immudb Cryptographic Ledger State Sentinel

id: immudb-cryptographic-ledger-state-sentinel
namespace: company.security

inputs:
  - id: jdbc_url
    type: STRING
    description: JDBC connection URL for the immudb PostgreSQL wire protocol
      compatibility port (default 5432)
    defaults: "jdbc:postgresql://immudb-server:5432/defaultdb"

  - id: expected_root_prefix
    type: STRING
    description: Optional cryptographic state digest prefix or anchor for verifying
      ledger continuity
    defaults: ""

  - id: quarantine_on_tamper
    type: BOOL
    description: When true, enforces compliance quarantine and halts downstream
      processing on state corruption
    defaults: true

  - id: dry_run
    type: BOOL
    description: When true, audits state and simulates quarantine actions without
      locking pipelines
    defaults: true

  - id: slack_channel
    type: STRING
    description: Slack notification channel for security alerts and cryptographic
      compliance reports
    defaults: "#security-audit"

triggers:
  - id: every_fifteen_minutes
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "*/15 * * * *"
    disabled: true

tasks:
  - id: probe_ledger_state
    type: io.kestra.plugin.jdbc.postgresql.Query
    description: Queries immudb cryptographic root state digest via PostgreSQL wire protocol
    url: "{{ inputs.jdbc_url }}"
    username: "{{ secret('IMMUDB_USERNAME') }}"
    password: "{{ secret('IMMUDB_PASSWORD') }}"
    fetchType: FETCH_ONE
    allowFailure: true
    sql: |
      SELECT
        COALESCE(immudb_state(), '') AS state_digest,
        NOW() AS probe_time;

  - id: classify_tamper_health
    type: io.kestra.plugin.core.debug.Return
    description: Evaluates cryptographic state digest and probe connectivity into
      compliance health tiers
    format: |
      {% if outputs.probe_ledger_state.row is null or outputs.probe_ledger_state.row.state_digest is null %}
      PROBE_FAILED
      {% elseif outputs.probe_ledger_state.row.state_digest == '' %}
      TAMPER_DETECTED
      {% elseif inputs.expected_root_prefix != '' and not (outputs.probe_ledger_state.row.state_digest starts with inputs.expected_root_prefix) %}
      ROOT_MISMATCH
      {% else %}
      HEALTHY
      {% endif %}

  - id: route_by_compliance
    type: io.kestra.plugin.core.flow.Switch
    description: Routes execution based on ledger integrity and compliance state
    value: "{{ outputs.classify_tamper_health.value | trim }}"
    cases:
      TAMPER_DETECTED:
        - id: alert_tamper_slack
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          description: Dispatches high-urgency security incident alert when ledger state
            digest is missing or invalid
          url: "{{ secret('SLACK_WEBHOOK_URL') }}"
          payload: |
            {
              "channel": "{{ inputs.slack_channel }}",
              "text": "🚨 *IMMUDB CRYPTOGRAPHIC INTEGRITY VIOLATION*\n*Status:* `TAMPER_DETECTED`\n*Target Ledger:* `{{ inputs.jdbc_url }}`\n*Quarantine Enforced:* `{{ inputs.quarantine_on_tamper }}` (Dry-run: `{{ inputs.dry_run }}`)\n*Details:* The immudb cryptographic root state digest could not be verified. Potential tampering or ledger desynchronization detected.\n*Execution ID:* `{{ execution.id }}`"
            }

        - id: quarantine_gate
          type: io.kestra.plugin.core.flow.If
          description: Validates whether automated compliance quarantine is active
          condition: "{{ inputs.quarantine_on_tamper == true and inputs.dry_run == false
            }}"
          then:
            - id: log_quarantine_enforced
              type: io.kestra.plugin.core.log.Log
              message: "SECURITY LOCK: immudb cryptographic ledger quarantine active.
                Downstream analytical ingestion blocked."
          else:
            - id: log_quarantine_preview
              type: io.kestra.plugin.core.log.Log
              message: "Quarantine preview mode (quarantine_on_tamper={{
                inputs.quarantine_on_tamper }}, dry_run={{ inputs.dry_run }}).
                Cryptographic anomaly flagged."

