Реализована проверка версионности и требование soft\force обновлений приложения

2026-09-03 19:12:38 +03:00
parent 465a70d488
commit 44db38f6fe
37 changed files with 3057 additions and 53 deletions
@@ -0,0 +1,90 @@
+# KESL 12.4 standalone policy decisions for HAN Chat VM1.
+#
+# REFERENCE ONLY: this is deliberately not a complete kesl-control import file.
+# Export the settings from the installed build, review the diff, and apply
+# individual values by the commands in RUNBOOK.KESL.ru.md. Importing a partial
+# or version-mismatched file can reset settings that are not listed here.
+#
+# This file contains no license, activation code, proxy credentials, hostname,
+# IP address, secret or environment value.
+
+[deployment]
+product_major_minor=12.4
+mode=standard_standalone
+gui=disabled
+update_source=KLServers
+interceptor=fanotify
+network_features=disabled
+ksn=<Yes_OR_No_AFTER_SECURITY_AND_LEGAL_APPROVAL>
+
+[resource_budget]
+# Choose from measured host capacity; see runbook section 4.
+scan_memory_limit_mb=<1024_OR_APPROVED_VALUE>
+max_memory=<2048MB_OR_APPROVED_VALUE>
+use_on_demand_cpu_limit=Yes
+on_demand_cpu_limit_percent=25
+
+[constrained_test_vm_override]
+# Explicitly approved only for the 4 GB non-production VM. Never copy this
+# profile to production without new sizing and baseline.
+scan_memory_limit_mb=512
+max_memory=1024MB
+use_on_demand_cpu_limit=Yes
+on_demand_cpu_limit_percent=15
+full_filesystem_scan=forbidden
+scan_archived=No
+parallel_ods_and_container_scan=forbidden
+stop_available_memory_mb=512
+
+[update_task_6]
+rule_type=Hourly
+required_result=completed_successfully
+required_bases_loaded=Yes
+stale_bases_alert=<APPROVED_THRESHOLD>
+
+[file_threat_protection_task_1]
+steady_state=Started
+interceptor_protection_mode=Block
+action_on_threat=DisinfectDeleteIfNotPossible
+scan_archived=No
+
+[file_threat_exclusions]
+# Replace placeholders only with mountpoints returned by docker volume inspect.
+# Do not guess the Compose project prefix.
+item_0000=<REDIS_DATA_MOUNTPOINT>
+item_0001=<OTEL_QUEUE_MOUNTPOINT>
+item_0002=<NGINX_CACHE_MOUNTPOINT>
+
+[forbidden_broad_exclusions]
+item_0000=/var/lib/docker
+item_0001=/var/lib/docker/overlay2
+item_0002=/opt/han-chat
+item_0003=/var/lib/han-deploy/incoming
+item_0004=/etc/han
+item_0005=/run/han-chat
+item_0006=/tmp
+item_0007=/
+
+[on_demand_scan]
+initial_scope=/opt/han-chat/current/backend
+initial_action=Inform
+steady_schedule=<APPROVED_WEEKLY_LOW_LOAD_WINDOW>
+
+[container_scan_task_18]
+initial_schedule=Manual
+steady_schedule=<APPROVED_WEEKLY_LOW_LOAD_WINDOW>
+post_deploy=after_smoke_only
+# Review before enabling: the vendor default can stop a container when scan
+# fails technically.
+container_scan_action=<SECURITY_APPROVED_NON_DISRUPTIVE_VALUE>
+
+[evidence]
+application_info=required
+license_valid=required
+bases_loaded_and_fresh=required
+file_threat_task_started=required
+update_schedule_hourly=required
+eicar_block_or_remediation_event=required
+application_smoke_after_each_stage=required
+firewall_unchanged=required
+resource_comparison_24h=required