ircforever/ddos-ui
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
No description
2 commits 1 branch 0 tags 50 KiB
Find a file
Exact
James 9c5da958f1 feat: DDoS event detection, per-event reports, IP/ASN enrichment 
- /api/events: detect discrete DDoS bursts from VictoriaMetrics (start/stop,
  duration, peak) over 48h; UI lists them, click one to report on that window.
- Reports saved per event (deterministic id) so they're reused; regenerate overwrites.
- Source enrichment: server-vs-home (managebot hosting keywords), traffic share %,
  reputation = Spamhaus ASN-DROP + AbuseIPDB (when ABUSEIPDB_KEY set).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-28 07:58:57 -04:00
web feat: DDoS event detection, per-event reports, IP/ASN enrichment 2026-06-28 07:58:57 -04:00
.dockerignore feat: DDoS incident report dashboard (Go + Svelte SPA) 2026-06-27 19:08:01 -04:00
.gitignore feat: DDoS incident report dashboard (Go + Svelte SPA) 2026-06-27 19:08:01 -04:00
Dockerfile feat: DDoS incident report dashboard (Go + Svelte SPA) 2026-06-27 19:08:01 -04:00
events.go feat: DDoS event detection, per-event reports, IP/ASN enrichment 2026-06-28 07:58:57 -04:00
go.mod feat: DDoS incident report dashboard (Go + Svelte SPA) 2026-06-27 19:08:01 -04:00
hosting.go feat: DDoS event detection, per-event reports, IP/ASN enrichment 2026-06-28 07:58:57 -04:00
main.go feat: DDoS event detection, per-event reports, IP/ASN enrichment 2026-06-28 07:58:57 -04:00
README.md feat: DDoS incident report dashboard (Go + Svelte SPA) 2026-06-27 19:08:01 -04:00
reputation.go feat: DDoS event detection, per-event reports, IP/ASN enrichment 2026-06-28 07:58:57 -04:00
spa.go feat: DDoS incident report dashboard (Go + Svelte SPA) 2026-06-27 19:08:01 -04:00

README.md

ddos-ui

Dashboard for the ircforever DDoS incident reports — a single Go binary that embeds a Svelte SPA, authenticates staff via Logto (OIDC), and generates reports by calling the on-box provision-agent's /ddos/report endpoint (bearer auth), enriching source IPs with geo/ASN intel (ip-api) and persisting each report to disk.

Runs on the VPS behind Traefik at https://ddos.ircforever.org.

Layout

  • main.go — HTTP server, OIDC (Logto) sessions, /api/* handlers
  • spa.go — embeds and serves web/dist
  • web/ — Vite + Svelte 5 SPA
  • Dockerfile — multi-stage (bun builds SPA → Go builds binary → distroless)

Config (env)

OIDC_ISSUER, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET, OIDC_REDIRECT_URL, OIDC_POST_LOGOUT_URL, OIDC_SESSION_SECRET, PROVISION_URL, PROVISION_TOKEN, REPORTS_DIR, HTTP_ADDR.

Build & run

docker build -t ddos-ui:latest .
docker run --env-file ddos-ui.env -v ./reports:/data/reports -p 8080:8080 ddos-ui:latest