Commit Graph
13 Commits
Author SHA1 Message Date
zwitschi 7f392ef908 chore(data): stop tracking runtime-refreshed whitelist seeds
The Cloudflare ips-v4/v6.txt and paloalto/.gitkeep were git-tracked. The
Cloudflare files are overwritten at runtime by every whitelist refresh, so on
a deployed server they become locally-modified tracked files that make 'git pull'
conflict. Keep the read-only paloalto/scanner-ips.txt seed tracked; ignore the
rest (they are re-downloaded if absent; built-in ranges are the fallback).
2026-10-24 19:50:39 +02:00
zwitschi 6036fa8b1e feat: Implement SQLite schema and migrations for intrusion detection system
- Added schema definition and migration logic in app/db/schema.py.
- Created tables for log sources, requests, IP stats, scans, blocklist, whitelist, and firewall rules.
- Introduced functions to apply migrations and ensure database integrity.

feat: Enhance scan functionality with database integration

- Added _sync_blocklist_to_db function to synchronize blocklist with SQLite.
- Updated run_scan function to handle database connections and scan records.
- Implemented error handling for database operations during scans.

feat: Introduce log analysis page and API endpoints

- Created analysis.html template for displaying log analysis results.
- Added routes for fetching top IPs, IP request timelines, and cross-source IPs.
- Integrated analysis data into the dashboard and status endpoints.

fix: Ensure whitelists are synchronized with the database

- Implemented sync_whitelists_to_db function to persist in-memory whitelists.
- Updated constants.py to define the path for the SQLite database.

refactor: Modularize analysis helpers for better maintainability

- Created _analysis_helpers function to encapsulate SQLite query logic.
- Updated routes.py to utilize new analysis helper functions for API responses.
2026-10-24 19:48:20 +02:00
zwitschi 4ba40dfef2 chore: allow re-including Cloudflare and PaloAlto whitelist seeds in app/data 2026-09-12 14:04:57 +02:00
zwitschi 880877ee0f chore: add .mypy_cache and .venv to gitignore 2026-09-12 14:01:31 +02:00
zwitschi 2fda2d817f chore: consolidate gitignore paths to app/data and app/reports 2026-09-12 13:48:56 +02:00
zwitschi c2eba88ac8 Refactor web_scan.py for improved readability and maintainability; add cron job script for npm log backups; update start.ps1 for consistent formatting. 2026-09-08 19:49:11 +02:00
zwitschi 41230ce04c feat: update blocklist with newly detected IPs 2026-08-06 14:58:55 +02:00
zwitschi 80a67635de feat: write timestamped blocklist change reports on firewall sync 2026-08-06 14:31:15 +02:00
zwitschi 51f57f7a04 feat: add incremental log scanning with resumable byte offsets
Track last processed byte offset per log file so scans only read new
entries, add --full flag to force a rescan, and persist state atomically.
2026-08-05 21:41:00 +02:00
zwitschi 0e2c69579a Remove MikroTik block list script and enhance scan.py for firewall synchronization
- Deleted the existing MikroTik block list script (mikrotik-block.rsc) which contained whitelisted and blocked IP addresses.
- Updated scan.py to include options for synchronizing the MikroTik blocked list after scanning.
- Added functionality to preview firewall changes without applying them.
- Integrated the MikrotikFirewall class to manage the synchronization of blocked IPs with the MikroTik device.
2026-08-04 18:38:08 +02:00
zwitschi 970e1b5eed adjust paths for reports data 2026-08-03 16:39:47 +02:00
zwitschi 42d786b0a2 Move WHOIS cache to data directory and update .gitignore to ignore report directories 2026-08-03 16:39:11 +02:00
zwitschi 15019de3d8 Initial commit: intrusion detection system for copyparty and NPM proxy logs with MikroTik blocklist export 2026-08-03 16:34:45 +02:00