feat(socai): add ThreatWinds as a zero-config default LLM provider

Author: Kbayero

backend/modules.go

@@ -184,7 +184,8 @@ func initModules(db *gorm.DB, cfg *config) *modules {
 
 	iamMod := iam.NewModule(authUsecase, userUsecase, roleUsecase, tfaUsecase, apiKeyUsecase, idpUsecase, samlUsecase, cfg.uploadDir)
 	socAIMod := socai.NewModule(cfg.socAIBaseURL, cfg.internalKey, cipher,
-		env.String("INTEGRATIONS_TENANT_DIR", "/workdir/pipeline", false))
+		env.String("INTEGRATIONS_TENANT_DIR", "/workdir/pipeline", false),
+		env.String("UPDATES_DIR", "/updates", false))
 	incidentsMod := incidents.NewModule(
 		db,
 		incidents_connectors.NewNoopMailer(),

backend/modules/socai/module.go

@@ -4,6 +4,7 @@ import (
 	"github.com/utmstack/utmstack/backend/modules/socai/repository"
 	"github.com/utmstack/utmstack/backend/modules/socai/usecase"
 	"github.com/utmstack/utmstack/backend/modules/socai/verifier"
+	"github.com/utmstack/utmstack/backend/pkg/instanceconfig"
 	"github.com/utmstack/utmstack/backend/pkg/secret"
 )
 
@@ -12,10 +13,15 @@ type Module struct {
 	config *usecase.ConfigService
 }
 
-func NewModule(baseURL, internalKey string, cipher *secret.Cipher, pipelineDir string) *Module {
+func NewModule(baseURL, internalKey string, cipher *secret.Cipher, pipelineDir, updatesDir string) *Module {
+	instanceconfig.Init(updatesDir)
+
+	config := usecase.NewConfigService(repository.NewConfigStore(pipelineDir), cipher, verifier.New())
+	config.StartEnsureDefaultLoop()
+
 	return &Module{
 		client: NewSocAIClient(baseURL, internalKey),
-		config: usecase.NewConfigService(repository.NewConfigStore(pipelineDir), cipher, verifier.New()),
+		config: config,
 	}
 }
 

backend/modules/socai/usecase/config.go

@@ -4,15 +4,92 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"strings"
+	"time"
 
+	"github.com/threatwinds/go-sdk/catcher"
 	"github.com/utmstack/utmstack/backend/modules/socai/dto"
 	"github.com/utmstack/utmstack/backend/modules/socai/repository"
 	"github.com/utmstack/utmstack/backend/modules/socai/verifier"
+	"github.com/utmstack/utmstack/backend/pkg/instanceconfig"
 	"github.com/utmstack/utmstack/backend/pkg/secret"
 )
 
 var ErrVerificationFailed = errors.New("connection verification failed")
 
