anti
4c37ece39e
Adds a new decnet orchestrate worker whose job is to keep the honeypot
ecosystem from looking suspiciously static — a frozen LAN with no
inter-host traffic and no filesystem aging is its own honeypot tell.
MVP scope:
- New OrchestratorEvent table + repo methods (purpose-built sibling
to Log so synthetic events stay separable from attacker-driven ones).
- New orchestrator.{activity,file}.<decky_id> bus topics +
system.orchestrator.health heartbeat.
- SSH-only driver. Traffic action runs python3 inside src container
to TCP-connect dst:22 and read the SSH banner — real on-the-wire
SSH-protocol traffic without shipping creds. File action drops or
refreshes a small file via docker exec on the destination.
- Random scheduler (50/50 traffic/file when >=2 SSH-capable deckies
are running). Diurnal shaping, role-aware pairing, and session-aware
backoff are explicit non-goals for MVP.
- CLI registration, systemd unit (SupplementaryGroups=docker),
worker-registry entry so the dashboard shows orchestrator health.
- 11 tests: scheduler policy, driver argv shape + injection-safety,
end-to-end one-tick integration with FakeBus + SQLite.
44 lines
1.3 KiB
Django/Jinja
44 lines
1.3 KiB
Django/Jinja
[Unit]
|
|
Description=DECNET Orchestrator (synthetic life-injection — inter-decky traffic + file ops)
|
|
Documentation=https://git.resacachile.cl/anti/DECNET/wiki/Workers#orchestrator
|
|
After=network-online.target decnet-bus.service
|
|
Wants=network-online.target decnet-bus.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
User={{ user }}
|
|
Group={{ group }}
|
|
WorkingDirectory={{ install_dir }}
|
|
EnvironmentFile=-{{ install_dir }}/.env.local
|
|
Environment=DECNET_SYSTEM_LOGS=/var/log/decnet/decnet.orchestrator.log
|
|
ExecStart={{ venv_dir }}/bin/decnet orchestrate
|
|
StandardOutput=append:/var/log/decnet/decnet.orchestrator.log
|
|
StandardError=append:/var/log/decnet/decnet.orchestrator.log
|
|
|
|
# The orchestrator drives `docker exec` against decky containers, so it
|
|
# needs membership in the docker group. It does NOT bind to the network,
|
|
# launch new containers, or write outside its own logs and install dir.
|
|
SupplementaryGroups=docker
|
|
|
|
CapabilityBoundingSet=
|
|
AmbientCapabilities=
|
|
|
|
# Security Hardening
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=full
|
|
ProtectHome=read-only
|
|
PrivateTmp=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectControlGroups=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
ReadWritePaths={{ install_dir }} /var/log/decnet
|
|
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
TimeoutStopSec=15
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|