feat(waf): Alerts — Regelübereinstimmungen in DB + UI — v1.2.77

- Migration 0038: waf_alerts-Tabelle
- AlertWriter (Buffered-Channel → async DB-Write)
- SPOE: MatchedRules → sendAlert() nach ProcessRequestHeaders()
- API: GET /waf/alerts + DELETE /waf/alerts
- WAF-Page: Tabs Domains | Alarme; Alarme-Tabelle mit Rule-ID,
  Severity, Aktion (Detected/Blocked), URI, Client-IP + Purge-Button

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/waf/alerts.go

@@ -0,0 +1,84 @@
+package waf
+
+import (
+	"context"
+	"log/slog"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// Alert represents a single WAF rule match that was logged.
+type Alert struct {
+	ID        int64     `json:"id"`
+	DomainID  *int64    `json:"domain_id,omitempty"`
+	Hostname  string    `json:"hostname"`
+	ClientIP  string    `json:"client_ip"`
+	Method    string    `json:"method"`
+	URI       string    `json:"uri"`
+	RuleID    int       `json:"rule_id"`
+	RuleMsg   string    `json:"rule_msg"`
+	Severity  string    `json:"severity"`
+	Action    string    `json:"action"` // "detected" | "blocked"
+	CreatedAt time.Time `json:"created_at"`
+}
+
+// AlertWriter accepts Alert values via a buffered channel and writes
+// them to PostgreSQL asynchronously so SPOE handling stays low-latency.
+type AlertWriter struct {
+	pool   *pgxpool.Pool
+	ch     chan Alert
+}
+
+// NewAlertWriter creates an AlertWriter and starts its background goroutine.
+// bufSize is the number of unwritten alerts that can queue before drops.
+func NewAlertWriter(pool *pgxpool.Pool, bufSize int) *AlertWriter {
+	aw := &AlertWriter{
+		pool: pool,
+		ch:   make(chan Alert, bufSize),
+	}
+	go aw.run()
+	return aw
+}
+
+// Send enqueues an alert. Drops silently if the channel is full to
+// avoid slowing down SPOE request handling.
+func (aw *AlertWriter) Send(a Alert) {
+	select {
+	case aw.ch <- a:
+	default:
+		slog.Warn("waf: alert channel full — dropping alert", "host", a.Hostname, "rule", a.RuleID)
+	}
+}
+
+func (aw *AlertWriter) run() {
+	for a := range aw.ch {
+		aw.write(a)
+	}
+}
+
+func (aw *AlertWriter) write(a Alert) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	// Resolve domain_id from hostname (best-effort).
+	var domainID *int64
+	var id int64
+	if err := aw.pool.QueryRow(ctx,
+		`SELECT id FROM domains WHERE name = $1 AND active = true LIMIT 1`,
+		a.Hostname,
+	).Scan(&id); err == nil {
+		domainID = &id
+	}
+
+	if _, err := aw.pool.Exec(ctx, `
+		INSERT INTO waf_alerts
+		    (domain_id, hostname, client_ip, method, uri,
+		     rule_id, rule_msg, severity, action)
+		VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)
+	`, domainID, a.Hostname, a.ClientIP, a.Method, a.URI,
+		a.RuleID, a.RuleMsg, a.Severity, a.Action,
+	); err != nil {
+		slog.Warn("waf: write alert to db failed", "error", err)
+	}
+}

internal/waf/spoe.go

@@ -6,6 +6,7 @@ import (
 	"net/http"
 	"strings"
 
+	"github.com/corazawaf/coraza/v3/types"
 	"github.com/dropmorepackets/haproxy-go/pkg/encoding"
 	"github.com/dropmorepackets/haproxy-go/spop"
 )
@@ -13,8 +14,9 @@ import (
 // SPOEAgent wraps the haproxy-go SPOE server and dispatches each
 // inspected request to the appropriate per-domain Coraza engine.
 type SPOEAgent struct {
-	Manager *Manager
-	Addr    string
+	Manager      *Manager
+	AlertWriter  *AlertWriter
+	Addr         string
 }
 
 // ListenAndServe starts the SPOE agent. Blocks until ctx is cancelled.
@@ -106,33 +108,48 @@ func (a *SPOEAgent) handle(ctx context.Context, w *encoding.ActionWriter, m *enc
 
 	// Evaluate request headers.
 	interruption := tx.ProcessRequestHeaders()
+
+	// Log all matched rules (detection + blocking).
+	for _, mr := range tx.MatchedRules() {
+		a.sendAlert(host, clientIP, method, uri, mr, interruption != nil)
+	}
+
 	if interruption != nil {
 		status := interruption.Status
 		if status == 0 {
 			status = http.StatusForbidden
 		}
 		slog.Info("waf: request blocked",
-			"host", host,
-			"method", method,
-			"uri", uri,
-			"client", clientIP,
-			"status", status,
-			"mode", de.Mode,
+			"host", host, "method", method, "uri", uri,
+			"client", clientIP, "status", status, "rule", interruption.RuleID,
 		)
 		if de.Mode == "blocking" {
 			if err := w.SetInt64(encoding.VarScopeTransaction, "status", int64(status)); err != nil {
 				slog.Warn("waf: SetInt64 status", "error", err)
 			}
 		}
+	}
+}
+
+// sendAlert enqueues a WAF alert for async DB write.
+func (a *SPOEAgent) sendAlert(host, clientIP, method, uri string, mr types.MatchedRule, blocked bool) {
+	if a.AlertWriter == nil {
 		return
 	}
-
-	// Alert-only log for detection mode.
-	if tx.IsInterrupted() && de.Mode != "blocking" {
-		slog.Info("waf: request flagged (detection)",
-			"host", host, "method", method, "uri", uri, "client", clientIP,
-		)
+	action := "detected"
+	if blocked && mr.Disruptive() {
+		action = "blocked"
 	}
+	a.AlertWriter.Send(Alert{
+		Hostname: host,
+		ClientIP: clientIP,
+		Method:   method,
+		URI:      uri,
+		RuleID:   mr.Rule().ID(),
+		RuleMsg:  mr.Message(),
+		Severity: mr.Rule().Severity().String(),
+		Action:   action,
+	})
 }
 
 // parseHeaders splits HAProxy raw headers ("Name: value\r\n…") and