fix(dlp): enforce server policy mode and preserve policy-engine settings in hardening

ansible/deploy_aw_windows.yml

@@ -25,9 +25,9 @@
     aw_windows_users_effective: "{{ (aw_windows_users + aw_windows_extra_users) | unique }}"
     aw_windows_install_root: "C:\\Program Files\\AWatch-rus\\bin"
     aw_windows_state_root: "C:\\ProgramData\\AWatch-rus"
-    aw_windows_policy_mode: "local"
+    aw_windows_policy_mode: "server"
     aw_windows_policy_refresh_seconds: 300
-    aw_windows_policy_engine_enabled: false
+    aw_windows_policy_engine_enabled: true
     aw_windows_policy_engine_host: "{{ aw_windows_server_host }}"
     aw_windows_policy_engine_port: 5601
     aw_windows_policy_engine_scheme: "http"

ansible/group_vars/aw_windows.yml

@@ -25,9 +25,9 @@ aw_windows_extra_users: []
 aw_windows_install_root: "C:\\Program Files\\AWatch-rus\\bin"
 aw_windows_state_root: "C:\\ProgramData\\AWatch-rus"
 aw_windows_hostname_override: ""
-aw_windows_policy_mode: "local"
+aw_windows_policy_mode: "server"
 aw_windows_policy_refresh_seconds: 300
-aw_windows_policy_engine_enabled: false
+aw_windows_policy_engine_enabled: true
 aw_windows_policy_engine_host: "{{ aw_windows_server_host }}"
 aw_windows_policy_engine_port: 5601
 aw_windows_policy_engine_scheme: "http"

ansible/roles/dlp-policy-engine/tasks/main.yml

@@ -21,21 +21,26 @@
     - { src: "{{ playbook_dir }}/../aw-server/dlp-policy-engine/policy_schema.py", dest: "/opt/activitywatch/dlp-policy-engine/policy_schema.py" }
     - { src: "{{ playbook_dir }}/../aw-server/dlp-policy-engine/policy_storage.py", dest: "/opt/activitywatch/dlp-policy-engine/policy_storage.py" }
     - { src: "{{ playbook_dir }}/../aw-server/dlp-policy-engine/policy_distributor.py", dest: "/opt/activitywatch/dlp-policy-engine/policy_distributor.py" }
-    - { src: "{{ playbook_dir }}/../aw-server/dlp-policy-engine/dlp-policy-engine.service", dest: "/etc/systemd/system/dlp-policy-engine.service" }
+    - { src: "{{ playbook_dir }}/../aw-server/dlp-policy-engine/requirements.txt", dest: "/opt/activitywatch/dlp-policy-engine/requirements.txt" }
+    - { src: "{{ playbook_dir }}/../aw-server/dlp-policy-engine/dlp-policy-engine.service", dest: "/etc/systemd/system/aw-dlp-policy-engine.service" }
 
-- name: Install python deps for policy engine
+- name: Ensure policy engine venv exists
+  become: true
+  ansible.builtin.command:
+    cmd: python3 -m venv /opt/activitywatch/dlp-policy-engine/.venv
+  args:
+    creates: /opt/activitywatch/dlp-policy-engine/.venv/bin/python
+
+- name: Install python deps for policy engine venv
   become: true
   ansible.builtin.pip:
-    name:
-      - fastapi
-      - uvicorn
-      - pydantic
-    executable: pip3
+    requirements: /opt/activitywatch/dlp-policy-engine/requirements.txt
+    virtualenv: /opt/activitywatch/dlp-policy-engine/.venv
 
