SPDT/sapl - sapl - Gitea: Git with a cup of tea

5928 Commits

62 Branches

269 Tags

234 MiB

Branch: rate-limiter-2026

Commit Graph

Author	SHA1	Message	Date
Edward Ribeiro	af9c38f1ce	Fix: replace OpenResty with nginx + libnginx-mod-http-lua (arm64 compat) continuous-integration/drone/push Build is passing Details OpenResty has no arm64 packages for Debian Bookworm; the official repo only publishes amd64. Switch to Debian's own packages which support both architectures and avoid any external repo setup: nginx libnginx-mod-http-geoip2 libnginx-mod-http-lua lua-resty-redis GeoIP2 C module returns (same nginx version → compatible). ASN/UA blocking goes back to nginx if() blocks. blocklist.lua handles only the Redis checks (prefix shared dict + pipelined GET for global/API block keys). lua_package_path set to /usr/share/lua/5.1/ where Debian installs resty.*. All paths revert to /etc/nginx/; start.sh reverts to /usr/sbin/nginx. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	6 days ago
Edward Ribeiro	27c098acfd	Add OpenResty nginx layer for Redis-backed early IP rejection continuous-integration/drone/push Build is passing Details Replace nginx + libnginx-mod-http-geoip2 with OpenResty so that blocked IPs are rejected before reaching Gunicorn, saving worker CPU on DDoS. nginx layer (read-only, DB 1): - blocklist.lua: UA check (nginx map var), ASN check (lua-resty-maxminddb, replaces geoip2 C module), IP-prefix check (shared dict refreshed every 60s, 4-candidate O(1) lookup), pipelined GET for global IP block and per-tenant API block. Parses REDIS_URL. Fail-open on Redis error. - lua_shared_dict ip_prefix_blocked 1m: in-process prefix cache. - init_by_lua_block: opens MaxMind ASN DB once in master process. - init_worker_by_lua_block: refreshes prefix SET from Redis every 60s. Django (ratelimit.py): - _refresh_ip_prefix_blocklist: normalises entries to trailing-dot form on load so per-request checks are O(1) set membership, not iteration. - _is_ip_prefix_blocked: 4-candidate check (p1., p1.p2., p1.p2.p3., ip) against the local set; same 60s refresh cadence as before. Capacity (1,200 tenants, single Redis): - Django pool: max_connections 6 → 3 (7,200 peak connections). - nginx keepalive pool: 1 connection/worker (4,800 peak connections). - Total: ~12,200 connections — 39% headroom under maxclients 20,000. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	6 days ago

Author

SHA1

Message

Date

Edward Ribeiro

af9c38f1ce

Fix: replace OpenResty with nginx + libnginx-mod-http-lua (arm64 compat)

OpenResty has no arm64 packages for Debian Bookworm; the official repo
only publishes amd64. Switch to Debian's own packages which support both
architectures and avoid any external repo setup:

  nginx libnginx-mod-http-geoip2 libnginx-mod-http-lua lua-resty-redis

GeoIP2 C module returns (same nginx version → compatible). ASN/UA blocking
goes back to nginx if() blocks. blocklist.lua handles only the Redis checks
(prefix shared dict + pipelined GET for global/API block keys).

lua_package_path set to /usr/share/lua/5.1/ where Debian installs resty.*.
All paths revert to /etc/nginx/; start.sh reverts to /usr/sbin/nginx.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

6 days ago

Edward Ribeiro

27c098acfd

Add OpenResty nginx layer for Redis-backed early IP rejection

Replace nginx + libnginx-mod-http-geoip2 with OpenResty so that blocked
IPs are rejected before reaching Gunicorn, saving worker CPU on DDoS.

nginx layer (read-only, DB 1):
- blocklist.lua: UA check (nginx map var), ASN check (lua-resty-maxminddb,
  replaces geoip2 C module), IP-prefix check (shared dict refreshed every
  60s, 4-candidate O(1) lookup), pipelined GET for global IP block and
  per-tenant API block. Parses REDIS_URL. Fail-open on Redis error.
- lua_shared_dict ip_prefix_blocked 1m: in-process prefix cache.
- init_by_lua_block: opens MaxMind ASN DB once in master process.
- init_worker_by_lua_block: refreshes prefix SET from Redis every 60s.

Django (ratelimit.py):
- _refresh_ip_prefix_blocklist: normalises entries to trailing-dot form
  on load so per-request checks are O(1) set membership, not iteration.
- _is_ip_prefix_blocked: 4-candidate check (p1., p1.p2., p1.p2.p3., ip)
  against the local set; same 60s refresh cadence as before.

Capacity (1,200 tenants, single Redis):
- Django pool: max_connections 6 → 3 (7,200 peak connections).
- nginx keepalive pool: 1 connection/worker (4,800 peak connections).
- Total: ~12,200 connections — 39% headroom under maxclients 20,000.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

6 days ago

2 Commits (rate-limiter-2026)