watchman/README.md

# Watchman
## Detect and Act on unauthorized access of any kind from any source

### Detect and Act on;
    - an increase of USB devices
    - network issues or network failure
    - filesystem changes
    - ssh "burn file"

#### Observed memory usage <100MB to ~1GB

### Install
```shell
# Install the binary from crates.io
cargo install watchman

# Configure as a system service (optional; requires root)
# Linux (systemd) / macOS (launchd)
watchman --service install --webhook-url https://discord.com/api/webhooks/XXXXXXXX/XXXXXXXX
```

# Setup
### Configuration
The first run will create a default settings file if missing. Default locations:
- Linux: ~/.config/watchman/config/settings.toml
- macOS: /Users/<user>/Library/Application Support/com.helloimalemur.watchman/config/settings.toml
- Windows: %APPDATA%\Watchman\config\settings.toml

Or create it manually:
```shell
## General settings
tick_delay_seconds = "5"
fs_tick_delay_seconds = "60"

### File System Integrity
fs_mon_enabled = "true"
fs_mon_dir = ["/etc", "/bin", "$PATH"]
fs_mon_hash_type = "blake3"

### USB Monitor
usb_mon_enabled = "true"
reboot_on_increase_of_usb_devices = "false"
notify_on_increase_of_usb_devices = "true"
unmount_crypt_on_increase_of_usb_devices = "true"

### Burn File Monitor
burn_file_mon_enabled = "false"
unmount_crypt_on_file_burn = "true"
ssh_check_burn_host = "hostname"
ssh_check_burn_user = "root"
ssh_check_burn_key = "/home/user/.ssh/id_rsa"
ssh_check_burn_path = "/root/.config/burn"
ssh_check_burn_check_interval = "30"
burn_path_1 = "/root/test/"

### Network Monitor
net_mon_enabled = "false"

######## Notification settings
discord_webhook_url = "https://discord.com/api/webhooks/"
discord_webhook_avatar_name = "Lazarus"
```

## Development and Collaboration
#### Feel free to open a pull request, please run the following prior to your submission please!
    echo "Run clippy"; cargo clippy -- -D clippy::all
    echo "Format source code"; cargo fmt -- --check


---

## Biblical References and Theme
This project embraces the theme of vigilant watchfulness.

- Isaiah 62:6 — "I have set watchmen upon thy walls, O Jerusalem, which shall never hold their peace day nor night."
- Psalm 127:1 — "Unless the Lord watches over the city, the watchman stays awake in vain."
- Ezekiel 3:17 — "Son of man, I have made thee a watchman unto the house of Israel; therefore hear the word at my mouth, and give them warning from me."
- Habakkuk 2:1 — "I will take my stand at my watchpost and station myself on the tower."
- Matthew 24:42 — "Therefore stay awake, for you do not know on what day your Lord is coming."
- Matthew 26:41 — "Watch and pray that you may not enter into temptation."
- 1 Peter 5:8 — "Be sober-minded; be watchful. Your adversary the devil prowls around like a roaring lion."
- Proverbs 4:23 — "Keep your heart with all vigilance, for from it flow the springs of life."

These verses inspire the intent of Watchman: to observe faithfully, detect wisely, and act prudently.
## Safety Notes
- This tool can perform disruptive actions (rebooting, unmounting encrypted volumes). All such actions are disabled by default and must be explicitly enabled in settings.toml.
- Service installation writes to system locations (/etc/systemd/system on Linux, /Library/LaunchDaemons on macOS) and requires root. Review the generated unit file before enabling.
- Network scanning features (client discovery and nmap scans) should be used responsibly and only on networks you are authorized to test.
- Discord webhooks leak to a third-party service; do not include sensitive data in messages.