feat: CrowdSec journald-Acquisition + Alarm-Quittieren/Löschen — v1.3.5

- fix(crowdsec/packaging): postinst setzt die HAProxy-Acquisition deterministisch
  auf die journald-Unit (haproxy.service) statt der cscli-setup-Datei-Default
  (/var/log/haproxy.log existiert nicht → CrowdSec las nichts → HTTP/CVE-Szenarien
  liefen leer). Self-healing auf jedem configure; admin-Custom bleibt unangetastet.
- feat(alerts): Alarme (alert_events) bulk quittieren + löschen. Migration 0045
  (acknowledged_at + Teil-Index). Dashboard-Karte zählt nur noch OFFENE (open=true)
  → Quittieren lässt die "Aktuelle Alerts"-Meldung verschwinden, History bleibt.
  Events-Tab: Row-Selection, Quittieren/Löschen (Auswahl) + "Alle quittieren",
  Status-Spalte (offen/quittiert). Audit-geloggt.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

VERSION

@@ -1 +1 @@
-1.3.4
+1.3.5

internal/database/migrations/0045_alert_events_acknowledge.sql

@@ -0,0 +1,22 @@
+-- +goose Up
+-- +goose StatementBegin
+
+-- Quittieren von Alarmen. acknowledged_at = NULL → offen (zählt im Dashboard).
+-- Gesetzt → quittiert (bleibt als History sichtbar, zählt aber nicht mehr auf
+-- der Startseiten-Karte "Aktuelle Alerts"). alert_events ist node-lokal
+-- (localOnlyTables) → kein Replikations-Effekt.
+ALTER TABLE alert_events
+    ADD COLUMN IF NOT EXISTS acknowledged_at TIMESTAMPTZ;
+
+-- Teil-Index für den Dashboard-Query (nur offene, newest-first).
+CREATE INDEX IF NOT EXISTS idx_alert_events_open
+    ON alert_events (fired_at DESC)
+    WHERE acknowledged_at IS NULL;
+
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+DROP INDEX IF EXISTS idx_alert_events_open;
+ALTER TABLE alert_events DROP COLUMN IF EXISTS acknowledged_at;
+-- +goose StatementEnd

internal/handlers/alerts.go

@@ -18,7 +18,10 @@ import (
 //	PUT    /api/v1/alerts/channels/:id
 //	DELETE /api/v1/alerts/channels/:id
 //	POST   /api/v1/alerts/test           — Test-Event in alle aktiven Channels
-//	GET    /api/v1/alerts/events?limit=N — History
+//	GET    /api/v1/alerts/events?limit=N&open=true — History (open=nur offene)
+//	POST   /api/v1/alerts/events/acknowledge      — Bulk-Quittieren {ids:[…]}
+//	POST   /api/v1/alerts/events/acknowledge-all  — alle offenen quittieren
+//	POST   /api/v1/alerts/events/delete           — Bulk-Löschen {ids:[…]}
 type AlertsHandler struct {
 	Service *alerts.Service
 	Audit   *audit.Repo
@@ -37,6 +40,9 @@ func (h *AlertsHandler) Register(rg *gin.RouterGroup) {
 	g.DELETE("/channels/:id", h.DeleteChannel)
 	g.POST("/test", h.TestFire)
 	g.GET("/events", h.ListEvents)
+	g.POST("/events/acknowledge", h.AcknowledgeEvents)
+	g.POST("/events/acknowledge-all", h.AcknowledgeAllEvents)
+	g.POST("/events/delete", h.DeleteEvents)
 }
 
