Enhance log sniffing features with AI analysis and REST API

.env.sample

@@ -1,2 +1,138 @@
-APP_HOST=localhost
-APP_PORT=5000
+# Stackdog configuration.
+# Copy to .env in the working directory, or to ~/.config/stackdog/.env
+# (`stackdog init` writes this file there). Real environment variables and
+# the nearer file win; everything here is optional and defaults are safe.
+
+#APP_HOST=localhost
+# in container
+APP_HOST=0.0.0.0
+
+APP_PORT=5000
+DATABASE_URL=stackdog.db
+RUST_BACKTRACE=full
+
+# Log Sniff Configuration
+#STACKDOG_LOG_SOURCES=/var/log/syslog,/var/log/auth.log,/var/log/nginx/access.log
+#STACKDOG_SNIFF_INTERVAL=30
+#STACKDOG_SNIFF_OUTPUT_DIR=./stackdog-logs/
+#STACKDOG_SERVE_SNIFF_ENABLED=true
+
+# AI Provider Configuration
+# Supports OpenAI, Ollama (http://localhost:11434/v1), or any OpenAI-compatible API
+# `stackdog serve` defaults to the local pattern analyzer unless you override this.
+#STACKDOG_AI_PROVIDER=openai
+#STACKDOG_AI_API_URL=http://localhost:11434/v1
+#STACKDOG_AI_API_KEY=
+#STACKDOG_AI_MODEL=llama3
+
+# How long the same finding stays suppressed before it alerts again (seconds).
+# Default 21600 (6h). Standing misconfigurations are re-detected every pass, so
+# a short window means the same alert all day.
+#STACKDOG_ALERT_DEDUP_WINDOW_SECS=21600
+
+# Dashboard base URL. When set, every notification carries a link straight to
+# the alert (<url>/#alerts/{id}). Point it at the UI container, not the API.
+#STACKDOG_UI_URL=https://stackdog.example.com
+
+# Notification Channels
+# Slack: create an incoming webhook at https://api.slack.com/messaging/webhooks
+#STACKDOG_SLACK_WEBHOOK_URL=https://hooks.slack.com/services/T.../B.../xxxxx
+# Slack sender identity. Only honored by legacy custom-integration webhooks or a
+# bot token with chat:write.customize; Slack-app webhooks use the app's own name
+# and icon, which you set under Basic Information > Display Information.
+#STACKDOG_SLACK_USERNAME=Stackdog
+# Defaults to https://stackdog.app/stackdog-mark.png, falling back to the
+# GitHub raw copy if that host does not answer. Setting this skips the probe.
+#STACKDOG_SLACK_ICON_URL=https://stackdog.app/stackdog-mark.png
+# Discord: create an incoming webhook in your channel settings
+# (Edit Channel > Integrations > Webhooks). Alerts arrive as plain messages
+# under the webhook's own name and avatar; Discord allows 2000 characters,
+# longer alerts are truncated to fit.
+#STACKDOG_DISCORD_WEBHOOK_URL=https://discord.com/api/webhooks/.../...
+# Telegram: create a bot with @BotFather, invite it to a channel or group, and
+# set both values. Alerts only — action notifications (bans, quarantines) are
+# not sent to Telegram. Telegram allows 4096 characters per message; longer
+# alerts are truncated to fit.
+#STACKDOG_TELEGRAM_BOT_TOKEN=123456789:AAF...
+#STACKDOG_TELEGRAM_CHAT_ID=-1001234567890
+# Generic webhook endpoint for alert notifications
+#STACKDOG_WEBHOOK_URL=https://example.com/webhook
+#STACKDOG_SMTP_HOST=smtp.example.com
+#STACKDOG_SMTP_PORT=587
+#STACKDOG_SMTP_USER=alerts@example.com
+#STACKDOG_SMTP_PASSWORD=secret
+#STACKDOG_EMAIL_RECIPIENTS=soc@example.com,oncall@example.com
+# Identity shown as "Instance" in notifications — say which host sent the
+# alert. Falls back to the machine hostname when unset; set this explicitly
+# for stable names in a fleet.
+#STACKDOG_NOTIFICATION_LABEL=prod-eu-1
+#STACKDOG_NOTIFICATION_MIN_SEVERITY=critical
+#
+# Action notification toggles
+#STACKDOG_NOTIFY_IP_BAN_ACTIONS=true
+
+# Never ban these, whatever the logs say. Comma-separated, bare addresses or
+# CIDR notation. Put load balancers, health checkers and VPN gateways here:
+# banning them takes the service down with them. Empty by default.
