codefilterph-logcollector 0.1.1__tar.gz

codefilterph_logcollector-0.1.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 CodefilterPH | Euge
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

codefilterph_logcollector-0.1.1/MANIFEST.in

@@ -0,0 +1,12 @@
+include README.md
+include LICENSE
+prune log_collector/docs
+include log_collector/docs/installation.md
+include log_collector/docs/configuration.md
+include log_collector/docs/api.md
+include log_collector/docs/operations-guide.md
+recursive-include log_collector/templates *.html
+recursive-include log_collector/static *.css
+prune log_collector/tests
+prune packaging
+global-exclude __pycache__ *.py[cod] *.sqlite3 *.db .env*

codefilterph_logcollector-0.1.1/PKG-INFO

@@ -0,0 +1,56 @@
+Metadata-Version: 2.4
+Name: codefilterph-logcollector
+Version: 0.1.1
+Summary: Django Nginx log collection, security monitoring, and remote collector dashboards
+Author: CodefilterPH | Euge
+License-Expression: MIT
+Project-URL: Documentation, https://github.com/codefilterPH/logcollector/tree/main/log_collector/docs
+Project-URL: Source, https://github.com/codefilterPH/logcollector
+Classifier: Framework :: Django
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: System :: Logging
+Requires-Python: <3.14,>=3.12
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: Django<6.1,>=6.0
+Requires-Dist: channels<5,>=4.2
+Requires-Dist: celery<6,>=5.5
+Requires-Dist: djangorestframework<4,>=3.16
+Requires-Dist: requests<3,>=2.32
+Requires-Dist: cryptography<47,>=44
+Provides-Extra: redis
+Requires-Dist: channels-redis<5,>=4.2; extra == "redis"
+Provides-Extra: asgi
+Requires-Dist: daphne<5,>=4.2; extra == "asgi"
+Dynamic: license-file
+
+# LOG Collector
+
+Developed by: CodefilterPH | Euge
+
+LOG Collector is a Django application for local Nginx access-log collection,
+security incidents, API access, WebSocket updates, Celery processing, and
+read-only connections to other LOG Collector installations. CrowdSec connection
+management is included in the distribution.
+
+Install with `pip install codefilterph-logcollector`. Add `log_collector` and
+`crowdsec_integration` to `INSTALLED_APPS`, mount `log_collector.urls`, and run
+migrations. Nginx file access, ASGI, a channel layer, and Celery services are
+configured by the host project; installing the wheel does not provision them.
+
+The developer guides are installed in `log_collector/docs/` inside the Python
+package and are also available in the source repository:
+
+- [Installation](https://github.com/codefilterPH/logcollector/blob/main/log_collector/docs/installation.md)
+- [Configuration](https://github.com/codefilterPH/logcollector/blob/main/log_collector/docs/configuration.md)
+- [API integration](https://github.com/codefilterPH/logcollector/blob/main/log_collector/docs/api.md)
+- [Operations](https://github.com/codefilterPH/logcollector/blob/main/log_collector/docs/operations-guide.md)
+
+The app title defaults to **LOG Collector**. A Django superuser can set the
+displayed title and shared theme on the hosting entity Manage page. The developer
+credit is fixed in the application and cannot be edited through its settings.
+
+License: [MIT](LICENSE).
+
+Release owner: [first-release account setup](https://github.com/codefilterPH/logcollector/blob/main/RELEASE_SETUP.md).

codefilterph_logcollector-0.1.1/README.md

@@ -0,0 +1,29 @@
+# LOG Collector
+
+Developed by: CodefilterPH | Euge
+
+LOG Collector is a Django application for local Nginx access-log collection,
+security incidents, API access, WebSocket updates, Celery processing, and
+read-only connections to other LOG Collector installations. CrowdSec connection
+management is included in the distribution.
+
+Install with `pip install codefilterph-logcollector`. Add `log_collector` and
+`crowdsec_integration` to `INSTALLED_APPS`, mount `log_collector.urls`, and run
+migrations. Nginx file access, ASGI, a channel layer, and Celery services are
+configured by the host project; installing the wheel does not provision them.
+
+The developer guides are installed in `log_collector/docs/` inside the Python
+package and are also available in the source repository:
+
+- [Installation](https://github.com/codefilterPH/logcollector/blob/main/log_collector/docs/installation.md)
+- [Configuration](https://github.com/codefilterPH/logcollector/blob/main/log_collector/docs/configuration.md)
+- [API integration](https://github.com/codefilterPH/logcollector/blob/main/log_collector/docs/api.md)
+- [Operations](https://github.com/codefilterPH/logcollector/blob/main/log_collector/docs/operations-guide.md)
+
+The app title defaults to **LOG Collector**. A Django superuser can set the
+displayed title and shared theme on the hosting entity Manage page. The developer
+credit is fixed in the application and cannot be edited through its settings.
+
+License: [MIT](LICENSE).
+
+Release owner: [first-release account setup](https://github.com/codefilterPH/logcollector/blob/main/RELEASE_SETUP.md).

