Enhance Stackdog with AI tools, deduplication, and IP management

.env.sample

@@ -7,7 +7,7 @@ DATABASE_URL=stackdog.db
 RUST_BACKTRACE=full
 
 # Log Sniff Configuration
-#STACKDOG_LOG_SOURCES=/var/log/syslog,/var/log/auth.log
+#STACKDOG_LOG_SOURCES=/var/log/syslog,/var/log/auth.log,/var/log/nginx/access.log
 #STACKDOG_SNIFF_INTERVAL=30
 #STACKDOG_SNIFF_OUTPUT_DIR=./stackdog-logs/
 #STACKDOG_SERVE_SNIFF_ENABLED=true
@@ -20,9 +20,21 @@ RUST_BACKTRACE=full
 #STACKDOG_AI_API_KEY=
 #STACKDOG_AI_MODEL=llama3
 
+# How long the same finding stays suppressed before it alerts again (seconds).
+# Default 21600 (6h). Standing misconfigurations are re-detected every pass, so
+# a short window means the same alert all day.
+#STACKDOG_ALERT_DEDUP_WINDOW_SECS=21600
+
 # Notification Channels
 # Slack: create an incoming webhook at https://api.slack.com/messaging/webhooks
 #STACKDOG_SLACK_WEBHOOK_URL=https://hooks.slack.com/services/T.../B.../xxxxx
+# Slack sender identity. Only honored by legacy custom-integration webhooks or a
+# bot token with chat:write.customize; Slack-app webhooks use the app's own name
+# and icon, which you set under Basic Information > Display Information.
+#STACKDOG_SLACK_USERNAME=Stackdog
+# Defaults to https://stackdog.stacker.my/stackdog-mark.png, falling back to the
+# GitHub raw copy if that host does not answer. Setting this skips the probe.
+#STACKDOG_SLACK_ICON_URL=https://stackdog.stacker.my/stackdog-mark.png
 # Generic webhook endpoint for alert notifications
 #STACKDOG_WEBHOOK_URL=https://example.com/webhook
 #STACKDOG_SMTP_HOST=smtp.example.com
@@ -35,4 +47,9 @@ RUST_BACKTRACE=full
 #
 # Action notification toggles
 #STACKDOG_NOTIFY_IP_BAN_ACTIONS=true
+
+# Never ban these, whatever the logs say. Comma-separated, bare addresses or
+# CIDR notation. Put load balancers, health checkers and VPN gateways here:
+# banning them takes the service down with them. Empty by default.
+#STACKDOG_IP_BAN_ALLOWLIST=167.233.9.19,10.0.0.0/8
 #STACKDOG_NOTIFY_QUARANTINE_ACTIONS=true

.github/workflows/docker.yml

@@ -100,5 +100,5 @@ jobs:
           context: .
           push: true
           tags: |
-            vsilent/stackdog:latest
-            vsilent/stackdog:${{ github.sha }}
+            trydirect/stackdog:latest
+            trydirect/stackdog:${{ github.sha }}

.github/workflows/website-docker.yml

@@ -0,0 +1,52 @@
+name: Website Docker CICD
+
+on:
+  push:
+    branches: [main, dev]
+    paths:
+      - 'website/**'
+  pull_request:
+    branches: [main, dev]
+    paths:
+      - 'website/**'
+
+jobs:
+  build-and-push:
+    name: Build & Push Website Image
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        if: github.event_name == 'push'
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: trydirect/stackdog-website
+          tags: |
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
+            type=raw,value=dev,enable=${{ github.ref == 'refs/heads/dev' }}
+            type=sha,format=short
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: ./website
+          file: ./website/Dockerfile
+          push: ${{ github.event_name == 'push' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

BUGS.md

@@ -169,5 +169,5 @@ When fixing bugs, ensure:
 ## Contact
 
 For bug-related questions:
-- **GitHub Issues:** https://github.com/vsilent/stackdog/issues
+- **GitHub Issues:** https://github.com/trydirect/stackdog/issues
 - **Gitter:** https://gitter.im/stackdog/community

