infradrift 1.1.0__tar.gz

infradrift-1.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Serber1990
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

infradrift-1.1.0/PKG-INFO

@@ -0,0 +1,195 @@
+Metadata-Version: 2.4
+Name: infradrift
+Version: 1.1.0
+Summary: Detect drift between a known-good baseline and the current state of a Linux server — packages, ports, users, groups, crons and services.
+Author-email: Serber1990 <serber1990@pm.me>
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/serber1990/infradrift
+Project-URL: Repository, https://github.com/serber1990/infradrift
+Project-URL: Issues, https://github.com/serber1990/infradrift/issues
+Project-URL: Changelog, https://github.com/serber1990/infradrift/blob/main/CHANGELOG.md
+Keywords: infrastructure,drift,sysadmin,devops,security,audit,snapshot,linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Environment :: Console
+Classifier: Intended Audience :: System Administrators
+Classifier: Topic :: System :: Systems Administration
+Classifier: Topic :: Security
+Classifier: Topic :: Utilities
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: shellcolorize>=1.1.0
+Provides-Extra: dev
+Requires-Dist: pytest>=7; extra == "dev"
+Requires-Dist: ruff>=0.4; extra == "dev"
+Dynamic: license-file
+
+# infradrift
+
+[![CI](https://github.com/serber1990/infradrift/actions/workflows/ci.yml/badge.svg)](https://github.com/serber1990/infradrift/actions/workflows/ci.yml)
+[![PyPI version](https://badge.fury.io/py/infradrift.svg)](https://badge.fury.io/py/infradrift)
+[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
+
+Detect **infrastructure drift** between a known-good baseline and the current state of any Linux server —
+packages, listening ports, user accounts, privileged groups, cron jobs and systemd services.
+
+Take a snapshot when the server is in a good state. Run `check` any time — after a deploy, from cron,
+or during an incident — to see exactly what changed. No agent, no daemon, no dependencies on the server
+beyond Python.
+
+---
+
+## 📄 Example
+
+```
+  ╔═══════════════════════════════╗
+  ║  infradrift  ·  drift report  ║
+  ╚═══════════════════════════════╝
+
+  Baseline   2026-05-10T09:00:00+02:00  (prod-01)  as root
+  Current    2026-05-12T14:22:18+02:00  (prod-01)  as root
+
+
+  ── Ports ─────────────────────────────────
+  ⛔ +  4444/tcp on all interfaces  (nc) — new listening port
+  ⛔ ~  6379/tcp on all interfaces  (redis-server) — now listening on a new address
+
+  ── Users ─────────────────────────────────
+  ⛔ ~  backup — account changed  shell /usr/sbin/nologin → /bin/bash
+  ⛔ +  deploy — new user  uid=1005 shell=/bin/bash
+
+  ── Privileged Groups ─────────────────────
+  ⛔ +  deploy added to privileged group sudo
+
+  ── Cron Jobs ─────────────────────────────
+  ⚠  +  New cron job: @reboot  /tmp/.cache/update.sh  crontab:www-data
+
+  ── Services ──────────────────────────────
+  ⚠  ~  nginx  active → failed
+
+  ── Packages ──────────────────────────────
+  · ~  [apt] openssl upgraded  3.0.13-0ubuntu3 → 3.0.13-0ubuntu3.1
+
+  ──────────────────────────────────────────
+  8 changes detected  (5 critical, 2 warnings, 1 info)
+```
+
+---
+
+## ✨ What it detects
+
+| Category | What's tracked |
+|----------|----------------|
+| **Packages** | dpkg (Debian/Ubuntu), rpm (RHEL/Fedora/SUSE), pacman (Arch), pip — installed, removed, upgraded, downgraded |
+| **Ports** | Listening TCP and bound UDP sockets **with their bind address** — a service moving from `127.0.0.1` to `0.0.0.0` is flagged |
