DDoS防护管理系统

# 1. Download compose file
curl -O https://raw.githubusercontent.com/opastorello/a10-guardian/main/docker-compose.yml
curl -O https://raw.githubusercontent.com/opastorello/a10-guardian/main/.env.example

# 2. Configure
cp .env.example .env
# Edit .env with your A10 credentials

# 3. Pull and start
docker compose pull
docker compose up -d

# Pull the image
docker pull ghcr.io/opastorello/a10-guardian:latest

# Run REST API server
docker run -d \
  --name a10-guardian-api \
  -p 8000:8000 \
  -e A10_USERNAME=admin \
  -e A10_PASSWORD=your_password \
  -e A10_BASE_URL=https://your-a10-host:17489 \
  -e API_SECRET_TOKEN=your_secret_token \
  -e WEBHOOK_ENABLED=true \
  -e WEBHOOK_URL=https://discord.com/api/webhooks/your-webhook \
  -e NOTIFY_ATTACK_DETECTED=true \
  -e NOTIFY_ATTACK_MITIGATED=true \
  -v $(pwd)/logs:/app/logs \
  -v $(pwd)/config:/app/config \
  --restart unless-stopped \
  ghcr.io/opastorello/a10-guardian:latest

# Run MCP Server (optional - for AI agent integration)
docker run -d \
  --name a10-guardian-mcp \
  -p 8001:8001 \
  -e A10_USERNAME=admin \
  -e A10_PASSWORD=your_password \
  -e A10_BASE_URL=https://your-a10-host:17489 \
  -e API_SECRET_TOKEN=your_secret_token \
  -e MCP_TRANSPORT=streamable-http \
  -e MCP_HOST=0.0.0.0 \
  -e MCP_PORT=8001 \
  -v $(pwd)/logs:/app/logs \
  -v $(pwd)/config:/app/config \
  --restart unless-stopped \
  ghcr.io/opastorello/a10-guardian:latest \
  python src/a10_guardian/mcp_server.py

# Required
A10_USERNAME=admin                               # A10 device username
A10_PASSWORD=your_password                       # A10 device password
A10_BASE_URL=https://your-a10-host:17489       # A10 device URL
API_SECRET_TOKEN=your_internal_token            # Internal master token — full access
MCP_SECRET_TOKEN=your_mcp_token                 # Dedicated MCP token — full access

# Optional - Webhooks
WEBHOOK_ENABLED=true                            # Enable webhook notifications
WEBHOOK_URL=https://discord.com/api/webhooks/...  # Discord/Slack webhook URL
WEBHOOK_USERNAME=A10 Guardian                   # Bot display name

# Optional - Telegram (works alongside webhooks)
TELEGRAM_BOT_TOKEN=123456:ABC-DEF...            # Get from @BotFather
TELEGRAM_CHAT_ID=-1001234567890                 # Chat/group ID (@userinfobot)

# Optional - Attack Monitoring
NOTIFY_ATTACK_DETECTED=true                     # Alert on new attacks
NOTIFY_ATTACK_MITIGATED=true                    # Alert when attacks end
NOTIFY_ATTACK_ONGOING=false                     # Periodic updates (15min)
ATTACK_MONITORING_INTERVAL=30                   # Check interval (seconds)

# Optional - Mitigation Notifications
NOTIFY_MITIGATION_START=true                    # Alert on mitigation start
NOTIFY_MITIGATION_STOP=true                     # Alert on mitigation stop

# Optional - Template Notifications
NOTIFY_TEMPLATE_CREATE=true                     # Alert on template creation
NOTIFY_TEMPLATE_IMPORT=true                     # Alert on template import

# 1. Clone and configure
git clone https://github.com/opastorello/a10-guardian.git
cd a10-guardian
cp .env.example .env
# Edit .env with your A10 credentials

# 2. Build and start
docker compose up --build -d

# Create virtual environment
python -m venv venv
source venv/bin/activate  # Windows: venv\Scripts\activate

# Install
pip install -e .

# Start API server
uvicorn a10_guardian.main:app --reload

# Start MCP server (separate terminal)
MCP_TRANSPORT=streamable-http MCP_PORT=8001 python src/a10_guardian/mcp_server.py

curl -X POST "http://localhost:8000/api/v1/templates/import/203.0.113.5?name=default" \
  -H "x-api-token: YOUR_TOKEN"

curl -X POST "http://localhost:8000/api/v1/templates/default" \
  -H "x-api-token: YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d @docs/examples/gaming-template.json

