# yaml-language-server: $schema=https://schema.zeabur.app/template.json
apiVersion: zeabur.com/v1
kind: Template
metadata:
    name: CyberStrikeAI
spec:
    description: |
        CyberStrikeAI is an AI-native cybersecurity agent platform (Eino agents, MCP tools,
        RAG knowledge, attack-chain ops). One-click deploy with HTTP behind Zeabur Ingress.
        For authorized security testing only.
    coverImage: https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/main/images/logo.png
    icon: https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/main/images/logo.png
    variables:
        - key: PUBLIC_DOMAIN
          type: DOMAIN
          name: Domain
          description: Public domain for CyberStrikeAI Web UI (e.g. agent.z88.dev)
        - key: AI_API_KEY
          type: PASSWORD
          name: AI API Key
          description: OpenAI-compatible API key (DashScope / OpenAI / DeepSeek / etc.)
        - key: AI_BASE_URL
          type: STRING
          name: AI Base URL
          description: OpenAI-compatible base URL
        - key: AI_MODEL
          type: STRING
          name: AI Model
          description: Model id (e.g. qwen3-max, gpt-4o, deepseek-chat)
    tags:
        - AI
        - Agent
        - Security
        - Cybersecurity
        - MCP
    readme: "# CyberStrikeAI\n\nAI-native cybersecurity agent platform — intent to governed execution, evidence, and replay.\n\n**Upstream:** [github.com/Ed1s0nZ/CyberStrikeAI](https://github.com/Ed1s0nZ/CyberStrikeAI)  \n**License:** Apache-2.0\n\n## After deploy\n\n1. Open **PUBLIC_DOMAIN** (HTTPS via Zeabur).\n2. First boot prints a one-time **admin** password in runtime logs — change it immediately.\n3. Confirm AI channel under **System Settings** (pre-filled from template vars).\n4. Optional: install host tools (nmap/sqlmap/nuclei) on the dedicated server for full tool coverage.\n\n## Reset / reinstall\n\nDelete the service (or wipe the `data` volume) and redeploy this template for a clean admin bootstrap.\n\n## Security\n\nUse only on systems you own or are authorized to test. Prefer private access / IP allowlists for production.\nHigh-risk features (WebShell / C2) must stay disabled unless authorized.\n"
    resourceRequirement:
        minConfig:
            cpu: 2
            ram: 4
        recommendedConfig:
            cpu: 4
            ram: 8
    services:
        - name: cyberstrikeai
          icon: https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/main/images/logo.png
          template: PREBUILT_V2
          spec:
            id: cyberstrikeai
            source:
                source: ARBITRARY_GIT
                gitURL: https://github.com/Ed1s0nZ/CyberStrikeAI.git
                branch: main
                dockerfile: |
                    # CyberStrikeAI — multi-stage image for Zeabur / Docker
                    # Upstream: https://github.com/Ed1s0nZ/CyberStrikeAI
                    # Build context = repository root

                    FROM golang:1.25-bookworm AS builder
                    WORKDIR /src

                    RUN apt-get update \
                        && apt-get install -y --no-install-recommends gcc libc6-dev libsqlite3-dev \
                        && rm -rf /var/lib/apt/lists/*

                    ENV GOPROXY=https://proxy.golang.org,https://goproxy.cn,direct \
                        CGO_ENABLED=1

                    COPY go.mod go.sum ./
                    RUN go mod download

                    COPY . .
                    RUN go build -trimpath -ldflags="-s -w" -o /out/cyberstrike-ai ./cmd/server

                    # ---------- runtime ----------
                    FROM python:3.12-slim-bookworm
                    WORKDIR /app

                    RUN apt-get update \
                        && apt-get install -y --no-install-recommends ca-certificates libsqlite3-0 tini \
                        && rm -rf /var/lib/apt/lists/*

                    COPY --from=builder /out/cyberstrike-ai /app/cyberstrike-ai
                    COPY web /app/web
                    COPY tools /app/tools
                    COPY roles /app/roles
                    COPY skills /app/skills
                    COPY agents /app/agents
                    COPY knowledge_base /app/knowledge_base
                    COPY requirements.txt /app/requirements.txt

                    RUN pip install --no-cache-dir -r /app/requirements.txt \
                        && chmod +x /app/cyberstrike-ai

