fix(windows): disable outlook popup and enforce smtp-only email monitoring

ansible/deploy_aw_server.yml

@@ -20,6 +20,7 @@
       ansible.builtin.apt:
         name:
           - curl
+          - python3-venv
           - rsync
           - unzip
         state: present
@@ -298,9 +299,58 @@
               AW_WORKTIME_REPORT_BASE={{ aw_worktime_report_base }}
               AW_WORKTIME_TZ={{ aw_worktime_timezone }}
               AW_DLP_IOC_DIR={{ aw_dlp_ioc_workdir }}/output
+              AW_DLP_POLICY_ENGINE_BIND_HOST={{ aw_dlp_policy_engine_bind_host }}
+              AW_DLP_POLICY_ENGINE_PORT={{ aw_dlp_policy_engine_port }}
+              AW_DLP_POLICY_ENGINE_DB_PATH={{ aw_dlp_policy_engine_db_path }}
               XDG_DATA_HOME={{ aw_server_data_dir }}/.local/share
               XDG_CONFIG_HOME={{ aw_server_data_dir }}/.config
 
+        - name: Создать каталог DLP policy engine
+          ansible.builtin.file:
+            path: /opt/activitywatch/dlp-policy-engine
+            state: directory
+            owner: "{{ aw_server_user }}"
+            group: "{{ aw_server_group }}"
+            mode: "0755"
+          when: aw_dlp_policy_engine_enabled | default(false) | bool
+
+        - name: Скопировать файлы DLP policy engine
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/aw-server/dlp-policy-engine/{{ item }}"
+            dest: "/opt/activitywatch/dlp-policy-engine/{{ item }}"
+            owner: "{{ aw_server_user }}"
+            group: "{{ aw_server_group }}"
+            mode: "0644"
+          loop:
+            - policy_service.py
+            - policy_schema.py
+            - policy_storage.py
+            - policy_distributor.py
+            - requirements.txt
+          when: aw_dlp_policy_engine_enabled | default(false) | bool
+
+        - name: Создать virtualenv DLP policy engine
+          ansible.builtin.command:
+            cmd: python3 -m venv /opt/activitywatch/dlp-policy-engine/.venv
+          args:
+            creates: /opt/activitywatch/dlp-policy-engine/.venv/bin/python
+          when: aw_dlp_policy_engine_enabled | default(false) | bool
+
+        - name: Установить зависимости DLP policy engine
+          ansible.builtin.pip:
+            requirements: /opt/activitywatch/dlp-policy-engine/requirements.txt
+            virtualenv: /opt/activitywatch/dlp-policy-engine/.venv
+          when: aw_dlp_policy_engine_enabled | default(false) | bool
+
+        - name: Установить systemd unit DLP policy engine
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/aw-server/dlp-policy-engine/dlp-policy-engine.service"
+            dest: /etc/systemd/system/aw-dlp-policy-engine.service
+            owner: root
+            group: root
+            mode: "0644"
+          when: aw_dlp_policy_engine_enabled | default(false) | bool
+
         - name: Установить скрипт AW worktime API
           ansible.builtin.copy:
             src: "{{ aw_repo_root }}/aw-server/aw-worktime-api.py"
@@ -345,6 +395,13 @@
           ansible.builtin.systemd:
             daemon_reload: true
 
+        - name: Включить и перезапустить DLP policy engine
+          ansible.builtin.systemd:
+            name: aw-dlp-policy-engine.service
+            enabled: true
+            state: restarted
+          when: aw_dlp_policy_engine_enabled | default(false) | bool
+
         - name: Включить и перезапустить AW worktime API
           ansible.builtin.systemd:
             name: aw-worktime-api.service

ansible/deploy_aw_windows.yml

@@ -25,6 +25,12 @@
     aw_windows_users_effective: "{{ (aw_windows_users + aw_windows_extra_users) | unique }}"
     aw_windows_install_root: "C:\\Program Files\\AWatch-rus\\bin"
     aw_windows_state_root: "C:\\ProgramData\\AWatch-rus"
+    aw_windows_policy_mode: "local"
+    aw_windows_policy_refresh_seconds: 300
+    aw_windows_policy_engine_enabled: false
+    aw_windows_policy_engine_host: "{{ aw_windows_server_host }}"
+    aw_windows_policy_engine_port: 5601
+    aw_windows_policy_engine_scheme: "http"
     aw_windows_afk_enabled: true
     aw_windows_window_enabled: true
     aw_windows_file_ops_enabled: true
@@ -83,6 +89,7 @@
         - ActivityWatch.Windows.Common.psm1
         - browser-domains-native-collector.ps1
         - dlp-endpoint-signals-collector.ps1
+        - dlp-policy-client.ps1
         - email-outbound-collector.ps1
         - file-operations-collector.ps1
         - worktime-session-collector.ps1
@@ -156,6 +163,12 @@
             IncidentScreenshotEnabled = {{ '$true' if (aw_windows_incident_screenshot_enabled | bool) else '$false' }}
             IncidentArtifactsRoot = "{{ aw_windows_incident_artifacts_root }}"
             LogonMarkerEnabled = {{ '$true' if (aw_windows_logon_marker_enabled | bool) else '$false' }}
+            PolicyMode = "{{ aw_windows_policy_mode }}"
+            PolicyEngineEnabled = {{ '$true' if (aw_windows_policy_engine_enabled | bool) else '$false' }}
+            PolicyEngineHost = "{{ aw_windows_policy_engine_host }}"
+            PolicyEnginePort = {{ aw_windows_policy_engine_port }}
+            PolicyEngineScheme = "{{ aw_windows_policy_engine_scheme }}"
+            PolicyRefreshSeconds = {{ aw_windows_policy_refresh_seconds }}
             CustomRulesPath = "{{ aw_windows_rules_path }}"
             CustomPolicyPath = "{{ aw_windows_policy_path }}"
           }
@@ -171,6 +184,9 @@
           {% if aw_windows_skip_hardening | bool %}
           $params.SkipHardening = $true
           {% endif %}
+          {% if aw_windows_integration_test_enabled | bool %}
+          $params.IntegrationTestEnabled = $true
+          {% endif %}
           & "{{ aw_windows_deploy_root }}\windows\deploy-ensemble.ps1" @params
 
