fix(gateway): deploy native in-project soc-gateway-live container artifact, eliminate ttyd terminal, clean up external static apps, and update English security reports

2026-10-13 01:56:56 +03:00
parent f8917dfa88
commit 1a4a583f8b
31 changed files with 1320 additions and 33 deletions
@@ -24,10 +24,11 @@ Rigorous functionality verification (Internal DNS, Raw TCP Sockets, Reverse Prox
   - The security analysis engine `soc-backend` (`soc-backend-d1895c70f6b2`) has `publicAccess: false` and `expose: false`.
   - External HTTP probes to `https://soc-backend-d1895c70f6b2.hosted.ghaymah.systems/` return `HTTP 404 Not Found`. The backend is strictly accessible only over the internal mesh.

-4. **Public Edge SOC Command Center Live**:
-   - The Edge Gateway UI is deployed and live at:
-     **Live URL**: [`https://ghaymah-soc-gateway-ac352412-web-3e953576.hosted.cumin.dev`](https://ghaymah-soc-gateway-ac352412-web-3e953576.hosted.cumin.dev)
-   - Serves the complete, interactive SOC Command Center UI (Dark mode, glassmorphism, threat metrics, live target scans, incident management, services status).
+4. **Public Edge SOC Command Center Live (Native Container Artifact)**:
+   - The Edge Gateway UI is deployed natively inside the project `ghaymah-soc-microservices` and is live at:
+     **Live URL**: [`https://soc-gateway-live-7c2ca9361c37.hosted.ghaymah.systems/`](https://soc-gateway-live-7c2ca9361c37.hosted.ghaymah.systems/)
+   - Built and rolled out as a native container artifact (`nginx:alpine`) serving the complete, interactive SOC Command Center UI (Dark mode, glassmorphism, threat metrics, live target scans, incident management, services status).
+   - Zero terminal interface (`ttyd` completely eliminated from user ingress).

 5. **Critical Security Finding: Missing Intra-Tenant Cross-Project Isolation**:
   - **Vulnerability**: Ghaymah organizes all projects owned by the same user account inside a single, shared Kubernetes namespace (`d62f9886-fced-4cf2-98e4-5b62000d4f03`).
@@ -45,7 +46,7 @@ Rigorous functionality verification (Internal DNS, Raw TCP Sockets, Reverse Prox

 ```mermaid
 graph TD
-    subgraph PUBLIC_INTERNET["🌐 Public Internet / Analysts"]
+    subgraph PUBLIC_INTERNET["🌐 Public Internet / Security Analysts"]
        Browser["User Web Browser"]
    end

@@ -53,8 +54,8 @@ graph TD
        
        subgraph PROJECT_SOC["📁 Project: ghaymah-soc-microservices (ID: 5be77e31)"]
            
-            subgraph INGRESS_LAYER["Edge Ingress Layer"]
-                Gateway["🛡️ SOC Gateway Dashboard\nURL: https://ghaymah-soc-gateway-ac352412-web-3e953576.hosted.cumin.dev\nStatus: Healthy (HTTP 200)"]
+            subgraph INGRESS_LAYER["Edge Ingress Layer (Nginx Container)"]
+                Gateway["🛡️ SOC Gateway Dashboard (soc-gateway-live)\nURL: https://soc-gateway-live-7c2ca9361c37.hosted.ghaymah.systems\nStatus: Synced (HTTP 200 / Nginx 1.31.6)"]
            end
            
            subgraph INTERNAL_MESH["Private Internal Mesh (10.42.5.0/24)"]
@@ -72,7 +73,7 @@ graph TD
        DNS["🧭 CoreDNS Cluster Resolver\nIP: 10.43.0.10:53"]
    end

-    Browser -->|HTTPS GET| Gateway
+    Browser -->|HTTPS GET :80| Gateway
    Gateway -->|Internal Mesh| Backend
    Backend -->|Raw TCP Port 6379| Redis
    Tester -->|CoreDNS Query| DNS
@@ -86,10 +87,11 @@ graph TD