# Use default template
POST /api/v1/mitigation/zones/mitigate/203.0.113.10

# Use specific template
POST /api/v1/mitigation/zones/mitigate/203.0.113.10?template=gaming

# Attack Monitoring (real-time DDoS attack detection)
NOTIFY_ATTACK_DETECTED=True       # Alert when DDoS attack is detected
NOTIFY_ATTACK_MITIGATED=True      # Alert when attack stops
NOTIFY_ATTACK_ONGOING=False       # Periodic updates for long-running attacks (every 15min)
ATTACK_MONITORING_INTERVAL=30     # Check for attacks every N seconds (min: 10, max: 300)

{
  "title": "🚨 Attack Detected",
  "description": "DDoS attack detected on 203.0.113.50",
  "color": 16711680,  // Red
  "fields": [
    {"name": "Zone", "value": "203.0.113.50"},
    {"name": "Severity", "value": "High"},
    {"name": "Incident ID", "value": "a1b2c3d4-..."}
  ]
}

{
  "title": "✅ Attack Stopped",
  "description": "Attack on 203.0.113.50 has stopped",
  "color": 65280,  // Green
  "fields": [
    {"name": "Zone", "value": "203.0.113.50"},
    {"name": "Duration", "value": "8 minutes 42 seconds"}
  ]
}

# List all ongoing attacks
GET /api/v1/attacks/ongoing?page=1&items=20

# Get detailed statistics for specific attack
GET /api/v1/attacks/incident/{incident_id}/stats

# Get full incident details with raw A10 data
GET /api/v1/attacks/incident/{incident_id}/details

{
  "total": 2,
  "page": 1,
  "items_per_page": 20,
  "incidents": [
    {
      "incident_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
      "zone_name": "203.0.113.50",
      "zone_id": "f6593c0b-9c93-4736-babc-8a3828e35af6",
      "severity": "High",
      "start_time": "2026-02-13T10:15:30Z",
      "status": "Ongoing"
    }
  ]
}

{
  "incident_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "zone_name": "203.0.113.50",
  "total_packets": 15000000,
  "total_bytes": 7500000000,
  "peak_pps": 500000,
  "peak_bps": 4000000000,
  "attack_vectors": [
    {"protocol": "UDP", "port": 53, "percentage": 65},
    {"protocol": "TCP", "port": 80, "percentage": 25},
    {"protocol": "ICMP", "port": null, "percentage": 10}
  ]
}

TELEGRAM_BOT_TOKEN=123456789:ABCdefGHIjklMNOpqrsTUVwxyz
TELEGRAM_CHAT_ID=-1001234567890

*🚨 Attack Detected*

DDoS attack detected on zone 203.0.113.50

🌐 *IP:* 203.0.113.50
📎 *Zone ID:* f6593c0b-...
⚙️ *Mode:* monitor

_A10 Guardian API_

*🛡️ Mitigation Started*

Protection activated for 203.0.113.50

🌐 *IP:* 203.0.113.50
🛡️ *Services:* 23
📋 *Profile:* Gaming_Profile
📋 *Template:* default

_A10 Guardian API_

# Enable both Telegram and Discord
WEBHOOK_ENABLED=true
WEBHOOK_URL=https://discord.com/api/webhooks/...
TELEGRAM_BOT_TOKEN=123456:ABC-DEF...
TELEGRAM_CHAT_ID=-1001234567890

# Notification preferences (apply to both)
NOTIFY_ATTACK_DETECTED=true
NOTIFY_ATTACK_MITIGATED=true
NOTIFY_MITIGATION_START=true
NOTIFY_TEMPLATE_CREATE=true

claude mcp add a10-guardian --transport http http://<host>:8001/mcp \
  --header "Authorization: Bearer <MCP_SECRET_TOKEN>"

{
  "mcpServers": {
    "a10-guardian": {
      "command": "python",
      "args": ["src/a10_guardian/mcp_server.py"],
      "cwd": "/path/to/a10-guardian",
      "env": {
        "A10_USERNAME": "admin",
        "A10_PASSWORD": "your_password",
        "API_SECRET_TOKEN": "your_internal_token",
        "MCP_SECRET_TOKEN": "your_mcp_token",
        "A10_BASE_URL": "https://your-a10-host:17489"
      }
    }
  }
}

# .env
API_TOKENS={"tok_mysite": ["mitigation:read"]}

# Can call:
GET /api/v1/mitigation/under-attack/{ip}   ✅
GET /api/v1/mitigation/zones/list          ✅
GET /api/v1/mitigation/zones/status/{ip}   ✅

# Blocked:
POST /api/v1/mitigation/zones/mitigate     ❌ 403
DELETE /api/v1/mitigation/zones/remove     ❌ 403