Parham Monfared
1262690276
The single-file stdlib server became the limit: no way to track what had been done about an alert, no accounts, and a UI that had to be hand-rolled in template strings. This restructures it into something deployable. Backend (FastAPI) - app/ holds config, database, auth, delivery and the routers; triagelib keeps the triage engine unchanged, so the validated screening and runbook logic is untouched. - Cases persist per alert fingerprint with a status workflow (investigating, customer contacted, escalated to Infra, waiting, remediated, resolved, won't fix, false positive), an assignee, notes and an append-only history. An alert that stops and re-fires lands back on the same case and counts as a reopen. - Suppression rules move from a JSON file into the database. Auth - Signed session cookies over PBKDF2 local accounts, plus an OIDC flow ready for Authentik: users are created on first login and admin follows a group claim. Local login can be switched off entirely once SSO is live. Zendesk and Jira - Delivery is now implemented, behind three gates: the integration must be configured, its feature flag on, and CX_FEATURE_SEND_ENABLED on. A demo instance leaves the last off and cannot mail anyone. Both search before creating, so re-diagnosing an alert updates one ticket rather than opening several, and a rolling daily cap stops a loop mailing everybody. Deployment - Multi-stage Dockerfile builds the bundle and serves it from the API origin. - docker-compose for local and single-host use; Gitea Actions runs the tests, builds the image and renders deploy/k8s with envsubst. Two fixes found while testing: assigning a case returned a null assignee, and add_event could leave an already-loaded history collection stale. Known gap: the engine reaches OpenStack via `docker exec <region>-osc`, which does not work in a pod without the CX-Tools containers alongside it. docs/DEPLOYMENT.md sets out the three ways to close that. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
68 lines
2.7 KiB
Plaintext
68 lines
2.7 KiB
Plaintext
# ---------------------------------------------------------------------------
|
|
# Copy to .env and edit. Everything here is read at startup.
|
|
# ---------------------------------------------------------------------------
|
|
|
|
# --- app -------------------------------------------------------------------
|
|
CX_APP_NAME=CX Triage
|
|
CX_PORT=8080
|
|
# Must be the externally reachable URL: the SSO redirect is built from it.
|
|
CX_BASE_URL=http://localhost:8080
|
|
# openssl rand -hex 32
|
|
CX_SECRET_KEY=change-me
|
|
CX_SESSION_HOURS=12
|
|
|
|
# --- database --------------------------------------------------------------
|
|
# compose provides postgres; sqlite is fine for a single user.
|
|
# CX_DATABASE_URL=sqlite:////data/cx-triage.db
|
|
CX_DATABASE_URL=postgresql+psycopg://cx:cx@db:5432/cxtriage
|
|
|
|
# --- data sources ----------------------------------------------------------
|
|
CX_PROMETHEUS_BASE=http://10.11.254.250:9090
|
|
# Container to relay Prometheus queries through when the host has no route to
|
|
# the internal network. Leave blank to auto-detect (ca1-osc, us1-osc, ...).
|
|
CX_PROMETHEUS_RELAY=
|
|
CX_TOOLS_PATH=/opt/cx-tools
|
|
|
|
# --- authentication --------------------------------------------------------
|
|
CX_AUTH_LOCAL_ENABLED=true
|
|
# Only used to create the very first account, when the user table is empty.
|
|
CX_BOOTSTRAP_ADMIN_EMAIL=admin@nexgencloud.com
|
|
CX_BOOTSTRAP_ADMIN_PASSWORD=
|
|
|
|
# --- Authentik SSO ---------------------------------------------------------
|
|
# Redirect URI to register in Authentik:
|
|
# ${CX_BASE_URL}/api/auth/oidc/callback
|
|
CX_OIDC_ENABLED=false
|
|
CX_OIDC_ISSUER=https://sso.nexgencloud.com/application/o/cx-triage/
|
|
CX_OIDC_CLIENT_ID=
|
|
CX_OIDC_CLIENT_SECRET=
|
|
CX_OIDC_SCOPES=openid email profile
|
|
# Members of this group become administrators.
|
|
CX_OIDC_ADMIN_GROUP=cx-triage-admins
|
|
CX_OIDC_GROUPS_CLAIM=groups
|
|
|
|
# --- feature flags ---------------------------------------------------------
|
|
# The master switch. With this off nothing can reach a customer, whatever else
|
|
# is configured. Leave it off on demo and staging instances.
|
|
CX_FEATURE_SEND_ENABLED=false
|
|
CX_FEATURE_ZENDESK=false
|
|
CX_FEATURE_JIRA=false
|
|
CX_FEATURE_LINKAGE_SCAN=true
|
|
# Refuses to send more than this in a rolling 24h, so a loop cannot mail everyone.
|
|
CX_SEND_DAILY_CAP=25
|
|
|
|
# --- Zendesk ---------------------------------------------------------------
|
|
# Admin Center -> Apps and integrations -> APIs -> Zendesk API -> Add API token
|
|
CX_ZENDESK_SUBDOMAIN=
|
|
CX_ZENDESK_EMAIL=
|
|
CX_ZENDESK_TOKEN=
|
|
CX_ZENDESK_PUBLIC_REPLY=true
|
|
|
|
# --- Jira ------------------------------------------------------------------
|
|
# https://id.atlassian.com/manage-profile/security/api-tokens
|
|
CX_JIRA_BASE=https://nexgencloud.atlassian.net
|
|
CX_JIRA_EMAIL=
|
|
CX_JIRA_TOKEN=
|
|
CX_JIRA_PROJECT=INFRA
|
|
CX_JIRA_ISSUE_TYPE=Task
|