 func (h *AlertsHandler) ListChannels(c *gin.Context) {
@@ -125,10 +131,64 @@ func (h *AlertsHandler) ListEvents(c *gin.Context) {
 			limit = n
 		}
 	}
-	out, err := h.Service.ListEvents(c.Request.Context(), limit)
+	// ?open=true → nur offene (nicht quittierte) Events. Nutzt die
+	// Dashboard-Karte, damit Quittieren die Meldung verschwinden lässt.
+	openOnly := c.Query("open") == "true"
+	out, err := h.Service.ListEvents(c.Request.Context(), limit, openOnly)
 	if err != nil {
 		response.Internal(c, err)
 		return
 	}
 	response.OK(c, gin.H{"events": out})
 }
+
+// eventIDsRequest ist der Body für Bulk-Quittieren/-Löschen.
+type eventIDsRequest struct {
+	IDs []int64 `json:"ids"`
+}
+
+// AcknowledgeEvents quittiert die übergebenen Event-IDs.
+func (h *AlertsHandler) AcknowledgeEvents(c *gin.Context) {
+	var req eventIDsRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	n, err := h.Service.Acknowledge(c.Request.Context(), req.IDs)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "alert.events.acknowledge",
+		strconv.Itoa(len(req.IDs)), gin.H{"ids": req.IDs, "acknowledged": n}, h.NodeID)
+	response.OK(c, gin.H{"acknowledged": n})
+}
+
+// AcknowledgeAllEvents quittiert alle offenen Events.
+func (h *AlertsHandler) AcknowledgeAllEvents(c *gin.Context) {
+	n, err := h.Service.AcknowledgeAll(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "alert.events.acknowledge_all",
+		"all", gin.H{"acknowledged": n}, h.NodeID)
+	response.OK(c, gin.H{"acknowledged": n})
+}
+
+// DeleteEvents löscht die übergebenen Event-IDs endgültig.
+func (h *AlertsHandler) DeleteEvents(c *gin.Context) {
+	var req eventIDsRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	n, err := h.Service.DeleteEvents(c.Request.Context(), req.IDs)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "alert.events.delete",
+		strconv.Itoa(len(req.IDs)), gin.H{"ids": req.IDs, "deleted": n}, h.NodeID)
+	response.OK(c, gin.H{"deleted": n})
+}

internal/services/alerts/alerts.go

@@ -62,13 +62,14 @@ type EmailSettings struct {
 
 // Event ist eine Row in alert_events.
 type Event struct {
-	ID        int64           `json:"id"`
+	ID             int64           `json:"id"`
-	Kind      string          `json:"kind"`
+	Kind           string          `json:"kind"`
-	Severity  Severity        `json:"severity"`
+	Severity       Severity        `json:"severity"`
-	Subject   string          `json:"subject"`
+	Subject        string          `json:"subject"`
-	Message   string          `json:"message"`
+	Message        string          `json:"message"`
-	SentTo    json.RawMessage `json:"sent_to"`
+	SentTo         json.RawMessage `json:"sent_to"`
-	FiredAt   time.Time       `json:"fired_at"`
+	FiredAt        time.Time       `json:"fired_at"`
+	AcknowledgedAt *time.Time      `json:"acknowledged_at,omitempty"`
 }
 
 // SendResult pro Channel — landet als JSON-Array in sent_to.
@@ -170,14 +171,19 @@ func (s *Service) DeleteChannel(ctx context.Context, id int64) error {
 	return nil
 }
 
