Release v2.5.0-bv2

.env.model

@@ -1,13 +1,31 @@
 # -- COMMON
 LOG_LEVEL=info
 
+# -- HOSTNAME (single source of truth)
+# When set, IRIS_HOSTNAME provides fallback defaults for SERVER_NAME
+# (nginx), PUBLIC_EXTERNAL_API_URL / ORIGIN (SvelteKit), and
+# VITE_ALLOWED_HOSTS (Vite dev). Explicit values still take precedence
+# for split-hostname deployments (e.g. API on a different host than UI).
+# Existing .env files that set the four vars individually keep working.
+#IRIS_HOSTNAME=iris.app.dev
+
 # -- NGINX
 NGINX_IMAGE_NAME=ghcr.io/dfir-iris/iriswebapp_nginx
 
 SERVER_NAME=iris.app.dev
+# When both KEY_FILENAME and CERT_FILENAME are unset AND certbot's
+# standard fullchain.pem + privkey.pem pair exist under
+# ./certificates/web_certificates/, the nginx entrypoint autodetects
+# them — useful for Let's Encrypt setups. See
+# scripts/certbot-deploy-hook.sh for zero-copy renewals.
 KEY_FILENAME=iris_dev_key.pem
 CERT_FILENAME=iris_dev_cert.pem
 
+# Nginx polls the cert file's mtime every N seconds and reloads on
+# change so certbot renewals apply without a container restart. Set
+# to 0 to disable if your deployment reloads nginx externally.
+#IRIS_CERT_RELOAD_INTERVAL=60
+
 # -- DATABASE
 DB_IMAGE_NAME=ghcr.io/dfir-iris/iriswebapp_db
 
@@ -88,6 +106,23 @@ IRIS_AUTHENTICATION_TYPE=local
 # optional mapping for usergroup-names
 # OIDC_MAPPING_USERGROUP= "iris-roles" #Group field in OIDC Token
 # OIDC_MAPPING_ROLES= '{"iris-admin": "1", "iris-analyst": "2"}'
+# -- CUSTOM CA CERTIFICATES (Keycloak, LDAPS, webhooks, ...)
+# The recommended way to trust internal CAs is to drop one or more
+# *.crt / *.pem files into ./certificates/ca-bundle/ on the host —
+# they are mounted at /etc/iris-ca/ inside the app and worker
+# containers, and the entrypoint installs them into the OS trust
+# store (update-ca-certificates) on every boot. This is ADDITIVE:
+# system roots stay trusted, so no manual concatenation is needed.
+#
+# The legacy single-file bundle at
+# ./certificates/ca-bundle/extra-ca.crt is still honoured for
+# backward compatibility, as are the REQUESTS_CA_BUNDLE /
+# SSL_CERT_FILE / TLS_ROOT_CA env vars (which REPLACE the default
+# trust store rather than augmenting it — prefer the drop-in dir
+# unless you have a reason to pin the exact bundle).
+#REQUESTS_CA_BUNDLE=/etc/iris-ca/extra-ca.crt
+#SSL_CERT_FILE=/etc/iris-ca/extra-ca.crt
+
 # -- LISTENING PORT
 INTERFACE_HTTPS_PORT=443
 

.github/workflows/ci.yml

@@ -110,43 +110,6 @@ jobs:
           name: iriswebapp_app
           path: ${{ runner.temp }}/iriswebapp_app.tar
 
-  build-graphql-documentation:
-    name: Generate graphQL documentation
-    runs-on: ubuntu-22.04
-    needs:
-      - build-docker-db
-      - build-docker-nginx
-      - build-docker-app
-    steps:
-      - name: Download artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: iriswebapp_*
-          path: ${{ runner.temp }}
-          merge-multiple: true
-      - name: Load docker images
-        run: |
-          docker load --input ${{ runner.temp }}/iriswebapp_db.tar
-          docker load --input ${{ runner.temp }}/iriswebapp_nginx.tar
-          docker load --input ${{ runner.temp }}/iriswebapp_app.tar
-      - name: Check out iris
-        uses: actions/checkout@v4
-      - name: Start development server
-        run: |
-          cp .env.tests.model .env
-          docker compose --file docker-compose.dev.yml up --detach --wait
-      - name: Generate GraphQL documentation
-        run: |
-          npx spectaql@^3.0.2 source/spectaql/config.yml
-      - name: Stop development server
-        run: |
-          docker compose down
-      - uses: actions/upload-artifact@v4
-        with:
-            name: GraphQL DFIR-IRIS documentation
-            path: public
-            if-no-files-found: error
-
   test-api:
     name: Test API
     runs-on: ubuntu-22.04

.gitignore

@@ -31,4 +31,6 @@ run_nv_test.py
 certificates/web_certificates/*.pem
 certificates/web_certificates/*.key
 !certificates/web_certificates/iris_dev_*
-local_dev/
+local_dev/
+.serena/
+.tokensave