+| **Users** | `/etc/passwd` accounts — added, removed, uid/gid/shell/home changes |
+| **Privileged groups** | Membership of `sudo`, `wheel`, `admin`, `docker`, `lxd`, `libvirt`, `adm`, `disk`, `shadow`, `root` |
+| **Cron jobs** | User crontabs, `/etc/crontab`, `/etc/cron.d/`, `/etc/cron.{hourly,daily,weekly,monthly}/`, including `@reboot` entries |
+| **Services** | systemd unit state (active / inactive / failed) and boot enablement (enabled / disabled / masked) |
+
+### Severity levels
+
+| Severity | Examples |
+|----------|----------|
+| ⛔ **CRITICAL** | New listening port, port exposed on a new address, new user, uid/shell change, user added to a privileged group |
+| ⚠️ **WARNING** | Service state or enablement change, new enabled service, cron job added/removed, package removed or downgraded |
+| ℹ️ **INFO** | Package installed or upgraded, new high UDP port (ephemeral range — usually a client socket) |
+
+---
+
+## 📥 Installation
+
+```bash
+pip install infradrift
+```
+
+Run it as **root** for complete results: other users' crontabs and the process names of every socket are
+only visible to root. infradrift warns you when it runs unprivileged.
+
+---
+
+## 🛠 Usage
+
+### 1 — Take a baseline snapshot
+
+```bash
+sudo infradrift snapshot
+```
+
+Saved to `/var/lib/infradrift/baseline.json` when run as root, or `~/.config/infradrift/baseline.json` otherwise.
+The file is created with `0600` permissions: it lists users, ports and cron commands.
+
+```bash
+sudo infradrift snapshot --output /opt/baselines/prod-$(date +%F).json
+```
+
+### 2 — Check for drift
+
+```bash
+sudo infradrift check                                   # terminal report
+sudo infradrift check --format json | jq .summary       # JSON on stdout, progress on stderr
+sudo infradrift check -f markdown -o drift-report.md    # Markdown file
+sudo infradrift check --baseline /opt/baselines/prod-2026-05-12.json --fail-on critical
+```
+
+### 3 — Diff any two snapshots
+
+```bash
+infradrift diff before-deploy.json after-deploy.json
+infradrift diff web-01.json web-02.json --format markdown   # compare two servers
+```
+
+---
+
+## 🔁 Use in cron / CI
+
+| Exit code | Meaning |
+|-----------|---------|
+| `0` | No drift at or above `--fail-on` |
+| `1` | Drift detected |
+| `2` | Error (missing or unreadable baseline) |
+
+```cron
+# Every hour: keep a Markdown report only when something critical changed
+0 * * * * root infradrift check --fail-on critical -o /var/log/infradrift/last.md || cp /var/log/infradrift/last.md /var/log/infradrift/alert-$(date +\%F-\%H).md
+```
+
+---
+
+## 📋 Options
+
+### `infradrift snapshot`
+| Option | Description |
+|--------|-------------|
+| `-o`, `--output FILE` | Where to save the baseline |
+
+### `infradrift check` / `infradrift diff BASELINE CURRENT`
+| Option | Description |
+|--------|-------------|
+| `-b`, `--baseline FILE` | *(check)* Baseline to compare against |
+| `-f`, `--format` | `terminal` (default), `json` or `markdown` |
+| `-o`, `--output FILE` | Write the report to a file (JSON or Markdown) |
+| `--fail-on LEVEL` | `info` (default: any change), `warning`, `critical` or `never` |
+
+---
+
+## 🧪 Development
+
+```bash
+pip install -e ".[dev]"
+ruff check .
+pytest
+```
+
+See [CHANGELOG.md](CHANGELOG.md) for release notes.
+
+---
+
+## 📝 License
+
+MIT — see [LICENSE](LICENSE).
+
+## 🌐 Connect
+
+[![GitHub](https://img.shields.io/badge/GitHub-@serber1990-181717?style=flat-square&logo=github)](https://github.com/serber1990)