                    # Entrypoint: generate config from env (Zeabur reverse-proxy friendly, HTTP only)
                    RUN cat > /docker-entrypoint.sh << 'SCRIPT'
                    #!/bin/sh
                    set -eu
                    CONFIG="${CYBERSTRIKE_CONFIG:-/app/config.yaml}"
                    DATA_DIR="${CYBERSTRIKE_DATA_DIR:-/app/data}"
                    PORT="${PORT:-8080}"
                    mkdir -p "$DATA_DIR"
                    AI_CHANNEL_ID="${AI_CHANNEL_ID:-default}"
                    AI_CHANNEL_NAME="${AI_CHANNEL_NAME:-Default}"
                    AI_PROVIDER="${AI_PROVIDER:-openai_compatible}"
                    AI_BASE_URL="${AI_BASE_URL:-https://api.openai.com/v1}"
                    AI_API_KEY="${AI_API_KEY:-}"
                    AI_MODEL="${AI_MODEL:-gpt-4o}"
                    AI_MAX_TOTAL="${AI_MAX_TOTAL_TOKENS:-120000}"
                    AI_MAX_COMPLETION="${AI_MAX_COMPLETION_TOKENS:-16384}"
                    LOG_LEVEL="${LOG_LEVEL:-info}"
                    SESSION_HOURS="${SESSION_DURATION_HOURS:-12}"
                    if [ -f "$CONFIG" ] && [ -s "$CONFIG" ] && [ "${FORCE_GENERATE_CONFIG:-0}" != "1" ]; then
                      echo "[entrypoint] using existing config: $CONFIG"
                    else
                      echo "[entrypoint] generating config: $CONFIG"
                      cat > "$CONFIG" <<EOF
                    version: "v1.7.9"
                    server:
                      host: "0.0.0.0"
                      port: ${PORT}
                      tls_enabled: false
                      tls_auto_self_sign: false
                    auth:
                      session_duration_hours: ${SESSION_HOURS}
                    log:
                      level: ${LOG_LEVEL}
                      output: stdout
                    audit:
                      enabled: true
                      retention_days: 15
                      max_detail_bytes: 8192
                      auth_failure_cooldown_seconds: 60
                    monitor:
                      retention_days: 90
                    ai:
                      default_channel: ${AI_CHANNEL_ID}
                      channels:
                        ${AI_CHANNEL_ID}:
                          name: ${AI_CHANNEL_NAME}
                          provider: ${AI_PROVIDER}
                          base_url: "${AI_BASE_URL}"
                          api_key: "${AI_API_KEY}"
                          model: "${AI_MODEL}"
                          max_total_tokens: ${AI_MAX_TOTAL}
                          max_completion_tokens: ${AI_MAX_COMPLETION}
                          reasoning:
                            mode: auto
                            allow_client_reasoning: true
                            profile: openai_compat
                    vision:
                      enabled: false
                    EOF
                    fi
                    exec /app/cyberstrike-ai -config "$CONFIG" -http
                    SCRIPT
                    RUN chmod +x /docker-entrypoint.sh

                    ENV PORT=8080 \
                        CYBERSTRIKE_CONFIG=/app/config.yaml \
                        CYBERSTRIKE_DATA_DIR=/app/data

                    EXPOSE 8080
                    VOLUME ["/app/data"]

                    ENTRYPOINT ["tini", "--", "/docker-entrypoint.sh"]
            ports:
                - id: web
                  port: 8080
                  type: HTTP
            volumes:
                - id: data
                  dir: /app/data
            env:
                AI_API_KEY:
                    default: ${AI_API_KEY}
                AI_BASE_URL:
                    default: ${AI_BASE_URL}
                AI_CHANNEL_ID:
                    default: default
                AI_CHANNEL_NAME:
                    default: Default
                AI_MODEL:
                    default: ${AI_MODEL}
                AI_PROVIDER:
                    default: openai_compatible
                FORCE_GENERATE_CONFIG:
                    default: "1"
                LOG_LEVEL:
                    default: info
                PORT:
                    default: "8080"
                SESSION_DURATION_HOURS:
                    default: "12"
            healthCheck:
                type: HTTP
                port: web
                http:
                    path: /
          domainKey: PUBLIC_DOMAIN
localization:
    zh-CN:
        description: |
            CyberStrikeAI 是 AI 原生网络安全智能体平台（Eino Agent、MCP 工具、RAG 知识库、攻击链运营）。
            一键部署到 Zeabur 专用机；HTTPS 由入口终止，容器内 HTTP。仅限授权安全测试。
        variables:
            - key: PUBLIC_DOMAIN
              type: DOMAIN
              name: 域名
              description: Web 控制台公网域名（如 agent.z88.dev）
            - key: AI_API_KEY
              type: PASSWORD
              name: AI API Key
              description: OpenAI 兼容 API Key（通义 / OpenAI / DeepSeek 等）
            - key: AI_BASE_URL
              type: STRING
              name: AI Base URL
              description: OpenAI 兼容 Base URL
            - key: AI_MODEL
              type: STRING
              name: AI 模型
              description: 模型 ID（如 qwen3-max、gpt-4o）
        readme: |
            # CyberStrikeAI

            AI 原生网络安全智能体平台。

            **上游：** [github.com/Ed1s0nZ/CyberStrikeAI](https://github.com/Ed1s0nZ/CyberStrikeAI)

            ## 部署后

            1. 打开 **PUBLIC_DOMAIN**
            2. 在运行日志中查看一次性 **admin** 密码并立即修改
            3. 在系统设置确认 AI 通道
            4. 按需在宿主机安装 nmap/sqlmap/nuclei 等工具

            ## 重置

            删除服务或清空 data 卷后重新部署本模板即可全新初始化。