dennisleetw/pandora-console repository overview

⁠pandora-console

⁠Short Description

Pandora Box Console IDS-IPS Backend API - Comprehensive security management console with Vision One integration, device management, and zero-trust verification

⁠Full Description

# Pandora Box Console IDS-IPS Backend API

A production-ready backend API server for the Pandora Box Console IDS-IPS platform, providing comprehensive security management, threat intelligence integration, device management, and zero-trust verification capabilities.

## Features

- **Vision One Integration**: Real-time threat intelligence from Trend Micro Vision One
- **Device Management**: Complete CRUD operations for device registry and verification
- **Zero-Trust Verification**: WebAuthn-based device authentication and verification
- **Database Migrations**: Automated PostgreSQL migrations with support for DATABASE_URL
- **RESTful API**: Comprehensive REST API with Swagger/OpenAPI documentation
- **Authentication**: JWT-based authentication with refresh tokens
- **WebSocket Support**: Real-time updates via WebSocket connections
- **Multi-Database Support**: PostgreSQL (Supabase, Render, OCI compatible)
- **RabbitMQ Integration**: Event-driven architecture with RabbitMQ
- **Non-Root Execution**: Runs as non-root user for security

## Quick Start

```bash
docker run -d \
  --name pandora-console \
  -p 3001:3001 \
  -e DATABASE_URL=postgresql://user:pass@host:5432/dbname \
  -e JWT_SECRET=your-secret-key \
  -e RUN_MIGRATIONS=true \
  -v /app/config:/app/config \
  your-username/pandora-console:latest

⁠Required Environment Variables

• DATABASE_URL: PostgreSQL connection string (or use POSTGRES_* variables)
• JWT_SECRET: Secret key for JWT token generation
• RUN_MIGRATIONS: Set to true to run database migrations on startup
• REDIS_URL: Redis connection string for caching
• VISION_ONE_API_KEY: (Optional) Trend Micro Vision One API key
• RABBITMQ_URL: (Optional) RabbitMQ connection string

See configs/console-config.yaml.template for full configuration.

⁠Database Migrations

The container supports automatic database migrations:

1. Set RUN_MIGRATIONS=true environment variable
2. Provide database connection via DATABASE_URL or POSTGRES_* variables
3. Migrations run automatically on container startup
4. Supports Supabase, Render, and standard PostgreSQL connections

⁠API Documentation

Swagger/OpenAPI documentation is available at:

• /swagger/index.html - Interactive API documentation
• /swagger.json - OpenAPI 3.0 specification
• /swagger.yaml - OpenAPI 3.0 specification (YAML)

⁠Health Check

• Endpoint: /api/v1/health
• Port: 3001
• Interval: 30 seconds

⁠Architecture

• Base Image: Alpine Linux (latest)
• Runtime: Go 1.25 (statically compiled)
• Database: PostgreSQL (via postgresql-client for migrations)
• Size: ~200MB compressed

⁠Included Components

• Swagger documentation generation
• Database migration scripts (goose-compatible)
• WebAuthn configuration support
• Vision One sync service
• Device registry management
• Audit logging system
• IAM (Identity and Access Management)

⁠Security

• Non-root user execution (UID 1001)
• SSL/TLS support for database connections
• JWT token-based authentication
• Environment variable-based configuration (no secrets in image)
• Minimal attack surface (Alpine Linux)

⁠Documentation

• API Documentation⁠
• Deployment Guide⁠
• Vision One Integration⁠
• Configuration Reference⁠

⁠License

Proprietary - All rights reserved

⁠Support

For issues and questions, please open an issue on GitHub.

---

## pandora-lockhead

### Short Description
**Pandora Box Lockhead Ingestion Worker - SBOM and provenance verification service with support for droppr, protobomit, hoppr-cop, and bomctl**

### Full Description

```markdown
# Pandora Box Lockhead Ingestion Worker

A specialized ingestion worker service for SBOM (Software Bill of Materials) processing, provenance verification, and vulnerability scanning. Includes integration with industry-standard tools for SBOM composition, verification, and analysis.

## Features

- **SBOM Processing**: Comprehensive SBOM ingestion and processing pipeline
- **Provenance Verification**: Cryptographic provenance verification using protobomit
- **Vulnerability Scanning**: SBOM-based vulnerability detection with hoppr-cop
- **SBOM Composition**: Multi-format SBOM merging and composition via bomctl
- **Bundle Unpacking**: Hoppr bundle extraction with droppr
- **PostgreSQL Integration**: Persistent storage for SBOMs, attestations, and reports
- **Audit Logging**: Complete audit trail for all SBOM operations
- **Non-Root Execution**: Runs as non-root user (lockhead:1001)

## Included Tools

- **droppr**: Hoppr bundle unpacking tool
- **protobomit**: SBOM provenance verification
- **hoppr-cop**: SBOM vulnerability scanning
- **bomctl**: SBOM composition and merging tool

## Quick Start

```bash
docker run -d \
  --name pandora-lockhead \
  -p 3002:3002 \
  -e DATABASE_URL=postgresql://user:pass@host:5432/dbname \
  -e INGEST_STAGING_DIR=/app/staging \
  -e INGEST_BLOB_DIR=/app/blobs \
  -v lockhead_staging:/app/staging \
  -v lockhead_blobs:/app/blobs \
  your-username/pandora-lockhead:latest

⁠Configuration

Required environment variables:

• DATABASE_URL: PostgreSQL connection string
• INGEST_STAGING_DIR: Directory for staging SBOM files (default: /app/staging)
• INGEST_BLOB_DIR: Directory for blob storage (default: /app/blobs)
• DROPPR_PATH: Path to droppr binary (default: /usr/local/bin/droppr)
• PROTOBOMIT_PATH: Path to protobomit binary (default: /usr/local/bin/protobomit)
• HOPPR_COP_PATH: Path to hoppr-cop binary (default: /usr/local/bin/hoppr-cop)
• BOMCTL_PATH: Path to bomctl binary (default: /usr/local/bin/bomctl)

⁠Health Check

• Endpoint: /api/v1/health
• Port: 3002
• Interval: 30 seconds

⁠Architecture

• Base Image: Alpine Linux 3.22.1
• Runtime: Go 1.25 (statically compiled)
• Database: PostgreSQL (with migration support)
• Tools: Python 3 for hoppr-cop
• Size: ~300MB compressed (includes all SBOM tools)

⁠Supported SBOM Formats

• SPDX (Software Package Data Exchange)
• CycloneDX
• SWID (Software Identification)
• Custom formats via bomctl

⁠Use Cases

• Software supply chain security
• License compliance verification
• Vulnerability management
• Software asset inventory
• Provenance attestation

⁠Documentation

• Lockhead Documentation⁠
• SBOM Format Guide⁠
• Configuration Reference⁠

⁠License

Proprietary - All rights reserved

⁠Support

For issues and questions, please open an issue on GitHub.