SPDT/sapl - sapl - Gitea: Git with a cup of tea

5920 Commits

62 Branches

269 Tags

234 MiB

Tree: 27c098acfd

Commit Graph

Author	SHA1	Message	Date
Edward Ribeiro	27c098acfd	Add OpenResty nginx layer for Redis-backed early IP rejection continuous-integration/drone/push Build is passing Details Replace nginx + libnginx-mod-http-geoip2 with OpenResty so that blocked IPs are rejected before reaching Gunicorn, saving worker CPU on DDoS. nginx layer (read-only, DB 1): - blocklist.lua: UA check (nginx map var), ASN check (lua-resty-maxminddb, replaces geoip2 C module), IP-prefix check (shared dict refreshed every 60s, 4-candidate O(1) lookup), pipelined GET for global IP block and per-tenant API block. Parses REDIS_URL. Fail-open on Redis error. - lua_shared_dict ip_prefix_blocked 1m: in-process prefix cache. - init_by_lua_block: opens MaxMind ASN DB once in master process. - init_worker_by_lua_block: refreshes prefix SET from Redis every 60s. Django (ratelimit.py): - _refresh_ip_prefix_blocklist: normalises entries to trailing-dot form on load so per-request checks are O(1) set membership, not iteration. - _is_ip_prefix_blocked: 4-candidate check (p1., p1.p2., p1.p2.p3., ip) against the local set; same 60s refresh cadence as before. Capacity (1,200 tenants, single Redis): - Django pool: max_connections 6 → 3 (7,200 peak connections). - nginx keepalive pool: 1 connection/worker (4,800 peak connections). - Total: ~12,200 connections — 39% headroom under maxclients 20,000. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	6 days ago

Author

SHA1

Message

Date

Edward Ribeiro

27c098acfd

Add OpenResty nginx layer for Redis-backed early IP rejection

Replace nginx + libnginx-mod-http-geoip2 with OpenResty so that blocked
IPs are rejected before reaching Gunicorn, saving worker CPU on DDoS.

nginx layer (read-only, DB 1):
- blocklist.lua: UA check (nginx map var), ASN check (lua-resty-maxminddb,
  replaces geoip2 C module), IP-prefix check (shared dict refreshed every
  60s, 4-candidate O(1) lookup), pipelined GET for global IP block and
  per-tenant API block. Parses REDIS_URL. Fail-open on Redis error.
- lua_shared_dict ip_prefix_blocked 1m: in-process prefix cache.
- init_by_lua_block: opens MaxMind ASN DB once in master process.
- init_worker_by_lua_block: refreshes prefix SET from Redis every 60s.

Django (ratelimit.py):
- _refresh_ip_prefix_blocklist: normalises entries to trailing-dot form
  on load so per-request checks are O(1) set membership, not iteration.
- _is_ip_prefix_blocked: 4-candidate check (p1., p1.p2., p1.p2.p3., ip)
  against the local set; same 60s refresh cadence as before.

Capacity (1,200 tenants, single Redis):
- Django pool: max_connections 6 → 3 (7,200 peak connections).
- nginx keepalive pool: 1 connection/worker (4,800 peak connections).
- Total: ~12,200 connections — 39% headroom under maxclients 20,000.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

6 days ago

1 Commits (27c098acfde75e5a309a6843f6e6a20e9c26978f)