Sign inSign up

nickcrew/horizon

By nickcrew

•Updated 6 months ago
Archived

Moved to nickcrew/synapse-fleet

Image
Networking
Security
Monitoring & observability
0

205

nickcrew/horizon repository overview

ATTENTION: Repository has moved to nickcrew/synapse-fleet⁠

⁠Signal Horizon

Multi-tenant fleet intelligence hub and management control plane for distributed Synapse WAF sensors. Centralized threat correlation, impossible travel detection, historical hunting, and collaborative incident response.

Integrates with Synapse WAF⁠.

⁠Quick Start

Horizon requires PostgreSQL as its source of truth:

# Start PostgreSQL
docker run -d --name postgres \
  -e POSTGRES_DB=signal_horizon \
  -e POSTGRES_USER=postgres \
  -e POSTGRES_PASSWORD=postgres \
  -p 5432:5432 \
  postgres:15-alpine

# Start Horizon
docker run -p 3100:3100 \
  -e DATABASE_URL=postgresql://postgres:[email protected]:5432/signal_horizon \
  nickcrew/horizon
  • API: localhost:3100⁠
  • WebSocket (sensors): ws://localhost:3100/ws/sensors
  • WebSocket (dashboard): ws://localhost:3100/ws/dashboard

⁠Configuration

VariableDefaultDescription
PORT3100API server port
HOST0.0.0.0Bind address
NODE_ENVdevelopmentEnvironment (production recommended)
DATABASE_URL—PostgreSQL connection string (required)
LOG_LEVELinfoLogging level
⁠WebSocket
VariableDefaultDescription
WS_SENSOR_PATH/ws/sensorsSensor connection endpoint
WS_DASHBOARD_PATH/ws/dashboardDashboard connection endpoint
WS_HEARTBEAT_INTERVAL_MS30000Heartbeat interval
WS_MAX_SENSOR_CONNECTIONS1000Max sensor connections
WS_MAX_DASHBOARD_CONNECTIONS100Max dashboard connections
⁠Signal Processing
VariableDefaultDescription
SIGNAL_BATCH_SIZE100Signals per batch
SIGNAL_BATCH_TIMEOUT_MS5000Max batch wait time
BLOCKLIST_PUSH_DELAY_MS50Blocklist propagation delay
BLOCKLIST_CACHE_SIZE100000Max cached blocklist entries
⁠Security
VariableDefaultDescription
API_KEY_HEADERX-API-KeyHeader for API authentication
CONFIG_ENCRYPTION_KEY—Encryption key for stored configs
TELEMETRY_JWT_SECRET—JWT secret for telemetry auth
CORS_ORIGINS—Comma-separated allowed origins
⁠Optional Services
VariableDefaultDescription
REDIS_URL—Redis connection string (recommended for production)
CLICKHOUSE_ENABLEDfalseEnable ClickHouse for historical analytics
CLICKHOUSE_HOSTlocalhostClickHouse host
CLICKHOUSE_HTTP_PORT8123ClickHouse HTTP port
CLICKHOUSE_DBsignal_horizonClickHouse database
CLICKHOUSE_USERdefaultClickHouse user
CLICKHOUSE_PASSWORD—ClickHouse password

⁠Key Features

  • Fleet Management — centralized command and control for distributed Synapse sensors
  • Threat Intelligence — real-time campaign correlation across tenants
  • Impossible Travel Detection — geographic anomaly detection for credential compromise
  • Historical Hunting — time-window routing between PostgreSQL and ClickHouse
  • War Room — collaborative incident response workspace

⁠Dependencies

ServiceRequiredPurpose
PostgreSQL 15+YesSource of truth for tenants, configs, signals
Redis 7+RecommendedQueue, distributed state, pub/sub
ClickHouse 23+OptionalHistorical analytics and long-term signal storage

⁠Using with Synapse WAF

Synapse WAF⁠ sensors connect to Horizon via WebSocket to stream detection signals and receive blocklist updates. Configure Synapse's telemetry section to point at Horizon:

# In Synapse config.yaml
telemetry:
  enabled: true
  endpoint: "http://horizon:3100/telemetry"
  api_key: "your-api-key"
  batch_size: 100
  flush_interval: 10s

⁠Full Platform (Compose)

Run Horizon with Synapse WAF, PostgreSQL, and optional ClickHouse:

services:
  horizon:
    image: nickcrew/horizon:latest
    ports:
      - "3100:3100"
    environment:
      NODE_ENV: production
      DATABASE_URL: postgresql://postgres:postgres@postgres:5432/signal_horizon
      CLICKHOUSE_ENABLED: "true"
      CLICKHOUSE_HOST: clickhouse
      REDIS_URL: redis://redis:6379
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - edge
    restart: unless-stopped

  synapse:
    image: nickcrew/synapse-waf:latest
    ports:
      - "6190:6190"
      - "6191:6191"
    volumes:
      - ./config.yaml:/app/config.yaml:ro
    networks:
      - edge
    restart: unless-stopped

  postgres:
    image: postgres:15-alpine
    environment:
      POSTGRES_DB: signal_horizon
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - edge

  clickhouse:
    image: clickhouse/clickhouse-server:23.8
    volumes:
      - clickhouse_data:/var/lib/clickhouse
    networks:
      - edge

  redis:
    image: redis:7-alpine
    networks:
      - edge

networks:
  edge:

volumes:
  postgres_data:
  clickhouse_data:
docker compose up -d
ServiceURL
Horizon APIlocalhost:3100⁠
Synapse Proxylocalhost:6190⁠
Synapse Adminlocalhost:6191⁠

⁠Also available on npm

npm install -g @atlascrew/horizon
horizon start

Tag summary

Content type

Image

Digest

sha256:7ae1df4c5…

Size

365.6 MB

Last updated

6 months ago

docker pull nickcrew/horizon