Edward Ribeiro
85e971ae9b
Update ratelimit.py docstring; add Redis service to docker-compose
ratelimit.py: fix module docstring to reflect current _NAMESPACE resolution
(settings.POD_NAMESPACE, not K8s SA files read inside the middleware).
docker-compose.yaml:
- Add saplredis service (redis:7-alpine, no persistence, 512 MB maxmemory,
allkeys-lru, 4 databases, same policy as k8s ConfigMap).
- Add REDIS_URL=redis://saplredis:6379 and CACHE_BACKEND=redis to the
sapl service so local docker-compose runs use Redis out of the box.
- sapl depends_on now includes saplredis.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
3 weeks ago
Edward Ribeiro
69d10d893d
Fix 5 code-quality issues in RateLimitMiddleware
1. user_id: str(request.user.pk) — pk is int, lower()/strip() were no-ops
2. Redis key constants: RL_IP_REQUESTS, RL_IP_BLOCKED, RL_USER_REQUESTS,
RL_USER_BLOCKED, RL_NS_WINDOW — no more inline f-string literals
3. Tenant namespace: _NAMESPACE resolved once at module load from
POD_NAMESPACE env var (K8s Downward API) → service-account namespace
file → 'global' fallback. No per-request getattr(request, 'tenant').
4. KEY_PREFIX in CACHES['default'] set to POD_NAMESPACE (e.g. patobranco-pr)
so each tenant's cache keys are isolated in shared Redis.
5. Logger extra: replaced getattr(request, 'tenant', 'unknown') with
_NAMESPACE (the actual resolved constant).
settings.py: add POD_NAMESPACE = config('POD_NAMESPACE', default='sapl');
use it as KEY_PREFIX.
start.sh: add resolve_pod_namespace() (Downward API → SA file → fallback);
call it before resolve_redis_url(); write POD_NAMESPACE into .env.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
3 weeks ago
Edward Ribeiro
12f6a3e396
Phase 1: shared Redis pod — Django dual-backend cache + startup wiring
django/settings.py:
- REDIS_URL / CACHE_BACKEND env vars read at startup (written by start.sh)
- CACHES['default'] (DB0, KEY_PREFIX='sapl') switches between django-redis
and FileBasedCache transparently; IGNORE_EXCEPTIONS=True for graceful
degradation on Redis failure
- CACHES['ratelimit'] (DB1, no prefix) for cross-pod rate-limit counters
- RATELIMIT_USE_CACHE = 'ratelimit'
- Connection pool capped at 6/worker (1,200 pods × 2 workers × 6 = 14,400
peak connections; maxclients=20,000 gives 40% headroom)
start.sh:
- resolve_redis_url(): reads REDIS_URL from local namespace Secret (envFrom)
or falls back to global cluster Secret via k8s API
- configure_redis_cache(): ensures REDIS_CACHE waffle switch row exists (off)
- resolve_cache_backend(): reads waffle switch; sets CACHE_BACKEND=redis|file
- wait_for_redis(): blocks until Redis reachable; falls back gracefully
- write_env_file() now persists REDIS_URL + CACHE_BACKEND into pod .env
k8s manifests (docker/k8s/):
- redis-configmap.yaml: no persistence, allkeys-lru, maxmemory=5gb,
maxclients=20000, activedefrag, 4 databases
- redis-deployment.yaml: redis:7-alpine, 1 replica, liveness/readiness probes,
1Gi request / 6Gi limit
- redis-service.yaml: ClusterIP on port 6379
requirements: add django-redis==5.4.0
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
3 weeks ago
Edward Ribeiro
eaf4a8405a
Phase 0 hardening: nginx GeoIP2, rate limits, Gunicorn tuning, N+1 fix
- nginx: sendfile on, tcp_nopush, reduced keepalive/proxy timeouts
- nginx: GeoIP2 ASN-based bot blocking (cloud providers + known scrapers)
- nginx: UA blocklist (GPTBot, ClaudeBot, Chrome/98.0.4758 impersonator, etc.)
