awatch-rus/AWatch-rus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(detmir): ship ops, dlp, 1c and mcp updates

Browse Source
This commit is contained in:
igor04091968
2026-05-27 05:56:43 +03:00
parent 033ae810f3
commit 3042bd5042
85 changed files with 12028 additions and 460 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/deploy_tsj_guardian_bot_proxmox.yml
+62 -6
View File
@@ -11,6 +11,9 @@
tsj_bot_script_name: "tsj_guardian_bot.py"
tsj_bot_script_dest: "{{ tsj_bot_root }}/{{ tsj_bot_script_name }}"
tsj_bot_source_local_path: "{{ aw_repo_root }}/proxmox/tsj_guardian_bot.py"
tsj_bot_openvpn_helper_name: "pfsense_openvpn_client_export.php"
tsj_bot_openvpn_helper_dest: "{{ tsj_bot_root }}/{{ tsj_bot_openvpn_helper_name }}"
tsj_bot_openvpn_helper_source_local_path: "{{ aw_repo_root }}/proxmox/{{ tsj_bot_openvpn_helper_name }}"
tsj_bot_service_name: "tsj-guardian-bot.service"
tsj_bot_env_path: "{{ tsj_bot_root }}/.env"
tsj_bot_state_dir: "/home/codex/infra-admin/.state"
@@ -51,12 +54,27 @@
- tsj_bot_source_stat.stat.isreg
fail_msg: "Файл бота не найден: {{ tsj_bot_source_local_path }}"
- name: Проверить наличие helper для OpenVPN экспорта на контроллере
ansible.builtin.stat:
path: "{{ tsj_bot_openvpn_helper_source_local_path }}"
register: tsj_bot_openvpn_helper_stat
delegate_to: localhost
become: false
- name: Остановить выполнение если helper для OpenVPN не найден
ansible.builtin.assert:
that:
- tsj_bot_openvpn_helper_stat.stat.exists
- tsj_bot_openvpn_helper_stat.stat.isreg
fail_msg: "Файл helper для OpenVPN не найден: {{ tsj_bot_openvpn_helper_source_local_path }}"
tasks:
- name: Установить зависимости Python для бота
ansible.builtin.package:
name:
- python3
- python3-requests
- sshpass
state: present
- name: Создать каталоги бота
@@ -80,6 +98,15 @@
mode: "0750"
notify: Restart tsj bot
- name: Развернуть helper для OpenVPN экспорта
ansible.builtin.copy:
src: "{{ tsj_bot_openvpn_helper_source_local_path }}"
dest: "{{ tsj_bot_openvpn_helper_dest }}"
owner: root
group: "{{ tsj_bot_group }}"
mode: "0640"
notify: Restart tsj bot
- name: Сгенерировать полный .env бота
when:
- telegram_bot_token is defined
@@ -100,7 +127,7 @@
NO_PROXY={{ tsj_bot_no_proxy | default('localhost,127.0.0.1,10.10.10.0/24') }}
NODE_13_HOST={{ tsj_bot_node_13_host | default('10.10.10.13') }}
NODE_16_HOST={{ tsj_bot_node_16_host | default('10.10.10.16') }}
NODE_13_URL={{ tsj_bot_node_13_url | default('http://10.10.10.13:5600/') }}
NODE_13_URL={{ tsj_bot_node_13_url | default('http://10.10.10.13:5600/api/0/info') }}
NODE_16_URL={{ tsj_bot_node_16_url | default('http://10.10.10.16/') }}
NODE_16_ENABLED={{ tsj_bot_node_16_enabled | default('false') }}
CHECK_SCRIPT={{ tsj_bot_check_script | default('/home/codex/infra-admin/scripts/system_self_support.sh --check') }}
@@ -123,15 +150,17 @@
TELEGRAM_PROXY_URL={{ tsj_bot_telegram_proxy_url | default('http://127.0.0.1:11090') }}
AI_CHAT_ENABLED={{ tsj_bot_ai_chat_enabled | default('true') }}
