jcoffey-dev
cd8aa290ca
Extends the agent, ingest, storage, api, and web with Windows Event Log/ETW sourcing and Tantivy-backed free-text search, per the approved Phase 1 plan. - CLAUDE.md: materialized on disk (never existed as a file before) with a new Phase 1 "done looks like" section. - agent: Windows Event Log (EvtSubscribe) and ETW sources, Windows service wrapper (install/uninstall/run-service), both feature- and target_os-gated so Linux builds/tests/clippy stay unaffected. Also fixed two pre-existing Phase 0 clippy gaps (dead-code on default-features-only builds, a type-inference edge case) found while testing every feature combination properly for the first time. UNVERIFIED on real Windows -- no Windows toolchain existed anywhere in the build environment; flagged prominently in three places. - proto/ingest: new record_id field, assigned once server-side in ingest's gRPC front end so ClickHouse and Tantivy agree on the same ID for the same record. - storage: record_id column + bloom filter index, verified against a live ClickHouse. - search: new service, Tantivy index, rskafka consumer as an independent second consumer group on the same Redpanda topic ingest already reads. - api/web: new /search endpoint and page, sharing the query page's result-table shape and component. - hack/windows-fixture: sends realistic Windows-shaped data straight to ingest, so the pipeline's handling of it is verifiable without a Windows host. Verified end-to-end on the live docker-compose stack: the same record_id comes back from both /query and /search for the same log line, including for windows-fixture's synthetic Windows Event Log data. Real bugs found and fixed along the way: api/Dockerfile missing proto/ in its build context, search's logs being completely silent (RUST_LOG gap), and search/target/ missing from .gitignore/.dockerignore.
177 lines
6.1 KiB
YAML
177 lines
6.1 KiB
YAML
# Phase 0+1 stack: Redpanda -> ingest -> ClickHouse -> api -> web, plus
|
|
# search (Tantivy full-text indexing, reads the same Redpanda topic
|
|
# ingest's consumer does).
|
|
#
|
|
# Does NOT include the Rust agent — see /agent/README.md: journald
|
|
# sourcing needs the host's journal, which isn't something a container
|
|
# gets for free. Run the agent natively on the host per
|
|
# /docs/phase-0-runbook.md, pointed at ingest's mapped port (localhost:4317).
|
|
# Windows Event Log/ETW sourcing needs a real Windows host regardless —
|
|
# see /docs/phase-1-runbook.md.
|
|
#
|
|
# Before first run: generate dev mTLS certs (hack/dev-certs/generate.sh).
|
|
# See /docs/phase-0-runbook.md (Linux pipeline) and
|
|
# /docs/phase-1-runbook.md (Windows + full-text search) for the full
|
|
# sequences.
|
|
services:
|
|
redpanda:
|
|
image: docker.redpanda.com/redpandadata/redpanda:v24.2.7
|
|
container_name: sentry-redpanda
|
|
command:
|
|
- redpanda
|
|
- start
|
|
- --smp=1
|
|
- --memory=1G
|
|
- --reserve-memory=0M
|
|
- --overprovisioned
|
|
- --node-id=0
|
|
- --check=false
|
|
- --kafka-addr=PLAINTEXT://0.0.0.0:9092
|
|
- --advertise-kafka-addr=PLAINTEXT://redpanda:9092
|
|
ports:
|
|
- "9092:9092"
|
|
volumes:
|
|
- redpanda-data:/var/lib/redpanda/data
|
|
healthcheck:
|
|
test: ["CMD", "rpk", "cluster", "health", "--exit-when-healthy"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 30
|
|
|
|
# One-shot: creates the sentry.logs.raw topic, then exits 0. ingest
|
|
# waits on this completing successfully before it starts.
|
|
redpanda-provision:
|
|
build:
|
|
context: ./transport
|
|
container_name: sentry-redpanda-provision
|
|
depends_on:
|
|
redpanda:
|
|
condition: service_healthy
|
|
environment:
|
|
REDPANDA_BROKERS: "redpanda:9092"
|
|
REDPANDA_ADMIN_HOSTS: "redpanda:9644"