CHANGELOG.md

@@ -306,7 +306,7 @@ This release was made possible by contributions from:
 
 ## Links
 
-- **GitHub:** https://github.com/vsilent/stackdog
+- **GitHub:** https://github.com/trydirect/stackdog
 - **Documentation:** See docs/ directory
-- **Issues:** https://github.com/vsilent/stackdog/issues
-- **Discussions:** https://github.com/vsilent/stackdog/discussions
+- **Issues:** https://github.com/trydirect/stackdog/issues
+- **Discussions:** https://github.com/trydirect/stackdog/discussions

CONTRIBUTING.md

@@ -30,7 +30,7 @@ git clone https://github.com/YOUR_USERNAME/stackdog
 cd stackdog
 
 # Add upstream remote
-git remote add upstream https://github.com/vsilent/stackdog
+git remote add upstream https://github.com/trydirect/stackdog
 ```
 
 ### 2. Setup Development Environment
@@ -353,8 +353,8 @@ Update relevant documentation:
 ## Questions?
 
 - **General questions:** [Gitter](https://gitter.im/stackdog/community)
-- **Bug reports:** [GitHub Issues](https://github.com/vsilent/stackdog/issues)
-- **Feature requests:** [GitHub Discussions](https://github.com/vsilent/stackdog/discussions)
+- **Bug reports:** [GitHub Issues](https://github.com/trydirect/stackdog/issues)
+- **Feature requests:** [GitHub Discussions](https://github.com/trydirect/stackdog/discussions)
 
 ---
 

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "stackdog"
-version = "0.2.2"
+version = "0.2.4"
 authors = ["Vasili Pascal <info@try.direct>"]
 edition = "2021"
 description = "Security platform for Docker containers and Linux servers"

DEVELOPMENT.md

@@ -597,7 +597,7 @@ cargo-deny = "0.14"
 
 ```bash
 # Clone repository
-git clone https://github.com/vsilent/stackdog
+git clone https://github.com/trydirect/stackdog
 cd stackdog
 
 # Install Rust (if not installed)

QWEN.md

@@ -74,7 +74,7 @@ stackdog/
 
 ```bash
 # Clone and setup
-git clone https://github.com/vsilent/stackdog
+git clone https://github.com/trydirect/stackdog
 cd stackdog
 
 # Environment setup

README.md

@@ -83,7 +83,8 @@ docker volume create stackdog-data
 
 docker run --rm -it \
   --name stackdog \
-  -p 5000:5000 \
+  --network host \
+  --cap-add=NET_ADMIN \
   -e APP_HOST=0.0.0.0 \
   -e APP_PORT=5000 \
   -e DATABASE_URL=/data/stackdog.db \
@@ -92,6 +93,8 @@ docker run --rm -it \
   trydirect/stackdog:latest
 ```
 
+> **Note:** `--network host` and `--cap-add=NET_ADMIN` are required for IP banning (iptables/nftables) to work. Without them, firewall rules from inside the container cannot affect host traffic.
+
 Then open another shell and hit the API:
 
 ```bash
@@ -127,7 +130,8 @@ docker build -f docker/backend/Dockerfile -t stackdog-local .
 
 docker run --rm -it \
   --name stackdog-local \
-  -p 5000:5000 \
+  --network host \
+  --cap-add=NET_ADMIN \
   -e APP_HOST=0.0.0.0 \
   -e APP_PORT=5000 \
   -e DATABASE_URL=/data/stackdog.db \
@@ -151,10 +155,12 @@ This starts:
 
 The compose stack uses:
 
-- `stackdog` service — builds `docker/backend/Dockerfile`, runs `stackdog serve`, and mounts `/var/run/docker.sock`
+- `stackdog` service — builds `docker/backend/Dockerfile`, runs `stackdog serve`, mounts `/var/run/docker.sock`, uses `network_mode: host`, and adds `NET_ADMIN` capability for IP banning
 - `stackdog-ui` service — builds the React app and serves it with Nginx
 - `stackdog-data` volume — persists the SQLite database between restarts
 
+> **Prerequisite for IP banning:** The `network_mode: host` and `cap_add: NET_ADMIN` settings are required so that `iptables`/`nftables` rules applied inside the container affect the host's network stack. Without them, IP ban firewall rules cannot reach host traffic.
+
 To stop it:
 