AI_CHAT_TIMEOUT_SEC={{ tsj_bot_ai_chat_timeout_sec | default(1800) }}
AI_CHAT_WORKDIR={{ tsj_bot_ai_chat_workdir | default('/home/codex/infra-admin') }}
AI_CHAT_WORKDIR={{ tsj_bot_ai_chat_workdir | default('/home/igor') }}
AI_CHAT_SANDBOX={{ tsj_bot_ai_chat_sandbox | default('workspace-write') }}
CODEX_MODEL={{ tsj_bot_codex_model | default('gpt-5.3-codex') }}
CODEX_FALLBACK_MODELS={{ tsj_bot_codex_fallback_models | default('gpt-5.4-mini') }}
AI_EXEC_USER={{ tsj_bot_ai_exec_user | default('codex') }}
TMUX_USER={{ tsj_bot_tmux_user | default('codex') }}
AI_EXEC_USER={{ tsj_bot_ai_exec_user | default('igor') }}
TMUX_USER={{ tsj_bot_tmux_user | default('igor') }}
TMUX_SESSION={{ tsj_bot_tmux_session | default('ai') }}
TMUX_CREATE_IF_MISSING={{ tsj_bot_tmux_create_if_missing | default('false') }}
TMUX_START_COMMAND={{ tsj_bot_tmux_start_command | default('codex') }}
PFSENSE_ENV_PATH={{ tsj_bot_pfsense_env_path | default('/home/igor/.config/tsj-bot/pfsense.env.readonly') }}
PFSENSE_INVENTORY_PATH={{ tsj_bot_pfsense_inventory_path | default('/home/igor/.config/tsj-bot/inventory.md') }}
PFSENSE_CHANGE_CONTROL_ENABLED={{ tsj_bot_pfsense_change_control_enabled | default('true') }}
PFSENSE_CHANGE_CONFIRM_TTL_SEC={{ tsj_bot_pfsense_change_confirm_ttl_sec | default(900) }}
OPENVPN_CONFIG_ENABLED={{ tsj_bot_openvpn_config_enabled | default('true') }}
@@ -146,7 +175,9 @@
UPDATE_TARGETS={{ tsj_bot_update_targets | default('auto') }}
AW_RUS_API_BASE={{ tsj_bot_aw_rus_api_base | default('http://10.10.10.13:5600/api/0') }}
AW_RUS_WORKTIME_BASE={{ tsj_bot_aw_rus_worktime_base | default('http://10.10.10.13:5610') }}
AW_RUS_WORKTIME_HEAL_CMD={{ tsj_bot_aw_rus_worktime_heal_cmd | default("sshpass -p '04091968' ssh -o PubkeyAuthentication=no -o StrictHostKeyChecking=no igor@10.10.10.13 'sudo -S /usr/local/bin/aw-worktime-autoheal.sh && sudo -S systemctl start aw-worktime-ui-bridge.service'") }}
AW_DLP_POLICY_API_BASE={{ tsj_bot_aw_dlp_policy_api_base | default('http://10.10.10.13:5601/api/0') }}
AW_DLP_POLICY_ACTOR={{ tsj_bot_aw_dlp_policy_actor | default('tsj-guardian-bot') }}
AW_RUS_WORKTIME_HEAL_CMD={{ tsj_bot_aw_rus_worktime_heal_cmd | default("sshpass -p '04091968' ssh -o PubkeyAuthentication=no -o StrictHostKeyChecking=no igor@10.10.10.13 'sudo -S /usr/local/bin/aw-worktime-autoheal.sh && sudo -S systemctl reset-failed aw-worktime-ui-bridge.service && sudo -S systemctl start aw-worktime-ui-bridge.service'") }}
AW_RUS_DLP_HEAL_CMD={{ tsj_bot_aw_rus_dlp_heal_cmd | default("sshpass -p '04091968' ssh -o PubkeyAuthentication=no -o StrictHostKeyChecking=no igor@10.10.10.13 'sudo -S systemctl restart activitywatch-server.service && sudo -S systemctl start activitywatch-dlp-aggregator.service || true && sudo -S /usr/local/bin/aw-health-check && sudo -S /usr/local/bin/dlp-health-check'") }}
AW_RUS_CASE_API_BASE={{ tsj_bot_aw_rus_case_api_base | default('http://10.10.10.13:5602') }}
AW_RUS_HAYABUSA_ENABLED={{ tsj_bot_aw_rus_hayabusa_enabled | default('true') }}
