Documentation
¶
Overview ¶
Package auditsink streams audit ledger events to external sinks (webhook, SIEM, or file) in real time. It is designed to sit on the ledger append path: Emit never blocks the caller and never returns an error. Network sinks buffer events in a bounded queue drained by a background worker; when the queue overflows the oldest event is dropped and counted rather than blocking the producer.
Index ¶
Constants ¶
const ( // EnvWebhookURL, when set, POSTs each event as JSON to the given URL. EnvWebhookURL = "RUNEWARD_AUDIT_WEBHOOK_URL" // EnvWebhookHeader optionally adds one "Key: Value" header to every // webhook request, e.g. "Authorization: Bearer <token>". EnvWebhookHeader = "RUNEWARD_AUDIT_WEBHOOK_HEADER" // EnvFile, when set, appends each event as one JSON line to the file. EnvFile = "RUNEWARD_AUDIT_FILE" // EnvOTLPEndpoint, when set, exports each event as an OTLP log record. EnvOTLPEndpoint = "RUNEWARD_AUDIT_OTLP_ENDPOINT" // EnvOTLPHeaders optionally sets OTLP headers as "k=v,k2=v2". EnvOTLPHeaders = "RUNEWARD_AUDIT_OTLP_HEADERS" // EnvOTLPInsecure toggles insecure OTLP transport when true. EnvOTLPInsecure = "RUNEWARD_AUDIT_OTLP_INSECURE" // EnvOTLPServiceName sets resource attribute "service.name". EnvOTLPServiceName = "RUNEWARD_AUDIT_OTLP_SERVICE_NAME" // EnvOTLPResourceAttrs sets resource attrs as "k=v,k2=v2". EnvOTLPResourceAttrs = "RUNEWARD_AUDIT_OTLP_RESOURCE_ATTRS" )
Environment variables recognised by FromEnv.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Multi ¶
type Multi struct {
// contains filtered or unexported fields
}
Multi fans a single event out to several sinks.
type OTLPSinkConfig ¶
type OTLPSinkConfig struct {
Endpoint string
Headers map[string]string
Insecure bool
ServiceName string
ResourceAttributes map[string]string
Logger *slog.Logger
QueueSize int
}
OTLPSinkConfig configures OTLP audit export.
type Sink ¶
Sink receives audit events. Emit must be non-blocking and must never fail or stall the caller. Close flushes best-effort and stops any workers.
func FromEnv ¶
FromEnv builds a Sink from environment variables. With no relevant variables set it returns a no-op sink. It returns an error only on obviously bad configuration (malformed URL, unopenable file, malformed header). logger may be nil, in which case slog.Default is used.
func NewFileSink ¶
NewFileSink opens (creating if needed) the JSON Lines file at path for appending. The file is opened O_APPEND|O_CREATE|O_WRONLY with mode 0o600.
func NewMulti ¶
NewMulti returns a Sink that fans out to each of sinks. If no sinks are given it returns a no-op sink so callers never have to nil-check.
func NewOTLPSink ¶
func NewOTLPSink(cfg OTLPSinkConfig) (Sink, error)
NewOTLPSink builds an OTLP audit sink with a bounded queue and worker.
func NewWebhookSink ¶
func NewWebhookSink(cfg WebhookConfig) Sink
NewWebhookSink builds a webhook Sink and starts its worker goroutine.
type WebhookConfig ¶
type WebhookConfig struct {
URL string
HeaderKey string
HeaderValue string
// Client is the HTTP client to use; nil uses a client with a sane
// per-request timeout.
Client *http.Client
// Logger receives drop and failure warnings; nil uses slog.Default.
Logger *slog.Logger
// QueueSize overrides the default bounded queue size when > 0.
QueueSize int
}
WebhookConfig configures a webhook sink. Only URL is required.
Source Files