SPDT/sapl - sapl - Gitea: Git with a cup of tea

5885 Commits

61 Branches

269 Tags

217 MiB

Tree: 742f3db6cd

Commit Graph

Author	SHA1	Message	Date
Edward Ribeiro	e6dff2bc00	Fix Redis configmap inline comment, clean cache key format, add blocked-IP scan to plan - redis-configmap: move inline comment to its own line (Redis fatal parse error) - settings: add CACHE_MIDDLEWARE_KEY_PREFIX='p' to remove double-dot in cache_page keys - settings: monkey-patch _i18n_cache_key_suffix to strip pt-br/timezone suffix from keys - ratelimit.py, settings: update example namespace from patobranco-pr to sapl31demo-df - robots.txt: add AwarioSmartBot block - plan: add rl:ip:*:blocked scan commands with TTL/value output Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2 weeks ago
Edward Ribeiro	027ce68253	Phase 1-4: Redis infra, rate limiter middleware, cache layer, nginx hardening docker/Dockerfile: - GeoIP offline build with MaxMind secret; optional build args for graphviz, poppler, psql client; envsubst for nginx burst vars docker/docker-compose.yaml: - saplredis service (redis:7-alpine, allkeys-lru, 512 MB) - REDIS_URL + CACHE_BACKEND wired into sapl service docker/startup_scripts/start.sh: - configure_redis_cache(): builds CACHES dict, sets REDIS_CACHE waffle switch, falls back to file cache gracefully - POD_NAMESPACE resolution (k8s Downward API → hostname fallback) - DATABASE_URL exported before migrate docker/k8s/redis/ (moved from docker/k8s/): - redis-configmap.yaml, redis-deployment.yaml, redis-service.yaml - ClusterIP service on port 6379, sapl-redis namespace docker/k8s/sapl-k8s.yaml: - REDIS_URL env var injected; app.kubernetes.io/name=sapl label for fleet-wide discovery sapl/middleware/test_ratelimiter.py: - Unit tests for RateLimitMiddleware with mocked Redis scripts/test_ratelimiter.py: - CLI smoke-test: fires N requests and reports first 429 Removed: rate-limiter-v2.md (content migrated to plan/RATE_LIMITER_PLAN.md), scripts/test_ratelimiter.sh (replaced by .py), docker/k8s/README.md (merged into plan/RATE_LIMITER_PLAN.md), docker/scripts/redis_populate_test_data.py (renamed to redis_inject_test_data.py) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	3 weeks ago
Edward Ribeiro	12f6a3e396	Phase 1: shared Redis pod — Django dual-backend cache + startup wiring django/settings.py: - REDIS_URL / CACHE_BACKEND env vars read at startup (written by start.sh) - CACHES['default'] (DB0, KEY_PREFIX='sapl') switches between django-redis and FileBasedCache transparently; IGNORE_EXCEPTIONS=True for graceful degradation on Redis failure - CACHES['ratelimit'] (DB1, no prefix) for cross-pod rate-limit counters - RATELIMIT_USE_CACHE = 'ratelimit' - Connection pool capped at 6/worker (1,200 pods × 2 workers × 6 = 14,400 peak connections; maxclients=20,000 gives 40% headroom) start.sh: - resolve_redis_url(): reads REDIS_URL from local namespace Secret (envFrom) or falls back to global cluster Secret via k8s API - configure_redis_cache(): ensures REDIS_CACHE waffle switch row exists (off) - resolve_cache_backend(): reads waffle switch; sets CACHE_BACKEND=redis\|file - wait_for_redis(): blocks until Redis reachable; falls back gracefully - write_env_file() now persists REDIS_URL + CACHE_BACKEND into pod .env k8s manifests (docker/k8s/): - redis-configmap.yaml: no persistence, allkeys-lru, maxmemory=5gb, maxclients=20000, activedefrag, 4 databases - redis-deployment.yaml: redis:7-alpine, 1 replica, liveness/readiness probes, 1Gi request / 6Gi limit - redis-service.yaml: ClusterIP on port 6379 requirements: add django-redis==5.4.0 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	3 weeks ago

