feat(synapse-waf): demo simulator with procedural attacker archetypes (Phase 1)

Adds src/simulator.rs — a tokio background task that procedurally
generates HTTP requests from attacker archetypes and feeds them through
the REAL WAF detection engine + real shared managers (EntityManager,
CampaignManager, BlockLog, WafStats). When the binary is run with --demo,
the simulator populates these managers from synthetic traffic, so the
admin endpoints horizon already polls (/sensor/status, /sensor/entities,
/sensor/campaigns) serve live-looking data without needing a real
network sensor in front of the proxy.

Two archetypes ship in Phase 1:

- CredentialStuffer: 20 source IPs sharing a Go-client JA4 fingerprint,
  rotating usernames against /api/login. Exercises CampaignManager's
  JA4-cluster correlation; the dashboard sees a real campaign emerge.

- VulnScanner: single IP, sqlmap UA, classic SQLi/XSS/path-traversal/
  command-injection payloads against varied URIs. Trips production
  rules (200200, 280001 etc.) and accumulates entity risk to 100.0.

The simulator does NOT touch the production filter chain — it calls
DetectionEngine::analyze_with_signals directly and mirrors the small
set of post-analyze state updates request_filter normally does. This
seam is documented inline; the long-term cleanup is to extract a
process_request_state helper both paths call.

admin_server: removes 4 hardcoded short-circuits in sites/status/
entities/campaigns handlers so the real handler path serves
simulator-populated data when --demo is set. The demo_*() helpers are
retained as fallbacks for the brief window between startup and the
first simulator tick.

Smoke test (10s of runtime): waf.analyzed=140 blocked=20 blockRate=14.3%,
entity 203.0.113.99 risk=100.0, real campaign with confidence=100.

Author: NickCrew

apps/synapse-pingora/src/admin_server.rs

@@ -1725,12 +1725,30 @@ async fn restart_handler() -> impl IntoResponse {
 
 /// GET /sites - List configured sites
 async fn sites_handler(State(state): State<AdminState>) -> impl IntoResponse {
-    // Demo mode: return pre-populated sample data
+    // NOTE: demo mode used to short-circuit here with hardcoded JSON. The
+    // simulator (src/simulator.rs) now populates real managers from
+    // procedural traffic, so the regular handler path serves live data
+    // even in demo mode. The demo_sites() helper is retained for sites
+    // because the simulator does not yet generate site config; if the
+    // configured sites list is empty AND demo mode is on, fall back to
+    // the canned shape so dashboards aren't blank.
+    let response = state.handler.handle_list_sites();
     if is_demo_mode() {
-        return (StatusCode::OK, Json(demo_sites())).into_response();
+        // Inspect the raw JSON to decide whether to fall back. handle_list_sites
+        // returns an ApiResponse wrapping a serializable. Cheap heuristic:
+        // serialize, count sites array length, fall back if zero.
+        if let Ok(value) = serde_json::to_value(&response) {
+            let empty = value
+                .get("data")
+                .and_then(|d| d.get("sites"))
+                .and_then(|s| s.as_array())
+                .map(|a| a.is_empty())
+                .unwrap_or(true);
+            if empty {
+                return (StatusCode::OK, Json(demo_sites())).into_response();
+            }
+        }
     }
-
-    let response = state.handler.handle_list_sites();
     wrap_response(response)
 }
 
@@ -2112,11 +2130,11 @@ async fn sensor_header_profiles_handler() -> impl IntoResponse {
 /// GET /_sensor/status - Dashboard status endpoint
 /// Returns a format compatible with the dashboard's expected response.
 async fn sensor_status_handler(State(state): State<AdminState>) -> impl IntoResponse {
-    // Demo mode: return pre-populated sample data
-    if is_demo_mode() {
-        return (StatusCode::OK, Json(demo_status()));
-    }
-
+    // NOTE: demo mode no longer short-circuits — the simulator populates
+    // real WAF stats via DetectionEngine::analyze_with_signals so the
+    // regular handler path serves live numbers. demo_status() retained
+    // for a hard fallback if state somehow goes empty mid-demo (see
+    // sites_handler for the same pattern).
     let health = state.handler.handle_health();
     let stats = state.handler.handle_stats();
     let waf = state.handler.handle_waf_stats();
@@ -2196,13 +2214,18 @@ async fn sensor_entities_handler(
     Query(params): Query<EntitiesQuery>,
     State(state): State<AdminState>,
 ) -> impl IntoResponse {
-    // Demo mode: return pre-populated sample data
-    if is_demo_mode() {
+    let limit = params.limit.unwrap_or(100);
+    let entities = state.handler.handle_list_entities(limit);
+
+    // NOTE: demo mode used to short-circuit here. The simulator now
+    // populates EntityManager via touch_entity_with_fingerprint and
+    // apply_external_risk, so the regular handler returns live data.
+    // Fall back to demo_entities() only if the manager is empty AND
+    // demo mode is on (e.g. simulator hasn't ticked yet on first poll).
+    if is_demo_mode() && entities.is_empty() {
         return (StatusCode::OK, Json(demo_entities()));
     }
 