     - name: Удалить лишние ActivityWatch Launch tasks вне текущего deployment-config
@@ -346,7 +362,7 @@
       ansible.builtin.shell: |
         python3 - <<'PY'
         import json, sys
-        with open('{{ aw_windows_validation_local_dir }}/{{ inventory_hostname }}-aw_validate_ansible.json', 'r') as f:
+        with open('{{ aw_windows_validation_local_dir }}/{{ inventory_hostname }}-aw_validate_ansible.json', 'r', encoding='utf-8-sig') as f:
             data = json.load(f)
         if not data.get('overallOk', False):
             print(f"Validation failed for {{ inventory_hostname }}: {data.get('summary', 'Unknown error')}")

ansible/group_vars/all.example.yml

@@ -35,3 +35,8 @@ aw_worktime_to: "17:00"
 aw_worktime_start_of_day: "{{ aw_worktime_from }}"
 aw_server_always_active_pattern: "aw-watcher-window"
 aw_server_landingpage: "/activity/SHARKON2025/view/"
+
+aw_dlp_policy_engine_enabled: true
+aw_dlp_policy_engine_bind_host: "0.0.0.0"
+aw_dlp_policy_engine_port: 5601
+aw_dlp_policy_engine_db_path: "{{ aw_server_data_dir }}/dlp-policy-engine.sqlite"

ansible/group_vars/all.yml

@@ -27,6 +27,10 @@ aw_dlp_ioc_workdir: "/opt/activitywatch/dlp-ioc"
 aw_dlp_ioc_rules_zip_url: "https://github.com/Yamato-Security/hayabusa-rules/archive/refs/heads/main.zip"
 aw_dlp_ioc_refresh_on_boot_sec: "5min"
 aw_dlp_ioc_refresh_interval: "6h"
+aw_dlp_policy_engine_enabled: true
+aw_dlp_policy_engine_bind_host: "0.0.0.0"
+aw_dlp_policy_engine_port: 5601
+aw_dlp_policy_engine_db_path: "{{ aw_server_data_dir }}/dlp-policy-engine.sqlite"
 
 aw_worktime_from: "08:00"
 aw_worktime_to: "17:00"

ansible/group_vars/aw_server.yml

@@ -7,3 +7,12 @@ ansible_become: true
 ansible_become_method: sudo
 # If sudo password differs, set AW_SUDO_PASSWORD. Otherwise it will reuse AW_SSH_PASSWORD.
 ansible_become_password: "{{ lookup('env', 'AW_SUDO_PASSWORD') | default(lookup('env', 'AW_SSH_PASSWORD'), true) }}"
+
+# Hayabusa IOC refresh settings (backward compatible - defaults to disabled)
+aw_hayabusa_ioc_refresh_enabled: false
+aw_hayabusa_rules_root: "/mnt/usb_hdd1/Projects/hayabusa/rules"
+aw_hayabusa_ioc_output_dir: "{{ aw_server_data_dir }}/dlp-ioc"
+aw_dlp_policy_engine_enabled: true
+aw_dlp_policy_engine_bind_host: "0.0.0.0"
+aw_dlp_policy_engine_port: 5601
+aw_dlp_policy_engine_db_path: "{{ aw_server_data_dir }}/dlp-policy-engine.sqlite"

ansible/group_vars/aw_windows.yml

@@ -25,6 +25,12 @@ aw_windows_extra_users: []
 aw_windows_install_root: "C:\\Program Files\\AWatch-rus\\bin"
 aw_windows_state_root: "C:\\ProgramData\\AWatch-rus"
 aw_windows_hostname_override: ""
+aw_windows_policy_mode: "local"
+aw_windows_policy_refresh_seconds: 300
+aw_windows_policy_engine_enabled: false
+aw_windows_policy_engine_host: "{{ aw_windows_server_host }}"
+aw_windows_policy_engine_port: 5601
+aw_windows_policy_engine_scheme: "http"
 
 aw_windows_afk_enabled: true
 aw_windows_window_enabled: true
@@ -53,3 +59,6 @@ aw_windows_migration_report_remote_path: "{{ aw_windows_state_root }}\\aw_migrat
 aw_windows_api_smoke_check_enabled: true
 aw_windows_api_smoke_check_bucket: ""
 aw_windows_api_smoke_check_limit: 10
+
+# Integration test settings (backward compatible - defaults to disabled)
+aw_windows_integration_test_enabled: false