-// ListEvents liefert die letzten N Events newest-first.
+// ListEvents liefert die letzten N Events newest-first. Wenn openOnly
-func (s *Service) ListEvents(ctx context.Context, limit int) ([]Event, error) {
+// gesetzt ist, werden nur noch offene (nicht quittierte) Events geliefert —
+// das nutzt die Dashboard-Karte, damit Quittieren die Meldung verschwinden
+// lässt.
+func (s *Service) ListEvents(ctx context.Context, limit int, openOnly bool) ([]Event, error) {
 	if limit <= 0 || limit > 500 {
 		limit = 100
 	}
 	rows, err := s.Pool.Query(ctx, `
-SELECT id, kind, severity, subject, message, sent_to, fired_at
+SELECT id, kind, severity, subject, message, sent_to, fired_at, acknowledged_at
-FROM alert_events ORDER BY fired_at DESC, id DESC LIMIT $1`, limit)
+FROM alert_events
+WHERE ($2::bool = false OR acknowledged_at IS NULL)
+ORDER BY fired_at DESC, id DESC LIMIT $1`, limit, openOnly)
 	if err != nil {
 		return nil, err
 	}
@@ -186,7 +192,7 @@ FROM alert_events ORDER BY fired_at DESC, id DESC LIMIT $1`, limit)
 	for rows.Next() {
 		var e Event
 		if err := rows.Scan(&e.ID, &e.Kind, &e.Severity, &e.Subject,
-			&e.Message, &e.SentTo, &e.FiredAt); err != nil {
+			&e.Message, &e.SentTo, &e.FiredAt, &e.AcknowledgedAt); err != nil {
 			return nil, err
 		}
 		out = append(out, e)
@@ -194,6 +200,46 @@ FROM alert_events ORDER BY fired_at DESC, id DESC LIMIT $1`, limit)
 	return out, rows.Err()
 }
 
+// Acknowledge quittiert die angegebenen Events (setzt acknowledged_at=NOW()
+// bei noch offenen). Liefert die Anzahl geänderter Rows.
+func (s *Service) Acknowledge(ctx context.Context, ids []int64) (int64, error) {
+	if len(ids) == 0 {
+		return 0, nil
+	}
+	tag, err := s.Pool.Exec(ctx,
+		`UPDATE alert_events SET acknowledged_at = NOW()
+		 WHERE id = ANY($1) AND acknowledged_at IS NULL`, ids)
+	if err != nil {
+		return 0, err
+	}
+	return tag.RowsAffected(), nil
+}
+
+// AcknowledgeAll quittiert alle offenen Events — Backing für den
+// "Alle quittieren"-Button.
+func (s *Service) AcknowledgeAll(ctx context.Context) (int64, error) {
+	tag, err := s.Pool.Exec(ctx,
+		`UPDATE alert_events SET acknowledged_at = NOW() WHERE acknowledged_at IS NULL`)
+	if err != nil {
+		return 0, err
+	}
+	return tag.RowsAffected(), nil
+}
+
+// DeleteEvents löscht die angegebenen Events endgültig. Liefert die Anzahl
+// gelöschter Rows.
+func (s *Service) DeleteEvents(ctx context.Context, ids []int64) (int64, error) {
+	if len(ids) == 0 {
+		return 0, nil
+	}
+	tag, err := s.Pool.Exec(ctx,
+		`DELETE FROM alert_events WHERE id = ANY($1)`, ids)
+	if err != nil {
+		return 0, err
+	}
+	return tag.RowsAffected(), nil
+}
+
 // Cleanup löscht alert_events älter als keepDays und liefert die Anzahl
 // gelöschter Rows. make_interval(days => $1) nimmt $1 sauber als int —
 // der frühere ($1 || ' days')::interval-Ansatz erzwang text und scheiterte

management-ui/src/i18n/locales/de/common.json

@@ -1505,6 +1505,12 @@
     "emptyEventsDesc": "Triggers (Cert-Expiry, Backup-Fail, Cluster-Drift, License-Invalid, etc.) haben noch keinen Event gefeuert. Wenn sie feuern, landen sie hier und werden an die konfigurierten Channels zugestellt.",
     "noChannels": "kein Channel aktiv",
     "confirmDelete": "Channel {{name}} wirklich löschen?",
+    "acknowledge": "Quittieren",
+    "acknowledgeAll": "Alle quittieren",
+    "acknowledged": "Quittiert",
+    "acked": "quittiert",
+    "open": "offen",
+    "confirmDeleteEvents": "{{n}} Event(s) endgültig löschen?",
     "kindWebhook": "Webhook (Slack/Discord/Teams/HTTP-Endpoint)",
     "kindEmail": "E-Mail (SMTP)",
     "smtp": {
@@ -1525,7 +1531,8 @@
       "time": "Zeit",
       "severity": "Severity",
       "subject": "Betreff",
-      "delivered": "Gesendet"
+      "delivered": "Gesendet",
+      "status": "Status"
     }
   },
   "remotes": {