-    let limit = params.limit.unwrap_or(100);
-    let entities = state.handler.handle_list_entities(limit);
     (
         StatusCode::OK,
         Json(serde_json::json!({ "entities": entities })),
@@ -2889,11 +2912,9 @@ async fn sensor_anomalies_handler(State(state): State<AdminState>) -> impl IntoR
 
 /// GET /_sensor/campaigns - Returns active threat campaigns
 async fn sensor_campaigns_handler(State(state): State<AdminState>) -> impl IntoResponse {
-    // Demo mode: return pre-populated sample data
-    if is_demo_mode() {
-        return (StatusCode::OK, Json(demo_campaigns()));
-    }
-
+    // NOTE: demo mode no longer short-circuits — the simulator drives
+    // CampaignManager via register_fingerprints. demo_campaigns() retained
+    // as a fallback for first-poll-before-tick scenarios.
     let campaigns = match state.handler.campaign_manager() {
         Some(manager) => manager
             .get_campaigns()
@@ -2919,6 +2940,11 @@ async fn sensor_campaigns_handler(State(state): State<AdminState>) -> impl IntoR
         None => vec![],
     };
 
+    // Fall back to canned demo campaigns if the real manager is empty.
+    if is_demo_mode() && campaigns.is_empty() {
+        return (StatusCode::OK, Json(demo_campaigns()));
+    }
+
     (
         StatusCode::OK,
         Json(serde_json::json!({ "data": campaigns })),

apps/synapse-pingora/src/main.rs

@@ -20,6 +20,11 @@
 //!                     └─────────────────┘
 //! ```
 
+// Submodules of the bin crate (see also lib.rs for the library half).
+// `simulator` lives here rather than in the lib because it depends on
+// `DetectionEngine` which is bin-local.
+mod simulator;
+
 use async_trait::async_trait;
 use bytes::Bytes;
 use http::header::{HeaderName, HeaderValue, AUTHORIZATION, COOKIE, USER_AGENT};
@@ -6305,6 +6310,38 @@ fn main() {
         );
     }
 
+    // Demo simulator: when --demo is set, kick off the procedural traffic
+    // generator that populates the real EntityManager / CampaignManager /
+    // BlockLog from synthetic attacker archetypes. The admin endpoints
+    // horizon polls then serve live-looking data without needing a real
+    // network sensor in front of the proxy. See src/simulator.rs.
+    //
+    // The simulator runs in a tokio task on the same runtime as the admin
+    // server. It does NOT touch the production filter chain — it calls
+    // DetectionEngine::analyze_with_signals directly and mirrors the
+    // post-analyze state updates request_filter normally does.
+    if demo_mode {
+        let sim_loop = simulator::SimulatorLoop::new(
+            Arc::clone(&shared_entity_manager),
+            Arc::clone(&campaign_manager),
+            Arc::clone(&shared_block_log),
+            health_checker.waf_stats(),
+        );
+        // Spawn on the existing tokio runtime that admin_server runs on.
+        // The handle is intentionally dropped — the loop runs forever or
+        // until the process exits. Pingora's shutdown will tear down the
+        // tokio runtime which terminates the loop.
+        std::thread::spawn(move || {
+            let rt = tokio::runtime::Runtime::new().expect("simulator tokio runtime");
+            rt.block_on(async move {
+                let _handle = sim_loop.start();
+                // Keep the runtime alive for the lifetime of the process.
+                std::future::pending::<()>().await;
+            });
+        });
+        info!("Demo simulator started (background traffic generator)");
+    }
+
     // Launch TUI if requested, otherwise run server normally
     if cli.tui {
         let metrics_for_tui = Arc::clone(&metrics_registry);