feat(dlp): implement SIEM/SOAR integrations (CEF, webhook, syslog, systemd timers)

ansible/deploy_aw_server.yml

@@ -385,6 +385,99 @@
             virtualenv: /opt/activitywatch/dlp-content-analysis/.venv
           when: aw_dlp_content_analysis_enabled | default(true) | bool
 
+        - name: Создать каталог DLP integrations
+          ansible.builtin.file:
+            path: /opt/activitywatch/dlp-integrations
+            state: directory
+            owner: "{{ aw_server_user }}"
+            group: "{{ aw_server_group }}"
+            mode: "0755"
+          when: aw_dlp_integrations_enabled | default(true) | bool
+
+        - name: Скопировать файлы DLP integrations
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/aw-server/dlp-integrations/{{ item }}"
+            dest: "/opt/activitywatch/dlp-integrations/{{ item }}"
+            owner: "{{ aw_server_user }}"
+            group: "{{ aw_server_group }}"
+            mode: "0644"
+          loop:
+            - cef_exporter.py
+            - webhook_sender.py
+            - cef-config.yaml
+            - webhook-config.yaml
+            - requirements.txt
+          when: aw_dlp_integrations_enabled | default(true) | bool
+
+        - name: Выставить executable для python scripts DLP integrations
+          ansible.builtin.file:
+            path: "/opt/activitywatch/dlp-integrations/{{ item }}"
+            owner: "{{ aw_server_user }}"
+            group: "{{ aw_server_group }}"
+            mode: "0755"
+          loop:
+            - cef_exporter.py
+            - webhook_sender.py
+          when: aw_dlp_integrations_enabled | default(true) | bool
+
+        - name: Создать virtualenv DLP integrations
+          ansible.builtin.command:
+            cmd: python3 -m venv /opt/activitywatch/dlp-integrations/.venv
+          args:
+            creates: /opt/activitywatch/dlp-integrations/.venv/bin/python
+          when: aw_dlp_integrations_enabled | default(true) | bool
+
+        - name: Установить зависимости DLP integrations
+          ansible.builtin.pip:
+            requirements: /opt/activitywatch/dlp-integrations/requirements.txt
+            virtualenv: /opt/activitywatch/dlp-integrations/.venv
+          when: aw_dlp_integrations_enabled | default(true) | bool
+
+        - name: Создать state каталог DLP integrations
+          ansible.builtin.file:
+            path: /var/lib/activitywatch/dlp-integrations
+            state: directory
+            owner: "{{ aw_server_user }}"
+            group: "{{ aw_server_group }}"
+            mode: "0755"
+          when: aw_dlp_integrations_enabled | default(true) | bool
+
+        - name: Установить systemd unit CEF exporter
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/aw-server/dlp-integrations/cef-exporter.service"
+            dest: /etc/systemd/system/aw-dlp-cef-exporter.service
+            owner: root
+            group: root
+            mode: "0644"
+          when: aw_dlp_integrations_enabled | default(true) | bool
+
+        - name: Установить systemd timer CEF exporter
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/aw-server/dlp-integrations/cef-exporter.timer"
+            dest: /etc/systemd/system/aw-dlp-cef-exporter.timer
+            owner: root
+            group: root
+            mode: "0644"
+          when: aw_dlp_integrations_enabled | default(true) | bool
+
+        - name: Установить systemd unit webhook sender
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/aw-server/dlp-integrations/webhook-sender.service"
+            dest: /etc/systemd/system/aw-dlp-webhook-sender.service
+            owner: root
+            group: root
+            mode: "0644"
+          when: aw_dlp_integrations_enabled | default(true) | bool
+
+        - name: Установить systemd timer webhook sender
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/aw-server/dlp-integrations/webhook-sender.timer"
+            dest: /etc/systemd/system/aw-dlp-webhook-sender.timer
+            owner: root
+            group: root
+            mode: "0644"
+          when: aw_dlp_integrations_enabled | default(true) | bool
+
         - name: Установить скрипт AW worktime API
           ansible.builtin.copy:
             src: "{{ aw_repo_root }}/aw-server/aw-worktime-api.py"
@@ -468,6 +561,20 @@
             state: restarted
           when: aw_dlp_policy_engine_enabled | default(false) | bool
 
