Translated agent into python

.dev.env.example

@@ -0,0 +1,41 @@
+# =============================================================================
+# EDR Local Development Environment Template (.dev.env)
+# Usage:
+#   cp .dev.env.example .env
+#   # Adjust values below if you have a custom setup
+# =============================================================================
+
+# ── Fleet Server Settings ──────────────────────────────────────────────────────
+# Host/Port the gRPC service will listen on (0.0.0.0 to bind on all interfaces)
+HOST=0.0.0.0
+PORT=50051
+
+# Secret key used to sign and verify node authorization JWT tokens.
+# Change this in staging/production!
+JWT_SECRET=dev-jwt-secret-key-do-not-use-in-production-12345
+
+# Logging configuration for fleet-server
+RUST_LOG=debug
+LOG_FORMAT=human
+
+# ── Database Connections ─────────────────────────────────────────────────────
+# PostgreSQL instance for fleet node registrations (managed by infra/docker-compose.yml)
+# Default port is 5433 for nodes DB
+DATABASE_URL=postgres://edr:changeme@127.0.0.1:5433/edr_nodes
+
+# ── Kafka Configuration ──────────────────────────────────────────────────────
+# Kafka brokers list (using 127.0.0.1 explicitly to bypass IPv6 resolution delays/bugs on local Docker setups)
+KAFKA_BROKERS=127.0.0.1:9092
+
+# Raw telemetry ingestion topic
+KAFKA_TOPIC_AGENTS_EVENTS=edr.events.raw
+
+# Note: The Kafka Web UI is accessible in your browser at http://localhost:8090
+
+# ── Agent Settings ───────────────────────────────────────────────────────────
+# Config path override for running the EDR agent locally without sudo installation.
+# By setting this, 'cargo run --bin edr-agent' will load this config file automatically.
+EDR_AGENT_CONFIG=agent/agent.toml
+
+# Logging configuration for the agent
+AGENT_RUST_LOG=debug

.dockerignore

@@ -0,0 +1,3 @@
+target/
+.git/
+.github/

.env.example

@@ -0,0 +1,25 @@
+# EDR Workspace Environment Variables Template
+# Copy this file to .env at the workspace root and adjust as necessary for your local setup.
+
+# Fleet Server Database Connection
+# Format: postgres://<user>:<password>@<host>:<port>/<database>
+DATABASE_URL=postgres://edr:changeme@localhost:5433/edr_nodes
+
+# Kafka Brokers configuration (using 127.0.0.1 to avoid IPv6 localhost resolution bugs on host)
+KAFKA_BROKERS=127.0.0.1:9092
+KAFKA_TOPIC_AGENTS_EVENTS=edr.events.raw
+
+# Auth JWT Secret (Replace with a real 256-bit secret in production)
+JWT_SECRET=change-me-in-production
+
+# Server bind host and port
+HOST=0.0.0.0
+PORT=50051
+
+# Logging level and output format (human | json)
+RUST_LOG=info
+LOG_FORMAT=human
+
+# EDR Agent configuration path (optional, overrides default /etc/aigis-zero/config.toml)
+# EDR_AGENT_CONFIG=agent/agent.toml
+

.github/workflows/agent-release.yml

@@ -0,0 +1,70 @@
+name: Aigis-Zero Agent Release
+
+on:
+  push:
+    tags:
+      - 'agent-v*'
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    name: Build and Package Agent (${{ matrix.target }})
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        include:
+          - target: x86_64-unknown-linux-musl
+            arch: x86_64
+          - target: aarch64-unknown-linux-musl
+            arch: aarch64
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - name: Install cross
+        run: cargo install cross --git https://github.com/cross-rs/cross
+
+      - name: Build Agent (${{ matrix.target }})
+        run: |
+          cd agent
+          cross build --bin edr-agent --target ${{ matrix.target }} --release
+
+      - name: Package Release (${{ matrix.arch }})
+        run: |
+          mkdir -p aigis-zero-agent
+          # Copy binary
+          cp target/${{ matrix.target }}/release/edr-agent aigis-zero-agent/aigis-zero
+          # Copy scripts
+          cp agent/install.sh aigis-zero-agent/
+          cp agent/uninstall.sh aigis-zero-agent/
+          # Copy configs
+          cp agent/agent.toml aigis-zero-agent/
+          cp -r agent/osquery aigis-zero-agent/
+          cp -r agent/sysctl aigis-zero-agent/
+          cp -r agent/limits aigis-zero-agent/
+          cp -r agent/systemd aigis-zero-agent/
+
+          # Create tarball
+          tar -czvf aigis-zero-agent-linux-${{ matrix.arch }}.tar.gz aigis-zero-agent/
+
+      - name: Upload Artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: aigis-zero-agent-linux-${{ matrix.arch }}
+          path: aigis-zero-agent-linux-${{ matrix.arch }}.tar.gz
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v1
+        with:
+          files: aigis-zero-agent-linux-${{ matrix.arch }}.tar.gz
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}