feat(portal): make UEBA risk policy configurable

ansible/deploy_detmir_portal.yml

@@ -13,6 +13,7 @@
     detmir_portal_one_c_host: "{{ hostvars[(groups['proxmox'] | default([]) | first) | default('192.0.2.2', true)].ansible_host | default((groups['proxmox'] | default([]) | first) | default('192.0.2.2', true), true) }}"
     detmir_portal_one_c_url: "{{ detmir_portal_one_c_url_override | default('http://' + detmir_portal_one_c_host + ':8710', true) }}"
     detmir_portal_workforce_policy_path: "/etc/detmir-portal-workforce-policy.json"
+    detmir_portal_ueba_policy_path: "/etc/detmir-portal-ueba-policy.yaml"
 
   tasks:
     - name: Check local detmir-portal binary
@@ -49,6 +50,7 @@
           DETMIR_PORTAL_WORKTIME_URL={{ detmir_portal_worktime_url }}
           DETMIR_PORTAL_ONE_C_URL={{ detmir_portal_one_c_url }}
           DETMIR_PORTAL_WORKFORCE_POLICY_PATH={{ detmir_portal_workforce_policy_path }}
+          DETMIR_PORTAL_UEBA_POLICY_PATH={{ detmir_portal_ueba_policy_path }}
           DETMIR_PORTAL_TIMEOUT_SECONDS=10
           DETMIR_PORTAL_STATE_DIR=/var/lib/detmir-portal
           DETMIR_PORTAL_DLP_DB_PATH=/var/lib/activitywatch/dlp_warehouse.sqlite
@@ -65,6 +67,15 @@
         force: false
         content: "{{ lookup('file', aw_repo_root + '/configs/detmir-workforce-policy.example.json') }}"
 
+    - name: Install initial UEBA risk policy when absent
+      ansible.builtin.copy:
+        dest: "{{ detmir_portal_ueba_policy_path }}"
+        owner: root
+        group: root
+        mode: "0644"
+        force: false
+        content: "{{ lookup('file', aw_repo_root + '/configs/detmir-ueba-risk-policy.example.yaml') }}"
+
     - name: Ensure detmir-portal state and evidence directories
       ansible.builtin.file:
         path: "{{ item }}"