codefilterph_logcollector-0.1.1/codefilterph_logcollector.egg-info/PKG-INFO

@@ -0,0 +1,56 @@
+Metadata-Version: 2.4
+Name: codefilterph-logcollector
+Version: 0.1.1
+Summary: Django Nginx log collection, security monitoring, and remote collector dashboards
+Author: CodefilterPH | Euge
+License-Expression: MIT
+Project-URL: Documentation, https://github.com/codefilterPH/logcollector/tree/main/log_collector/docs
+Project-URL: Source, https://github.com/codefilterPH/logcollector
+Classifier: Framework :: Django
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: System :: Logging
+Requires-Python: <3.14,>=3.12
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: Django<6.1,>=6.0
+Requires-Dist: channels<5,>=4.2
+Requires-Dist: celery<6,>=5.5
+Requires-Dist: djangorestframework<4,>=3.16
+Requires-Dist: requests<3,>=2.32
+Requires-Dist: cryptography<47,>=44
+Provides-Extra: redis
+Requires-Dist: channels-redis<5,>=4.2; extra == "redis"
+Provides-Extra: asgi
+Requires-Dist: daphne<5,>=4.2; extra == "asgi"
+Dynamic: license-file
+
+# LOG Collector
+
+Developed by: CodefilterPH | Euge
+
+LOG Collector is a Django application for local Nginx access-log collection,
+security incidents, API access, WebSocket updates, Celery processing, and
+read-only connections to other LOG Collector installations. CrowdSec connection
+management is included in the distribution.
+
+Install with `pip install codefilterph-logcollector`. Add `log_collector` and
+`crowdsec_integration` to `INSTALLED_APPS`, mount `log_collector.urls`, and run
+migrations. Nginx file access, ASGI, a channel layer, and Celery services are
+configured by the host project; installing the wheel does not provision them.
+
+The developer guides are installed in `log_collector/docs/` inside the Python
+package and are also available in the source repository:
+
+- [Installation](https://github.com/codefilterPH/logcollector/blob/main/log_collector/docs/installation.md)
+- [Configuration](https://github.com/codefilterPH/logcollector/blob/main/log_collector/docs/configuration.md)
+- [API integration](https://github.com/codefilterPH/logcollector/blob/main/log_collector/docs/api.md)
+- [Operations](https://github.com/codefilterPH/logcollector/blob/main/log_collector/docs/operations-guide.md)
+
+The app title defaults to **LOG Collector**. A Django superuser can set the
+displayed title and shared theme on the hosting entity Manage page. The developer
+credit is fixed in the application and cannot be edited through its settings.
+
+License: [MIT](LICENSE).
+
+Release owner: [first-release account setup](https://github.com/codefilterPH/logcollector/blob/main/RELEASE_SETUP.md).

