Configuration Reference

1package main
2
3import (
4    "time"
5
6    sentinel "github.com/MUKE-coder/sentinel"
7    "github.com/gin-gonic/gin"
8)
9
10func main() {
11    r := gin.Default()
12
13    sentinel.Mount(r, nil, sentinel.Config{
14        Dashboard: sentinel.DashboardConfig{
15            Username:  "admin",
16            Password:  "s3cur3-p4ss!",
17            SecretKey: "my-jwt-secret-change-in-production",
18        },
19
20        Storage: sentinel.StorageConfig{
21            Driver:        sentinel.SQLite,
22            DSN:           "sentinel.db",
23            RetentionDays: 90,
24            MaxOpenConns:  10,
25            MaxIdleConns:  5,
26        },
27
28        WAF: sentinel.WAFConfig{
29            Enabled: true,
30            Mode:    sentinel.ModeBlock,
31            Rules: sentinel.RuleSet{
32                SQLInjection:     sentinel.RuleStrict,
33                XSS:              sentinel.RuleStrict,
34                PathTraversal:    sentinel.RuleStrict,
35                CommandInjection: sentinel.RuleStrict,
36                SSRF:             sentinel.RuleMedium,
37                XXE:              sentinel.RuleStrict,
38                LFI:              sentinel.RuleStrict,
39                OpenRedirect:     sentinel.RuleMedium,
40            },
41            CustomRules: []sentinel.WAFRule{
42                {
43                    ID:        "block-admin-enum",
44                    Name:      "Block admin enumeration",
45                    Pattern:   `(?i)/(wp-admin|phpmyadmin|administrator)`,
46                    AppliesTo: []string{"path"},
47                    Severity:  sentinel.SeverityMedium,
48                    Action:    "block",
49                    Enabled:   true,
50                },
51            },
52            ExcludeRoutes: []string{"/health", "/metrics"},
53            ExcludeIPs:    []string{"10.0.0.0/8"},
54        },
55
56        RateLimit: sentinel.RateLimitConfig{
57            Enabled:  true,
58            Strategy: sentinel.SlidingWindow,
59            ByIP:     &sentinel.Limit{Requests: 100, Window: time.Minute},
60            ByUser:   &sentinel.Limit{Requests: 500, Window: time.Minute},
61            Global:   &sentinel.Limit{Requests: 5000, Window: time.Minute},
62            ByRoute: map[string]sentinel.Limit{
63                "/api/login":    {Requests: 5, Window: 15 * time.Minute},
64                "/api/register": {Requests: 3, Window: time.Hour},
65            },
66        },
67
68        AuthShield: sentinel.AuthShieldConfig{
69            Enabled:                    true,
70            LoginRoute:                 "/api/login",
71            MaxFailedAttempts:          5,
72            LockoutDuration:            15 * time.Minute,
73            CredentialStuffingDetection: true,
74            BruteForceDetection:        true,
75        },
76
77        Headers: sentinel.HeaderConfig{
78            ContentSecurityPolicy:   "default-src 'self'",
79            StrictTransportSecurity: true,
80            XFrameOptions:           "DENY",
81            XContentTypeOptions:     true,
82            ReferrerPolicy:          "strict-origin-when-cross-origin",
83            PermissionsPolicy:       "camera=(), microphone=(), geolocation=()",
84        },
85
86        Anomaly: sentinel.AnomalyConfig{
87            Enabled:        true,
88            Sensitivity:    sentinel.AnomalySensitivityMedium,
89            LearningPeriod: 7 * 24 * time.Hour,
90            Checks: []sentinel.AnomalyCheckType{
91                sentinel.CheckImpossibleTravel,
92                sentinel.CheckUnusualAccess,
93                sentinel.CheckDataExfiltration,
94                sentinel.CheckOffHoursAccess,
95                sentinel.CheckVelocityAnomaly,
96            },
97        },
98
99        IPReputation: sentinel.IPReputationConfig{
100            Enabled:       true,
101            AbuseIPDBKey:  "your-abuseipdb-api-key",
102            AutoBlock:     true,
103            MinAbuseScore: 80,
104        },
105
106        Geo: sentinel.GeoConfig{
107            Enabled:  true,
108            Provider: sentinel.GeoIPFree,
109        },
110
111        Alerts: sentinel.AlertConfig{
112            MinSeverity: sentinel.SeverityHigh,
113            Slack: &sentinel.SlackConfig{
114                WebhookURL: "https://hooks.slack.com/services/...",
115            },
116            Email: &sentinel.EmailConfig{
117                SMTPHost:   "smtp.example.com",
118                SMTPPort:   587,
119                Username:   "alerts@example.com",
120                Password:   "smtp-password",
121                Recipients: []string{"security@example.com"},
122            },
123            Webhook: &sentinel.WebhookConfig{
124                URL: "https://your-siem.example.com/webhook",
125                Headers: map[string]string{
126                    "Authorization": "Bearer your-token",
127                },
128            },
129        },
130
131        AI: &sentinel.AIConfig{
132            Provider:     sentinel.Claude,
133            APIKey:       "your-anthropic-api-key",
134            Model:        "claude-sonnet-4-20250514",
135            DailySummary: true,
136        },
137
138        UserExtractor: func(c *gin.Context) *sentinel.UserContext {
139            userID := c.GetHeader("X-User-ID")
140            if userID == "" {
141                return nil
142            }
143            return &sentinel.UserContext{
144                ID:    userID,
145                Email: c.GetHeader("X-User-Email"),
146                Role:  c.GetHeader("X-User-Role"),
147            }
148        },
149
150        Performance: sentinel.PerformanceConfig{
151            SlowRequestThreshold: 2 * time.Second,
152            SlowQueryThreshold:   500 * time.Millisecond,
153            TrackMemory:          true,
154            TrackGoroutines:      true,
155        },
156    })
157
158    r.GET("/api/hello", func(c *gin.Context) {
159        c.JSON(200, gin.H{"message": "Hello, World!"})
160    })
161
162    r.Run(":8080")
163}