+// threatWindsAIPath is the CM proxy path for the AI chat-completions endpoint
+// (see backend/modules/threatintel: same reverse-proxy target, same id/key auth).
+const threatWindsAIPath = "/proxy/api/ai/v1/chat/completions"
+const threatWindsDefaultModel = "silas-1.0"
+
+var ErrInstanceNotRegistered = errors.New("instance not registered yet — cannot use the ThreatWinds provider")
+
+const ensureDefaultRetryInterval = 30 * time.Second
+
+// StartEnsureDefaultLoop provisions the default ThreatWinds config in the
+// background, retrying until it succeeds. A fresh install's backend can
+// start before the updater service (a separate host process installed after
+// the Docker stack — see installer/install.go) finishes registering the
+// instance and writing instance-config.yml, so a single boot-time attempt
+// isn't enough; this keeps checking every 30s until the instance is
+// registered or a config already exists.
+func (s *ConfigService) StartEnsureDefaultLoop() {
+	if s.EnsureDefault() {
+		return
+	}
+	go func() {
+		for range time.Tick(ensureDefaultRetryInterval) {
+			if s.EnsureDefault() {
+				return
+			}
+		}
+	}()
+}
+
+func (s *ConfigService) EnsureDefault() bool {
+	existing, err := s.store.Load()
+	if err != nil {
+		catcher.Warn("socai: failed to check existing config for default provisioning", map[string]any{"error": err.Error()})
+		return false
+	}
+	if existing != nil {
+		return true
+	}
+
+	inst := instanceconfig.Get()
+	if inst == nil || inst.Server == "" || inst.InstanceID == "" || inst.InstanceKey == "" {
+		return false
+	}
+
+	idEnc, err := s.cipher.Encrypt(inst.InstanceID)
+	if err != nil {
+		catcher.Warn("socai: failed to encrypt default ThreatWinds credentials", map[string]any{"error": err.Error()})
+		return false
+	}
+	keyEnc, err := s.cipher.Encrypt(inst.InstanceKey)
+	if err != nil {
+		catcher.Warn("socai: failed to encrypt default ThreatWinds credentials", map[string]any{"error": err.Error()})
+		return false
+	}
+
+	fc := &repository.FileConfig{
+		Provider:          "threatwinds",
+		Model:             threatWindsDefaultModel,
+		URL:               strings.TrimRight(inst.Server, "/") + threatWindsAIPath,
+		AuthType:          "none",
+		CustomHeaders:     map[string]string{"id": idEnc, "key": keyEnc},
+		MaxTokens:         4096,
+		MaxToolIterations: 12,
+		AutoAnalyze:       true,
+	}
+	if err := s.store.Save(fc); err != nil {
+		catcher.Warn("socai: failed to save default ThreatWinds config", map[string]any{"error": err.Error()})
+		return false
+	}
+	catcher.Info("socai: auto-configured default ThreatWinds provider", nil)
+	return true
+}
+
 // connectionVerifier pings the LLM endpoint with the candidate credentials.
 type connectionVerifier interface {
 	Verify(ctx context.Context, c verifier.Config) error
@@ -94,14 +171,29 @@ func (s *ConfigService) Update(ctx context.Context, req dto.ConfigRequest) (*dto
 		authType = "bearer"
 	}
 
+	url := req.URL
+	authHeaderName := req.AuthHeaderName
+
+	if req.Provider == "threatwinds" {
+		inst := instanceconfig.Get()
+		if inst == nil || inst.Server == "" || inst.InstanceID == "" || inst.InstanceKey == "" {
+			return nil, ErrInstanceNotRegistered
+		}
+		url = strings.TrimRight(inst.Server, "/") + threatWindsAIPath
+		authType = "none"
+		authHeaderName = ""
+		apiKeyPlain = ""
+		headersPlain = map[string]string{"id": inst.InstanceID, "key": inst.InstanceKey}
+	}
+
 	// 2. Verify the connection before writing anything.
 	if err := s.verifier.Verify(ctx, verifier.Config{
 		Provider:       req.Provider,
-		URL:            req.URL,
+		URL:            url,
 		Model:          req.Model,
 		APIKey:         apiKeyPlain,
 		AuthType:       authType,
-		AuthHeaderName: req.AuthHeaderName,
+		AuthHeaderName: authHeaderName,
 		CustomHeaders:  headersPlain,
 	}); err != nil {
 		return nil, fmt.Errorf("%w: %v", ErrVerificationFailed, err)
@@ -136,10 +228,10 @@ func (s *ConfigService) Update(ctx context.Context, req dto.ConfigRequest) (*dto
 	fc := &repository.FileConfig{
 		Provider:          req.Provider,
 		Model:             req.Model,
-		URL:               req.URL,
+		URL:               url,
 		APIKey:            apiKeyEnc,
 		AuthType:          authType,
-		AuthHeaderName:    req.AuthHeaderName,
+		AuthHeaderName:    authHeaderName,
 		CustomHeaders:     headersEnc,
 		MaxTokens:         maxTokens,
 		MaxToolIterations: maxIters,

backend/modules/threatintel/handler/proxy.go

@@ -10,7 +10,7 @@ import (
 	"time"
 
 	"github.com/gin-gonic/gin"
-	"github.com/utmstack/utmstack/backend/modules/threatintel/internal"
+	"github.com/utmstack/utmstack/backend/pkg/instanceconfig"
 )
 
 // ReverseProxyHandler creates a reverse proxy that maps a local route to a CM proxy target.
@@ -25,7 +25,7 @@ func NewReverseProxyHandler(targetPath string) *ReverseProxyHandler {
 