codefilterph_logcollector-0.1.1/codefilterph_logcollector.egg-info/SOURCES.txt

@@ -0,0 +1,59 @@
+LICENSE
+MANIFEST.in
+README.md
+pyproject.toml
+codefilterph_logcollector.egg-info/PKG-INFO
+codefilterph_logcollector.egg-info/SOURCES.txt
+codefilterph_logcollector.egg-info/dependency_links.txt
+codefilterph_logcollector.egg-info/requires.txt
+codefilterph_logcollector.egg-info/top_level.txt
+crowdsec_integration/__init__.py
+crowdsec_integration/apps.py
+crowdsec_integration/models.py
+crowdsec_integration/services.py
+crowdsec_integration/migrations/0001_initial.py
+crowdsec_integration/migrations/__init__.py
+log_collector/__init__.py
+log_collector/apps.py
+log_collector/consumers.py
+log_collector/forms.py
+log_collector/integrations.py
+log_collector/middleware.py
+log_collector/models.py
+log_collector/permissions.py
+log_collector/routing.py
+log_collector/security_events.py
+log_collector/tasks.py
+log_collector/urls.py
+log_collector/views.py
+log_collector/docs/api.md
+log_collector/docs/configuration.md
+log_collector/docs/installation.md
+log_collector/docs/operations-guide.md
+log_collector/management/__init__.py
+log_collector/management/commands/__init__.py
+log_collector/management/commands/backfill_security_incidents.py
+log_collector/management/commands/manage_security_block.py
+log_collector/management/commands/retry_security_sms.py
+log_collector/migrations/0001_initial.py
+log_collector/migrations/0002_remove_logcollectorentity_allowed_api_key_names_and_more.py
+log_collector/migrations/0003_blockedipaddress_securityincident_ipblockauditevent_and_more.py
+log_collector/migrations/0004_app_appearance.py
+log_collector/migrations/__init__.py
+log_collector/services/__init__.py
+log_collector/services/blocking.py
+log_collector/services/client_ip.py
+log_collector/services/incidents.py
+log_collector/services/nginx.py
+log_collector/services/remote.py
+log_collector/services/response.py
+log_collector/services/security.py
+log_collector/services/security_sms.py
+log_collector/services/sync.py
+log_collector/services/trusted_ips.py
+log_collector/static/log_collector/appearance.css
+log_collector/templates/log_collector/dashboard.html
+log_collector/templates/log_collector/entity_form.html
+log_collector/templates/log_collector/entity_manage.html
+log_collector/templates/log_collector/entity_selection.html
+log_collector/templates/log_collector/security_report.html

codefilterph_logcollector-0.1.1/codefilterph_logcollector.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

codefilterph_logcollector-0.1.1/codefilterph_logcollector.egg-info/requires.txt

@@ -0,0 +1,12 @@
+Django<6.1,>=6.0
+channels<5,>=4.2
+celery<6,>=5.5
+djangorestframework<4,>=3.16
+requests<3,>=2.32
+cryptography<47,>=44
+
+[asgi]
+daphne<5,>=4.2
+
+[redis]
+channels-redis<5,>=4.2

codefilterph_logcollector-0.1.1/codefilterph_logcollector.egg-info/top_level.txt

@@ -0,0 +1,2 @@
+crowdsec_integration
+log_collector

codefilterph_logcollector-0.1.1/crowdsec_integration/__init__.py

@@ -0,0 +1 @@
+

codefilterph_logcollector-0.1.1/crowdsec_integration/apps.py

@@ -0,0 +1,6 @@
+from django.apps import AppConfig
+
+
+class CrowdSecIntegrationConfig(AppConfig):
+    default_auto_field = "django.db.models.BigAutoField"
+    name = "crowdsec_integration"

codefilterph_logcollector-0.1.1/crowdsec_integration/migrations/0001_initial.py

@@ -0,0 +1,22 @@
+"""Initial CrowdSec connection schema for standalone installations."""
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    initial = True
+    dependencies = []
+    operations = [
+        migrations.CreateModel(
+            name="CrowdSecConnection",
+            fields=[
+                ("id", models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name="ID")),
+                ("entity_id", models.PositiveBigIntegerField(db_index=True, unique=True)),
+                ("api_url", models.URLField(max_length=500)),
+                ("machine_id", models.CharField(max_length=255)),
+                ("encrypted_password", models.TextField()),
+                ("updated_at", models.DateTimeField(auto_now=True)),
+            ],
+            options={"ordering": ("-updated_at",)},
+        ),
+    ]

codefilterph_logcollector-0.1.1/crowdsec_integration/migrations/__init__.py

@@ -0,0 +1 @@
+

codefilterph_logcollector-0.1.1/crowdsec_integration/models.py

@@ -0,0 +1,14 @@
+from django.db import models
+
+
+class CrowdSecConnection(models.Model):
+    """CrowdSec LAPI credentials for the local Log Collector entity."""
+
+    entity_id = models.PositiveBigIntegerField(unique=True, db_index=True)
+    api_url = models.URLField(max_length=500)
+    machine_id = models.CharField(max_length=255)
+    encrypted_password = models.TextField()
+    updated_at = models.DateTimeField(auto_now=True)
+
+    class Meta:
+        ordering = ("-updated_at",)