+#STACKDOG_IP_BAN_ALLOWLIST=167.233.9.19,10.0.0.0/8
+# Ceiling on blocks per minute. A burst is far more often a misread log than a
+# crowd of attackers; the ceiling caps the damage. 0 disables it.
+#STACKDOG_IP_BAN_MAX_PER_MINUTE=10
+# Whether findings written by the AI analyzer may trigger a ban. Detector-backed
+# findings are unaffected. Set to false to ban only on deterministic detectors.
+#STACKDOG_IP_BAN_FROM_AI_FINDINGS=true
+# Never ban addresses of this host or its containers (interface addresses, docker
+# network subnets). A DROP rule for one of those severs the service from itself.
+# Off only to block a local address deliberately.
+#STACKDOG_IP_BAN_PROTECT_LOCAL_IPS=true
+#STACKDOG_NOTIFY_QUARANTINE_ACTIONS=true
+
+# Mail abuse guard. The traffic heuristic alone matches ordinary HTTP/JSON
+# chatter between microservices, so quarantine (a network disconnect) requires
+# observed SMTP egress (ports 25/465/587 in the conntrack table) on top of it.
+# A match without SMTP evidence is an alert. Set to false to quarantine on the
+# traffic heuristic alone.
+#STACKDOG_MAIL_GUARD_REQUIRE_SMTP=true
+
+# PHP shell detection. Scans PHP files in web roots for webshell code and
+# watches access logs for requests to them. A flagged file is an alert; a
+# request that drives a shell (POST to PHP under an uploads/ URL, parameters
+# sent to a flagged file) feeds the IP ban like any other detector finding.
+# false turns off both the scan and the access-log detector.
+#STACKDOG_PHPSHELL_ENABLED=true
+# Host web roots to scan. Containers are found on their own (see below).
+#STACKDOG_PHPSHELL_PATHS=/var/www
+# Container name/image fragments that mark a PHP workload. Any container with
+# something mounted at /var/www, /srv, /app or /usr/share/nginx/html is scanned
+# as well, whatever its name.
+#STACKDOG_PHPSHELL_CONTAINERS=php,wordpress,drupal,joomla,laravel,magento,apache,httpd
+# Where the host filesystem is mounted when Stackdog runs in a container
+# (- /:/host:ro). Needed to read host paths and container docroots.
+#STACKDOG_HOST_ROOT=/host
+#STACKDOG_PHPSHELL_SKIP_DIRS=vendor,node_modules,.git
+#STACKDOG_PHPSHELL_MAX_FILE_BYTES=2097152
+# Extra signatures, JSON: [{"id","description","pattern","weight":"strong|medium|weak"}]
+#STACKDOG_PHPSHELL_SIGNATURES=/etc/stackdog/php-shell-signatures.json
+# PHP2Shell (CVE-2026-109618, CVE-2026-109619): alert on PHP builds older than
+# the fixed releases, on the host and in running containers. Alert only.
+#STACKDOG_PHP_VERSION_CHECK_ENABLED=true
+# SSHole (CVE-2026-123158): flag OpenSSH builds older than 10.6p2 on musl
+# systems (Alpine's default sshd is the vulnerable configuration), and ban
+# password logins to key-only accounts. That login line is what a successful
+# SSHole attack leaves behind.
+#STACKDOG_SSHOLE_ENABLED=true
+# Accounts that should never accept a password login. Defaults to root,alpine.
+#STACKDOG_SSHOLE_KEYONLY_USERS=root,alpine
+# CVE watch: match every package on the host and in containers against the
+# public feeds (OSV + CISA's KEV catalog) and alert once per package and CVE.
+# Refreshed at least daily, which is what catches newly published CVEs.
+#STACKDOG_CVE_WATCH_ENABLED=true
+
+# ---------------------------------------------------------------------------
+# Dashboard container (docker-compose.yml / docker-compose.app.yml)
+# ---------------------------------------------------------------------------
+# Host:port a browser uses to reach the API. Read by the dashboard container at
+# start-up, so a restart is enough — no rebuild.
+#STACKDOG_API_HOST=192.0.2.10:5000
+# Port the dashboard is published on.
+#STACKDOG_UI_PORT=3000