 ```bash
@@ -750,7 +756,7 @@ copies of the Software...
 - **Project Lead:** Vasili Pascal
 - **Email:** info@try.direct
 - **X:** [@VasiliiPascal](https://twitter.com/VasiliiPascal)
-- **GitHub:** [vsilent/stackdog](https://github.com/vsilent/stackdog)
+- **GitHub:** [trydirect/stackdog](https://github.com/trydirect/stackdog)
 
 ---
 

STATUS.md

@@ -347,7 +347,7 @@ All Phase 1 tasks are now complete. The foundation for Stackdog Security is read
 
 - **Project Lead:** Vasili Pascal
 - **Email:** info@try.direct
-- **GitHub:** https://github.com/vsilent/stackdog
+- **GitHub:** https://github.com/trydirect/stackdog
 - **Gitter:** https://gitter.im/stackdog/community
 
 ---

docker-compose.app.yml

@@ -5,12 +5,14 @@ services:
       dockerfile: docker/backend/Dockerfile
     command: ["serve"]
     container_name: stackdog
+    network_mode: host
+    cap_add:
+      - NET_ADMIN
     environment:
       APP_HOST: 0.0.0.0
       APP_PORT: 5000
       DATABASE_URL: /data/stackdog.db
-    ports:
-      - "5000:5000"
+      STACKDOG_SNIFF_INTERVAL: 30
     volumes:
       - stackdog-data:/data
       - /var/run/docker.sock:/var/run/docker.sock

docker-compose.yml

@@ -1,20 +1,24 @@
 services:
   stackdog:
     image: trydirect/stackdog:latest
-    ports:
-    - target: 5000
-      published: 5000
+    network_mode: host
+    cap_add:
+      - NET_ADMIN
+    labels:
+      # Keeps Stackdog from reading its own logs and reporting its own errors
+      # as findings. More reliable than inferring the container ID from /proc.
+      com.trydirect.stackdog.ignore: "true"
     environment:
       APP_HOST: 0.0.0.0
       APP_PORT: 5000
       DATABASE_URL: /data/stackdog.db
-      STACKDOG_SNIFF_INTERVAL: 600
+      STACKDOG_SNIFF_INTERVAL: 30
       STACKDOG_AI_PROVIDER: openai
       STACKDOG_AI_API_URL: https://api.openai.com/v1
       STACKDOG_AI_MODEL: gpt-4o-mini
       STACKDOG_AI_API_KEY: <yourkeyhere>
       STACKDOG_SLACK_WEBHOOK_URL: <yourslackchannelwebhook?
-      STACKDOG_LOG_SOURCES: /var/log/syslog,/var/log/auth.log
+      STACKDOG_LOG_SOURCES: /var/log/syslog,/var/log/auth.log,/var/log/nginx/access.log
     restart: unless-stopped
     volumes:
     - source: stackdog-data
@@ -23,13 +27,7 @@ services:
     - source: /var/run/docker.sock
       target: /var/run/docker.sock
       type: bind
-    networks:
-    - default_network
     command: serve
 volumes:
   stackdog-data:
     name: stackdog-data
-networks:
-  default_network:
-    external: true
-    name: default_network

docker/backend/Dockerfile

@@ -19,8 +19,11 @@ FROM debian:bookworm-slim
 
 WORKDIR /app
 
+# nftables/iptables are required for IP banning: the host's binaries are not
+# reachable from here, since network_mode host shares the network namespace but
+# not the filesystem.
 RUN apt-get update && \
-    apt-get install --no-install-recommends -y ca-certificates sqlite3 && \
+    apt-get install --no-install-recommends -y ca-certificates sqlite3 nftables iptables && \
     rm -rf /var/lib/apt/lists/* && \
     mkdir -p /data
 

docker/local/Dockerfile

@@ -37,7 +37,7 @@ WORKDIR /app
 
 # install libpq
 RUN apt-get update; \
-    apt-get install --no-install-recommends -y libpq-dev sqlite3 libsqlite3-dev openssl; \
+    apt-get install --no-install-recommends -y libpq-dev sqlite3 libsqlite3-dev openssl nftables iptables; \
     rm -rf /var/lib/apt/lists/*
 