 - name: Enable and restart policy engine
   become: true
   ansible.builtin.systemd:
     daemon_reload: true
-    name: dlp-policy-engine.service
+    name: aw-dlp-policy-engine.service
     enabled: true
     state: restarted

windows/deploy-ensemble.ps1

@@ -116,7 +116,14 @@ if (-not $SkipHardening) {
         -LogonMarkerEnabled $LogonMarkerEnabled `
         -AwHostname $AwHostname `
         -CustomRulesPath $CustomRulesPath `
-        -CustomPolicyPath $CustomPolicyPath
+        -CustomPolicyPath $CustomPolicyPath `
+        -PolicyMode $PolicyMode `
+        -PolicyEngineEnabled $PolicyEngineEnabled `
+        -PolicyEngineHost $PolicyEngineHost `
+        -PolicyEnginePort $PolicyEnginePort `
+        -PolicyEngineScheme $PolicyEngineScheme `
+        -PolicyRefreshSeconds $PolicyRefreshSeconds `
+        -PolicyCachePath $PolicyCachePath
 }
 
 $report = [ordered]@{

windows/hardening-recovery.ps1

@@ -24,6 +24,15 @@ param(
     [string]$AwHostname,
     [string]$CustomRulesPath,
     [string]$CustomPolicyPath,
+    [ValidateSet('local', 'server')]
+    [string]$PolicyMode,
+    [bool]$PolicyEngineEnabled,
+    [string]$PolicyEngineHost,
+    [int]$PolicyEnginePort,
+    [ValidateSet('http', 'https')]
+    [string]$PolicyEngineScheme,
+    [int]$PolicyRefreshSeconds,
+    [string]$PolicyCachePath,
     [switch]$RepairPackage,
     [string]$Version,
     [string]$PackageUrl,
@@ -59,6 +68,7 @@ $effectiveFileCollector = if ($existingConfig -and $existingConfig.paths.PSObjec
 $effectiveSessionCollector = if ($existingConfig -and $existingConfig.paths.PSObject.Properties.Name -contains 'sessionCollectorScript') { [string]$existingConfig.paths.sessionCollectorScript } else { Join-Path $effectiveStateRoot 'worktime-session-collector.ps1' }
 $effectiveRules = Join-Path $effectiveStateRoot 'web-category-rules.json'
 $effectivePolicy = if ($existingConfig -and $existingConfig.paths.PSObject.Properties.Name -contains 'policyPath') { [string]$existingConfig.paths.policyPath } else { Join-Path $effectiveStateRoot 'dlp-policy.json' }
+$effectivePolicyClientScript = if ($existingConfig -and $existingConfig.paths.PSObject.Properties.Name -contains 'policyClientScript') { [string]$existingConfig.paths.policyClientScript } else { Join-Path $effectiveStateRoot 'dlp-policy-client.ps1' }
 