management-ui/src/i18n/locales/en/common.json

@@ -1505,6 +1505,12 @@
     "emptyEventsDesc": "Triggers (cert expiry, backup failure, cluster drift, license invalid, etc.) haven't fired any events yet. When they do, they land here and get delivered to the configured channels.",
     "noChannels": "no active channel",
     "confirmDelete": "Really delete channel {{name}}?",
+    "acknowledge": "Acknowledge",
+    "acknowledgeAll": "Acknowledge all",
+    "acknowledged": "Acknowledged",
+    "acked": "acknowledged",
+    "open": "open",
+    "confirmDeleteEvents": "Permanently delete {{n}} event(s)?",
     "kindWebhook": "Webhook (Slack/Discord/Teams/HTTP endpoint)",
     "kindEmail": "Email (SMTP)",
     "smtp": {
@@ -1525,7 +1531,8 @@
       "time": "Time",
       "severity": "Severity",
       "subject": "Subject",
-      "delivered": "Delivered"
+      "delivered": "Delivered",
+      "status": "Status"
     }
   },
   "remotes": {

management-ui/src/pages/Alerts/index.tsx

@@ -42,6 +42,7 @@ interface AlertEvent {
   message: string
   sent_to: SendResult[]
   fired_at: string
+  acknowledged_at?: string | null
 }
 
 interface ChannelFormValues {
@@ -99,6 +100,29 @@ export default function AlertsPage() {
   const [form] = Form.useForm<ChannelFormValues>()
   const [filterSev, setFilterSev] = useState<string | undefined>()
   const [filterKind, setFilterKind] = useState<string | undefined>()
+  const [selectedIds, setSelectedIds] = useState<number[]>([])
+
+  // Nach Quittieren/Löschen sowohl die Event-Liste als auch die Dashboard-
+  // Karte (queryKey ['alerts','events','recent']) invalidieren — Prefix-Match.
+  const refreshEvents = () => {
+    setSelectedIds([])
+    void qc.invalidateQueries({ queryKey: ['alerts', 'events'] })
+  }
+  const ackMut = useMutation({
+    mutationFn: (ids: number[]) => apiClient.post('/alerts/events/acknowledge', { ids }),
+    onSuccess: () => { message.success(t('alerts.acknowledged')); refreshEvents() },
+    onError: (e: Error) => message.error(e.message),
+  })
+  const ackAllMut = useMutation({
+    mutationFn: () => apiClient.post('/alerts/events/acknowledge-all'),
+    onSuccess: () => { message.success(t('alerts.acknowledged')); refreshEvents() },
+    onError: (e: Error) => message.error(e.message),
+  })
+  const delEventsMut = useMutation({
+    mutationFn: (ids: number[]) => apiClient.post('/alerts/events/delete', { ids }),
+    onSuccess: () => { message.success(t('common.delete')); refreshEvents() },
+    onError: (e: Error) => message.error(e.message),
+  })
 
   const kindOptions = useMemo(() => {
     const kinds = [...new Set((events.data ?? []).map(e => e.kind))].sort()
@@ -276,6 +300,14 @@ export default function AlertsPage() {
         )
       },
     },
+    {
+      title: t('alerts.col.status'), key: 'ack', width: 110,
+      render: (_, r: AlertEvent) => r.acknowledged_at
+        ? <Tooltip title={dayjs(r.acknowledged_at).format('YYYY-MM-DD HH:mm')}>
+            <Tag color="green">{t('alerts.acked')}</Tag>
+          </Tooltip>
+        : <Tag color="gold">{t('alerts.open')}</Tag>,
+    },
   ]
 
