gdelt.NewClient(gdelt.ClientConfig{}),
|
|
Repo: gdelt.NewRepo(db.DB),
|
|
Emitter: eventBus,
|
|
State: collectorState,
|
|
Logger: logger.With("collector", "gdelt"),
|
|
})
|
|
collectorGroup.Go(func() error { return coll.Run(collectorCtx) })
|
|
}
|
|
|
|
if cfg.Collectors.ISS.Enabled {
|
|
coll := iss.NewCollector(iss.CollectorConfig{
|
|
PositionInterval: cfg.Collectors.ISS.PositionInterval,
|
|
TLEInterval: cfg.Collectors.ISS.TLEInterval,
|
|
Fetcher: iss.NewClient(iss.ClientConfig{}),
|
|
TLEStore: iss.NewTLEStore(redis.Client),
|
|
Emitter: eventBus,
|
|
State: collectorState,
|
|
Logger: logger.With("collector", "iss"),
|
|
})
|
|
collectorGroup.Go(func() error { return coll.Run(collectorCtx) })
|
|
}
|
|
|
|
logger.Info("collectors started",
|
|
"heartbeat", true,
|
|
"dshield", cfg.Collectors.DShield.Enabled,
|
|
"cfradar", cfg.Collectors.CFRadar.Enabled,
|
|
"cve", cfg.Collectors.CVE.Enabled,
|
|
"kev", cfg.Collectors.KEV.Enabled,
|
|
"ransomware", cfg.Collectors.Ransomware.Enabled,
|
|
"coinbase", cfg.Collectors.Coinbase.Enabled,
|
|
"usgs", cfg.Collectors.USGS.Enabled,
|
|
"swpc", cfg.Collectors.SWPC.Enabled,
|
|
"wikipedia", cfg.Collectors.Wikipedia.Enabled,
|
|
"gdelt", cfg.Collectors.GDELT.Enabled,
|
|
"iss", cfg.Collectors.ISS.Enabled,
|
|
)
|
|
|
|
srv := server.New(server.Config{
|
|
ServerConfig: cfg.Server,
|
|
HealthHandler: healthHandler,
|
|
Logger: logger,
|
|
})
|
|
|
|
router := srv.Router()
|
|
|
|
router.Use(middleware.RequestID)
|
|
router.Use(middleware.Logger(logger))
|
|
router.Use(
|
|
middleware.NewRateLimiter(redis.Client, middleware.RateLimitConfig{
|
|
Limit: middleware.PerWindow(
|
|
cfg.RateLimit.Requests,
|
|
cfg.RateLimit.Burst,
|
|
cfg.RateLimit.Window,
|
|
),
|
|
KeyFunc: middleware.KeyByClientIP(cfg.Server.TrustedProxyHops),
|
|
FailOpen: true,
|
|
}).Handler,
|
|
)
|
|
router.Use(middleware.SecurityHeaders(cfg.App.Environment == "production"))
|
|
router.Use(middleware.CORS(cfg.CORS))
|
|
|
|
healthHandler.RegisterRoutes(router)
|
|
|
|
router.Get("/.well-known/jwks.json", jwtManager.GetJWKSHandler())
|
|
|
|
authenticator := middleware.Authenticator(authVerifier)
|
|
adminOnly := middleware.RequireAdmin
|
|
|
|
router.Route("/v1", func(r chi.Router) {
|
|
r.Get("/healthz", healthHandler.Liveness)
|
|
r.Get("/readyz", healthHandler.Readiness)
|
|
|
|
r.Get("/snapshot", snapHandler.ServeHTTP)
|
|
r.Get("/ws", wsHandler.ServeHTTP)
|
|
|
|
intelHandler.RegisterRoutes(r)
|
|
|
|
authHandler.RegisterRoutes(r, authenticator)
|
|
|
|
userHandler.RegisterRoutes(r, authenticator)
|
|
userHandler.RegisterAdminRoutes(r, authenticator, adminOnly)
|
|
adminHandler.RegisterRoutes(r, authenticator, adminOnly)
|
|
|
|
if notifHandler != nil {
|
|
notifHandler.RegisterRoutes(r, authenticator)
|
|
}
|
|
if alertsHandler != nil {
|
|
alertsHandler.RegisterRoutes(r, authenticator)
|
|
}
|
|
})
|
|
|
|
errChan := make(chan error, 1)
|
|
go func() {
|
|
errChan <- srv.Start()
|
|
}()
|
|
|
|
select {
|
|
case err := <-errChan:
|
|
return err
|
|
case <-ctx.Done():
|
|
logger.Info("shutdown signal received")
|
|
}
|
|
|
|
shutdownCtx, cancel := context.WithTimeout(
|
|
context.Background(),
|
|
cfg.Server.ShutdownTimeout+drainDelay+5*time.Second,
|
|
)
|
|
defer cancel()
|
|
|
|
if err := srv.Shutdown(shutdownCtx, drainDelay); err != nil {
|
|
logger.Error("server shutdown error", "error", err)
|
|
}
|
|
|
|
if telemetry != nil {
|
|
if err := telemetry.Shutdown(shutdownCtx); err != nil {
|
|
logger.Error("telemetry shutdown error", "error", err)
|
|
}
|
|
}
|
|
|
|
if err := collectorGroup.Wait(); err != nil &&
|
|
!errors.Is(err, context.Canceled) &&
|
|
!errors.Is(err, context.DeadlineExceeded) {
|
|
logger.Error("collector group exit", "error", err)
|
|
}
|
|
|
|
if err := redis.Close(); err != nil {
|
|
logger.Error("redis close error", "error", err)
|
|
}
|
|
|
|
if err := db.Close(); err != nil {
|
|
logger.Error("database close error", "error", err)
|
|
}
|
|
|
|
logger.Info("application stopped")
|
|
return nil
|
|
}
|
|
|
|
func ensureJWTKeys(cfg config.JWTConfig, logger *slog.Logger) error {
|
|
if _, err := os.Stat(cfg.PrivateKeyPath); err == nil {
|
|
return nil
|
|
} else if !errors.Is(err, os.ErrNotExist) {
|
|
return err
|
|
}
|
|
|
|
if dir := filepath.Dir(cfg.PrivateKeyPath); dir != "" && dir != "." {
|
|
if err := os.MkdirAll(dir, 0o700); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
if dir := filepath.Dir(cfg.PublicKeyPath); dir != "" && dir != "." {
|
|
if err := os.MkdirAll(dir, 0o700); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
|
|
logger.Warn("JWT keys missing, generating",
|
|
"private", cfg.PrivateKeyPath,
|
|
"public", cfg.PublicKeyPath,
|
|
)
|
|
return auth.GenerateKeyPair(cfg.PrivateKeyPath, cfg.PublicKeyPath)
|
|
}
|
|
|
|
func setupLogger(cfg config.LogConfig) *slog.Logger {
|
|
var handler slog.Handler
|
|
|
|
level := slog.LevelInfo
|
|
switch cfg.Level {
|
|
case "debug":
|
|
level = slog.LevelDebug
|
|
case "warn":
|
|
level = slog.LevelWarn
|
|
case "error":
|
|
level = slog.LevelError
|
|
}
|
|
|
|
opts := &slog.HandlerOptions{Level: level}
|
|
|
|
if cfg.Format == "json" {
|
|
handler = slog.NewJSONHandler(os.Stdout, opts)
|
|
} else {
|
|
handler = slog.NewTextHandler(os.Stdout, opts)
|
|
}
|
|
|
|
return slog.New(handler)
|
|
}
|