 | Service Name | Internal Identifier (UniqueName) | Role & Container Type | Port(s) | Internal Overlay IP | Public Routing | Status |
 | :--- | :--- | :--- | :--- | :--- | :--- | :---: |
-| **ghaymah-soc-gateway** | `ghaymah-soc-gateway` | Edge SOC Dashboard & UI | 80 | Overlay CNI | `https://ghaymah-soc-gateway-ac352412-web-3e953576.hosted.cumin.dev` | **Healthy (Live)** |
+| **soc-gateway-live** | `soc-gateway-live-7c2ca9361c37` | Edge SOC Dashboard & UI (Nginx) | 80 | Overlay CNI | `https://soc-gateway-live-7c2ca9361c37.hosted.ghaymah.systems/` | **Synced (HTTP 200 Live)** |
 | **soc-backend** | `soc-backend-d1895c70f6b2` | Security Analysis API | 4000 | `10.42.5.103` | **Disabled (HTTP 404)** | **Synced (Private)** |
 | **soc-redis** | `soc-redis-10f420c389ef` | In-Memory Threat DB | 6379 | `10.42.5.99` | **Disabled (HTTP 404)** | **Synced (Private)** |
 | **soc-tester** | `soc-tester-9b6540e2d4ed` | DevSecOps Diagnostic Pod | 7681 | `10.42.5.102` | Management WebSocket | **Synced** |
+| *soc-gateway (Legacy)* | `soc-gateway-28cd1dc4e034` | Legacy Terminal Pod (`ttyd:alpine`) | 7681 | `10.42.5.101` | Deprecated | **Deleted / Retired** |

 ---

@@ -154,7 +156,7 @@ CRITICAL_RANSOMWARE_BLOCKED_ON_MESH
 ### 3.3 Inter-Service Mesh Communication

 * Direct connection from Edge Gateway pod to `soc-redis:6379` returned `+PONG`.
-* Direct connection from Edge Gateway pod to `soc-backend:4000` / `7681` confirmed port open.
+* Direct connection from Edge Gateway pod to `soc-backend:4000` confirmed port open.
 * **Result**: **PASS (100%)**.

 ---
@@ -165,6 +167,7 @@ CRITICAL_RANSOMWARE_BLOCKED_ON_MESH

 | Test Domain | Target | Result | Risk Level | Assessment & Impact |
 | :--- | :--- | :---: | :---: | :--- |
+| **Edge Gateway Web UI** | `soc-gateway-live-7c2ca9361c37` | **HTTP 200 (OK)** | Secure | ✅ Full SOC Dashboard served via Nginx; terminal removed |
 | **Cross-Project DNS** | `test-redis-feccbaec5bd7` | **RESOLVED (`10.42.5.97`)** | Medium | Pod resolves hosts across projects in same tenant |
 | **Cross-Project TCP** | `test-redis-feccbaec5bd7:6379` | **PORT OPEN (Connected)** | **High** | ⚠️ Unrestricted intra-tenant cross-project lateral movement |
 | **Cross-Project HTTP** | `auth-deploy-4c0bca85312b:80` | **HTTP 200 (`<h1>test</h1>`)** | **High** | ⚠️ Pod exfiltrates data from separate project web server |
@@ -193,4 +196,72 @@ CRITICAL_RANSOMWARE_BLOCKED_ON_MESH
 * All automated test scripts, logs, structured JSON outputs, and reports are committed and pushed to the dedicated **GitPasha** repository:
  - **GitPasha URL**: `https://app.gitpasha.com/Ziad_Abdelgwad/ghaymah-dns-net-sec-tests.git`
  - **Branch**: `master`
-* The original `cumin-soc` repository remains completely clean and untouched.
+* The original `cumin` repository remains completely clean and untouched.
+
+---
+
+## 6. Gateway UI Architecture: Terminal Root Cause Analysis & Native Container Migration
+
+### 6.1 Root Cause of Initial Terminal (`ttyd`) Display
+During initial deployment of project `ghaymah-soc-microservices`, the edge gateway service was initialized with the container image `tsl0922/ttyd:alpine` with port `7681` mapped directly as public edge ingress. While this allowed interactive shell testing, any user visiting the public URL encountered an active command-line interface (`ttyd` web terminal) rather than the intended graphical Security Operations Center (SOC) dashboard.
