nickcrew/synapse-fleet repository overview

⁠Synapse Fleet

Multi-tenant fleet intelligence hub and management control plane for distributed Synapse WAF sensors. Centralized threat correlation, impossible travel detection, historical hunting, and collaborative incident response.

Part of the Edge Protection⁠ platform alongside Synapse WAF⁠.

⁠Quick Start

Synapse Fleet requires PostgreSQL as its source of truth:

# Start PostgreSQL
docker run -d --name postgres \
  -e POSTGRES_DB=synapse_fleet \
  -e POSTGRES_USER=postgres \
  -e POSTGRES_PASSWORD=postgres \
  -p 5432:5432 \
  postgres:15-alpine

# Start Synapse Fleet
docker run -p 3100:3100 \
  -e DATABASE_URL=postgresql://postgres:[email protected]:5432/synapse_fleet \
  nickcrew/synapse-fleet

• API: localhost:3100⁠
• WebSocket (sensors): ws://localhost:3100/ws/sensors
• WebSocket (dashboard): ws://localhost:3100/ws/dashboard

⁠Configuration

⁠WebSocket

⁠Signal Processing

⁠Security

⁠Optional Services

⁠Key Features

• Fleet Management — centralized command and control for distributed Synapse sensors
• Threat Intelligence — real-time campaign correlation across tenants
• Impossible Travel Detection — geographic anomaly detection for credential compromise
• Historical Hunting — time-window routing between PostgreSQL and ClickHouse
• War Room — collaborative incident response workspace

⁠Dependencies

⁠Using with Synapse WAF

Synapse WAF⁠ sensors connect to Synapse Fleet via WebSocket to stream detection signals and receive blocklist updates. Configure Synapse's telemetry section to point at the fleet hub:

# In Synapse config.yaml
telemetry:
  enabled: true
  endpoint: "http://synapse-fleet:3100/telemetry"
  api_key: "your-api-key"
  batch_size: 100
  flush_interval: 10s

⁠Full Platform (Compose)

Run Synapse Fleet with Synapse WAF, PostgreSQL, and optional ClickHouse:

services:
  synapse-fleet:
    image: nickcrew/synapse-fleet:latest
    ports:
      - "3100:3100"
    environment:
      NODE_ENV: production
      DATABASE_URL: postgresql://postgres:postgres@postgres:5432/synapse_fleet
      CLICKHOUSE_ENABLED: "true"
      CLICKHOUSE_HOST: clickhouse
      REDIS_URL: redis://redis:6379
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - edge
    restart: unless-stopped

  synapse:
    image: nickcrew/synapse-waf:latest
    ports:
      - "6190:6190"
      - "6191:6191"
    volumes:
      - ./config.yaml:/app/config.yaml:ro
    networks:
      - edge
    restart: unless-stopped

  postgres:
    image: postgres:15-alpine
    environment:
      POSTGRES_DB: synapse_fleet
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - edge

  clickhouse:
    image: clickhouse/clickhouse-server:23.8
    volumes:
      - clickhouse_data:/var/lib/clickhouse
    networks:
      - edge

  redis:
    image: redis:7-alpine
    networks:
      - edge

networks:
  edge:

volumes:
  postgres_data:
  clickhouse_data:

docker compose up -d

⁠Also available on npm

npm install -g @atlascrew/synapse-fleet
synapse-fleet start

⁠Migrating from nickcrew/horizon

Signal Horizon has been renamed to Synapse Fleet. The Docker image nickcrew/horizon is deprecated and will not receive new builds. Existing tags remain pullable, but new releases (bug fixes, features, security patches) are only published under nickcrew/synapse-fleet.

To migrate:

• Replace nickcrew/horizon with nickcrew/synapse-fleet in compose files, Kubernetes manifests, and pull commands.
• Environment variables (HORIZON_*, DATABASE_URL, etc.) and the on-wire protocol are unchanged — no data migration required.
• The internal behaviour, API, and storage layout are identical. This is a pure name change.

See ADR-0003⁠ for the full rename scope.

⁠Links

• Homepage⁠
• Documentation⁠
• GitHub⁠
• npm⁠