 // Handle is the Gin handler that proxies the request.
 func (h *ReverseProxyHandler) Handle(c *gin.Context) {
-	cfg := internal.Get()
+	cfg := instanceconfig.Get()
 	if cfg == nil || cfg.Server == "" || cfg.InstanceID == "" || cfg.InstanceKey == "" {
 		c.JSON(http.StatusServiceUnavailable, gin.H{"error": "instance not configured"})
 		return
@@ -51,7 +51,7 @@ func (h *ReverseProxyHandler) Handle(c *gin.Context) {
 }
 
 // directorFunc returns a Director function that rewrites the request.
-func (h *ReverseProxyHandler) directorFunc(cfg *internal.InstanceConfig, targetURL *url.URL) func(*http.Request) {
+func (h *ReverseProxyHandler) directorFunc(cfg *instanceconfig.InstanceConfig, targetURL *url.URL) func(*http.Request) {
 	return func(req *http.Request) {
 		// Set scheme and host from CM proxy
 		req.URL.Scheme = targetURL.Scheme
@@ -77,7 +77,7 @@ func (h *ReverseProxyHandler) directorFunc(cfg *internal.InstanceConfig, targetU
 
 // HandleUsageEndpoint is a special handler for the /usage endpoint which has a different prefix structure.
 func (h *ReverseProxyHandler) HandleUsageEndpoint(c *gin.Context) {
-	cfg := internal.Get()
+	cfg := instanceconfig.Get()
 	if cfg == nil || cfg.Server == "" || cfg.InstanceID == "" || cfg.InstanceKey == "" {
 		c.JSON(http.StatusServiceUnavailable, gin.H{"error": "instance not configured"})
 		return

backend/modules/threatintel/handler/proxy_test.go

@@ -6,12 +6,12 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/utmstack/utmstack/backend/modules/threatintel/internal"
+	"github.com/utmstack/utmstack/backend/pkg/instanceconfig"
 )
 
 func TestDirectorRewritesPathAndHeaders(t *testing.T) {
 	// Setup instance config
-	cfg := &internal.InstanceConfig{
+	cfg := &instanceconfig.InstanceConfig{
 		Server:      "https://example.com",
 		InstanceID:  "test-id-123",
 		InstanceKey: "test-key-456",

backend/modules/threatintel/internal/instanceconfig.go

@@ -3,22 +3,16 @@ package threatintel
 import (
 	"context"
 
-	"github.com/threatwinds/go-sdk/catcher"
-	"github.com/utmstack/utmstack/backend/modules/threatintel/internal"
+	"github.com/utmstack/utmstack/backend/pkg/instanceconfig"
 )
 
 type Module struct {
 	updatesDir string
 }
 
 func NewModule(updatesDir string) *Module {
-	m := &Module{updatesDir: updatesDir}
-
-	if _, err := internal.LoadInstanceConfig(updatesDir); err != nil {
-		catcher.Warn("threatintel: failed to load instance config", map[string]any{"error": err.Error()})
-	}
-
-	return m
+	instanceconfig.Init(updatesDir)
+	return &Module{updatesDir: updatesDir}
 }
 
 func (m *Module) Start(ctx context.Context) {}

backend/modules/threatintel/module.go

@@ -0,0 +1,56 @@
+package instanceconfig
+
+import (
+	"os"
+	"path/filepath"
+	"sync"
+
+	"gopkg.in/yaml.v3"
+)
+
+type InstanceConfig struct {
+	Server      string `yaml:"server"`
+	InstanceID  string `yaml:"instance_id"`
+	InstanceKey string `yaml:"instance_key"`
+}
+
+var (
+	mu         sync.RWMutex
+	updatesDir string
+	cached     *InstanceConfig
+)
+
+// Init records where instance-config.yml lives. Call once at startup.
+func Init(dir string) {
+	mu.Lock()
+	updatesDir = dir
+	mu.Unlock()
+}
+
+func Get() *InstanceConfig {
+	mu.RLock()
+	if cached != nil {
+		defer mu.RUnlock()
+		return cached
+	}
+	dir := updatesDir
+	mu.RUnlock()
+
+	if dir == "" {
+		return nil
+	}
+
+	data, err := os.ReadFile(filepath.Join(dir, "instance-config.yml"))
+	if err != nil {
+		return nil
+	}
+	var cfg InstanceConfig
+	if err := yaml.Unmarshal(data, &cfg); err != nil {
+		return nil
+	}
+
+	mu.Lock()
+	cached = &cfg
+	mu.Unlock()
+	return &cfg
+}