feat(security): deploy OpenCanary honeypot on VLAN 50 with Gotify and Discord alerting

scripts/check_ha_events.py

@@ -1,21 +1,43 @@
-import json
-import ssl
 import urllib.request
+import ssl
+import json
+import sys
+
+sys.stdout.reconfigure(encoding='utf-8')
 
 ctx = ssl.create_default_context()
 ctx.check_hostname = False
 ctx.verify_mode = ssl.CERT_NONE
 
-req = urllib.request.Request(
-    'https://authentik.snarfnet.net/api/v3/events/events/?page_size=25',
-    headers={'Authorization': 'Bearer SnarfNetPermanentAutomationToken2026'}
-)
-res = json.loads(urllib.request.urlopen(req, context=ctx).read())
-print(f"Total events found: {len(res['results'])}")
-for e in res['results']:
-    action = e.get('action')
-    app = e.get('app')
-    user = e.get('user', {}).get('username')
-    created = e.get('created')
-    context = json.dumps(e.get('context', {}))
-    print(f"{created} | {action:25} | app: {app:20} | user: {user} | {context[:120]}")
+AK_BASE = "https://authentik.snarfnet.net"
+AK_TOKEN = "SnarfNetPermanentAutomationToken2026"
+
+headers = {
+    "Authorization": f"Bearer {AK_TOKEN}",
+    "Content-Type": "application/json",
+    "Accept": "application/json"
+}
+
+# Fetch events matching homeassistant or redirect_uri
+req = urllib.request.Request(f"{AK_BASE}/api/v3/events/events/?search=homeassistant", headers=headers)
+with urllib.request.urlopen(req, timeout=10, context=ctx) as r:
+    data = json.loads(r.read().decode())
+    print(f"Total matching 'homeassistant': {data.get('pagination', {}).get('count')}")
+    for ev in data.get("results", []):
+        created = ev.get("created")
+        action = ev.get("action")
+        ctx_data = ev.get("context", {})
+        print(f"[{created}] Action: {action}")
+        print(json.dumps(ctx_data, indent=2))
+
+print("\n--- Also search for 'redirect_uri' ---")
+req2 = urllib.request.Request(f"{AK_BASE}/api/v3/events/events/?search=redirect_uri", headers=headers)
+with urllib.request.urlopen(req2, timeout=10, context=ctx) as r:
+    data2 = json.loads(r.read().decode())
+    print(f"Total matching 'redirect_uri': {data2.get('pagination', {}).get('count')}")
+    for ev in data2.get("results", [])[:5]:
+        created = ev.get("created")
+        action = ev.get("action")
+        ctx_data = ev.get("context", {})
+        print(f"[{created}] Action: {action}")
+        print(json.dumps(ctx_data, indent=2))