codefilterph_logcollector-0.1.1/crowdsec_integration/services.py

@@ -0,0 +1,70 @@
+import base64
+import hashlib
+from urllib.parse import urlsplit
+
+import requests
+from cryptography.fernet import Fernet, InvalidToken
+from django.conf import settings
+
+from .models import CrowdSecConnection
+
+
+class CrowdSecError(Exception):
+    pass
+
+
+def _fernet():
+    key = base64.urlsafe_b64encode(hashlib.sha256(settings.SECRET_KEY.encode()).digest())
+    return Fernet(key)
+
+
+def encrypt_password(password):
+    return _fernet().encrypt(password.encode()).decode()
+
+
+def _password(connection):
+    try:
+        return _fernet().decrypt(connection.encrypted_password.encode()).decode()
+    except (InvalidToken, ValueError) as exc:
+        raise CrowdSecError("Saved credential cannot be decrypted. Re-enter the CrowdSec credential.") from exc
+
+
+def _url(api_url, path):
+    parsed = urlsplit(api_url)
+    if parsed.scheme not in {"https", "http"} or not parsed.hostname or parsed.username or parsed.password:
+        raise CrowdSecError("Enter a valid CrowdSec Local API URL.")
+    if parsed.scheme != "https" and parsed.hostname not in {"localhost", "127.0.0.1", "::1"}:
+        raise CrowdSecError("CrowdSec connections must use HTTPS except for loopback development.")
+    return f"{api_url.rstrip('/')}/{path.lstrip('/')}"
+
+
+def request(connection, method, path, **kwargs):
+    try:
+        login = requests.post(
+            _url(connection.api_url, "v1/watchers/login"),
+            json={"machine_id": connection.machine_id, "password": _password(connection)},
+            timeout=8,
+        )
+        login.raise_for_status()
+        token = login.json().get("token")
+        if not token:
+            raise CrowdSecError("CrowdSec returned no session token.")
+        response = requests.request(
+            method, _url(connection.api_url, path),
+            headers={"Authorization": f"Bearer {token}"}, timeout=8, **kwargs,
+        )
+        response.raise_for_status()
+        return response.json() if response.content else {}
+    except CrowdSecError:
+        raise
+    except (requests.RequestException, ValueError) as exc:
+        raise CrowdSecError("CrowdSec connection failed. Check the URL, credentials, and LAPI permissions.") from exc
+
+
+def validate_connection(api_url, machine_id, password):
+    class Candidate:
+        pass
+    candidate = Candidate()
+    candidate.api_url, candidate.machine_id = api_url, machine_id
+    candidate.encrypted_password = encrypt_password(password)
+    request(candidate, "GET", "v1/alerts?limit=1")

codefilterph_logcollector-0.1.1/log_collector/__init__.py

@@ -0,0 +1 @@
+

codefilterph_logcollector-0.1.1/log_collector/apps.py

@@ -0,0 +1,13 @@
+from django.apps import AppConfig
+
+
+class LogCollectorConfig(AppConfig):
+    default_auto_field = "django.db.models.BigAutoField"
+    name = "log_collector"
+
+    def ready(self):
+        from django.core.checks import register
+
+        from log_collector.services.client_ip import check_security_cidrs
+
+        register(check_security_cidrs)

