Sign inSign up

nickcrew/horizon

By nickcrew

Updated 6 months ago
Archived

Moved to nickcrew/synapse-fleet

Image
Networking
Security
Monitoring & observability
0

197

nickcrew/horizon repository overview

ATTENTION: Repository has moved to nickcrew/synapse-fleet

Signal Horizon

Multi-tenant fleet intelligence hub and management control plane for distributed Synapse WAF sensors. Centralized threat correlation, impossible travel detection, historical hunting, and collaborative incident response.

Integrates with Synapse WAF.

Quick Start

Horizon requires PostgreSQL as its source of truth:

# Start PostgreSQL
docker run -d --name postgres \
  -e POSTGRES_DB=signal_horizon \
  -e POSTGRES_USER=postgres \
  -e POSTGRES_PASSWORD=postgres \
  -p 5432:5432 \
  postgres:15-alpine

# Start Horizon
docker run -p 3100:3100 \
  -e DATABASE_URL=postgresql://postgres:[email protected]:5432/signal_horizon \
  nickcrew/horizon
  • API: localhost:3100
  • WebSocket (sensors): ws://localhost:3100/ws/sensors
  • WebSocket (dashboard): ws://localhost:3100/ws/dashboard

Configuration

VariableDefaultDescription
PORT3100API server port
HOST0.0.0.0Bind address
NODE_ENVdevelopmentEnvironment (production recommended)
DATABASE_URLPostgreSQL connection string (required)
LOG_LEVELinfoLogging level
WebSocket
VariableDefaultDescription
WS_SENSOR_PATH/ws/sensorsSensor connection endpoint
WS_DASHBOARD_PATH/ws/dashboardDashboard connection endpoint
WS_HEARTBEAT_INTERVAL_MS30000Heartbeat interval
WS_MAX_SENSOR_CONNECTIONS1000Max sensor connections
WS_MAX_DASHBOARD_CONNECTIONS100Max dashboard connections
Signal Processing
VariableDefaultDescription
SIGNAL_BATCH_SIZE100Signals per batch
SIGNAL_BATCH_TIMEOUT_MS5000Max batch wait time
BLOCKLIST_PUSH_DELAY_MS50Blocklist propagation delay
BLOCKLIST_CACHE_SIZE100000Max cached blocklist entries
Security
VariableDefaultDescription
API_KEY_HEADERX-API-KeyHeader for API authentication
CONFIG_ENCRYPTION_KEYEncryption key for stored configs
TELEMETRY_JWT_SECRETJWT secret for telemetry auth
CORS_ORIGINSComma-separated allowed origins
Optional Services
VariableDefaultDescription
REDIS_URLRedis connection string (recommended for production)
CLICKHOUSE_ENABLEDfalseEnable ClickHouse for historical analytics
CLICKHOUSE_HOSTlocalhostClickHouse host
CLICKHOUSE_HTTP_PORT8123ClickHouse HTTP port
CLICKHOUSE_DBsignal_horizonClickHouse database
CLICKHOUSE_USERdefaultClickHouse user
CLICKHOUSE_PASSWORDClickHouse password

Key Features

  • Fleet Management — centralized command and control for distributed Synapse sensors
  • Threat Intelligence — real-time campaign correlation across tenants
  • Impossible Travel Detection — geographic anomaly detection for credential compromise
  • Historical Hunting — time-window routing between PostgreSQL and ClickHouse
  • War Room — collaborative incident response workspace

Dependencies

ServiceRequiredPurpose
PostgreSQL 15+YesSource of truth for tenants, configs, signals
Redis 7+RecommendedQueue, distributed state, pub/sub
ClickHouse 23+OptionalHistorical analytics and long-term signal storage

Using with Synapse WAF

Synapse WAF sensors connect to Horizon via WebSocket to stream detection signals and receive blocklist updates. Configure Synapse's telemetry section to point at Horizon:

# In Synapse config.yaml
telemetry:
  enabled: true
  endpoint: "http://horizon:3100/telemetry"
  api_key: "your-api-key"
  batch_size: 100
  flush_interval: 10s

Full Platform (Compose)

Run Horizon with Synapse WAF, PostgreSQL, and optional ClickHouse:

services:
  horizon:
    image: nickcrew/horizon:latest
    ports:
      - "3100:3100"
    environment:
      NODE_ENV: production
      DATABASE_URL: postgresql://postgres:postgres@postgres:5432/signal_horizon
      CLICKHOUSE_ENABLED: "true"
      CLICKHOUSE_HOST: clickhouse
      REDIS_URL: redis://redis:6379
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - edge
    restart: unless-stopped

  synapse:
    image: nickcrew/synapse-waf:latest
    ports:
      - "6190:6190"
      - "6191:6191"
    volumes:
      - ./config.yaml:/app/config.yaml:ro
    networks:
      - edge
    restart: unless-stopped

  postgres:
    image: postgres:15-alpine
    environment:
      POSTGRES_DB: signal_horizon
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - edge

  clickhouse:
    image: clickhouse/clickhouse-server:23.8
    volumes:
      - clickhouse_data:/var/lib/clickhouse
    networks:
      - edge

  redis:
    image: redis:7-alpine
    networks:
      - edge

networks:
  edge:

volumes:
  postgres_data:
  clickhouse_data:
docker compose up -d
ServiceURL
Horizon APIlocalhost:3100
Synapse Proxylocalhost:6190
Synapse Adminlocalhost:6191

Also available on npm

npm install -g @atlascrew/horizon
horizon start

Tag summary

Content type

Image

Digest

sha256:7ae1df4c5

Size

365.6 MB

Last updated

6 months ago

docker pull nickcrew/horizon