|
|
# Explicit rather than relying on both this script's and /search's
|
|
# defaults happening to agree — search consumes this same topic and
|
|
# needs to know the partition count up front (see /search/README.md).
|
|
REDPANDA_TOPIC_PARTITIONS: "6"
|
|
|
|
clickhouse:
|
|
image: clickhouse/clickhouse-server:24.8
|
|
container_name: sentry-clickhouse
|
|
ports:
|
|
- "8123:8123" # HTTP interface, used by the migrate step
|
|
- "9000:9000" # native protocol, used by ingest and api
|
|
environment:
|
|
# The official image disables *network* access entirely for the
|
|
# default user (even from sibling containers) unless
|
|
# CLICKHOUSE_USER or CLICKHOUSE_PASSWORD is set to a genuinely
|
|
# non-empty value — confirmed by testing, not just reading docs: an
|
|
# explicitly-empty CLICKHOUSE_PASSWORD="" still triggers the
|
|
# lockdown, silently returning 403 to every other container. This
|
|
# password isn't a real secret (mTLS between agent and ingest is
|
|
# the actual security boundary here) — it exists purely to satisfy
|
|
# this image's login gate for local/homelab use.
|
|
CLICKHOUSE_PASSWORD: "sentry-dev-only"
|
|
volumes:
|
|
- clickhouse-data:/var/lib/clickhouse
|
|
ulimits:
|
|
nofile:
|
|
soft: 262144
|
|
hard: 262144
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8123/ping"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 30
|
|
|
|
# One-shot: applies /storage/migrations/*.sql, then exits 0. ingest and
|
|
# api both wait on this completing successfully.
|
|
clickhouse-migrate:
|
|
build:
|
|
context: ./storage
|
|
container_name: sentry-clickhouse-migrate
|
|
depends_on:
|
|
clickhouse:
|
|
condition: service_healthy
|
|
environment:
|
|
CLICKHOUSE_HTTP: "http://clickhouse:8123"
|
|
CLICKHOUSE_PASSWORD: "sentry-dev-only"
|
|
|
|
ingest:
|
|
build:
|
|
context: . # needs both ingest/ and proto/
|
|
dockerfile: ingest/Dockerfile
|
|
container_name: sentry-ingest
|
|
depends_on:
|
|
redpanda-provision:
|
|
condition: service_completed_successfully
|
|
clickhouse-migrate:
|
|
condition: service_completed_successfully
|
|
ports:
|
|
- "4317:4317" # gRPC, mTLS — this is what the host-run agent connects to
|
|
environment:
|
|
REDPANDA_BROKERS: "redpanda:9092"
|
|
CLICKHOUSE_ADDR: "clickhouse:9000"
|
|
CLICKHOUSE_PASSWORD: "sentry-dev-only"
|
|
# TLS_*_FILE env vars are left at their defaults
|
|
# (/etc/sentry-ingest/{server,server-key,ca}.pem) — matches where
|
|
# the volume below mounts the generated dev certs.
|
|
volumes:
|
|
- ./hack/dev-certs/out:/etc/sentry-ingest:ro
|
|
|
|
# Reads the same sentry.logs.raw topic ingest's consumer does (own
|
|
# offset tracking, own failure domain — see /search/README.md) and
|
|
# builds a Tantivy full-text index over the message field.
|
|
search:
|
|
build:
|
|
context: . # needs both search/ and proto/
|
|
dockerfile: search/Dockerfile
|
|
container_name: sentry-search
|
|
depends_on:
|
|
redpanda-provision:
|
|
condition: service_completed_successfully
|
|
environment:
|
|
REDPANDA_BROKERS: "redpanda:9092"
|
|
REDPANDA_TOPIC_PARTITIONS: "6" # must match redpanda-provision's above
|
|
# tracing-subscriber's default filter suppresses INFO without this
|
|
# -- found by actually checking `docker compose logs search` and
|
|
# seeing nothing, same silent-logging gap the agent had in Phase 0.
|
|
RUST_LOG: "info"
|
|
volumes:
|
|
- search-index-data:/var/lib/sentry-search
|
|
|
|
api:
|
|
build:
|
|
context: . # needs both api/ and proto/ (gRPC client to search)
|
|
dockerfile: api/Dockerfile
|
|
container_name: sentry-api
|
|
depends_on:
|
|
clickhouse-migrate:
|
|
condition: service_completed_successfully
|
|
ports:
|
|
- "8080:8080"
|
|
environment:
|
|
CLICKHOUSE_ADDR: "clickhouse:9000"
|
|
CLICKHOUSE_PASSWORD: "sentry-dev-only"
|
|
SEARCH_GRPC_ADDR: "search:50052"
|
|
|
|
web:
|
|
build:
|
|
context: web
|
|
args:
|
|
# Baked in at build time (static site, not a server) as
|
|
# localhost:8080 -- this is fetched from the *browser*, which
|
|
# resolves against the host's mapped port, not the compose
|
|
# network's service DNS name.
|
|
VITE_API_BASE_URL: "http://localhost:8080"
|
|
container_name: sentry-web
|
|
depends_on:
|
|
- api
|
|
ports:
|
|
- "3000:3000"
|
|
|
|
volumes:
|
|
redpanda-data:
|
|
clickhouse-data:
|
|
search-index-data:
|