- nginx: rate-limit zones (30r/m general, 10r/m heavy/relatorios), 429/500 error pages
- nginx: proper ETags + Cache-Control on /media/ to stop 30GB logo re-transfers
- Dockerfile: install libnginx-mod-http-geoip2; download GeoLite2-ASN.mmdb via
BuildKit secret (key never baked into image layers); ARG GEOIP_CACHE_BUST for
forced re-download without --no-cache
- Gunicorn: workers 3->2, threads 8->4, timeout 300->120, max_memory 300->400MB
- Django: FILE_UPLOAD_MAX_MEMORY_SIZE=2MB, FILE_UPLOAD_TEMP_DIR for large uploads
- relatorios/views.py: fix N+1 in get_etiqueta_protocolos with bulk-fetch
MateriaLegislativa + DocumentoAdministrativo using select_related + dict lookups
- Add robots.txt, 429.html, 500.html static pages
- docker-compose.yaml: use sapl:local for local dev
- docker/README.md: build instructions with MAXMIND_LICENSE_KEY
- rate-limiter-v2.md: canonical planning document (Architecture through Phase 5)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
3 weeks ago
Edward Ribeiro
773a810337
Release: 3.1.165-RC2
1 month ago
Edward Ribeiro
f5666e8b9d
Release: 3.1.165-RC1
2 months ago
Edward Ribeiro
ead9dab93f
Release: 3.1.165-RC0
2 months ago
Edward Ribeiro
592d23e3e3
Adiciona requestId em requisições
4 months ago
Edward Ribeiro
3f0d61bdb6
Release: 3.1.164-RC5
7 months ago
Edward Ribeiro
b63a0cec38
Release: 3.1.164-RC4
8 months ago
Edward Ribeiro
3faba84bc8
Fix recibo proposição e adiciona rate limiter em matéria e norma
8 months ago
Edward Ribeiro
bda00ac9c9
Release: 3.1.164-RC3
8 months ago
Edward Ribeiro
4792c784bf
Fix read-only mount on k8s
8 months ago
Edward Ribeiro
c370807007
Release: 3.1.164-RC2
8 months ago
Edward Ribeiro
c015681a94
Restaura prod settings de docker-compose
8 months ago
2953b898b5
Atualização da imagem base Docker ( #3787 )
Update de imagem based Docker and libs Python
Co-authored-by: Edward <9326037+edwardoliveira@users.noreply.github.com>
8 months ago
Edward Ribeiro
0af03caa7a
Release: 3.1.164-RC1
9 months ago
Edward Ribeiro
794856a69c
Release: 3.1.164-RC0
10 months ago
Edward Ribeiro
d135e71e4e
Remove version e monta mais um volume
10 months ago
Edward Ribeiro
423009d4bf
Release: 3.1.163
12 months ago
Edward Ribeiro
87dee5b2c3
Release: 3.1.163-RC24
12 months ago
Edward Ribeiro
1c1f6818f3
Release: 3.1.163-RC23
2 years ago
ae442257a0
Release: 3.1.163-RC22
2 years ago
b4c099a709
Release: 3.1.163-RC21
2 years ago
49a6149ee0
fix: Update docker-compose.yaml
2 years ago
Edward Ribeiro
ae7380df76
Release: 3.1.163-RC20
2 years ago
Edward Ribeiro
dcbab27767
Release: 3.1.163-RC19
2 years ago
Edward Ribeiro
b7971ac6bc
Release: 3.1.163-RC18
2 years ago
b495a35c34
Adiciona feature flag lib ( #3693 )
Adiciona feature flag lib e refatora Solr para usá-la
2 years ago
Edward Ribeiro
18929355d9
Release: 3.1.163-RC17
3 years ago
Edward Ribeiro
d2d9480d69
Release: 3.1.163-RC16
3 years ago
Edward Ribeiro
c202c689a6
Release: 3.1.163-RC15
3 years ago
Edward Ribeiro
3f14fecde7
HOT-FIX: conserta changelog
3 years ago
Edward Ribeiro
23adf66eae
Release: 3.1.163-RC13
3 years ago
Edward Ribeiro
f43da4d66c
Release: 3.1.163-RC12
3 years ago
Edward Ribeiro
85e79348f3
HOT-FIX: fix Solr data volume
3 years ago
Edward Ribeiro
1567303ad3
Release: 3.1.163-RC11
3 years ago
Edward Ribeiro
71f445fcc9
Release: 3.1.163-RC10
3 years ago
ac1a3a9b06
Tela de pesquisa de AuditLog ( #3622 )
* Tela de pesquisa de AuditLog
* Add template tags
* Corrige erro em paginação
3 years ago
Edward Ribeiro
555cbb7591
Release: 3.1.163-RC9
4 years ago
Edward Ribeiro
c04ead1853
Release: 3.1.163-RC8
4 years ago
Edward Ribeiro
80267846ec
Release: 3.1.163-RC7
4 years ago
Edward Ribeiro
0bc47eebd9
Release: 3.1.163-RC6
4 years ago
Edward Ribeiro
435cd0dbc5
Release: 3.1.163-RC5
4 years ago
Edward Ribeiro
afe75d8571
Release: 3.1.163-RC4
4 years ago
Edward Ribeiro
e20b98094b
Ajusta localização docker-compose.yaml
4 years ago
3efdf6a8f9
Refatora Solr ( #3585 )
4 years ago
746b826810
Solr atualizado para 8.11 distribuicao docker ( #3555 )
Mudando docker/docker-compose.yml para dist/docker-compose.yml
Alteração no readme sobre a atualização do solr no docker
Mudança do caminho do solr no arquivo solr.rst
4 years ago
Edward Ribeiro
33d76e3715
HOT-FIX: conserta CORS' preflight steps in browser
4 years ago
Edward Ribeiro
f9f72b4839
Release: 3.1.162
4 years ago
Edward
joaohortsenado
LeandroJatai
Gustavo274