Commit Graph

9 Commits

Author SHA1 Message Date
user
546570d21b fix: mount secrets volume for flaskpaste mTLS certs 2026-02-16 23:15:10 +01:00
user
7698d079f2 fix: switch to k8s-file log driver for reliable log capture
journald was dropping early startup logs. k8s-file writes directly
to disk, captures from process start, and is lighter on the Pi.
Capped at 10 MB with automatic rotation.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-15 21:40:53 +01:00
user
b973635445 fix: route SearXNG direct via static route, drop proxy
SearXNG instance at 192.168.122.119 is reachable via grokbox
static route -- no need to tunnel through SOCKS5. Reverts searx
and alert plugins to stdlib urlopen for SearXNG queries. YouTube
and Twitch in alert.py still use the proxy. Also removes cprofile
flag from docker-compose command.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-15 17:52:43 +01:00
user
6e591a85b2 fix: use host networking for container proxy access
Bridge networking can't reach the host's loopback. Switch to
network_mode: host so the container shares the host network stack
and can reach the SOCKS5 proxy at 127.0.0.1:1080. Revert proxy
address back to 127.0.0.1.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-15 16:46:24 +01:00
user
7520bba192 fix: mount src and data volumes in container targets
Bind-mount src/ and data/ alongside plugins/ and config so the
container picks up code changes without rebuilding. Update Makefile
targets, compose file, and INSTALL.md to match.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-15 16:11:59 +01:00
user
ee68e77157 refactor: mount source and plugins instead of baking into image
Containerfile now installs only dependencies (maxminddb). Source
code, plugins, and config are volume-mounted via docker-compose.
Code changes no longer require an image rebuild.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-15 03:49:09 +01:00
user
f96224afb1 feat: add admin/owner permission system
Hostmask-based admin controls with automatic IRCOP detection via WHO.
Permission enforcement in the central dispatch path denies restricted
commands to non-admins. Includes !whoami and !admins commands, marks
load/reload/unload as admin-only.

Also lands previously-implemented SASL PLAIN auth, token-bucket rate
limiting, and CTCP VERSION/TIME/PING responses that were staged but
uncommitted.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-15 02:26:27 +01:00
user
36b21e2463 feat: concurrent command dispatch and profiling test client
Replace sequential await in command/event dispatch with
asyncio.create_task() so slow commands (whois, httpcheck, tlscheck)
no longer block the read loop. Add _spawn() for task lifecycle
tracking. Enable cProfile in docker-compose for profiling. Add
scripts/test_client.py for end-to-end plugin testing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-15 02:09:53 +01:00
user
c5b0430da8 docs: add podman-compose, update all project documentation
- docker-compose.yml for podman-compose deployment
- Makefile: add up/down/logs compose targets
- README: plugin table, container quickstart, make targets
- PROJECT: plugin categories, deployment matrix, design decisions
- ROADMAP: v0.1 done, v0.2 current, v0.3-v1.0 planned
- TASKS: current sprint with priorities
- TODO: full backlog organized by wave
- CHEATSHEET: reorganized by category (OSINT, Red Team, OPSEC)
- INSTALL: container deployment instructions
- DEBUG: container logs, hot-reload, DNS troubleshooting
- USAGE: all 19 commands documented

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-15 01:46:21 +01:00