   const kind = Form.useWatch('kind', form)
@@ -351,32 +383,61 @@ export default function AlertsPage() {
           label: t('alerts.tabs.events'),
           children: (
             <Card size="small">
-              <Space className="mb-8">
+              <div style={{ display: 'flex', justifyContent: 'space-between', flexWrap: 'wrap', gap: 8 }} className="mb-8">
-                <Select
+                <Space>
-                  allowClear
+                  <Select
-                  placeholder={t('alerts.col.severity')}
+                    allowClear
-                  style={{ width: 150 }}
+                    placeholder={t('alerts.col.severity')}
-                  value={filterSev}
+                    style={{ width: 150 }}
-                  onChange={setFilterSev}
+                    value={filterSev}
-                  options={[
+                    onChange={setFilterSev}
-                    { value: 'info',     label: <Tag color="blue">INFO</Tag> },
+                    options={[
-                    { value: 'warning',  label: <Tag color="orange">WARNING</Tag> },
+                      { value: 'info',     label: <Tag color="blue">INFO</Tag> },
-                    { value: 'error',    label: <Tag color="red">ERROR</Tag> },
+                      { value: 'warning',  label: <Tag color="orange">WARNING</Tag> },
-                    { value: 'critical', label: <Tag color="magenta">CRITICAL</Tag> },
+                      { value: 'error',    label: <Tag color="red">ERROR</Tag> },
-                  ]}
+                      { value: 'critical', label: <Tag color="magenta">CRITICAL</Tag> },
-                />
+                    ]}
-                <Select
+                  />
-                  allowClear
+                  <Select
-                  showSearch
+                    allowClear
-                  placeholder={t('alerts.col.kind')}
+                    showSearch
-                  style={{ width: 220 }}
+                    placeholder={t('alerts.col.kind')}
-                  value={filterKind}
+                    style={{ width: 220 }}
-                  onChange={setFilterKind}
+                    value={filterKind}
-                  options={kindOptions}
+                    onChange={setFilterKind}
-                />
+                    options={kindOptions}
-              </Space>
+                  />
+                </Space>
+                <Space>
+                  <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
+                    <Button size="small" disabled={isViewer || selectedIds.length === 0}
+                      loading={ackMut.isPending} onClick={() => ackMut.mutate(selectedIds)}>
+                      {t('alerts.acknowledge')}{selectedIds.length > 0 ? ` (${selectedIds.length})` : ''}
+                    </Button>
+                  </Tooltip>
+                  <Popconfirm title={t('alerts.confirmDeleteEvents', { n: selectedIds.length })}
+                    onConfirm={() => delEventsMut.mutate(selectedIds)}
+                    disabled={isViewer || selectedIds.length === 0}>
+                    <Button size="small" danger disabled={isViewer || selectedIds.length === 0}
+                      loading={delEventsMut.isPending}>
+                      {t('common.delete')}{selectedIds.length > 0 ? ` (${selectedIds.length})` : ''}
+                    </Button>
+                  </Popconfirm>
+                  <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
+                    <Button size="small" type="primary" ghost disabled={isViewer}
+                      loading={ackAllMut.isPending} onClick={() => ackAllMut.mutate()}>
+                      {t('alerts.acknowledgeAll')}
+                    </Button>
+                  </Tooltip>
+                </Space>
+              </div>
               <Table size="small" rowKey="id" loading={events.isFetching}
                 dataSource={filteredEvents} columns={evColumns}
+                rowSelection={{
+                  selectedRowKeys: selectedIds,
+                  onChange: (keys) => setSelectedIds(keys as number[]),
+                }}
+                rowClassName={(r) => (r.acknowledged_at ? 'eg-row-muted' : '')}
                 pagination={{ pageSize: 25 }}
                 locale={{ emptyText: (
                   <EmptyState

