Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

README.md

@@ -196,6 +196,198 @@ sudo systemctl enable --now autarch-daemon
 sudo systemctl enable --now autarch-web
 ```
 
+---
+## Prerequisites & Required Tools
+
+AUTARCH is a large platform with many optional features. The core web dashboard and AI agent require only Python dependencies (installed via pip). External system tools are needed for specific feature areas. Install only what you need.
+
+### Core (Required)
+
+Python 3.10+
+Git
+pip (Python package manager)
+OpenSSL
+
+Python dependencies are installed automatically by the setup script:
+
+```bash
+bash scripts/setup-venv.sh
+```
+
+Or manually:
+
+```bash
+pip install -r requirements.txt
+```
+
+### Network Scanning & Analysis
+
+nmap — Network scanner (port scanning, host discovery, service detection)
+tshark — Terminal-based Wireshark (packet analysis, protocol decoding)
+tcpdump — Packet capture
+whois — Domain/IP WHOIS lookups
+dig (dnsutils/bind-utils) — DNS enumeration
+curl — HTTP requests
+wget — File downloads
+masscan — High-speed port scanner (optional)
+
+Debian/Ubuntu:
+
+```bash
+apt install nmap tshark tcpdump whois dnsutils curl wget
+```
+
+Fedora/RHEL:
+
+```bash
+dnf install nmap wireshark-cli tcpdump whois bind-utils curl wget
+```
+
+### Wireless / WiFi Tools
+
+iw — Wireless device configuration
+iwconfig (wireless-tools) — Legacy wireless config
+aircrack-ng suite — airmon-ng, airodump-ng, aireplay-ng, airbase-ng
+reaver / wash — WPS attacks
+mdk3 / mdk4 — Wireless denial-of-service testing
+hostapd — Access point creation
+dnsmasq — DHCP/DNS for rogue AP
+bettercap — MITM and network attacks (optional)
+
+Debian/Ubuntu:
+
+```bash
+apt install iw wireless-tools aircrack-ng reaver mdk4 hostapd dnsmasq
+```
+
+### Penetration Testing
+
+Metasploit Framework — msfrpcd, msfconsole, msfvenom (exploit framework)
+RouterSploit — Router exploitation framework
+hydra — Password brute-forcing
+john (John the Ripper) — Password cracking
+hashcat — GPU-accelerated password cracking
+nikto — Web server scanner
+gobuster — Directory/DNS brute-forcing
+sqlmap — SQL injection (optional, manual install)
+
+Metasploit install:
+
+```bash
+curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall
+chmod 755 msfinstall
+./msfinstall
+```
+
+### VPN & Firewall
+
+wireguard-tools (wg, wg-quick) — VPN tunnel management
+iptables or nftables (nft) — Firewall rules
+fail2ban — Brute-force protection
+ssh / sshd / ssh-keygen — SSH management
+
+Debian/Ubuntu:
+
+```bash
+apt install wireguard-tools iptables nftables fail2ban openssh-server
+```
+
+### Forensics & Reverse Engineering
+
+file — File type identification
+strings (binutils) — Extract printable strings from binaries
+strace — System call tracer
+ltrace — Library call tracer
+
+Debian/Ubuntu:
+
+```bash
+apt install file binutils strace ltrace
+```
+
+### Hardware & Mobile
+
+adb / fastboot (Android Platform Tools) — Android device management
+scrcpy — Android screen mirroring
+esptool — ESP32 firmware flashing (installed via pip)
+proxmark3 / pm3 — RFID/NFC tools
+nfc-list / nfc-mfclassic / nfc-poll (libnfc) — NFC tools
+rtl_sdr — RTL-SDR software-defined radio
+hackrf_transfer — HackRF SDR tools
+
+Debian/Ubuntu:
+
+```bash
+apt install android-tools-adb android-tools-fastboot scrcpy libnfc-bin
+```
+
+### Containers
+
+docker — Container security auditing
+
+### LLM Backends (AI Features)
+
+For local LLM inference, you need at least one of:
+
+llama.cpp (via llama-cpp-python, installed by pip) — GGUF model inference
+HuggingFace Transformers (installed by pip) — SafeTensors model inference
+PyTorch — Required for local transformers models. Install manually from https://pytorch.org/get-started/locally/
+
+For cloud LLM backends, configure API keys in the vault:
+
+Anthropic Claude API key
+OpenAI-compatible API key
+HuggingFace Inference API key
+
+For GPU-accelerated llama.cpp:
+
+```bash
+CMAKE_ARGS="-DGGML_CUDA=on" pip install llama-cpp-python --force-reinstall --no-cache-dir
+```
+
+### Node.js (WebUSB Driver Compilation Only)
+
+Node.js and npm are required ONLY if you need to recompile the WebUSB/Web Serial driver bundles. They are NOT needed at runtime. See the WebUSB Drivers section below.
+
+---
+
+## WebUSB Drivers (User-Compiled)
+
+AUTARCH ships with pre-built WebUSB JavaScript bundles for ADB, Fastboot, and ESP32 flashing in web/static/js/lib/. These bundles enable direct browser-based hardware access through Chromium-based browsers without installing native drivers.
+
+However, if you need to modify the WebUSB integration, update the library versions, or the pre-built bundles are missing or outdated, you MUST compile them yourself.
+
+The WebUSB bundles are built from three entry points in src/:
+
+src/adb-entry.js — ADB over WebUSB (@yume-chan/adb)
+src/fastboot-entry.js — Fastboot over WebUSB (android-fastboot)
+src/esptool-entry.js — ESP32 flashing over Web Serial (esptool-js)
+
+To compile the WebUSB drivers:
+
+1. Install Node.js (v18+ recommended) and npm
+2. From the project root, install the build dependencies:
+
+```bash
+npm install
+```
+
+3. Run the build script:
+
+```bash
+bash scripts/build-hw-libs.sh
+```
+
+This uses esbuild to bundle the JavaScript libraries into browser-ready IIFE bundles and outputs them to web/static/js/lib/. The build produces three files:
+
+adb-bundle.js — ADB over WebUSB
+fastboot-bundle.js — Fastboot over WebUSB
+esptool-bundle.js — ESP32 over Web Serial
+
+IMPORTANT: WebUSB and Web Serial APIs require a Chromium-based browser (Chrome, Edge, Brave, etc.). Firefox and Safari do not support these APIs. The device must be connected via USB directly to the machine running the browser. WebUSB will NOT work over remote/forwarded connections.
+
+If you do not need direct browser-based hardware access (ADB over WebUSB, Fastboot over WebUSB, or ESP32 Web Serial flashing), you can skip this step entirely. The rest of AUTARCH functions without these bundles. Standard ADB/Fastboot over the command line (via Android Platform Tools) works independently of WebUSB.
+
 ---
 
 ## The Daemon