codefilterph_logcollector-0.1.1/log_collector/consumers.py

@@ -0,0 +1,56 @@
+"""Authenticated, read-only security incident and block notifications."""
+
+import json
+from urllib.parse import parse_qsl
+
+from channels.db import database_sync_to_async
+from channels.generic.websocket import AsyncWebsocketConsumer
+
+from log_collector.models import LogCollectorEntity
+from log_collector.security_events import sanitize_security_event, security_group_name
+
+
+class SecurityEventsConsumer(AsyncWebsocketConsumer):
+    async def connect(self):
+        self.security_group = None
+        user = self.scope.get("user")
+        credentials = {"token", "api_key", "api_token", "access_token", "authorization", "key"}
+        query = self.scope.get("query_string", b"").decode("utf-8", errors="replace")
+        if (not user or not user.is_authenticated or not user.is_active
+                or any(key.lower() in credentials for key, _ in parse_qsl(query, keep_blank_values=True))):
+            await self.close(code=4401)
+            return
+        if not await self.is_data_center_member(user):
+            await self.close(code=4403)
+            return
+        self.entity_id = await self.active_entity_id(self.scope["url_route"]["kwargs"]["slug"])
+        if self.entity_id is None:
+            await self.close(code=4404)
+            return
+        self.security_group = security_group_name(self.entity_id)
+        await self.channel_layer.group_add(self.security_group, self.channel_name)
+        await self.accept()
+
+    @database_sync_to_async
+    def is_data_center_member(self, user):
+        return user.groups.filter(name="DATA_CENTER").exists()
+
+    @database_sync_to_async
+    def active_entity_id(self, slug):
+        return LogCollectorEntity.objects.filter(slug=slug, is_active=True).values_list("pk", flat=True).first()
+
+    async def disconnect(self, close_code):
+        if self.security_group:
+            await self.channel_layer.group_discard(self.security_group, self.channel_name)
+
+    async def receive(self, text_data=None, bytes_data=None):
+        # No client protocol: text, JSON actions and binary input have no effects.
+        pass
+
+    async def security_event(self, message):
+        payload = message.get("event", {})
+        if payload.get("entity_id") != self.entity_id:
+            return
+        event = sanitize_security_event(self.entity_id, payload.get("type"), payload)
+        if event is not None:
+            await self.send(text_data=json.dumps(event))

codefilterph_logcollector-0.1.1/log_collector/docs/api.md

@@ -0,0 +1,27 @@
+# API integration
+
+Mounting `log_collector.urls` at `/log-collector/` exposes read-only entity
+resources under `/log-collector/api/entities/<slug>/`. Resources include
+`metrics/`, `access-logs/`, `geolocation/`, `user-sessions/`, `endpoints/`, and
+`audit-events/`, subject to the entity's feature flags and caller permissions.
+Table resources support pagination; supported resources accept `export=csv`.
+
+Generate an entity-scoped collector token as a superuser on the entity Manage
+page. The raw token is shown once. Server-to-server callers send it in the
+`X-Api-Key` header. The server stores a hash, not the raw token. Tokens may
+have expiry, caller IP/CIDR, and origin restrictions. Do not embed a collector
+token in browser or mobile application code.
+
+To view another installation, create an integration entity with its HTTPS base
+URL, remote entity slug, and remote collector token. Remote calls are read-only
+and fetched on demand; they do not copy remote raw logs into the local database.
+The remote service must expose the LOG Collector API. Arbitrary logging APIs
+need a separate adapter.
+
+The available entity routes also include `security-summary/`,
+`security-incidents/`, `security-blocks/`, and CrowdSec status and decisions.
+State-changing security endpoints require an authorized same-origin session,
+CSRF protection, and the required operator role; a read-only API token cannot
+perform those actions. An expired, revoked, mismatched, or caller-restricted
+token is denied. Inspect recent token usage on the entity Manage page to
+diagnose denials without logging the raw key.