AGENTS.md

@@ -10,7 +10,7 @@ The upstream project is a DFIR case-management platform (Python/Flask backend, S
 | Branch | Purpose | Push rules |
 |---|---|---|
 | `bv-main` | Production-stable. Tagged releases deploy to AKS prod. | PR only, 1 approval + CI green |
-| `bv-develop` | Integration branch. Pushes auto-deploy to AKS staging. | Direct push allowed; PR preferred |
+| `bv-develop` | Integration branch. Staging (AKS) deploy is triggered manually, not automatically on push. | Direct push allowed; PR preferred |
 | `origin/master` | Upstream master mirror — **never modify** | Read-only |
 | `origin/develop` | Upstream develop mirror — **never modify** | Read-only |
 

README.md

@@ -6,7 +6,7 @@
 <p align="center">
   Incident Response Investigation System
   <br>
-  <i>Current Version v2.5.0-bv1</i>
+  <i>Current Version v2.5.0-bv2</i>
   <br>
   <a href="https://v200.beta.dfir-iris.org">Online Demonstration</a>
 </p>

bV-development-guide.md

@@ -22,7 +22,7 @@ upstream/develop  ────────────────────
         │
         │ PR from release/ branch only
         ▼
-   bv-develop   ◄── integration branch → AKS staging
+   bv-develop   ◄── integration branch → AKS staging (manual deploy trigger)
         │
    ┌────┴────────────────────┐
    ▼                         ▼
@@ -37,7 +37,7 @@ sync/upstream-<date>                    → PR to bv-develop (short-lived, delet
 | Branch | Purpose | Azure DevOps trigger |
 |---|---|---|
 | `bv-main` | Production-stable, tagged releases | Tag `v*-bv*` → deploy AKS prod (manual approval) |
-| `bv-develop` | Integration, always deployable | Push → deploy AKS staging (auto) |
+| `bv-develop` | Integration, always deployable | Push → deploy AKS staging (manual trigger) |
 | `origin/master` | Upstream master mirror — do not modify | None |
 | `origin/develop` | Upstream develop mirror — do not modify | None |
 
@@ -160,7 +160,8 @@ Rule: **if a commit has no `[BV]` prefix, it must be clean enough to open a PR o
 | Trigger | Jobs | Gate |
 |---|---|---|
 | PR to `bv-develop` | Build, static checks, unit tests | Auto — must pass before merge |
-| Push to `bv-develop` | Build, push to ACR (`:develop` tag), deploy AKS staging | Auto |
+| Push to `bv-develop` | Build, push to ACR (`:develop` tag) | Auto |
+| Deploy AKS staging | Deploy latest `:develop` image | Manual trigger |
 | Tag `v*-bv*` | Build, push to ACR (`:version` + `:latest` tags), deploy AKS prod | Manual approval |
 
 ### Docker image naming in ACR

bV-local-dev-environment-setup.md

@@ -68,6 +68,31 @@ podman compose -f docker-compose.bv.yml -p iris-bv logs -f bv-iriswebapp-app
 
 ---
 
+## Running the test suite
+
+`tests/*.py` talk to the app container directly on `127.0.0.1:8000` (see `API_URL` in
+`tests/iris.py`), so run the stack under its own project name (`iris-test`) and only start the
+services the tests need — no nginx, no frontend. Never point this project name at a real dev
+stack; treat its volumes as throwaway.
+
+Don't run this alongside a real dev stack (`iris-bv`, `iris-web-bv`, ...) — they'd collide on the
+same host ports (8000/5432).
+
+```bash
+# Build and start a disposable test stack (no nginx/worker needed to exercise the REST API)
+podman compose -f docker-compose.dev.yml -p iris-test up -d --build db rabbitmq app worker
+
+# Wait for the app container to become healthy, then run the suite from the host
+# (test files are named tests_*.py, not pytest's default test_*.py pattern)
+cd tests
+python -m unittest discover -p 'tests_*.py' -v
+
+# Tear down completely when done — safe to delete, this project only ever holds test fixtures
+podman compose -f docker-compose.dev.yml -p iris-test down -v
+```
+
+---
+
 ## Working on UI (JavaScript/Svelte) changes
 
 The `ui/dist` folder is bind-mounted into the container at `/iriswebapp/static`, so you can

deploy/kubernetes/charts/templates/ingress_route.yaml

@@ -17,12 +17,22 @@ spec:
   routes:
   {{- range $host := .Values.ingress.hosts }}
     {{- range $path := $host.paths }}
+    {{- $svcName := $.Values.irisapp.name }}
+    {{- $svcPort := $.Values.irisapp.service.port }}
+    {{- if hasKey $path "serviceName" }}
+      {{- $svcName = $path.serviceName }}
+      {{- if hasKey $path "servicePort" }}
+        {{- $svcPort = $path.servicePort }}
+      {{- end }}
+    {{- else if hasKey $path "servicePort" }}
+      {{- $svcPort = $path.servicePort }}
+    {{- end }}
     - kind: Rule
       match: >
         Host(`{{ $host.host }}`) && PathPrefix(`{{ $path.path }}`)
       services:
-        - name: {{ $.Values.irisapp.name }}
-          port: {{ $.Values.irisapp.service.port }}
+        - name: {{ $svcName }}
+          port: {{ $svcPort }}
     {{- end }}
   {{- end }}
 {{- end }}