1Dashboard: sentinel.DashboardConfig{
2    Prefix:    "/admin/security",
3    Username:  "secops",
4    Password:  "change-me-in-production",
5    SecretKey: "a-strong-random-secret",
6}

1// SQLite (default, recommended)
2Storage: sentinel.StorageConfig{
3    Driver:        sentinel.SQLite,
4    DSN:           "sentinel.db",
5    RetentionDays: 30,
6}
7
8// In-memory (for development/testing)
9Storage: sentinel.StorageConfig{
10    Driver: sentinel.Memory,
11}
12
13// PostgreSQL
14Storage: sentinel.StorageConfig{
15    Driver:       sentinel.Postgres,
16    DSN:          "postgres://user:pass@localhost:5432/sentinel?sslmode=disable",
17    MaxOpenConns: 25,
18    MaxIdleConns: 10,
19}

1WAF: sentinel.WAFConfig{
2    Enabled: true,
3    Mode:    sentinel.ModeBlock,
4    Rules: sentinel.RuleSet{
5        SQLInjection:     sentinel.RuleStrict,
6        XSS:              sentinel.RuleStrict,
7        PathTraversal:    sentinel.RuleStrict,
8        CommandInjection: sentinel.RuleStrict,
9        SSRF:             sentinel.RuleMedium,
10        XXE:              sentinel.RuleStrict,
11        LFI:              sentinel.RuleStrict,
12        OpenRedirect:     sentinel.RuleMedium,
13    },
14    CustomRules: []sentinel.WAFRule{
15        {
16            ID:        "block-admin-enum",
17            Name:      "Block admin enumeration",
18            Pattern:   `(?i)/(wp-admin|phpmyadmin|administrator)`,
19            AppliesTo: []string{"path"},
20            Severity:  sentinel.SeverityMedium,
21            Action:    "block",
22            Enabled:   true,
23        },
24        {
25            ID:        "block-sensitive-files",
26            Name:      "Block sensitive file access",
27            Pattern:   `(?i)\.(env|git|bak|sql|log)$`,
28            AppliesTo: []string{"path"},
29            Severity:  sentinel.SeverityHigh,
30            Action:    "block",
31            Enabled:   true,
32        },
33    },
34    ExcludeRoutes: []string{"/health", "/readiness"},
35    ExcludeIPs:    []string{"127.0.0.1", "10.0.0.0/8"},
36}

