Refactor code structure and optimize performance across multiple modules

etc/env/airgap.env.sample

@@ -0,0 +1,161 @@
+# StellaOps Air-Gapped Environment
+# Copy to .env in repository root: cp etc/env/airgap.env.sample .env
+#
+# This profile is for fully offline/air-gapped deployments with no external
+# network connectivity. All feeds, models, and packages must be pre-loaded.
+
+# ============================================================================
+# PROFILE IDENTIFICATION
+# ============================================================================
+STELLAOPS_PROFILE=airgap
+STELLAOPS_LOG_LEVEL=Information
+
+# ============================================================================
+# NETWORK ISOLATION
+# ============================================================================
+# Block all outbound connections (enforced at application level)
+STELLAOPS_NETWORK_ISOLATION=strict
+STELLAOPS_ALLOWED_HOSTS=localhost,*.internal
+
+# ============================================================================
+# POSTGRES DATABASE
+# ============================================================================
+POSTGRES_HOST=postgres.internal
+POSTGRES_PORT=5432
+POSTGRES_USER=stellaops
+# POSTGRES_PASSWORD=<inject-from-secure-storage>
+POSTGRES_DB=stellaops_platform
+
+# ============================================================================
+# VALKEY (REDIS-COMPATIBLE CACHE)
+# ============================================================================
+VALKEY_HOST=valkey.internal
+VALKEY_PORT=6379
+
+# ============================================================================
+# NATS MESSAGING
+# ============================================================================
+NATS_URL=nats://nats.internal:4222
+NATS_CLIENT_PORT=4222
+
+# ============================================================================
+# RUSTFS ARTIFACT STORAGE
+# ============================================================================
+RUSTFS_ENDPOINT=http://rustfs.internal:8080
+RUSTFS_HTTP_PORT=8080
+
+# ============================================================================
+# AUTHORITY SERVICE
+# ============================================================================
+AUTHORITY_PORT=8440
+AUTHORITY_ISSUER=https://auth.internal:8440
+
+# ============================================================================
+# SIGNER SERVICE (OFFLINE MODE)
+# ============================================================================
+SIGNER_PORT=8441
+SIGNER_POE_INTROSPECT_URL=https://auth.internal:8440/connect/introspect
+# Disable Rekor transparency log (requires internet)
+SIGNER_REKOR_ENABLED=false
+
+# ============================================================================
+# ATTESTOR SERVICE
+# ============================================================================
+ATTESTOR_PORT=8442
+
+# ============================================================================
+# SCANNER SERVICE (OFFLINE MODE)
+# ============================================================================
+SCANNER_WEB_PORT=8444
+SCANNER_EVENTS_ENABLED=true
+SCANNER_EVENTS_DRIVER=valkey
+SCANNER_EVENTS_DSN=valkey.internal:6379
+SCANNER_EVENTS_STREAM=stella.events
+
+# CRITICAL: Enable offline kit for air-gapped operation
+SCANNER_OFFLINEKIT_ENABLED=true
+SCANNER_OFFLINEKIT_REQUIREDSSE=true
+SCANNER_OFFLINEKIT_REKOROFFLINEMODE=true
+SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY=/etc/stellaops/trust-roots
+SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY=/var/lib/stellaops/rekor-snapshot
+SCANNER_OFFLINEKIT_TRUSTROOTS_HOST_PATH=/opt/stellaops/offline/trust-roots
+SCANNER_OFFLINEKIT_REKOR_SNAPSHOT_HOST_PATH=/opt/stellaops/offline/rekor-snapshot
+
+# ============================================================================
+# CONCELIER SERVICE (OFFLINE FEEDS)
+# ============================================================================
+CONCELIER_PORT=8445
+# Use pre-loaded vulnerability feeds
+CONCELIER_FEED_MODE=offline
+CONCELIER_FEED_DIRECTORY=/var/lib/stellaops/feeds
+
+# ============================================================================
+# NOTIFY SERVICE
+# ============================================================================
+NOTIFY_WEB_PORT=8446
+# Disable external notification channels
+NOTIFY_SLACK_ENABLED=false
+NOTIFY_TEAMS_ENABLED=false
+NOTIFY_WEBHOOK_ENABLED=false
+# Only internal email relay if available
+NOTIFY_EMAIL_ENABLED=true
+NOTIFY_EMAIL_SMTP_HOST=smtp.internal
+
+# ============================================================================
+# ISSUER DIRECTORY SERVICE
+# ============================================================================
+ISSUER_DIRECTORY_PORT=8447
+ISSUER_DIRECTORY_SEED_CSAF=false
+# Pre-loaded issuer registry
+ISSUER_DIRECTORY_OFFLINE_MODE=true
+
+# ============================================================================
+# ADVISORY AI SERVICE (LOCAL INFERENCE)
+# ============================================================================
+ADVISORY_AI_WEB_PORT=8448
+# CRITICAL: Use local inference only (no external API calls)
+ADVISORY_AI_INFERENCE_MODE=Local
+ADVISORY_AI_MODEL_BUNDLE_PATH=/opt/stellaops/offline/models
+# Do NOT set remote inference settings
+# ADVISORY_AI_REMOTE_BASEADDRESS=
+# ADVISORY_AI_REMOTE_APIKEY=
+
+# ============================================================================
+# SCHEDULER SERVICE
+# ============================================================================
+SCHEDULER_SCANNER_BASEADDRESS=http://scanner-web.internal:8444
+
+# ============================================================================
+# WEB UI
+# ============================================================================
+UI_PORT=8443
+
+# ============================================================================
+# CRYPTO PROFILE
+# ============================================================================
+# Select based on organizational requirements
+# Note: Some providers may require additional offline packages
+STELLAOPS_CRYPTO_PROFILE=us-fips
+
+# For Russian GOST (requires CryptoPro offline package):
+# STELLAOPS_CRYPTO_PROFILE=ru
+# CRYPTOPRO_ACCEPT_EULA=1
+
+# ============================================================================
+# TELEMETRY (LOCAL COLLECTOR ONLY)
+# ============================================================================
+STELLAOPS_TELEMETRY_ENABLED=true
+STELLAOPS_TELEMETRY_ENDPOINT=http://otel-collector.internal:4317
+# Disable cloud exporters
+STELLAOPS_TELEMETRY_CLOUD_EXPORT=false
+
+# ============================================================================
+# OFFLINE PACKAGE PATHS
+# ============================================================================
+# Pre-loaded package caches for language ecosystems
+STELLAOPS_OFFLINE_NPM_REGISTRY=/opt/stellaops/offline/npm
+STELLAOPS_OFFLINE_PYPI_INDEX=/opt/stellaops/offline/pypi
+STELLAOPS_OFFLINE_MAVEN_REPO=/opt/stellaops/offline/maven
+STELLAOPS_OFFLINE_NUGET_FEED=/opt/stellaops/offline/nuget
+STELLAOPS_OFFLINE_CRATES_INDEX=/opt/stellaops/offline/crates
+STELLAOPS_OFFLINE_GO_PROXY=/opt/stellaops/offline/goproxy