coalmine

git clone https://github.com/yourorg/coalmine.git
cd coalmine
cp .env.example .env
# 编辑 .env，填入你的数据库和云凭证

docker compose up -d

# 添加一个 AWS 凭证
docker compose exec app coalmine credentials add my-aws-cred AWS \
  --secrets '{"access_key_id": "...", "secret_access_key": "...", "region": "us-east-1"}'

# 在该凭证下添加一个账号
docker compose exec app coalmine accounts add prod-east --credential my-aws-cred \
  --account-id 111111111111

# 或者从 YAML 配置同步凭证与账号
docker compose exec app coalmine credentials sync --dry-run

# 创建 CloudTrail 日志目标
docker compose exec app coalmine logs create my-trail AWS_CLOUDTRAIL \
  --account <ACCOUNT_ID>

# 列出日志资源
docker compose exec app coalmine logs list

# 创建一个 AWS IAM 用户蜜令
docker compose exec app coalmine canary create my-canary AWS_IAM_USER \
  --account <ACCOUNT_ID> --logging-id <LOGGING_ID>

# 列出蜜令
docker compose exec app coalmine canary list

# 触发测试告警
docker compose exec app coalmine canary trigger my-canary

# 等待监控周期（约 1 分钟），然后检查告警
docker compose exec app coalmine alerts list

┌─────────────┐   ┌─────────────┐   ┌─────────────┐
│     CLI     │   │  REST API   │   │   WebUI     │
│  (coalmine) │   │  (FastAPI)  │   │  (React)    │
└──────┬──────┘   └──────┬──────┘   └──────┬──────┘
       │                 │                 │
       └────────┬────────┴────────┬────────┘
                │                 │
                │          ┌──────▼──────┐
                │          │Auth / RBAC  │
                │          │  (Casbin)   │
                │          └──────┬──────┘
                │                 │
         ┌──────▼─────────────────▼──────┐
         │         Celery Workers        │
         │  (Canary · Monitoring · Logs) │
         └──────────────┬────────────────┘
                        │
      ┌─────────────────┼─────────────────┐
      │                 │                 │
┌─────▼─────┐   ┌──────▼──────┐   ┌──────▼──────┐
│ OpenTofu  │   │  Monitors   │   │Notifications│
│ Templates │   │(CloudTrail/ │   │(Email/Hook/ │
│           │   │ Audit Logs) │   │   Syslog)   │
└─────┬─────┘   └──────┬──────┘   └─────────────┘
      │                │
┌─────▼─────┐   ┌──────▼──────┐
│ AWS / GCP │   │   Alerts    │
│(Resources)│   │    (DB)     │
└───────────┘   └─────────────┘

          ┌─────────────────┐
          │   PostgreSQL    │
          │   (Inventory)   │
          └────────┬────────┘
                   │
          ┌────────▼────────┐
          │   Celery Beat   │
          │   (Scheduler)   │
          └─────────────────┘

docker compose exec app coalmine --help
docker compose exec app coalmine canary --help

api_keys:
  - key: "your-api-key-here"
    name: "admin"
    permissions: ["read", "write"]
    scopes: ["all"]

# 列出蜜令
curl -H "X-API-Key: your-api-key" http://localhost:8000/api/v1/canaries

# 创建蜜令
curl -X POST -H "X-API-Key: your-api-key" \
  -H "Content-Type: application/json" \
  -d '{"name": "api-canary", "resource_type": "AWS_IAM_USER", "account_id": "...", "logging_id": "..."}' \
  http://localhost:8000/api/v1/canaries

credentials:
  my-aws-cred:
    provider: AWS
    auth_type: STATIC
    secrets:
      access_key_id: ${AWS_ACCESS_KEY_ID}
      secret_access_key: ${AWS_SECRET_ACCESS_KEY}
      region: ${AWS_DEFAULT_REGION:-us-east-1}
    accounts:
      - name: prod-east
        account_id: "111111111111"

outputs:
  email_admin:
    type: "email"
    enabled: true
    smtp_host: "smtp.example.com"
    smtp_port: 587
    to_addrs: ["[email protected]"]
  
  webhook_siem:
    type: "webhook"
    enabled: true
    url: "https://siem.example.com/webhook"

# 运行所有测试
docker compose run --rm app pytest -v

# 仅运行单元测试
docker compose run --rm app pytest tests/unit/ -v

# 运行集成测试
docker compose run --rm app pytest tests/integration/ -v

# 查看 worker 日志
docker compose logs -f worker

# 代码更改后重新构建
docker compose build && docker compose up -d