Author

SHA1

Message

Date

Edward Ribeiro

e6dff2bc00

Fix Redis configmap inline comment, clean cache key format, add blocked-IP scan to plan

- redis-configmap: move inline comment to its own line (Redis fatal parse error)
- settings: add CACHE_MIDDLEWARE_KEY_PREFIX='p' to remove double-dot in cache_page keys
- settings: monkey-patch _i18n_cache_key_suffix to strip pt-br/timezone suffix from keys
- ratelimit.py, settings: update example namespace from patobranco-pr to sapl31demo-df
- robots.txt: add AwarioSmartBot block
- plan: add rl:ip:*:blocked scan commands with TTL/value output

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2 weeks ago

Edward Ribeiro

027ce68253

Phase 1-4: Redis infra, rate limiter middleware, cache layer, nginx hardening

docker/Dockerfile:
- GeoIP offline build with MaxMind secret; optional build args for
  graphviz, poppler, psql client; envsubst for nginx burst vars

docker/docker-compose.yaml:
- saplredis service (redis:7-alpine, allkeys-lru, 512 MB)
- REDIS_URL + CACHE_BACKEND wired into sapl service

docker/startup_scripts/start.sh:
- configure_redis_cache(): builds CACHES dict, sets REDIS_CACHE waffle
  switch, falls back to file cache gracefully
- POD_NAMESPACE resolution (k8s Downward API → hostname fallback)
- DATABASE_URL exported before migrate

docker/k8s/redis/ (moved from docker/k8s/):
- redis-configmap.yaml, redis-deployment.yaml, redis-service.yaml
- ClusterIP service on port 6379, sapl-redis namespace

docker/k8s/sapl-k8s.yaml:
- REDIS_URL env var injected; app.kubernetes.io/name=sapl label for
  fleet-wide discovery

sapl/middleware/test_ratelimiter.py:
- Unit tests for RateLimitMiddleware with mocked Redis

scripts/test_ratelimiter.py:
- CLI smoke-test: fires N requests and reports first 429

Removed: rate-limiter-v2.md (content migrated to plan/RATE_LIMITER_PLAN.md),
         scripts/test_ratelimiter.sh (replaced by .py),
         docker/k8s/README.md (merged into plan/RATE_LIMITER_PLAN.md),
         docker/scripts/redis_populate_test_data.py (renamed to redis_inject_test_data.py)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

3 weeks ago

Edward Ribeiro

12f6a3e396

Phase 1: shared Redis pod — Django dual-backend cache + startup wiring

django/settings.py:
- REDIS_URL / CACHE_BACKEND env vars read at startup (written by start.sh)
- CACHES['default'] (DB0, KEY_PREFIX='sapl') switches between django-redis
  and FileBasedCache transparently; IGNORE_EXCEPTIONS=True for graceful
  degradation on Redis failure
- CACHES['ratelimit'] (DB1, no prefix) for cross-pod rate-limit counters
- RATELIMIT_USE_CACHE = 'ratelimit'
- Connection pool capped at 6/worker (1,200 pods × 2 workers × 6 = 14,400
  peak connections; maxclients=20,000 gives 40% headroom)

start.sh:
- resolve_redis_url(): reads REDIS_URL from local namespace Secret (envFrom)
  or falls back to global cluster Secret via k8s API
- configure_redis_cache(): ensures REDIS_CACHE waffle switch row exists (off)
- resolve_cache_backend(): reads waffle switch; sets CACHE_BACKEND=redis|file
- wait_for_redis(): blocks until Redis reachable; falls back gracefully
- write_env_file() now persists REDIS_URL + CACHE_BACKEND into pod .env

k8s manifests (docker/k8s/):
- redis-configmap.yaml: no persistence, allkeys-lru, maxmemory=5gb,
  maxclients=20000, activedefrag, 4 databases
- redis-deployment.yaml: redis:7-alpine, 1 replica, liveness/readiness probes,
  1Gi request / 6Gi limit
- redis-service.yaml: ClusterIP on port 6379

requirements: add django-redis==5.4.0

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

3 weeks ago

2 Commits (742f3db6cd47bd314b9970b7aae54893d71c47b6)