+
+### 6.2 Evaluation & Deprecation of Static Hosting Approaches
+An interim experiment deployed the UI assets as a static site on `hosted.cumin.dev` (`ghaymah-soc-gateway-ac352412-web-3e953576.hosted.cumin.dev`). However, this introduced external infrastructure dependencies outside the target Ghaymah platform (`deploy.ghaymah.systems`) and detached the gateway from the private microservices project mesh. 
+
+Consequently:
+- The temporary static app (`1a83e477-9e98-4dbb-8931-cc273db6e607`) was formally deleted via GraphQL (`deleteStaticApp`).
+- The public probe to `https://ghaymah-soc-gateway-ac352412-web-3e953576.hosted.cumin.dev/` now confirms `HTTP 404 Not Found`.
+
+### 6.3 Technical Discovery: Ghaymah In-Project Artifact Build Mechanics
+Attempts to mutate the existing running container in place (`update_ghaymah_cloud_resources_by_pk`) using artifact source values resulted in Helm operator pre-upgrade hook timeouts (`status: syncing`), because Ghaymah's build pipeline is triggered primarily on new resource instantiation.
+
+Furthermore, filesystem modifications made inside running pods (`docker exec` or ephemeral scripts) are inherently transient: upon any pod crash, scale, or rollout, all modified files are reset to the base container image.
+
+**The Architectural Solution**:
+To achieve permanent, production-grade deployment directly within project `ghaymah-soc-microservices` without a terminal interface:
+1. **Container Packaging**: An official lightweight `nginx:alpine` image was combined with the full, interactive SOC Command Center UI (`index.html`) using a standard `Dockerfile`:
+   ```dockerfile
+   FROM nginx:alpine
+   COPY ./ /usr/share/nginx/html/
+   EXPOSE 80
+   ```
+2. **Artifact S3 Upload**: Packaged into a standard POSIX `tar.gz` archive and uploaded directly to Ghaymah's file storage API:
+   `https://s3-nhost-proxy-83e02743fd61.hosted.ghaymah.systems/files/{userId}/{resourceId}.tar.gz`
+3. **Resource Provisioning**: Created resource `soc-gateway-live` via `insert_ghaymah_cloud_resources_one` attached to project `ghaymah-soc-microservices` (`5be77e31-3ac2-48f5-b97d-735e8b2ad45f`) with source:
+   ```json
+   {
+     "source": {
+       "enabled": true,
+       "type": "artifact",
+       "ref": "<sha256>",
+       "url": "https://s3-nhost-proxy-83e02743fd61.hosted.ghaymah.systems/files/{userId}/{resourceId}.tar.gz"
+     },
+     "container": {
+       "image": "registry.ghaymah.systems/{userId}/{resourceId}:latest"
+     },
+     "ports": [{ "number": 80, "expose": true }],
+     "publicAccess": {
+       "enabled": true,
+       "domain": "soc-gateway-live-7c2ca9361c37.hosted.ghaymah.systems"
+     }
+   }
+   ```
+4. **Automated Pipeline Execution**: Ghaymah's internal Kaniko/BuildKit builder fetched the artifact, compiled the container image to the internal container registry (`registry.ghaymah.systems`), and rolled out the deployment in under 35 seconds to `status: synced`.
+
+### 6.4 Verification Evidence & Live Endpoint Audits
+
+1. **Active SOC Gateway Ingress**:
+   - **URL**: `https://soc-gateway-live-7c2ca9361c37.hosted.ghaymah.systems/`
+   - **HTTP Status**: `200 OK`
+   - **Server Header**: `nginx/1.31.6`
+   - **Page Title**: `<title>Ghaymah SOC Command Center | Cloud Security Mesh</title>`
+   - **Verification**: Browsing the URL displays the rich dark-mode Security Operations Center dashboard directly. The terminal interface has been 100% eliminated.
+
+2. **Strict Private Backend Isolation (Re-verified)**:
+   - **Target**: `https://soc-backend-d1895c70f6b2.hosted.ghaymah.systems/`
+   - **Configuration**: `expose: false`, `publicAccess: false`
+   - **HTTP Probe Result**: `HTTP 404 Not Found` (Confirmed isolated from public ingress).
+
+3. **Legacy Cleanup**:
+   - Legacy `ttyd` container `3d5666fe-95db-4e73-b6b2-dd0e41fca7f6` marked `deleted: true`.
+   - External Cumin static app deleted (`HTTP 404`).