infradrift-1.1.0/README.md

@@ -0,0 +1,168 @@
+# infradrift
+
+[![CI](https://github.com/serber1990/infradrift/actions/workflows/ci.yml/badge.svg)](https://github.com/serber1990/infradrift/actions/workflows/ci.yml)
+[![PyPI version](https://badge.fury.io/py/infradrift.svg)](https://badge.fury.io/py/infradrift)
+[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
+
+Detect **infrastructure drift** between a known-good baseline and the current state of any Linux server —
+packages, listening ports, user accounts, privileged groups, cron jobs and systemd services.
+
+Take a snapshot when the server is in a good state. Run `check` any time — after a deploy, from cron,
+or during an incident — to see exactly what changed. No agent, no daemon, no dependencies on the server
+beyond Python.
+
+---
+
+## 📄 Example
+
+```
+  ╔═══════════════════════════════╗
+  ║  infradrift  ·  drift report  ║
+  ╚═══════════════════════════════╝
+
+  Baseline   2026-05-10T09:00:00+02:00  (prod-01)  as root
+  Current    2026-05-12T14:22:18+02:00  (prod-01)  as root
+
+
+  ── Ports ─────────────────────────────────
+  ⛔ +  4444/tcp on all interfaces  (nc) — new listening port
+  ⛔ ~  6379/tcp on all interfaces  (redis-server) — now listening on a new address
+
+  ── Users ─────────────────────────────────
+  ⛔ ~  backup — account changed  shell /usr/sbin/nologin → /bin/bash
+  ⛔ +  deploy — new user  uid=1005 shell=/bin/bash
+
+  ── Privileged Groups ─────────────────────
+  ⛔ +  deploy added to privileged group sudo
+
+  ── Cron Jobs ─────────────────────────────
+  ⚠  +  New cron job: @reboot  /tmp/.cache/update.sh  crontab:www-data
+
+  ── Services ──────────────────────────────
+  ⚠  ~  nginx  active → failed
+
+  ── Packages ──────────────────────────────
+  · ~  [apt] openssl upgraded  3.0.13-0ubuntu3 → 3.0.13-0ubuntu3.1
+
+  ──────────────────────────────────────────
+  8 changes detected  (5 critical, 2 warnings, 1 info)
+```
+
+---
+
+## ✨ What it detects
+
+| Category | What's tracked |
+|----------|----------------|
+| **Packages** | dpkg (Debian/Ubuntu), rpm (RHEL/Fedora/SUSE), pacman (Arch), pip — installed, removed, upgraded, downgraded |
+| **Ports** | Listening TCP and bound UDP sockets **with their bind address** — a service moving from `127.0.0.1` to `0.0.0.0` is flagged |
+| **Users** | `/etc/passwd` accounts — added, removed, uid/gid/shell/home changes |
+| **Privileged groups** | Membership of `sudo`, `wheel`, `admin`, `docker`, `lxd`, `libvirt`, `adm`, `disk`, `shadow`, `root` |
+| **Cron jobs** | User crontabs, `/etc/crontab`, `/etc/cron.d/`, `/etc/cron.{hourly,daily,weekly,monthly}/`, including `@reboot` entries |
+| **Services** | systemd unit state (active / inactive / failed) and boot enablement (enabled / disabled / masked) |
+
+### Severity levels
+
+| Severity | Examples |
+|----------|----------|
+| ⛔ **CRITICAL** | New listening port, port exposed on a new address, new user, uid/shell change, user added to a privileged group |
+| ⚠️ **WARNING** | Service state or enablement change, new enabled service, cron job added/removed, package removed or downgraded |
+| ℹ️ **INFO** | Package installed or upgraded, new high UDP port (ephemeral range — usually a client socket) |
+
+---
+
+## 📥 Installation
+
+```bash
+pip install infradrift
+```
+
+Run it as **root** for complete results: other users' crontabs and the process names of every socket are
+only visible to root. infradrift warns you when it runs unprivileged.
+
+---
+
+## 🛠 Usage
+
+### 1 — Take a baseline snapshot
+
+```bash
+sudo infradrift snapshot
+```
+
+Saved to `/var/lib/infradrift/baseline.json` when run as root, or `~/.config/infradrift/baseline.json` otherwise.
+The file is created with `0600` permissions: it lists users, ports and cron commands.
+
+```bash
+sudo infradrift snapshot --output /opt/baselines/prod-$(date +%F).json
+```
+
+### 2 — Check for drift
+
+```bash
+sudo infradrift check                                   # terminal report
+sudo infradrift check --format json | jq .summary       # JSON on stdout, progress on stderr
+sudo infradrift check -f markdown -o drift-report.md    # Markdown file
+sudo infradrift check --baseline /opt/baselines/prod-2026-05-12.json --fail-on critical
+```
+
+### 3 — Diff any two snapshots
+
+```bash
+infradrift diff before-deploy.json after-deploy.json
+infradrift diff web-01.json web-02.json --format markdown   # compare two servers
+```
+
+---
+
+## 🔁 Use in cron / CI
+
+| Exit code | Meaning |
+|-----------|---------|
+| `0` | No drift at or above `--fail-on` |
+| `1` | Drift detected |
+| `2` | Error (missing or unreadable baseline) |
+
+```cron
+# Every hour: keep a Markdown report only when something critical changed
+0 * * * * root infradrift check --fail-on critical -o /var/log/infradrift/last.md || cp /var/log/infradrift/last.md /var/log/infradrift/alert-$(date +\%F-\%H).md
+```
+
+---
+
+## 📋 Options
+
+### `infradrift snapshot`
+| Option | Description |
+|--------|-------------|
+| `-o`, `--output FILE` | Where to save the baseline |
+
+### `infradrift check` / `infradrift diff BASELINE CURRENT`
+| Option | Description |
+|--------|-------------|
+| `-b`, `--baseline FILE` | *(check)* Baseline to compare against |
+| `-f`, `--format` | `terminal` (default), `json` or `markdown` |
+| `-o`, `--output FILE` | Write the report to a file (JSON or Markdown) |
+| `--fail-on LEVEL` | `info` (default: any change), `warning`, `critical` or `never` |
+
+---
+
+## 🧪 Development
+
+```bash
+pip install -e ".[dev]"
+ruff check .
+pytest
+```
+
+See [CHANGELOG.md](CHANGELOG.md) for release notes.
+
+---
+
+## 📝 License
+
+MIT — see [LICENSE](LICENSE).
+
+## 🌐 Connect
+
+[![GitHub](https://img.shields.io/badge/GitHub-@serber1990-181717?style=flat-square&logo=github)](https://github.com/serber1990)