@@ -154,6 +185,15 @@
AW_RUS_HOST={{ tsj_bot_aw_rus_host | default('SHARKON2025') }}
AW_RUS_PRIMARY_USER={{ tsj_bot_aw_rus_primary_user | default('USER1') }}
AW_RUS_STALE_SEC={{ tsj_bot_aw_rus_stale_sec | default(900) }}
AW_RUS_WINDOWS_HOST={{ tsj_bot_aw_rus_windows_host | default(hostvars[(groups['aw_windows'] | first)].ansible_host | default('192.168.100.18')) }}
AW_RUS_WINDOWS_SSH_USER={{ tsj_bot_aw_rus_windows_ssh_user | default(hostvars[(groups['aw_windows'] | first)].ansible_user | default('Администратор')) }}
AW_RUS_WINDOWS_SSH_PASSWORD={{ tsj_bot_aw_rus_windows_ssh_password | default(hostvars[(groups['aw_windows'] | first)].ansible_password | default('')) }}
AW_RUS_WINDOWS_CONFIG_PATH={{ tsj_bot_aw_rus_windows_config_path | default('C:\ProgramData\AWatch-rus\deployment-config.json') }}
AW_RUS_WINDOWS_HARDENING_RECOVERY_PATH={{ tsj_bot_aw_rus_windows_hardening_recovery_path | default('C:\Program Files\AWatch-rus\windows\hardening-recovery.ps1') }}
AW_RUS_WINDOWS_SESSION_COLLECTOR_PATH={{ tsj_bot_aw_rus_windows_session_collector_path | default('C:\ProgramData\AWatch-rus\worktime-session-collector.ps1') }}
AW_RUS_WINDOWS_POLICY_PATH={{ tsj_bot_aw_rus_windows_policy_path | default('C:\ProgramData\AWatch-rus\dlp-policy.json') }}
AW_RUS_WINDOWS_BROWSER_COLLECTOR_PATH={{ tsj_bot_aw_rus_windows_browser_collector_path | default('C:\ProgramData\AWatch-rus\browser-domains-native-collector.ps1') }}
AW_RUS_WINDOWS_EMAIL_COLLECTOR_PATH={{ tsj_bot_aw_rus_windows_email_collector_path | default('C:\ProgramData\AWatch-rus\email-outbound-collector.ps1') }}
notify: Restart tsj bot
- name: Обновить только AW-Rus/Hayabusa env ключи в существующем .env
@@ -176,7 +216,9 @@
loop:
- { key: "AW_RUS_API_BASE", value: "{{ tsj_bot_aw_rus_api_base | default('http://10.10.10.13:5600/api/0') }}" }
- { key: "AW_RUS_WORKTIME_BASE", value: "{{ tsj_bot_aw_rus_worktime_base | default('http://10.10.10.13:5610') }}" }
- { key: "AW_RUS_WORKTIME_HEAL_CMD", value: "{{ tsj_bot_aw_rus_worktime_heal_cmd | default(\"sshpass -p '04091968' ssh -o PubkeyAuthentication=no -o StrictHostKeyChecking=no igor@10.10.10.13 'sudo -S /usr/local/bin/aw-worktime-autoheal.sh && sudo -S systemctl start aw-worktime-ui-bridge.service'\") }}" }
- { key: "AW_DLP_POLICY_API_BASE", value: "{{ tsj_bot_aw_dlp_policy_api_base | default('http://10.10.10.13:5601/api/0') }}" }
- { key: "AW_DLP_POLICY_ACTOR", value: "{{ tsj_bot_aw_dlp_policy_actor | default('tsj-guardian-bot') }}" }
- { key: "AW_RUS_WORKTIME_HEAL_CMD", value: "{{ tsj_bot_aw_rus_worktime_heal_cmd | default(\"sshpass -p '04091968' ssh -o PubkeyAuthentication=no -o StrictHostKeyChecking=no igor@10.10.10.13 'sudo -S /usr/local/bin/aw-worktime-autoheal.sh && sudo -S systemctl reset-failed aw-worktime-ui-bridge.service && sudo -S systemctl start aw-worktime-ui-bridge.service'\") }}" }