1RateLimit: sentinel.RateLimitConfig{
2    Enabled:  true,
3    Strategy: sentinel.SlidingWindow,
4
5    // 100 requests per minute per IP
6    ByIP: &sentinel.Limit{Requests: 100, Window: time.Minute},
7
8    // 500 requests per minute per authenticated user
9    ByUser: &sentinel.Limit{Requests: 500, Window: time.Minute},
10
11    // 5000 requests per minute globally
12    Global: &sentinel.Limit{Requests: 5000, Window: time.Minute},
13
14    // Strict limits on sensitive routes
15    ByRoute: map[string]sentinel.Limit{
16        "/api/login":    {Requests: 5, Window: 15 * time.Minute},
17        "/api/register": {Requests: 3, Window: time.Hour},
18        "/api/password-reset": {Requests: 3, Window: time.Hour},
19    },
20
21    // Extract user ID from your auth system
22    UserIDExtractor: func(c *gin.Context) string {
23        return c.GetHeader("X-User-ID")
24    },
25}

1AuthShield: sentinel.AuthShieldConfig{
2    Enabled:                    true,
3    LoginRoute:                 "/api/login",
4    MaxFailedAttempts:          5,
5    LockoutDuration:            15 * time.Minute,
6    CredentialStuffingDetection: true,
7    BruteForceDetection:        true,
8}

1Headers: sentinel.HeaderConfig{
2    ContentSecurityPolicy:   "default-src 'self'; script-src 'self' 'unsafe-inline'",
3    StrictTransportSecurity: true,
4    XFrameOptions:           "DENY",
5    XContentTypeOptions:     true,
6    ReferrerPolicy:          "strict-origin-when-cross-origin",
7    PermissionsPolicy:       "camera=(), microphone=(), geolocation=()",
8}

1Anomaly: sentinel.AnomalyConfig{
2    Enabled:        true,
3    Sensitivity:    sentinel.AnomalySensitivityMedium,
4    LearningPeriod: 7 * 24 * time.Hour,
5    Checks: []sentinel.AnomalyCheckType{
6        sentinel.CheckImpossibleTravel,
7        sentinel.CheckUnusualAccess,
8        sentinel.CheckDataExfiltration,
9        sentinel.CheckVelocityAnomaly,
10    },
11}

1IPReputation: sentinel.IPReputationConfig{
2    Enabled:       true,
3    AbuseIPDBKey:  os.Getenv("ABUSEIPDB_API_KEY"),
4    AutoBlock:     true,
5    MinAbuseScore: 80,
6}

1Geo: sentinel.GeoConfig{
2    Enabled:  true,
3    Provider: sentinel.GeoIPFree,
4}

1Alerts: sentinel.AlertConfig{
2    MinSeverity: sentinel.SeverityHigh,
3
4    // Slack alerts
5    Slack: &sentinel.SlackConfig{
6        WebhookURL: "https://hooks.slack.com/services/T00/B00/xxx",
7    },
8
9    // Email alerts
10    Email: &sentinel.EmailConfig{
11        SMTPHost:   "smtp.example.com",
12        SMTPPort:   587,
13        Username:   "alerts@example.com",
14        Password:   "smtp-password",
15        Recipients: []string{
16            "security-team@example.com",
17            "oncall@example.com",
18        },
19    },
20
21    // Webhook alerts (e.g., to a SIEM)
22    Webhook: &sentinel.WebhookConfig{
23        URL: "https://siem.example.com/api/ingest",
24        Headers: map[string]string{
25            "Authorization": "Bearer your-api-token",
26            "X-Source":      "sentinel",
27        },
28    },
29}