infradrift-1.1.0/infradrift/__init__.py

@@ -0,0 +1,5 @@
+__version__ = "1.1.0"
+
+from .cli import main  # noqa: E402  (after __version__: cli imports it)
+
+__all__ = ["main", "__version__"]

infradrift-1.1.0/infradrift/__main__.py

@@ -0,0 +1,3 @@
+from .cli import main
+
+main()

infradrift-1.1.0/infradrift/cli.py

@@ -0,0 +1,178 @@
+#!/usr/bin/env python3
+"""
+infradrift — snapshot a Linux server and detect drift: packages, ports, users,
+privileged groups, cron jobs and systemd services.
+
+Exit codes:  0 no drift (at or above --fail-on)   1 drift detected   2 usage or I/O error
+"""
+import argparse
+import os
+import sys
+from pathlib import Path
+
+from shellcolorize import Color
+
+from . import __version__
+from .diff import diff_snapshots
+from .renderer import render_json, render_markdown, render_terminal
+from .snapshot import StateSnapshot, default_path, take_snapshot
+
+EXIT_OK, EXIT_DRIFT, EXIT_ERROR = 0, 1, 2
+FAIL_LEVELS = {'info': 'INFO', 'warning': 'WARNING', 'critical': 'CRITICAL'}
+
+
+# Progress, warnings and errors go to stderr so stdout only carries the report.
+def _ok(msg: str)   -> None: print(f"  {Color.GREEN}✔{Color.RESET}  {msg}", file=sys.stderr)
+def _step(msg: str) -> None: print(f"  {Color.CYAN}▶{Color.RESET}  {msg}", file=sys.stderr)
+def _err(msg: str)  -> None: print(f"  {Color.RED}✖{Color.RESET}  {msg}", file=sys.stderr)
+def _warn(msg: str) -> None: print(f"  {Color.YELLOW}⚠{Color.RESET}  {msg}", file=sys.stderr)
+
+
+def _root_hint() -> None:
+    if os.geteuid() != 0:
+        _warn('Not running as root: other users\' crontabs and some process names are not visible.')
+
+# ── snapshot ──────────────────────────────────────────────────────────────────
+
+def cmd_snapshot(args: argparse.Namespace) -> int:
+    output = Path(args.output) if args.output else default_path()
+    print(f"\n  {Color.CYAN}{Color.BOLD}infradrift  ·  snapshot{Color.RESET}\n", file=sys.stderr)
+    _root_hint()
+    snap = take_snapshot(progress=lambda what: _step(f'Collecting {what}...'))
+
+    try:
+        snap.save(output)
+    except OSError as e:
+        _err(f'Cannot write {output}: {e.strerror}')
+        if os.geteuid() != 0:
+            _err('Use --output to choose another location, or run with sudo.')
+        return EXIT_ERROR
+
+    print()
+    _ok(f'Baseline saved: {output}')
+    managers = ', '.join(f'{m} {len(p)}' for m, p in snap.packages.items()) or 'none'
+    print(f'  Packages : {sum(len(p) for p in snap.packages.values())}  ({managers})')
+    print(f'  Ports    : {len(snap.ports)} listening')
+    print(f'  Users    : {len(snap.users)} accounts, {len(snap.groups)} privileged groups')
+    print(f'  Crons    : {len(snap.crons)} jobs')
+    print(f'  Services : {len(snap.services)} units')
+    print()
+    return EXIT_OK
+
+# ── check / diff ──────────────────────────────────────────────────────────────
+
+def _load(path: Path):
+    try:
+        return StateSnapshot.load(path)
+    except FileNotFoundError:
+        _err(f'Snapshot not found: {path}')
+    except PermissionError:
+        _err(f'Permission denied: {path} (baselines are only readable by their owner)')
+    except (OSError, ValueError, TypeError) as e:
+        _err(f'Cannot read snapshot {path}: {e}')
+    return None
+
+
+def _report(report, args: argparse.Namespace) -> int:
+    b_user, c_user = report.baseline_meta.get('user'), report.current_meta.get('user')
+    if b_user and c_user and b_user != c_user:
+        _warn(f'Baseline taken as "{b_user}", current state as "{c_user}": '
+              'some differences may only be visibility differences.')
+
+    fmt = args.format
+    if fmt == 'terminal' and args.output:
+        fmt = 'markdown' if str(args.output).endswith('.md') else 'json'
+