 COPY --from=rustscan/rustscan:latest  /usr/local/bin/rustscan /usr/local/bin/

docker/prod/Dockerfile

@@ -3,9 +3,11 @@ FROM debian:bookworm-slim
 
 WORKDIR /app
 
-# install ca-certificates for HTTPS requests
+# ca-certificates for HTTPS requests; nftables/iptables for IP banning.
+# The host's binaries are not reachable from here: network_mode host shares the
+# network namespace, not the filesystem, so the CLI must live in this image.
 RUN apt-get update && \
-    apt-get install --no-install-recommends -y ca-certificates && \
+    apt-get install --no-install-recommends -y ca-certificates sqlite3 nftables iptables && \
     rm -rf /var/lib/apt/lists/*
 
 # copy binary and configuration files

docs/INDEX.md

@@ -48,7 +48,7 @@ This document provides an index of all Stackdog Security documentation.
 | Document | Purpose | For |
 |----------|---------|-----|
 | [BUGS.md](../BUGS.md) | Bug tracking & reporting | Users/Dev |
-| [GitHub Issues](https://github.com/vsilent/stackdog/issues) | Issue tracker | Everyone |
+| [GitHub Issues](https://github.com/trydirect/stackdog/issues) | Issue tracker | Everyone |
 | [Gitter](https://gitter.im/stackdog/community) | Community chat | Everyone |
 
 ---
@@ -153,7 +153,7 @@ This document provides an index of all Stackdog Security documentation.
 ## 📞 Need Help?
 
 1. **Check documentation** - Start with this index
-2. **Search issues** - https://github.com/vsilent/stackdog/issues
+2. **Search issues** - https://github.com/trydirect/stackdog/issues
 3. **Ask on Gitter** - https://gitter.im/stackdog/community
 4. **Create issue** - If documentation is missing
 

docs/QUICKSTART.md

@@ -308,7 +308,7 @@ cargo test
 
 ## Getting Help
 
-- **GitHub Issues:** https://github.com/vsilent/stackdog/issues
+- **GitHub Issues:** https://github.com/trydirect/stackdog/issues
 - **Gitter:** https://gitter.im/stackdog/community
 - **Email:** info@try.direct
 

install.sh

@@ -2,15 +2,15 @@
 # Stackdog Security — install script
 #
 # Usage:
-#   curl -fsSL https://raw.githubusercontent.com/vsilent/stackdog/main/install.sh | sudo bash
-#   curl -fsSL https://raw.githubusercontent.com/vsilent/stackdog/main/install.sh | sudo bash -s -- --version v0.2.2
+#   curl -fsSL https://raw.githubusercontent.com/trydirect/stackdog/main/install.sh | sudo bash
+#   curl -fsSL https://raw.githubusercontent.com/trydirect/stackdog/main/install.sh | sudo bash -s -- --version v0.2.2
 #
 # Installs the stackdog binary to /usr/local/bin.
 # Requires: curl, tar, sha256sum (or shasum), Linux x86_64 or aarch64.
 
 set -eu
 
-REPO="vsilent/stackdog"
+REPO="trydirect/stackdog"
 INSTALL_DIR="/usr/local/bin"
 BINARY_NAME="stackdog"
 
@@ -155,6 +155,11 @@ main() {
   echo ""
   echo "  Run:  stackdog --help"
   echo ""
+  echo "  Prerequisites for IP banning (optional):"
+  echo "    - nftables or iptables must be installed"
+  echo "    - The binary requires root or CAP_NET_ADMIN to manage firewall rules"
+  echo "    - See https://stackdog.stacker.my/docs for full setup guide"
+  echo ""
 }
 
 main "$@"