.githooks/pre-commit

@@ -0,0 +1,18 @@
+#!/bin/sh
+set -e
+
+echo "🐕 Stackdog pre-commit: running cargo fmt..."
+cargo fmt --all -- --check || {
+    echo "❌ cargo fmt failed. Run 'cargo fmt --all' to fix."
+    exit 1
+}
+
+echo "🐕 Stackdog pre-commit: running cargo clippy..."
+cargo clippy 2>&1
+CLIPPY_EXIT=$?
+if [ $CLIPPY_EXIT -ne 0 ]; then
+    echo "❌ cargo clippy failed to compile. Fix errors before committing."
+    exit 1
+fi
+
+echo "✅ Pre-commit checks passed."

.github/copilot-instructions.md

@@ -0,0 +1,113 @@
+# Stackdog Security — Copilot Instructions
+
+## What This Project Is
+
+Stackdog is a Rust-based security platform for Docker containers and Linux servers. It collects events via eBPF syscall monitoring, runs them through a rule/signature engine and optional ML anomaly detection, manages firewall responses (nftables/iptables + container quarantine), and exposes a REST + WebSocket API consumed by a React/TypeScript dashboard.
+
+## Workspace Structure
+
+This is a Cargo workspace with two crates:
+- `.` — Main crate (`stackdog`): HTTP server, all security logic
+- `ebpf/` — Separate crate (`stackdog-ebpf`): eBPF programs compiled for the kernel (uses `aya-ebpf`)
+
+## Build, Test, and Lint Commands
+
+```bash
+# Build
+cargo build
+cargo build --release
+
+# Tests
+cargo test --lib                        # Unit tests only (in-source)
+cargo test --all                        # All tests including integration
+cargo test --lib -- events::            # Run tests for a specific module
+cargo test --lib -- rules::scorer       # Run a single test by name prefix
+
+# Code quality
+cargo fmt --all
+cargo clippy --all
+cargo audit                             # Dependency vulnerability scan
+
+# Benchmarks
+cargo bench
+
+# Frontend (in web/)
+npm test
+npm run lint
+npm run build
+```
+
+## Environment Setup
+
+Requires a `.env` file (copy `.env.sample`). Key variables:
+```
+APP_HOST=0.0.0.0
+APP_PORT=5000
+DATABASE_URL=stackdog.db
+RUST_BACKTRACE=full
+```
+
+System dependencies (Linux): `libsqlite3-dev libssl-dev clang llvm pkg-config`
+
+## Architecture
+
+```
+Collectors (Linux only)     Rule Engine          Response
+  eBPF syscall events   →   Signatures       →   nftables/iptables
+  Docker daemon events  →   Threat scoring   →   Container quarantine
+  Network events        →   ML anomaly det.  →   Alerting
+
+                         REST + WebSocket API
+                         React/TypeScript UI
+```
+
+**Key src/ modules:**
+
+| Module | Purpose |
+|---|---|
+| `events/` | Core event types: `SyscallEvent`, `SecurityEvent`, `NetworkEvent`, `ContainerEvent` |
+| `rules/` | Rule engine, signature database, threat scorer |
+| `alerting/` | `AlertManager`, notification channels (Slack/email/webhook) |
+| `collectors/` | eBPF loader, Docker daemon events, network collector (Linux only) |
+| `firewall/` | nftables management, iptables fallback, `QuarantineManager` (Linux only) |
+| `ml/` | Candle-based anomaly detection (optional `ml` feature) |
+| `correlator/` | Event correlation engine |
+| `baselines/` | Baseline learning for anomaly detection |
+| `database/` | SQLite connection pool (`r2d2` + raw `rusqlite`), repositories |
+| `api/` | actix-web REST endpoints + WebSocket |
+| `response/` | Automated response action pipeline |
+
+## Key Conventions
+
+### Platform-Gating
+Linux-only modules (`collectors`, `firewall`) and deps (aya, netlink) are gated:
+```rust
+#[cfg(target_os = "linux")]
+pub mod firewall;
+```
+The `ebpf` and `ml` features are opt-in and must be enabled explicitly:
+```bash
+cargo build --features ebpf
+cargo build --features ml
+```
+
+### Error Handling
+- Use `anyhow::{Result, Context}` for application/binary code
+- Use `thiserror` for library error types
+- Never use `.unwrap()` in production code; use `?` with `.context("...")`
+
+### Database
+The project uses raw `rusqlite` with `r2d2` connection pooling. `DbPool` is `r2d2::Pool<SqliteConnectionManager>`. Tables are created with `CREATE TABLE IF NOT EXISTS` in `database::connection::init_database`. Repositories are in `src/database/repositories/` and receive a `&DbPool`.
+
+### API Routes
+Each API sub-module exports a `configure_routes(cfg: &mut web::ServiceConfig)` function. All routes are composed in `api::configure_all_routes`, which is the single call site in `main.rs`.
+
+### Test Location
+- **Unit tests**: `#[cfg(test)] mod tests { ... }` inside source files
+- **Integration tests**: `tests/` directory at workspace root
+
+### eBPF Programs
+The `ebpf/` crate is compiled separately for the Linux kernel. User-space loading is handled by `src/collectors/ebpf/` using the `aya` library. Kernel-side programs use `aya-ebpf`.
+
+### Async Runtime
+The main binary uses `#[actix_rt::main]`. Library code uses `tokio`. Avoid mixing runtimes.

