sightingdb 0.7.2

A database designed for Sightings, a technique to count items
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59

# node-c — see the header of docker-compose.yml for the shape of the galaxy.

[daemon]
listen_ip = "0.0.0.0"
listen_port = 9999
authenticate = true
daemonize = false
ssl = false

dbdir = "/var/lib/sightingdb"
snapshot_interval = 300
sweep_interval = 60

# Unique in the galaxy. Sightings are counted per node, and two nodes sharing a
# name would each take the other's for its own.
node_id = "node-c"

[storage]
default_tier = "hot"
warm_idle = 3600
tiers_file = "/var/lib/sightingdb/tiers.toml"

# A *partial* mirror: it holds misp/ips and nothing else. A write to
# misp/domains or misp/hashes is never sent here, and a read of one is served
# by node-a or node-b.
#
# This is the whole reason a galaxy is not just replication: a node can be
# given the slice it has the disk, the locality or the authority for.
namespaces = ["misp/ips"]

[galaxy]
health_interval = 5
# Short so a node that was stopped visibly catches up when it comes back. It
# asks each peer what it holds, compares, and pulls what it is missing — and it
# only ever pulls namespaces it stores itself.
sync_interval = 30
# A node counts its own sightings, so it has no router's tally to repair.
reconcile_interval = 0
gossip_interval = 0
peers = [
  { url = "http://node-a:9999", key = "peer-full" },
]

# Keys, declared here rather than in a file so that this demo can show the one
# thing that matters about a peer key: it is a capability, and the *peer*
# decides what it opens.
#
# A file would be rewritable from the management interface, which is better in
# earnest — but an acl_file that does not exist yet starts empty and would
# discard these, so the demo would lose the point it is making. The load
# balancer has the writable files instead, since that is where you would open
# the interface.
[acl]
# For poking at this node directly: curl -H 'Authorization: demo' ...
"demo" = "rw, admin"
# Narrow on purpose. The load balancer holds this key, and if it were
# compromised it still could not write outside misp/ips here — this node
# refuses it, which is not something the load balancer can talk its way out of.
"lb-ips" = "rw:misp/ips"