codefilterph_logcollector-0.1.1/log_collector/docs/configuration.md

@@ -0,0 +1,82 @@
+# Configuration
+
+## Nginx collection
+
+Set `LOG_COLLECTOR_NGINX_ACCESS_LOG_PATHS` to the Nginx access-log files that
+the Django and worker processes can read. The default path is
+`/var/log/nginx/access.log`; set `[]` when no local file is available. The
+reader accepts Nginx common and combined access-log entries. Configure the
+hosting entity's paths, cooldown, maximum lines per sync, and retention on its
+Manage page. Access-log rotation must leave new files readable by workers.
+
+## ASGI and WebSockets
+
+Set `ASGI_APPLICATION` and a production `CHANNEL_LAYERS` backend, such as
+`channels_redis`, in the host project. Include the collector route under the
+host's authenticated ASGI WebSocket application:
+
+```python
+from channels.auth import AuthMiddlewareStack
+from channels.routing import ProtocolTypeRouter, URLRouter
+from django.core.asgi import get_asgi_application
+
+django_asgi_app = get_asgi_application()
+from log_collector.routing import websocket_urlpatterns
+
+application = ProtocolTypeRouter({
+    "http": django_asgi_app,
+    "websocket": AuthMiddlewareStack(URLRouter(websocket_urlpatterns)),
+})
+```
+
+The route is `/ws/log-collector/entities/<slug>/security/`. Its origin
+validator is part of the route. Set the host's `ALLOWED_HOSTS` correctly.
+The browser Origin must match the WebSocket Host and port; when
+`LOG_COLLECTOR_SECURITY_WEBSOCKET_ALLOWED_ORIGINS` is set, that exact origin
+must also appear in the list.
+
+## Celery
+
+Configure a Celery broker, worker, and beat scheduler in the host project.
+The default queue handles `log_collector.tasks.collect_analyze_and_respond`,
+`expire_security_blocks`, and `retry_security_edge_actions`. Schedule the
+first task at the desired polling interval (five seconds in the original
+deployment) and the latter two at one-minute intervals. An `sms` queue worker
+is required when security SMS is enabled; route `queue_security_incident_sms_alert`,
+`send_security_incident_sms_chunk`, and `retry_security_incident_sms_alert` there.
+Collection can also run on dashboard/API requests, but continuous collection
+requires beat and a worker.
+
+## Optional host integrations
+
+The local geolocation and user-session APIs need models supplied by the host:
+
+```python
+LOG_COLLECTOR_GEOLOCATION_MODEL = "your_geo_app.UserLocation"
+LOG_COLLECTOR_USER_SESSION_MODEL = "your_sessions_app.UserSession"
+```
+
+The geolocation model must expose `user`, `captured_at`, `ip_address`,
+`latitude`, `longitude`, `country`, and `city`; the session model must expose
+`user`, `session_key`, `ip`, `created_at`, `last_seen_at`, and `user_agent`.
+Disable the entity's geolocation or user-session feature when no compatible
+model exists. With an enabled feature but no model configured, its local API
+returns HTTP 503 naming the missing setting; security summaries still work
+without session data. Remote entities use the remote collector API instead.
+
+
+The package does not assume a particular user-profile or SMS provider. Set
+the following to importable dotted Python callables when using those actions:
+
+- `LOG_COLLECTOR_ACCOUNT_CONTAINMENT_FUNCTION`: accepts a user and returns an
+  object with `as_dict()` describing revoked authentication state.
+- `LOG_COLLECTOR_SMS_RECIPIENTS_FUNCTION`: returns iterable
+  `SecuritySMSRecipient(user, phone_number)` values from
+  `log_collector.integrations`.
+- `LOG_COLLECTOR_SMS_SENDER_FUNCTION`: accepts `mobile_number`, `message`, and
+  `context` keyword arguments.
+
+`LOG_COLLECTOR_SECURITY_SMS_ENABLED` defaults to false. Enable it only after
+the recipient and sender functions, provider, and `sms` worker are configured.
+The optional Nginx edge-block helper is supplied and reviewed by the host;
+the wheel does not install privileged executables. See [Operations](operations-guide.md).

codefilterph_logcollector-0.1.1/log_collector/docs/installation.md

@@ -0,0 +1,40 @@
+# Installation
+
+LOG Collector supports Python 3.12–3.13 and Django 6.0.x. Use a virtual
+environment in the host Django project:
+
+```shell
+python -m pip install 'codefilterph-logcollector[redis,asgi]'
+```
+
+Add the apps and mount the HTTP URLs:
+
+```python
+INSTALLED_APPS += [
+    "channels",
+    "rest_framework",
+    "crowdsec_integration.apps.CrowdSecIntegrationConfig",
+    "log_collector.apps.LogCollectorConfig",
+]
+
+# In the project's urls.py:
+urlpatterns += [path("log-collector/", include("log_collector.urls"))]
+```
+
+Keep Django's `auth`, `contenttypes`, and `sessions` apps installed. Apply the
+database schema with `python manage.py migrate`. The collector uses
+`AUTH_USER_MODEL`, so configure a custom user model before its first migration
+if your project needs one.
+
+Add `log_collector.middleware.SecurityIPBlockMiddleware` after Django's
+`AuthenticationMiddleware` if application-level IP blocking is wanted. Give
+authorized dashboard users membership in the `DATA_CENTER` group. A user also
+needs `is_superuser=True` to open the Manage page or change configuration.
+
+The default hosting entity is created on first access and has slug
+`hosting-app`. Open `/log-collector/entities/hosting-app/manage/` as a
+superuser to set the displayed app name, shared theme, and local collection
+paths. An unset name displays **LOG Collector**.
+
+See [Configuration](configuration.md) before enabling collection, WebSockets,
+Celery, SMS, or Nginx edge blocking.