+        - name: Включить и перезапустить timer CEF exporter
+          ansible.builtin.systemd:
+            name: aw-dlp-cef-exporter.timer
+            enabled: true
+            state: restarted
+          when: aw_dlp_integrations_enabled | default(true) | bool
+
+        - name: Включить и перезапустить timer webhook sender
+          ansible.builtin.systemd:
+            name: aw-dlp-webhook-sender.timer
+            enabled: true
+            state: restarted
+          when: aw_dlp_integrations_enabled | default(true) | bool
+
         - name: Включить и перезапустить AW worktime API
           ansible.builtin.systemd:
             name: aw-worktime-api.service

ansible/deploy_dlp_full_stack.yml

@@ -8,3 +8,5 @@
   gather_facts: false
   roles:
     - role: dlp-policy-engine
+    - role: dlp-content-analysis
+    - role: dlp-integrations

ansible/group_vars/all.example.yml

@@ -40,4 +40,6 @@ aw_dlp_policy_engine_enabled: true
 aw_dlp_policy_engine_bind_host: "0.0.0.0"
 aw_dlp_policy_engine_port: 5601
 aw_dlp_policy_engine_db_path: "{{ aw_server_data_dir }}/dlp-policy-engine.sqlite"
+aw_dlp_content_analysis_enabled: true
+aw_dlp_integrations_enabled: true
 aw_server_post_deploy_health_check_enabled: true

ansible/group_vars/all.yml

@@ -31,6 +31,8 @@ aw_dlp_policy_engine_enabled: true
 aw_dlp_policy_engine_bind_host: "0.0.0.0"
 aw_dlp_policy_engine_port: 5601
 aw_dlp_policy_engine_db_path: "{{ aw_server_data_dir }}/dlp-policy-engine.sqlite"
+aw_dlp_content_analysis_enabled: true
+aw_dlp_integrations_enabled: true
 aw_server_post_deploy_health_check_enabled: true
 
 aw_worktime_from: "08:00"

ansible/roles/dlp-integrations/tasks/main.yml

@@ -0,0 +1,77 @@
+---
+- name: Ensure DLP integrations directory
+  ansible.builtin.file:
+    path: /opt/activitywatch/dlp-integrations
+    state: directory
+    owner: "{{ aw_server_user | default('activitywatch') }}"
+    group: "{{ aw_server_group | default('activitywatch') }}"
+    mode: "0755"
+
+- name: Copy DLP integrations files
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../aw-server/dlp-integrations/{{ item }}"
+    dest: "/opt/activitywatch/dlp-integrations/{{ item }}"
+    owner: "{{ aw_server_user | default('activitywatch') }}"
+    group: "{{ aw_server_group | default('activitywatch') }}"
+    mode: "0644"
+  loop:
+    - cef_exporter.py
+    - webhook_sender.py
+    - cef-config.yaml
+    - webhook-config.yaml
+    - requirements.txt
+
+- name: Make DLP integrations scripts executable
+  ansible.builtin.file:
+    path: "/opt/activitywatch/dlp-integrations/{{ item }}"
+    owner: "{{ aw_server_user | default('activitywatch') }}"
+    group: "{{ aw_server_group | default('activitywatch') }}"
+    mode: "0755"
+  loop:
+    - cef_exporter.py
+    - webhook_sender.py
+
+- name: Create venv for DLP integrations
+  ansible.builtin.command:
+    cmd: python3 -m venv /opt/activitywatch/dlp-integrations/.venv
+  args:
+    creates: /opt/activitywatch/dlp-integrations/.venv/bin/python
+
+- name: Install Python dependencies for DLP integrations
+  ansible.builtin.pip:
+    requirements: /opt/activitywatch/dlp-integrations/requirements.txt
+    virtualenv: /opt/activitywatch/dlp-integrations/.venv
+
+- name: Ensure integrations state directory
+  ansible.builtin.file:
+    path: /var/lib/activitywatch/dlp-integrations
+    state: directory
+    owner: "{{ aw_server_user | default('activitywatch') }}"
+    group: "{{ aw_server_group | default('activitywatch') }}"
+    mode: "0755"
+
+- name: Install systemd units/timers for DLP integrations
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../aw-server/dlp-integrations/{{ item.src }}"
+    dest: "{{ item.dest }}"
+    owner: root
+    group: root
+    mode: "0644"
+  loop:
+    - { src: "cef-exporter.service", dest: "/etc/systemd/system/aw-dlp-cef-exporter.service" }
+    - { src: "cef-exporter.timer", dest: "/etc/systemd/system/aw-dlp-cef-exporter.timer" }
+    - { src: "webhook-sender.service", dest: "/etc/systemd/system/aw-dlp-webhook-sender.service" }
+    - { src: "webhook-sender.timer", dest: "/etc/systemd/system/aw-dlp-webhook-sender.timer" }
+
+- name: Reload systemd
+  ansible.builtin.systemd:
+    daemon_reload: true
+
+- name: Enable and restart DLP integration timers
+  ansible.builtin.systemd:
+    name: "{{ item }}"
+    enabled: true
+    state: restarted
+  loop:
+    - aw-dlp-cef-exporter.timer
+    - aw-dlp-webhook-sender.timer