- nginx: exempt /painel/<pk>/dados from rate limiting (polling endpoint,
will become WebSocket); dedicated location block with no limit_req
- ratelimit.py: bypass RATE_LIMIT_BYPASS_PATHS paths before _evaluate;
add layer=django to block log; increment daily Redis metrics counter
rl:metrics:{ns}:{date}:blocked:{reason} (TTL 8 days) on every block
- ratelimit.py: add quiltbot and AwarioBot to BOT_UA_FRAGMENTS
- ratelimit.py: fix _is_suspicious_headers to require missing UA before blocking
- settings: add RATE_LIMIT_BYPASS_PATHS with /painel/<pk>/dados pattern
- plan: extend UA blocklist SADD seed command with missing bot tokens
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Renames /private/media/ to /internal/media/ in nginx and serve_media().
Adds Content-Type and Content-Disposition to the X-Accel-Redirect response.
Replaces manual file reads in proposicao_texto and doc_texto_integral with
redirects to the media URL, removing the unused get_mime_type_from_file_extension helper.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- ConditionalGetMiddleware added to MIDDLEWARE (ETag/304 for all views)
- @condition(etag_func, last_modified_func) on MateriaLegislativa and
NormaJuridica detail views — skips view execution on cache hit via
data_ultima_atualizacao (auto_now=True) as freshness signal
- nginx /static/: expires 90m + Cache-Control public, max-age=5400
- nginx: removed upload-endpoint special-casing (location ~* ^/(protocoloadm/criar-protocolo|...))
- plan/RATE-LIMITER-PLAN.md updated to reflect all Phase 7 changes
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
nginx:
- /media/ proxied through Gunicorn (sapl_general rate limit) instead of
direct alias — Django middleware now runs on every media request
- /_accel/media/ internal location serves file bytes via X-Accel-Redirect
sapl/base/media.py (new):
- serve_media() gate: path traversal guard, auth redirect for
documentos_privados/, per-path Redis counter, content-type metadata
cache, X-Accel-Redirect response; falls back to Django serve() in DEBUG
sapl/middleware/ratelimit.py:
- RL_PATH_REQUESTS, RL_UA_BLOCKLIST, FILE_META_KEY constants
- _incr_with_ttl() extracted to module level (reused by media.py)
- Runtime UA deny list: _refresh_ua_blocklist() fetches rl:bot:ua:blocked
SET from Redis (SMEMBERS, cached per worker, TTL=RATE_LIMITER_UA_BLOCKLIST_REFRESH);
_is_redis_blocked_ua() tokenises UA and checks sha256 of each token
sapl/settings.py:
- RATE_LIMITER_UA_BLOCKLIST_REFRESH, MEDIA_PATH_COUNTER_TTL,
MEDIA_FILE_CACHE_TTL added (all env-tunable via config())
plan/RATE_LIMITER_PLAN.md:
- Key schema table updated; media file serving section added;
decision flow documented; UA deny list seed section expanded
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Adiciona dDocker baseado em Alpine-Python3 com Ngnix e Gunicorn
* Atualiza docker-compose com gunicorn, ngnix e postgres
* Ajusta gitignore para ignorar postgres-data
* Adiciona script bash para conexao ao banco
* Ajusta busy-wait.sh script para sincronizar o banco(postgres) com a aplicação django no docker
* Add alias to sapldb
* Refazer Dockerfile
* Ajusta Dockerfile e docker-compose com entrypoint start.sh
* Ajusta start.sh
* Adiciona mais pontos de montagem.
* Coloca start.sh como executável: chmod +x start.sh
* Remove arquivo lixo
* Substitui gen-env.py por shell script puro
* Ajusta diretorio /var/interlegis/sapl e collect_static como volume no nginix
* Simplifica criação de diretórios.
* Adiciona ponto de montagem em postgres para importar dados
* Adiciona mais parâmetros de ambiente UNIX para entrypoint docker
* Adiciona Docker baseado em Alpine-Python3 com Ngnix e Gunicorn
* Atualiza docker-compose com gunicorn, ngnix e postgres
* Ajusta gitignore para ignorar postgres-data
* Adiciona script bash para conexao ao banco
* Ajusta busy-wait.sh script para sincronizar o banco(postgres) com a aplicação django no docker
* Add alias to sapldb
Edward Ribeiro
Leandro Roberto
Edward
Edward
Matheus Veleci dos Santos