      ROOT_MISMATCH:
        - id: alert_root_mismatch
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          description: Dispatches alert when ledger root hash diverges from the expected
            anchor prefix
          url: "{{ secret('SLACK_WEBHOOK_URL') }}"
          payload: |
            {
              "channel": "{{ inputs.slack_channel }}",
              "text": "⚠️ *IMMUDB ROOT HASH DIVERGENCE ALERT*\n*Status:* `ROOT_MISMATCH`\n*Target Ledger:* `{{ inputs.jdbc_url }}`\n*Expected Prefix:* `{{ inputs.expected_root_prefix }}`\n*Observed Digest:* `{{ outputs.probe_ledger_state.row.state_digest }}`\n*Execution ID:* `{{ execution.id }}`"
            }

      PROBE_FAILED:
        - id: alert_probe_failed
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          description: Alerts SRE team when connectivity to immudb PostgreSQL listener fails
          url: "{{ secret('SLACK_WEBHOOK_URL') }}"
          payload: |
            {
              "channel": "{{ inputs.slack_channel }}",
              "text": "🔥 *IMMUDB SENTINEL PROBE FAILED*\n*Target:* `{{ inputs.jdbc_url }}`\n*Failure:* Unable to connect or authenticate to immudb PostgreSQL compatibility interface.\n*Execution ID:* `{{ execution.id }}`"
            }

      HEALTHY:
        - id: log_healthy
          type: io.kestra.plugin.core.log.Log
          message: "immudb cryptographic ledger state verified. Root digest: {{
            outputs.probe_ledger_state.row.state_digest }}"

  - id: log_audit_summary
    type: io.kestra.plugin.core.log.Log
    description: Emits immutable audit summary record documenting cryptographic
      state verification
    message: "immudb sentinel finished. Result: {{
      outputs.classify_tamper_health.value | trim }} | Endpoint: {{
      inputs.jdbc_url }} | Execution: {{ execution.id }}"

errors:
  - id: alert_flow_crash
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: Intercepts unhandled flow execution errors
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {
        "channel": "{{ inputs.slack_channel }}",
        "text": "💥 *IMMUDB SENTINEL EXECUTION CRASH*\n*Flow ID:* `{{ flow.id }}`\n*Execution ID:* `{{ execution.id }}`\n*Namespace:* `{{ flow.namespace }}`\n*Error:* Unexpected failure halted workflow execution."
      }

immudb is an open-source immutable database built on cryptographic verification using cryptographic Merkle trees. Regulated organizations rely on immudb for tamper-proof storage of financial ledgers, clinical data, and security audit logs to satisfy SOC 2, PCI-DSS, ISO 27001, and HIPAA compliance mandates. In production architectures, immutable ledgers can experience silent node desynchronization, unverified state transitions, or network partition isolation. When an immutable store fails to update its cryptographic root digest or when underlying storage becomes corrupted, traditional database monitors continue reporting green connections while audit proofs fail. This blueprint provides a continuous sentinel that queries immudb via its PostgreSQL wire protocol, validates cryptographic state digests, alerts security teams upon tamper anomalies, and enforces compliance quarantine when verified.

