DECNET/decnet at 32eeb0c813af93b6a86466874f05a1bc65d8dc71 - DECNET - RESACA Chile: Donde la ciberseguridad se chupa una chela.

anti/DECNET

Files

History

anti 32eeb0c813 refactor(orchestrator): collapse decnet-emailgen.service into orchestrator

Stage 5 of the realism migration. Email generation is no longer a
separate worker / systemd unit / CLI subcommand — the orchestrator's
single tick loop covers SSH traffic, file plants, and email drops.
Going from 21 services to 20.

Worker:
- _one_tick rolls between traffic / file / email (45/45/10 weights).
  The 10% email weight at a 60s orchestrator interval produces ~one
  email per 10 minutes, close to the pre-collapse 5-minute cadence.
- get_driver_for(action) (stage 4) handles SSH vs Email dispatch.
- Quiet branches fall through so a (decky-set, persona-pool,
  mail-decky) shape that silences one branch doesn't waste the tick.
- Periodic prune covers both orchestrator_events and
  orchestrator_emails tables.

Deletions:
- deploy/decnet-emailgen.service.j2
- decnet/orchestrator/emailgen/worker.py
- decnet/cli/emailgen.py
- tests/orchestrator/emailgen/test_worker_integration.py

Renames (history-preserving):
- decnet/web/router/emailgen/ -> decnet/web/router/realism/
- tests/api/emailgen/        -> tests/api/realism/
- tests/cli/test_emailgen_*  -> tests/cli/test_realism_*

Public surface changes (clean break, pre-v1):
- API URL /api/v1/emailgen/personas -> /api/v1/realism/personas
- CLI `decnet emailgen import-personas` -> `decnet realism
  import-personas`. `decnet emailgen run` is gone — the orchestrator
  covers it.
- gating.py: emailgen master-only group replaced by realism.
- decnet-orchestrator.service.j2: DECNET_REALISM_* env block added.
- decnet.target: decnet-emailgen.service entry removed.
- frontend: PersonaGeneration.tsx fetches /realism/personas.

2026-04-27 16:33:04 -04:00

..

feat(fleet): systemd unit + bus signal for fleet reconciler

2026-04-26 21:21:36 -04:00

feat(asn): IP→ASN enrichment via iptoasn.com bulk dump

2026-04-25 03:58:58 -04:00

feat(bus): canary token bus topics (placed/triggered/revoked)

2026-04-27 12:43:23 -04:00

feat(canary): mysql_dump generator with phone-home replica payload

2026-04-27 13:52:55 -04:00

refactor(orchestrator): collapse decnet-emailgen.service into orchestrator

2026-04-27 16:33:04 -04:00

test(clustering): full-bound passes through production campaign clusterer

2026-04-26 09:13:59 -04:00

fix(collector): label-based fleet container discovery

2026-04-25 08:11:21 -04:00

feat(correlation): credential-reuse engine + reuse-correlate worker

2026-04-26 03:37:49 -04:00

feat(deploy): seed canary baseline at deploy time + tests

2026-04-27 13:19:08 -04:00

feat(fleet): systemd unit + bus signal for fleet reconciler

2026-04-26 21:21:36 -04:00

feat(attackers): PTR record (reverse DNS) enrichment

2026-04-24 17:26:40 -04:00

refactor(intel): re-key attacker_intel on attacker_uuid (closes DEBT-041)

2026-04-26 05:35:29 -04:00

refactor: strip DECNET tokens from container-visible surface

2026-04-17 22:57:53 -04:00

fix(topology/allocator): widen default subnet base to /12 for mass-scale

2026-04-24 18:57:55 -04:00

feat(net): stealth-egress httpx client factory

2026-04-26 04:59:34 -04:00

refactor(orchestrator): collapse decnet-emailgen.service into orchestrator

2026-04-27 16:33:04 -04:00

feat(sniffer): ISN sequence classifier (reuses seq_class helper)

2026-04-26 20:30:24 -04:00

feat(sniffer): ISN sequence classifier (reuses seq_class helper)

2026-04-26 20:30:24 -04:00

feat(realism): synthetic_files table + planner wiring + scheduler swap

2026-04-27 16:22:07 -04:00

feat(creds): DEBT-040 Phase 3 — RDP NLA / CredSSP NTLMv2 capture

2026-04-25 07:42:52 -04:00

feat(sniffer): ISN sequence classifier (reuses seq_class helper)

2026-04-26 20:30:24 -04:00

feat(swarm): pin worker cert SHA-256 fingerprint per host

2026-04-25 03:01:15 -04:00

feat(templates): standalone NTLMSSP Type 3 parser + decnet-init wrapper

2026-04-27 10:12:30 -04:00

Revert "feat(mazenet): host resolution + cross-host bridge guard"

2026-04-25 03:26:19 -04:00

feat(agent,forwarder,updater): publish system.<worker>.health heartbeats (DEBT-031 workers 7-9)

2026-04-21 17:02:10 -04:00

feat(creds): cred-reuse foundation + vectorstore scaffold

2026-04-26 03:18:34 -04:00

refactor(orchestrator): collapse decnet-emailgen.service into orchestrator

2026-04-27 16:33:04 -04:00

fix(webhook/worker): self-heal when bus starts late or restarts

2026-04-24 16:39:38 -04:00

__init__.py

feat(env): run decnet.ini loader at package import; expose DECNET_MODE

2026-04-19 03:17:25 -04:00

archetypes.py

refactor(ssh): consolidate real_ssh into ssh, remove duplication

2026-04-11 19:51:41 -04:00

composer.py

fix(collector): label-based fleet container discovery

2026-04-25 08:11:21 -04:00

config_ini.py

feat(config): promote /etc/decnet/decnet.ini to real config with domain sections

2026-04-23 18:21:00 -04:00

config.py

fix(logging): don't crash the process if the system log can't be opened

2026-04-24 01:00:42 -04:00

custom_service.py

Add per-service customization, stealth hardening, and BYOS support

2026-04-04 04:08:27 -03:00

distros.py

fix: stabilize tests with synchronous DB init and handle Bandit security findings

2026-04-09 01:33:15 -04:00

env.py

fix(api): gate embedded Docker-log collector on DECNET_EMBED_COLLECTOR

2026-04-24 00:47:37 -04:00

ini_loader.py

fix: align tests with model validation and API error reporting

2026-04-13 01:43:52 -04:00

models.py

feat(swarm): DeckyConfig.host_uuid + fix agent log/status field refs

2026-04-18 19:10:25 -04:00

network.py

fix(network): sweep orphan Docker bridges that squat on our subnet

2026-04-20 23:19:42 -04:00

os_fingerprint.py

feat(os_fingerprint): Phase 2 — add icmp_ratelimit + icmp_ratemask sysctls

2026-04-10 16:41:23 -04:00

privdrop.py

fix: chown log files to sudo-invoking user so non-root API can append

2026-04-17 13:39:09 -04:00

telemetry.py

fix: resolve all ruff and bandit lint/security issues

2026-04-16 01:04:57 -04:00