Deploy On-Premise

# Deploy MinIO using Helm

# Add MinIO Helm repository
helm repo add minio https://charts.min.io/
helm repo update

# Create namespace
kubectl create namespace minio

# Install MinIO in distributed mode
helm install minio minio/minio \
  --namespace minio \
  --set mode=distributed \
  --set replicas=4 \
  --set persistence.size=100Gi \
  --set resources.requests.memory=1Gi \
  --set rootUser=${MINIO_ACCESS_KEY} \
  --set rootPassword=${MINIO_SECRET_KEY}

# Create bucket for audit logs
kubectl run --rm -it minio-client \
  --image=minio/mc \
  --restart=Never \
  --command -- mc alias set myminio http://minio.minio.svc.cluster.local:9000 \
  ${MINIO_ACCESS_KEY} ${MINIO_SECRET_KEY} && \
  mc mb myminio/audit-logs && \
  mc policy set private myminio/audit-logs

# /etc/dbaudit/config.yaml
# On-Premise DB Audit Configuration

mode: on-premise

# Storage configuration
storage:
  type: minio
  endpoint: https://minio.internal:9000
  bucket: audit-logs
  access_key: ${MINIO_ACCESS_KEY}
  secret_key: ${MINIO_SECRET_KEY}
  use_ssl: true
  region: us-east-1

  # Retention policy
  retention:
    enabled: true
    days: 90
    archive_to_glacier: false

# Encryption settings
encryption:
  key: ${DBAUDIT_ENCRYPTION_KEY}
  algorithm: AES-256-GCM
  rotate_interval: 90d

# Database connections to monitor
databases:
  - name: production-postgres
    type: postgresql
    host: postgres.internal
    port: 5432
    database: production
    username: dbaudit
    password: ${PG_PASSWORD}
    ssl: true

  - name: analytics-mysql
    type: mysql
    host: mysql.internal
    port: 3306
    database: analytics
    username: dbaudit
    password: ${MYSQL_PASSWORD}

  - name: mongodb-cluster
    type: mongodb
    host: mongo.internal
    port: 27017
    replica_set: rs0
    username: dbaudit
    password: ${MONGO_PASSWORD}

# Collector settings
collector:
  log_level: info
  buffer_size: 5000
  flush_interval: 5s
  max_connections: 100

  # High availability
  ha:
    enabled: true
    redis_url: redis://redis.internal:6379
    leader_election: true

  # Metrics endpoint
  metrics:
    enabled: true
    port: 9090
    path: /metrics

# Alert configuration
alerts:
  enabled: true
  channels:
    - type: email
      smtp_host: smtp.internal
      smtp_port: 587
      from: dbaudit@company.com
      recipients:
        - security@company.com

    - type: webhook
      url: https://siem.internal/api/events
      headers:
        Authorization: Bearer ${SIEM_TOKEN}

# Security settings
security:
  mask_sensitive_data: true
  ip_allowlist:
    - 10.0.0.0/8
    - 192.168.0.0/16
  tls:
    enabled: true
    cert_file: /etc/dbaudit/certs/server.crt
    key_file: /etc/dbaudit/certs/server.key
    ca_file: /etc/dbaudit/certs/ca.crt

# Backup script for on-premise DB Audit

#!/bin/bash
# backup-dbaudit.sh

set -e

BACKUP_DIR="/backups/dbaudit/$(date +%Y-%m-%d)"
MINIO_ALIAS="dbaudit-minio"
BUCKET="audit-logs"

# Create backup directory
mkdir -p ${BACKUP_DIR}

# Backup MinIO data
mc mirror ${MINIO_ALIAS}/${BUCKET} ${BACKUP_DIR}/minio/

# Backup Redis data
kubectl exec -n dbaudit redis-0 -- redis-cli BGSAVE
kubectl cp dbaudit/redis-0:/data/dump.rdb ${BACKUP_DIR}/redis/dump.rdb

# Backup configuration
kubectl get configmap dbaudit-config -n dbaudit -o yaml > ${BACKUP_DIR}/configmap.yaml
kubectl get secret dbaudit-storage-credentials -n dbaudit -o yaml > ${BACKUP_DIR}/secrets.yaml

# Compress backup
tar -czf /backups/dbaudit-$(date +%Y-%m-%d).tar.gz ${BACKUP_DIR}

# Upload to offsite storage (optional)
# aws s3 cp /backups/dbaudit-$(date +%Y-%m-%d).tar.gz s3://backups/

# Clean up old backups (keep last 30 days)
find /backups -name "dbaudit-*.tar.gz" -mtime +30 -delete

echo "Backup completed: /backups/dbaudit-$(date +%Y-%m-%d).tar.gz"