From 055dd3995f9a0532941e8394f12d57d42947b1f8 Mon Sep 17 00:00:00 2001 From: thesabear Date: Fri, 28 Aug 2026 20:50:11 +0300 Subject: [PATCH] dashy-soc-board: fix fabricated grep pattern in the 14-sources evidence The block added earlier this pass showed a grep pattern with a bracketed placeholder embedded inside the regex itself ('\.[service-to-service zone]') - not valid regex syntax, would never produce the shown output if actually run. Replaced with the real command (matching the _URL constant-naming pattern, which doesn't need the domain at all) and its real output, domain suffix genericized in output only. Separated the Authentik/Slack/fleetAudit/pfSense reasoning into prose, not disguised as more grep output. --- docs/dashy-soc-board.md | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/docs/dashy-soc-board.md b/docs/dashy-soc-board.md index cdbb652..e59c007 100644 --- a/docs/dashy-soc-board.md +++ b/docs/dashy-soc-board.md @@ -16,17 +16,24 @@ This board didn't start from nothing — it absorbed several formerly-standalone | Slack | 12 app-specific channels (the *arr suite, Jellyfin/Emby/Seerr, Kopia, Authentik, Gitea, Netbox, Grafana) mapped to their owning host by a plain lookup table, plus each host's own alert channel | | Proxmox `cluster/resources` API | The two hypervisor nodes' own CPU/RAM/disk (no Prometheus coverage on bare metal) plus the full running VM/LXC tree per node | -The fourteen, enumerated directly from the function's own upstream calls rather than counted by hand: +The fourteen, enumerated directly from the function's own upstream-URL constants rather than counted by hand — this is the actual grep and its real output, not a reconstruction: ``` -$ grep -oE 'https?://[a-zA-Z0-9._-]+\.[service-to-service zone]' soc_board_func.js | sort -u -authentik, hyper1 (Proxmox API), kestra, loki, n8n, pbs, prometheus, -technitium, vault, wazuh-api, wazuh-indexer → 11 distinct hosts -+ slack.com → 12 -+ fleetAudit (Node-RED global context, no HTTP call — see table above) → 13 -+ pfSense (own dedicated collector, folded into the Prometheus query) → 14 +$ grep -oE '[A-Z_]*URL[A-Z_]* = "https://[a-zA-Z0-9._-]+"' soc_board_func.js | sort -u +KESTRA_URL = "https://kestra.[app-to-app zone]" +LOKI_URL = "https://loki.[app-to-app zone]" +N_URL = "https://n8n.[app-to-app zone]" +PBS_URL = "https://pbs.[app-to-app zone]" +PROM_URL = "https://prometheus.[app-to-app zone]" +PVE_URL = "https://hyper1.[app-to-app zone]" +TECHNITIUM_URL = "https://technitium.[app-to-app zone]" +VAULT_URL = "https://vault.[app-to-app zone]" +WAZUH_API_URL = "https://wazuh-api.[app-to-app zone]" +WAZUH_INDEXER_URL = "https://wazuh-indexer.[app-to-app zone]" ``` +10 named constants — Authentik's isn't a top-level constant (built inline at its call site instead), which brings the real count to 11 HTTP hosts. Plus Slack (`slack.com`, external, not counted above), plus `fleetAudit` (no HTTP call at all — a Node-RED global context read, per the table above), plus pfSense (no constant of its own — folded into the Prometheus query via its own dedicated collector) = 14. + This is the real function, not a claimed size — one single Node-RED function, not several smaller ones stitched together: ```