management-ui/src/pages/Dashboard/index.tsx

@@ -201,7 +201,7 @@ export default function DashboardPage() {
   })
   const recentAlerts = useQuery({
     queryKey: ['alerts', 'events', 'recent'],
-    queryFn: () => fetchList<AlertEvent>('/alerts/events?limit=10', 'events'),
+    queryFn: () => fetchList<AlertEvent>('/alerts/events?limit=10&open=true', 'events'),
     refetchInterval: 60_000,
   })
   const services = useQuery({

management-ui/src/styles/enterprise.css

@@ -1160,6 +1160,9 @@ h1, h2, h3, h4, h5, h6 {
 .threat-tile.threat-tile--warn { opacity: 1; border-left: 3px solid #F59E0B; }
 .threat-tile.threat-tile--crit { opacity: 1; border-left: 3px solid #DC2626; }
 .threat-tile.threat-tile--idle { opacity: 0.55; border-left: 3px solid transparent; }
+
+/* Quittierte Alert-Events (Alerts → Events-Tab) werden abgedimmt. */
+tr.eg-row-muted > td { opacity: 0.5; }
 .threat-tile-value--hit  { color: #EF4444; }
 .threat-tile-value--warn { color: #F59E0B; }
 .threat-tile-value--crit { color: #DC2626; }

packaging/debian/edgeguard-api/DEBIAN/postinst

@@ -823,6 +823,37 @@ EOSQL
             fi
         fi
 
+        # ── CrowdSec HAProxy-Acquisition auf journald zeigen ──────────
+        # EdgeGuards HAProxy loggt nach journald (log /dev/log local0/1) —
+        # es gibt KEINE /var/log/haproxy.log. `cscli setup` rät aber auf eine
+        # datei-basierte Quelle → CrowdSec liest nichts → die HTTP-/CVE-
+        # Szenarien laufen leer (WAF-artiger Web-Schutz tot). Wir setzen die
+        # Acquisition deterministisch auf die haproxy.service-Journal-Unit
+        # (analog zur sshd-Quelle). Läuft auf JEDEM configure (self-healing
+        # auch für Bestandsinstalls). Admin-Custom bleibt unangetastet: nur
+        # überschreiben, wenn Datei fehlt / noch die kaputte Datei-Default
+        # (/var/log/haproxy.log) enthält / von uns stammt.
+        if command -v cscli >/dev/null 2>&1; then
+            CS_HAPROXY_ACQUIS="/etc/crowdsec/acquis.d/setup.haproxy.yaml"
+            if [ ! -f "$CS_HAPROXY_ACQUIS" ] \
+               || grep -q '/var/log/haproxy.log' "$CS_HAPROXY_ACQUIS" 2>/dev/null \
+               || grep -q 'Managed by EdgeGuard' "$CS_HAPROXY_ACQUIS" 2>/dev/null; then
+                install -d -m 0755 /etc/crowdsec/acquis.d
+                cat > "$CS_HAPROXY_ACQUIS" <<'ACQUIS'
+# Managed by EdgeGuard. HAProxy loggt nach journald (log /dev/log local0/1),
+# es gibt keine /var/log/haproxy.log. journalctl-Quelle analog zur sshd-Acquis.
+source: journalctl
+journalctl_filter:
+  - "_SYSTEMD_UNIT=haproxy.service"
+labels:
+  type: haproxy
+ACQUIS
+                # SIGHUP-Reload lädt die Acquisition neu; Restart als Fallback.
+                systemctl reload crowdsec 2>/dev/null \
+                    || systemctl restart crowdsec 2>/dev/null || true
+            fi
+        fi
+
         # ── Render initial service configs ───────────────────────────
         # Writes /etc/edgeguard/haproxy/haproxy.cfg + nftables.d/
         # ruleset.nft from the (just-migrated, empty) PG state.