- { key: "AW_RUS_DLP_HEAL_CMD", value: "{{ tsj_bot_aw_rus_dlp_heal_cmd | default(\"sshpass -p '04091968' ssh -o PubkeyAuthentication=no -o StrictHostKeyChecking=no igor@10.10.10.13 'sudo -S systemctl restart activitywatch-server.service && sudo -S systemctl start activitywatch-dlp-aggregator.service || true && sudo -S /usr/local/bin/aw-health-check && sudo -S /usr/local/bin/dlp-health-check'\") }}" }
- { key: "AW_RUS_CASE_API_BASE", value: "{{ tsj_bot_aw_rus_case_api_base | default('http://10.10.10.13:5602') }}" }
- { key: "AW_RUS_HAYABUSA_ENABLED", value: "{{ tsj_bot_aw_rus_hayabusa_enabled | default('true') }}" }
@@ -184,6 +226,20 @@
- { key: "AW_RUS_HOST", value: "{{ tsj_bot_aw_rus_host | default('SHARKON2025') }}" }
- { key: "AW_RUS_PRIMARY_USER", value: "{{ tsj_bot_aw_rus_primary_user | default('USER1') }}" }
- { key: "AW_RUS_STALE_SEC", value: "{{ tsj_bot_aw_rus_stale_sec | default(900) }}" }
- { key: "AW_RUS_WINDOWS_HOST", value: "{{ tsj_bot_aw_rus_windows_host | default(hostvars[(groups['aw_windows'] | first)].ansible_host | default('192.168.100.18')) }}" }
- { key: "AW_RUS_WINDOWS_SSH_USER", value: "{{ tsj_bot_aw_rus_windows_ssh_user | default(hostvars[(groups['aw_windows'] | first)].ansible_user | default('Администратор')) }}" }
- { key: "AW_RUS_WINDOWS_SSH_PASSWORD", value: "{{ tsj_bot_aw_rus_windows_ssh_password | default(hostvars[(groups['aw_windows'] | first)].ansible_password | default('')) }}" }
- { key: "AW_RUS_WINDOWS_CONFIG_PATH", value: "{{ tsj_bot_aw_rus_windows_config_path | default('C:\\ProgramData\\AWatch-rus\\deployment-config.json') }}" }
- { key: "AW_RUS_WINDOWS_HARDENING_RECOVERY_PATH", value: "{{ tsj_bot_aw_rus_windows_hardening_recovery_path | default('C:\\Program Files\\AWatch-rus\\windows\\hardening-recovery.ps1') }}" }
- { key: "AW_RUS_WINDOWS_SESSION_COLLECTOR_PATH", value: "{{ tsj_bot_aw_rus_windows_session_collector_path | default('C:\\ProgramData\\AWatch-rus\\worktime-session-collector.ps1') }}" }
- { key: "AW_RUS_WINDOWS_POLICY_PATH", value: "{{ tsj_bot_aw_rus_windows_policy_path | default('C:\\ProgramData\\AWatch-rus\\dlp-policy.json') }}" }
- { key: "AW_RUS_WINDOWS_BROWSER_COLLECTOR_PATH", value: "{{ tsj_bot_aw_rus_windows_browser_collector_path | default('C:\\ProgramData\\AWatch-rus\\browser-domains-native-collector.ps1') }}" }
- { key: "AW_RUS_WINDOWS_EMAIL_COLLECTOR_PATH", value: "{{ tsj_bot_aw_rus_windows_email_collector_path | default('C:\\ProgramData\\AWatch-rus\\email-outbound-collector.ps1') }}" }
- { key: "AI_CHAT_WORKDIR", value: "{{ tsj_bot_ai_chat_workdir | default('/home/igor') }}" }
- { key: "AI_EXEC_USER", value: "{{ tsj_bot_ai_exec_user | default('igor') }}" }
- { key: "TMUX_USER", value: "{{ tsj_bot_tmux_user | default('igor') }}" }
- { key: "PFSENSE_ENV_PATH", value: "{{ tsj_bot_pfsense_env_path | default('/home/igor/.config/tsj-bot/pfsense.env.readonly') }}" }
- { key: "PFSENSE_INVENTORY_PATH", value: "{{ tsj_bot_pfsense_inventory_path | default('/home/igor/.config/tsj-bot/inventory.md') }}" }
notify: Restart tsj bot
- name: Установить systemd unit бота