From 07f7809541e78c9f2b805afcea1738cc86eac66a Mon Sep 17 00:00:00 2001
From: acencyril <70582526+acencyril@users.noreply.github.com>
Date: Fri, 4 Sep 2026 08:37:23 +0200
Subject: [PATCH] Add acencyril/sentinelle-bundle recipe (#2040)

* Add acencyril/sentinelle-bundle recipe

* Remove aliases, not supported in contrib

* Target 0.2

* Target 0.3, English configuration

* Add trailing newlines

* Fix indentation

* Trailing newline, remove IDE files

* Fix YAML indentation
---
 .../0.3/config/packages/sentinelle.yaml       | 14 +++++++
 .../0.3/config/routes/sentinelle.yaml         |  3 ++
 acencyril/sentinelle-bundle/0.3/manifest.json | 40 +++++++++++++++++++
 3 files changed, 57 insertions(+)
 create mode 100644 acencyril/sentinelle-bundle/0.3/config/packages/sentinelle.yaml
 create mode 100644 acencyril/sentinelle-bundle/0.3/config/routes/sentinelle.yaml
 create mode 100644 acencyril/sentinelle-bundle/0.3/manifest.json

diff --git a/acencyril/sentinelle-bundle/0.3/config/packages/sentinelle.yaml b/acencyril/sentinelle-bundle/0.3/config/packages/sentinelle.yaml
new file mode 100644
index 00000000..c4ed4c0b
--- /dev/null
+++ b/acencyril/sentinelle-bundle/0.3/config/packages/sentinelle.yaml
@@ -0,0 +1,14 @@
+sentinelle:
+    # Dry-run: Sentinelle detects, logs and alerts, but blocks NOTHING.
+    # Nobody wires automatic blocking into a production site without knowing
+    # what it will shut out. Watch the dashboard for a few days, ask yourself
+    # "would I have wanted to block that one?", then switch it off.
+    dry_run: true
+    alert:
+        recipient: '%env(SENTINELLE_ALERT_EMAIL)%'
+    access:
+        role: ROLE_ADMIN
+    never_block:
+        # At minimum your own outbound address. Private ranges are protected
+        # by default, but yours is not: one wrong move locks you out.
+        ips: '%env(default::SENTINELLE_ALLOWLIST)%'
diff --git a/acencyril/sentinelle-bundle/0.3/config/routes/sentinelle.yaml b/acencyril/sentinelle-bundle/0.3/config/routes/sentinelle.yaml
new file mode 100644
index 00000000..640304a6
--- /dev/null
+++ b/acencyril/sentinelle-bundle/0.3/config/routes/sentinelle.yaml
@@ -0,0 +1,3 @@
+sentinelle:
+    resource: '@SentinelleBundle/config/routes.php'
+    type: php
diff --git a/acencyril/sentinelle-bundle/0.3/manifest.json b/acencyril/sentinelle-bundle/0.3/manifest.json
new file mode 100644
index 00000000..c0b51482
--- /dev/null
+++ b/acencyril/sentinelle-bundle/0.3/manifest.json
@@ -0,0 +1,40 @@
+{
+    "bundles": {
+        "Acencyril\\SentinelleBundle\\SentinelleBundle": [
+            "all"
+        ]
+    },
+    "copy-from-recipe": {
+        "config/": "%CONFIG_DIR%/"
+    },
+    "env": {
+        "#1": "Where security alerts are sent.",
+        "SENTINELLE_ALERT_EMAIL": "admin@example.com",
+        "#2": "IPs or CIDRs, comma separated, that must never be blocked.",
+        "#3": "PUT YOUR OWN OUTBOUND ADDRESS HERE before going live:",
+        "#4": "without it, an automatic block can lock you out of your own site.",
+        "SENTINELLE_ALLOWLIST": ""
+    },
+    "post-install-output": [
+        "  <bg=blue;fg=white>Sentinelle is installed.</> Three things before going live:",
+        "",
+        "  * Set <comment>SENTINELLE_ALLOWLIST</comment> in your <comment>.env</comment> — at minimum your own",
+        "    outbound address. Without it, an automatic block can lock you out of",
+        "    your own site.",
+        "",
+        "  * Create the schema:",
+        "      <comment>php bin/console doctrine:migrations:diff</comment>",
+        "      <comment>php bin/console doctrine:migrations:migrate</comment>",
+        "",
+        "  * Check it can do its job:",
+        "      <comment>php bin/console sentinelle:check</comment>",
+        "",
+        "  Sentinelle starts in <comment>dry-run</comment>: it detects, logs and alerts, but blocks",
+        "  nothing. Watch <comment>/admin/activity</comment> for a few days, then set",
+        "  <comment>sentinelle.dry_run</comment> to <comment>false</comment>.",
+        "",
+        "  And schedule the purge, without which strike counters never reset:",
+        "      <comment>0 4 * * * php bin/console sentinelle:purge</comment>",
+        ""
+    ]
+}