deploy/kubernetes/charts/templates/iris_collab.yaml

@@ -0,0 +1,153 @@
+{{- if .Values.iriscollab.enabled }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ .Values.iriscollab.name }}-pvc
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.iriscollab.pvcSize }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Values.iriscollab.name }}
+spec:
+  replicas: {{ .Values.iriscollab.replicaCount }}
+  selector:
+    matchLabels:
+      app: {{ .Values.iriscollab.app }}
+  template:
+    metadata:
+      labels:
+        app: {{ .Values.iriscollab.app }}
+    spec:
+      securityContext:
+        {{- toYaml .Values.iriscollab.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ .Values.iriscollab.name }}
+          securityContext:
+            {{- toYaml .Values.iriscollab.securityContext | nindent 12 }}
+          resources:
+            {{- toYaml .Values.iriscollab.resources | nindent 12 }}
+          image: "{{ .Values.iriscollab.image }}:{{ .Values.iriscollab.tag }}"
+          imagePullPolicy: "{{ .Values.iriscollab.imagePullPolicy }}"
+          command: ['uvicorn', 'app.collab_server:app', '--host', '0.0.0.0', '--port', '5001']
+
+          env:
+          {{- range $key := list "POSTGRES_USER" "POSTGRES_PASSWORD" "POSTGRES_ADMIN_USER" "POSTGRES_ADMIN_PASSWORD" "POSTGRES_PORT" "POSTGRES_SERVER" "IRIS_SECRET_KEY" "IRIS_SECURITY_PASSWORD_SALT" }}
+          - name: {{ $key }}
+            {{- if and (hasKey $.Values.iriscollab "envFromSecret") (has $key $.Values.iriscollab.envFromSecret.keys) }}
+            valueFrom:
+              secretKeyRef:
+                name: {{ $.Values.iriscollab.envFromSecret.name }}
+                key: {{ $key }}
+            {{- else }}
+            value: {{ index $.Values.iriscollab $key | quote }}
+            {{- end }}
+          {{- end }}
+
+          - name: IRIS_COLLAB_STORE_PATH
+            value: /home/iris/server_data/collab
+
+          ports:
+            - containerPort: 5001
+
+          readinessProbe:
+            httpGet:
+              path: /collab/healthz
+              port: 5001
+            initialDelaySeconds: 5
+            periodSeconds: 10
+
+          livenessProbe:
+            httpGet:
+              path: /collab/healthz
+              port: 5001
+            initialDelaySeconds: 15
+            periodSeconds: 30
+
+          volumeMounts:
+            - mountPath: /home/iris/server_data/collab
+              name: collab-data
+
+      volumes:
+        - name: collab-data
+          persistentVolumeClaim:
+            claimName: {{ .Values.iriscollab.name }}-pvc
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Values.iriscollab.name }}
+  labels:
+    app: {{ .Values.iriscollab.app }}
+spec:
+  type: ClusterIP
+  ports:
+    - port: 5001
+      targetPort: 5001
+  selector:
+    app: {{ .Values.iriscollab.app }}
+{{- if .Values.iriscollab.ingress.enabled }}
+{{- if .Values.ingress.traefik.enabled }}
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: {{ .Values.iriscollab.name }}-ingress-route
+spec:
+  entryPoints:
+    - {{ .Values.ingress.traefik.entryPoint | default "web" }}
+  routes:
+  {{- range $host := .Values.ingress.hosts }}
+    - kind: Rule
+      match: >
+        Host(`{{ $host.host }}`) && PathPrefix(`/collab`)
+      services:
+        - name: {{ $.Values.iriscollab.name }}
+          port: 5001
+  {{- end }}
+{{- else }}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ .Values.iriscollab.name }}-ingress
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+    {{- with .Values.iriscollab.ingress.customAnnotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  ingressClassName: {{ .Values.ingress.className }}
+  rules:
+    {{- range $host := .Values.ingress.hosts }}
+    - host: {{ $host.host }}
+      http:
+        paths:
+          - path: /collab
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ $.Values.iriscollab.name }}
+                port:
+                  number: 5001
+    {{- end }}
+  {{- if and .Values.ingress.enableTls (gt (len .Values.ingress.tls.hosts) 0) }}
+  tls:
+    - hosts:
+      {{- range .Values.ingress.tls.hosts }}
+      - {{ . }}
+      {{- end }}
+      secretName: {{ .Values.ingress.tls.secretName }}
+  {{- end }}
+{{- end }}
+{{- end }}
+{{- end }}