How it works

Scheduled trigger (every_fifteen_minutes) initiates diagnostic verification every 15 minutes, with manual on-demand execution supported via inputs.
Diagnostic probe (probe_ledger_state) connects to the immudb PostgreSQL compatibility listener via io.kestra.plugin.jdbc.postgresql.Query and executes SELECT immudb_state().
Classification step (classify_tamper_health) parses the cryptographic root digest using Pebble template conditionals, categorizing health into HEALTHY, ROOT_MISMATCH, TAMPER_DETECTED, or PROBE_FAILED.
Flow router (route_by_compliance) switches downstream remediation and notification branches based on the verified integrity tier.
On TAMPER_DETECTED, alert_tamper_slack broadcasts an urgent security incident alert to Slack, and quarantine_gate conditionally blocks downstream workflows when quarantine_on_tamper is enabled.
On ROOT_MISMATCH, alert_root_mismatch warns operators that the observed state digest has diverged from the configured baseline prefix.
On PROBE_FAILED or network errors, dedicated alerts notify administrators of database reachability loss or invalid credentials.
Audit log task (log_audit_summary) outputs an immutable execution record detailing the verified root digest, target endpoint, and execution lineage.

What you get

Automated, continuous validation of cryptographic Merkle root digests across immudb ledgers.
Early warning detection of state divergence and tampering before regulatory audits or compliance certifications fail.
Automated incident alerts delivered to Slack with endpoint targets and cryptographic state diagnostics.
Guarded compliance quarantine controls that prevent corrupted ledgers from propagating false status downstream.
Zero-credential-leak architecture keeping administrative passwords masked in execution logs.

Who it's for

Security Engineers enforcing cryptographic auditability and Zero Trust data retention.
Compliance Officers overseeing SOC 2, HIPAA, and PCI-DSS audit trail integrity.
Data Platform Engineers managing immutable ledgers and financial record stores.

Why orchestrate this with Kestra

Declarative YAML definition unifies security surveillance, cryptographic verification, and alerting into auditable GitOps workflows.
Native PostgreSQL JDBC plugin connectivity eliminates custom Python worker container dependencies and credentials leakage.
Centralized secret management protects database credentials from exposure in command arguments, logs, and monitoring agents.
Built-in conditional routing cleanly separates routine verification from high-priority security quarantine routines.
Immutable execution timelines in Kestra provide historical verification evidence for external compliance auditors.

Prerequisites

immudb instance (v1.4+) running with PostgreSQL wire compatibility enabled (default port 5432).
Database user with read permissions on default databases and access to immudb_state().
Slack incoming webhook URL for security notification routing.

Secrets

IMMUDB_USERNAME: Username for authenticating to the immudb PostgreSQL wire compatibility port.
IMMUDB_PASSWORD: Password for the immudb database user.
SLACK_WEBHOOK_URL: HTTPS incoming webhook URL for the security alert Slack channel.

Quick start

Configure IMMUDB_USERNAME, IMMUDB_PASSWORD, and SLACK_WEBHOOK_URL in your Kestra namespace secrets.
Deploy this flow to your Kestra instance and execute an initial manual run with dry_run: true to confirm connectivity against your immudb server.
Review the execution logs in the Kestra UI to verify the immudb_state() root digest is retrieved successfully.
Enable the every_fifteen_minutes schedule trigger to establish automated continuous integrity verification.

How to extend

Add transaction-level verification using immudb_verify_tx(tx_id) to audit specific high-value transactional sequences.
Integrate PagerDuty incident creation via io.kestra.plugin.pagerduty.notifications.PagerDutyAlert for high-severity cryptographic corruption.
Chain downstream archiving tasks to snapshot verified state digests to cloud object storage.

immudb Cryptographic Ledger State & Tamper Sentinel

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Quick start

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

New to Kestra?

immudb Cryptographic Ledger State & Tamper Sentinel

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Quick start

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

More Infrastructure Blueprints

Cerbos Authorization Policy Drift & Canary Health Gate

Catch Stale, Broken or Drifting Chainlink Price Feeds Before Your Protocol Uses Them

Ceph Cluster Health Gate

CertWatch - Kubernetes TLS certificate expiry watcher

Celery Unacknowledged Task Quarantine and Requeue Guard

Ceph RGW Critical Bucket Inventory Sentinel

New to Kestra?