1// Using Anthropic Claude
2AI: &sentinel.AIConfig{
3    Provider:     sentinel.Claude,
4    APIKey:       os.Getenv("ANTHROPIC_API_KEY"),
5    DailySummary: true,
6}
7
8// Using OpenAI
9AI: &sentinel.AIConfig{
10    Provider: sentinel.OpenAI,
11    APIKey:   os.Getenv("OPENAI_API_KEY"),
12    Model:    "gpt-4o",
13}
14
15// Using Google Gemini
16AI: &sentinel.AIConfig{
17    Provider: sentinel.Gemini,
18    APIKey:   os.Getenv("GEMINI_API_KEY"),
19}

1// Extract user from JWT claims set by your auth middleware
2UserExtractor: func(c *gin.Context) *sentinel.UserContext {
3    // Option 1: From headers (proxy/gateway sets these)
4    userID := c.GetHeader("X-User-ID")
5    if userID == "" {
6        return nil // Unauthenticated request
7    }
8    return &sentinel.UserContext{
9        ID:    userID,
10        Email: c.GetHeader("X-User-Email"),
11        Role:  c.GetHeader("X-User-Role"),
12    }
13}
14
15// Option 2: From Gin context (your auth middleware sets these)
16UserExtractor: func(c *gin.Context) *sentinel.UserContext {
17    userID, exists := c.Get("userID")
18    if !exists {
19        return nil
20    }
21    return &sentinel.UserContext{
22        ID:    userID.(string),
23        Email: c.GetString("userEmail"),
24        Role:  c.GetString("userRole"),
25    }
26}

1Performance: sentinel.PerformanceConfig{
2    SlowRequestThreshold: 1 * time.Second,
3    SlowQueryThreshold:   200 * time.Millisecond,
4    TrackMemory:          true,
5    TrackGoroutines:      true,
6}

1// Zero config — all defaults applied automatically
2r := gin.Default()
3sentinel.Mount(r, nil, sentinel.Config{})
4
5// This is equivalent to:
6sentinel.Mount(r, nil, sentinel.Config{
7    Dashboard: sentinel.DashboardConfig{
8        // Enabled:   true (default)
9        // Prefix:    "/sentinel"
10        // Username:  "admin"
11        // Password:  "sentinel"
12    },
13    Storage: sentinel.StorageConfig{
14        // Driver:        sentinel.SQLite
15        // DSN:           "sentinel.db"
16        // RetentionDays: 90
17    },
18    // WAF:       disabled
19    // RateLimit: disabled
20    // AuthShield: disabled
21    // Headers:   enabled with safe defaults
22    // Anomaly:   disabled
23    // Performance: enabled
24})

1import "os"
2
3config := sentinel.Config{
4    Dashboard: sentinel.DashboardConfig{
5        Username:  os.Getenv("SENTINEL_USERNAME"),
6        Password:  os.Getenv("SENTINEL_PASSWORD"),
7        SecretKey: os.Getenv("SENTINEL_SECRET_KEY"),
8    },
9    Storage: sentinel.StorageConfig{
10        Driver: sentinel.SQLite,
11        DSN:    os.Getenv("SENTINEL_DB_PATH"),
12    },
13    AI: &sentinel.AIConfig{
14        Provider: sentinel.Claude,
15        APIKey:   os.Getenv("ANTHROPIC_API_KEY"),
16    },
17    Alerts: sentinel.AlertConfig{
18        Slack: &sentinel.SlackConfig{
19            WebhookURL: os.Getenv("SLACK_WEBHOOK_URL"),
20        },
21    },
22    IPReputation: sentinel.IPReputationConfig{
23        Enabled:      os.Getenv("ABUSEIPDB_API_KEY") != "",
24        AbuseIPDBKey: os.Getenv("ABUSEIPDB_API_KEY"),
25    },
26}