+    if fmt == 'terminal':
+        render_terminal(report)
+    else:
+        text = render_json(report) if fmt == 'json' else render_markdown(report)
+        if args.output:
+            try:
+                Path(args.output).write_text(text + '\n', encoding='utf-8')
+            except OSError as e:
+                _err(f'Cannot write {args.output}: {e.strerror}')
+                return EXIT_ERROR
+            _ok(f'Report saved to {args.output}')
+        else:
+            print(text)
+
+    if args.fail_on == 'never':
+        return EXIT_OK
+    return EXIT_DRIFT if report.has_at_least(FAIL_LEVELS[args.fail_on]) else EXIT_OK
+
+
+def cmd_check(args: argparse.Namespace) -> int:
+    baseline_path = Path(args.baseline) if args.baseline else default_path()
+    if not baseline_path.exists():
+        _err(f'Baseline not found: {baseline_path}')
+        _err("Run 'infradrift snapshot' first to create one.")
+        return EXIT_ERROR
+    baseline = _load(baseline_path)
+    if baseline is None:
+        return EXIT_ERROR
+    _step('Collecting current state...')
+    return _report(diff_snapshots(baseline, take_snapshot()), args)
+
+
+def cmd_diff(args: argparse.Namespace) -> int:
+    snap_a, snap_b = _load(Path(args.snapshot_a)), _load(Path(args.snapshot_b))
+    if snap_a is None or snap_b is None:
+        return EXIT_ERROR
+    return _report(diff_snapshots(snap_a, snap_b), args)
+
+# ── main ──────────────────────────────────────────────────────────────────────
+
+def _add_report_options(p: argparse.ArgumentParser) -> None:
+    p.add_argument('--format', '-f', choices=['terminal', 'json', 'markdown'], default='terminal',
+                   help='Report format (default: terminal)')
+    p.add_argument('--output', '-o', metavar='FILE',
+                   help='Write the report to FILE (json or markdown; inferred from .md/.json if needed)')
+    p.add_argument('--fail-on', choices=['info', 'warning', 'critical', 'never'], default='info',
+                   help='Lowest severity that makes the exit code 1 (default: info = any change)')
+
+
+def build_parser() -> argparse.ArgumentParser:
+    default = default_path()
+    parser = argparse.ArgumentParser(
+        prog='infradrift',
+        description='Detect drift between a known-good baseline and the current state of a Linux server.',
+        epilog='exit codes: 0 no drift · 1 drift detected · 2 error',
+    )
+    parser.add_argument('-v', '--version', action='version', version=f'infradrift {__version__}')
+    sub = parser.add_subparsers(dest='command', metavar='COMMAND')
+
+    p_snap = sub.add_parser('snapshot', help='Capture the current state as baseline')
+    p_snap.add_argument('--output', '-o', metavar='FILE', help=f'Baseline output path (default: {default})')
+
+    p_check = sub.add_parser('check', help='Compare the current state against the baseline')
+    p_check.add_argument('--baseline', '-b', metavar='FILE',
+                         help=f'Baseline to compare against (default: {default})')
+    _add_report_options(p_check)
+
+    p_diff = sub.add_parser('diff', help='Compare two snapshot files')
+    p_diff.add_argument('snapshot_a', metavar='BASELINE')
+    p_diff.add_argument('snapshot_b', metavar='CURRENT')
+    _add_report_options(p_diff)
+    return parser
+
+
+def main(argv=None) -> None:
+    parser = build_parser()
+    args = parser.parse_args(argv)
+    Color.auto()
+
+    if args.command is None:
+        parser.print_help()
+        sys.exit(EXIT_OK)
+
+    dispatch = {'snapshot': cmd_snapshot, 'check': cmd_check, 'diff': cmd_diff}
+    try:
+        sys.exit(dispatch[args.command](args))
+    except KeyboardInterrupt:
+        _err('Interrupted')
+        sys.exit(130)
+
+
+if __name__ == '__main__':
+    main()