coalmine

git clone https://github.com/yourorg/coalmine.git
cd coalmine
cp .env.example .env
# Modifica .env con le tue credenziali del database e cloud

docker compose up -d

# Aggiungi una credenziale AWS
docker compose exec app coalmine credentials add my-aws-cred AWS \
  --secrets '{"access_key_id": "...", "secret_access_key": "...", "region": "us-east-1"}'

# Aggiungi un account sotto quella credenziale
docker compose exec app coalmine accounts add prod-east --credential my-aws-cred \
  --account-id 111111111111

# Oppure sincronizza credenziali e account da un file YAML
docker compose exec app coalmine credentials sync --dry-run

# Crea una destinazione di logging CloudTrail
docker compose exec app coalmine logs create my-trail AWS_CLOUDTRAIL \
  --account <ACCOUNT_ID>

# Elenca le risorse di logging
docker compose exec app coalmine logs list

# Crea un canary utente IAM AWS
docker compose exec app coalmine canary create my-canary AWS_IAM_USER \
  --account <ACCOUNT_ID> --logging-id <LOGGING_ID>

# Elenca i canary
docker compose exec app coalmine canary list

# Attiva un avviso di test
docker compose exec app coalmine canary trigger my-canary

# Attendi il ciclo di monitoraggio (~1 min) poi controlla gli avvisi
docker compose exec app coalmine alerts list

┌─────────────┐   ┌─────────────┐   ┌─────────────┐
│     CLI     │   │  REST API   │   │   WebUI     │
│  (coalmine) │   │  (FastAPI)  │   │  (React)    │
└──────┬──────┘   └──────┬──────┘   └──────┬──────┘
       │                 │                 │
       └────────┬────────┴────────┬────────┘
                │                 │
                │          ┌──────▼──────┐
                │          │Auth / RBAC  │
                │          │  (Casbin)   │
                │          └──────┬──────┘
                │                 │
         ┌──────▼─────────────────▼──────┐
         │         Celery Workers        │
         │  (Canary · Monitoraggio · Logs)│
         └──────────────┬────────────────┘
                        │
      ┌─────────────────┼─────────────────┐
      │                 │                 │
┌─────▼─────┐   ┌──────▼──────┐   ┌──────▼──────┐
│ Template  │   │  Monitor    │   │ Notifiche   │
│ OpenTofu  │   │(CloudTrail/ │   │(Email/Hook/ │
│           │   │ Log Audit)  │   │   Syslog)   │
└─────┬─────┘   └──────┬──────┘   └─────────────┘
      │                │
┌─────▼─────┐   ┌──────▼──────┐
│ AWS / GCP │   │   Avvisi    │
│(Risorse)  │   │    (DB)     │
└───────────┘   └─────────────┘

          ┌─────────────────┐
          │   PostgreSQL    │
          │   (Inventario)  │
          └────────┬────────┘
                   │
          ┌────────▼────────┐
          │   Celery Beat   │
          │ (Pianificatore) │
          └─────────────────┘

docker compose exec app coalmine --help
docker compose exec app coalmine canary --help

api_keys:
  - key: "your-api-key-here"
    name: "admin"
    permissions: ["read", "write"]
    scopes: ["all"]

# Elenca canary
curl -H "X-API-Key: your-api-key" http://localhost:8000/api/v1/canaries

# Crea un canary
curl -X POST -H "X-API-Key: your-api-key" \
  -H "Content-Type: application/json" \
  -d '{"name": "api-canary", "resource_type": "AWS_IAM_USER", "account_id": "...", "logging_id": "..."}' \
  http://localhost:8000/api/v1/canaries

credentials:
  my-aws-cred:
    provider: AWS
    auth_type: STATIC
    secrets:
      access_key_id: ${AWS_ACCESS_KEY_ID}
      secret_access_key: ${AWS_SECRET_ACCESS_KEY}
      region: ${AWS_DEFAULT_REGION:-us-east-1}
    accounts:
      - name: prod-east
        account_id: "111111111111"

outputs:
  email_admin:
    type: "email"
    enabled: true
    smtp_host: "smtp.example.com"
    smtp_port: 587
    to_addrs: ["[email protected]"]
  
  webhook_siem:
    type: "webhook"
    enabled: true
    url: "https://siem.example.com/webhook"

# Esegui tutti i test
docker compose run --rm app pytest -v

# Esegui solo test unitari
docker compose run --rm app pytest tests/unit/ -v

# Esegui test di integrazione
docker compose run --rm app pytest tests/integration/ -v

# Visualizza i log del worker
docker compose logs -f worker

# Ricostruisci dopo modifiche al codice
docker compose build && docker compose up -d