feat: add Fail2ban security detection console

2026-08-14 10:58:18 +08:00
parent b78faa1aa2
commit d30d9ea4d0
45 changed files with 1967 additions and 18 deletions
@@ -2321,3 +2321,114 @@ model GatewayDownstreamRecoveryStatus {
  @@index([state, updatedAt])
  @@index([nextRetryAt])
 }
+
+model SecurityDetectionRule {
+  id                  String   @id @default(cuid())
+  code                String   @unique
+  name                String
+  sourceType          String
+  enabled             Boolean  @default(true)
+  threshold           Int
+  windowSeconds       Int
+  cooldownSeconds     Int
+  severity            String
+  defaultBlockSeconds Int
+  maximumBlockSeconds Int
+  configVersion       Int      @default(1)
+  effectiveVersion    Int      @default(0)
+  applyStatus         String   @default("pending")
+  lastApplyError      String?
+  pendingConfig       Json?
+  createdAt           DateTime @default(now())
+  updatedAt           DateTime @updatedAt
+
+  events SecurityDetectionEvent[]
+  alerts SecurityAlert[]
+
+  @@index([enabled, sourceType])
+}
+
+model SecurityDetectionEvent {
+  id          String   @id @default(cuid())
+  eventKey    String   @unique
+  ruleId      String
+  sourceIp    String
+  sourcePort  Int?
+  accountHash String?
+  path        String?
+  protocol    String?
+  resultCode  String?
+  evidence    Json?
+  occurredAt  DateTime
+  createdAt   DateTime @default(now())
+
+  rule SecurityDetectionRule @relation(fields: [ruleId], references: [id], onDelete: Restrict)
+
+  @@index([ruleId, occurredAt])
+  @@index([sourceIp, occurredAt])
+}
+
+model SecurityAlert {
+  id               String    @id @default(cuid())
+  fingerprint      String    @unique
+  ruleId           String
+  sourceIp         String
+  severity         String
+  status           String    @default("open")
+  eventCount       Int       @default(0)
+  windowStartedAt  DateTime
+  firstOccurredAt  DateTime
+  lastOccurredAt   DateTime
+  acknowledgedAt   DateTime?
+  acknowledgedById String?
+  ignoredAt        DateTime?
+  ignoredById      String?
+  ignoreReason     String?
+  blockId          String?
+  createdAt        DateTime  @default(now())
+  updatedAt        DateTime  @updatedAt
+
+  rule SecurityDetectionRule @relation(fields: [ruleId], references: [id], onDelete: Restrict)
+
+  @@index([status, severity, lastOccurredAt])
+  @@index([sourceIp, status, lastOccurredAt])
+  @@index([ruleId, status, lastOccurredAt])
+}
+
+model SecurityBlock {
+  id                String    @id @default(cuid())
+  operationKey      String    @unique
+  alertId           String?
+  sourceIp          String
+  executor          String
+  status            String    @default("requested")
+  durationSeconds   Int
+  reason            String
+  requestedById     String
+  requestedAt       DateTime  @default(now())
+  appliedAt         DateTime?
+  expiresAt         DateTime?
+  releasedAt        DateTime?
+  releasedById      String?
+  executorReference String?
+  lastError         String?
+  createdAt         DateTime  @default(now())
+  updatedAt         DateTime  @updatedAt
+
+  @@index([status, expiresAt])
+  @@index([sourceIp, status, requestedAt])
+  @@index([alertId])
+}
+
+model SecurityProtectedNetwork {
+  id          String   @id @default(cuid())
+  network     String   @unique
+  name        String
+  reason      String
+  enabled     Boolean  @default(true)
+  createdById String
+  createdAt   DateTime @default(now())
+  updatedAt   DateTime @updatedAt
+
+  @@index([enabled, createdAt])
+}