 $effectiveServerHost = if ($ServerHost) { $ServerHost } elseif ($existingConfig) { [string]$existingConfig.server.host } else { $null }
 $effectiveServerPort = if ($PSBoundParameters.ContainsKey('ServerPort')) { $ServerPort } elseif ($existingConfig) { [int]$existingConfig.server.port } else { 5600 }
@@ -76,6 +86,13 @@ $effectiveIncidentArtifactsRoot = if ($PSBoundParameters.ContainsKey('IncidentAr
 $effectiveLogonMarkerEnabled = if ($PSBoundParameters.ContainsKey('LogonMarkerEnabled')) { [bool]$LogonMarkerEnabled } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'sessionEvents' -and $existingConfig.sessionEvents.PSObject.Properties.Name -contains 'logonEnabled') { [bool]$existingConfig.sessionEvents.logonEnabled } else { $true }
 $effectiveAwHostname = if ($PSBoundParameters.ContainsKey('AwHostname') -and -not [string]::IsNullOrWhiteSpace($AwHostname)) { [string]$AwHostname } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'awHostname' -and -not [string]::IsNullOrWhiteSpace([string]$existingConfig.awHostname)) { [string]$existingConfig.awHostname } else { [string]$env:COMPUTERNAME }
 $effectiveVersion = if ($Version) { $Version } elseif ($existingConfig) { [string]$existingConfig.package.version } else { 'v0.13.2' }
+$effectivePolicyMode = if ($PSBoundParameters.ContainsKey('PolicyMode') -and $PolicyMode) { [string]$PolicyMode } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'policyEngine' -and $existingConfig.policyEngine.PSObject.Properties.Name -contains 'mode') { [string]$existingConfig.policyEngine.mode } else { 'local' }
+$effectivePolicyEngineEnabled = if ($PSBoundParameters.ContainsKey('PolicyEngineEnabled')) { [bool]$PolicyEngineEnabled } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'policyEngine' -and $existingConfig.policyEngine.PSObject.Properties.Name -contains 'enabled') { [bool]$existingConfig.policyEngine.enabled } else { $false }
+$effectivePolicyEngineHost = if ($PSBoundParameters.ContainsKey('PolicyEngineHost') -and -not [string]::IsNullOrWhiteSpace($PolicyEngineHost)) { [string]$PolicyEngineHost } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'policyEngine' -and $existingConfig.policyEngine.PSObject.Properties.Name -contains 'host') { [string]$existingConfig.policyEngine.host } else { [string]$effectiveServerHost }
+$effectivePolicyEnginePort = if ($PSBoundParameters.ContainsKey('PolicyEnginePort')) { [int]$PolicyEnginePort } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'policyEngine' -and $existingConfig.policyEngine.PSObject.Properties.Name -contains 'port') { [int]$existingConfig.policyEngine.port } else { 5601 }
+$effectivePolicyEngineScheme = if ($PSBoundParameters.ContainsKey('PolicyEngineScheme') -and $PolicyEngineScheme) { [string]$PolicyEngineScheme } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'policyEngine' -and $existingConfig.policyEngine.PSObject.Properties.Name -contains 'scheme') { [string]$existingConfig.policyEngine.scheme } else { 'http' }
+$effectivePolicyRefreshSeconds = if ($PSBoundParameters.ContainsKey('PolicyRefreshSeconds')) { [int]$PolicyRefreshSeconds } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'policyEngine' -and $existingConfig.policyEngine.PSObject.Properties.Name -contains 'refreshSeconds') { [int]$existingConfig.policyEngine.refreshSeconds } else { 300 }
+$effectivePolicyCachePath = if ($PSBoundParameters.ContainsKey('PolicyCachePath') -and $PolicyCachePath) { [string]$PolicyCachePath } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'policyEngine' -and $existingConfig.policyEngine.PSObject.Properties.Name -contains 'cachePath') { [string]$existingConfig.policyEngine.cachePath } else { Join-Path $effectiveStateRoot 'dlp-policy-cache.json' }
 
 $effectiveUsers = if ($Users -or $UserListPath) {
     Normalize-ActivityWatchUsers -Users $Users -UserListPath $UserListPath -Domain $Domain
@@ -125,6 +142,7 @@ $config = New-ActivityWatchDeploymentConfig `
     -LogsRoot $effectiveLogsRoot `
     -CollectorScript $effectiveCollector `
     -EndpointCollectorScript $effectiveEndpointCollector `
+    -PolicyClientScript $effectivePolicyClientScript `
     -EmailCollectorScript $assetResult.EmailCollectorScript `
     -FileCollectorScript $effectiveFileCollector `
     -SessionCollectorScript $effectiveSessionCollector `
@@ -142,6 +160,13 @@ $config = New-ActivityWatchDeploymentConfig `
     -IncidentArtifactsRoot $effectiveIncidentArtifactsRoot `
     -LogonMarkerEnabled $effectiveLogonMarkerEnabled `
     -AwHostname $effectiveAwHostname `
+    -PolicyMode $effectivePolicyMode `
+    -PolicyEngineEnabled $effectivePolicyEngineEnabled `
+    -PolicyEngineHost $effectivePolicyEngineHost `
+    -PolicyEnginePort $effectivePolicyEnginePort `
+    -PolicyEngineScheme $effectivePolicyEngineScheme `
+    -PolicyRefreshSeconds $effectivePolicyRefreshSeconds `
+    -PolicyCachePath $effectivePolicyCachePath `
     -LaunchScriptPath $effectiveLaunchScript `
     -RecoveryScriptPath $effectiveRecoveryScript `
     -UserTasks $taskDefinitions `