.github/workflows/codacy-analysis.yml

@@ -21,11 +21,11 @@ jobs:
     steps:
       # Checkout the repository to the GitHub Actions runner
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
 
       # Execute Codacy Analysis CLI and generate a SARIF output with the security issues identified during the analysis
       - name: Run Codacy Analysis CLI
-        uses: codacy/codacy-analysis-cli-action@2.0.1
+        uses: codacy/codacy-analysis-cli-action@4.0.0
         with:
           # Check https://github.com/codacy/codacy-analysis-cli#project-token to get your project token from your Codacy repository
           # You can also omit the token and run the tools that support default configurations
@@ -41,6 +41,6 @@ jobs:
 
       # Upload the SARIF file generated in the previous step
       - name: Upload SARIF results file
-        uses: github/codeql-action/upload-sarif@v1
+        uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: results.sarif

.github/workflows/discord-release.yml

@@ -0,0 +1,42 @@
+name: Discord Release
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      release_name:
+        description: Release title to post
+        required: true
+      release_body:
+        description: Release notes body to post
+        required: true
+      release_html_url:
+        description: Release URL to link in Discord
+        required: false
+
+permissions:
+  contents: read
+
+jobs:
+  notify-discord:
+    name: Post release to Discord
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: GitHub Releases to Discord
+        uses: SethCohen/github-releases-to-discord@v1
+        with:
+          webhook_url: ${{ secrets.DISCORD_WEBHOOK_URL }}
+          release_name: ${{ inputs.release_name }}
+          release_body: ${{ inputs.release_body }}
+          release_html_url: ${{ inputs.release_html_url }}
+          color: "2105893"
+          username: "Stackdog Releases"
+          content: ""
+          footer_title: "Changelog"
+          footer_timestamp: true
+          reduce_headings: true
+          remove_github_reference_links: true