fingerprintd

Purpose

fingerprintd is a small standalone HTTP API that serves a centralized TLS fingerprint database — the same fingerprints, malicious_fingerprints, fingerprint_sources, and fingerprint_changelog ClickHouse tables that back JA3 lookups elsewhere in the system. It runs a scheduled aggregation job (cron-configured) that rolls up fingerprint statistics, and exposes a health check and the fingerprint-service routes over HTTP with CORS enabled for browser access.

Usage

fingerprintd -c <config.yaml> [-debug]

Configuration

name: fingerprintd
debug: true
listen: "localhost:8080"

clickhouse:
  host: localhost
  port: 19000
  database: insights
  username: insights
  password: secret

# Scheduled aggregation (collects fingerprint stats)
aggregate_schedule: "0 2 * * *"   # cron format, default: daily at 2am
aggregate_enabled: true            # default: true

listen defaults to :8080 and aggregate_schedule to "0 2 * * *" if left unset. On startup, fingerprintd validates that the four fingerprint tables exist before starting the HTTP server and aggregation scheduler; it stops the scheduler and drains in-flight requests (30s timeout) on SIGINT/SIGTERM.

Example

fingerprintd -c configs/fingerprintd.yaml -debug

A health check is available at GET /health once the server is running.