fingerprintd

Purpose

fingerprintd is a small standalone HTTP API that serves the centralized TLS fingerprint database that backs JA3 lookups elsewhere in the system. It runs a scheduled aggregation job (cron-configured) that rolls up fingerprint statistics, and exposes a health check and the fingerprint-service routes over HTTP.

Usage

fingerprintd -c <config.yaml> [-debug]

Configuration

name: fingerprintd
debug: false
listen: "localhost:8080"

clickhouse:
  host: localhost
  port: 19000
  database: insights
  username: <clickhouse-user>
  password: "<clickhouse-password>"

# Scheduled aggregation (collects fingerprint stats)
aggregate_schedule: "0 2 * * *"   # cron format, default: daily at 2am
aggregate_enabled: true            # default: true

listen defaults to :8080 and aggregate_schedule to "0 2 * * *" if left unset. Set listen to a loopback or private address. On startup, fingerprintd checks the database schema before starting the HTTP server and aggregation scheduler; it stops the scheduler and drains in-flight requests (30s timeout) on SIGINT/SIGTERM.

Example

fingerprintd -c fingerprintd.yaml -debug

A health check is available at GET /health once the server is running.