Supply Chain Decoys

#!/bin/bash
# create-decoy-repo.sh
# Creates a fake internal Git repository that looks like a real
# application codebase. Contains trap credentials and tracking.

REPO_DIR="/srv/git/internal-billing-api.git"
WORK_DIR=$(mktemp -d)

echo "[*] Creating decoy repository: internal-billing-api"

cd "$WORK_DIR"
git init internal-billing-api
cd internal-billing-api

# Create realistic project structure
mkdir -p src/{controllers,models,middleware} config test docs

# Application config with trap credentials
cat > config/production.json << 'CONFIG'
{
  "database": {
    "host": "prod-db-04.corp.internal",
    "port": 5432,
    "name": "billing_prod",
    "username": "billing_svc",
    "password": "B1ll1ng#Pr0d_2026!"
  },
  "redis": {
    "host": "cache-01.corp.internal",
    "port": 6379
  },
  "api_keys": {
    "stripe": "sk_live_51Hb2DECOY_NOT_REAL_KEY_abc123",
    "sendgrid": "SG.DECOY_KEY.not-a-real-sendgrid-key"
  }
}
CONFIG

# Realistic-looking application code
cat > src/controllers/billing.py << 'CODE'
"""Billing API controller - handles payment processing."""
from flask import Blueprint, request, jsonify
from models.invoice import Invoice
from middleware.auth import require_auth

billing_bp = Blueprint("billing", __name__)

@billing_bp.route("/api/v1/invoices", methods=["GET"])
@require_auth
def list_invoices():
    page = request.args.get("page", 1, type=int)
    invoices = Invoice.query.paginate(page=page, per_page=50)
    return jsonify([i.to_dict() for i in invoices.items])

@billing_bp.route("/api/v1/invoices/<int:id>/charge", methods=["POST"])
@require_auth
def charge_invoice(id):
    invoice = Invoice.query.get_or_404(id)
    result = invoice.process_payment()
    return jsonify(result), 200
CODE

cat > README.md << 'README'
# Internal Billing API

Production billing service for customer invoicing and payment processing.

## Quick Start
```bash
pip install -r requirements.txt
export FLASK_ENV=production
flask run --host=0.0.0.0 --port=5000
```

## Deployment
See docs/deployment.md for production deployment procedures.
Credentials are in config/production.json (DO NOT commit changes).
README

# Commit history to look authentic
git add -A
GIT_AUTHOR_DATE="2025-06-15T10:30:00" \
GIT_COMMITTER_DATE="2025-06-15T10:30:00" \
git commit -m "Initial project setup with billing API structure"

git add -A
GIT_AUTHOR_DATE="2026-01-20T14:22:00" \
GIT_COMMITTER_DATE="2026-01-20T14:22:00" \
git commit -m "Update production database credentials for Q1 rotation"

# Create bare repo for serving
git clone --bare "$WORK_DIR/internal-billing-api" "$REPO_DIR"
rm -rf "$WORK_DIR"

echo "[+] Decoy repository created at: $REPO_DIR"
echo "[!] Monitor for: git clone, git pull, and file access events"