SPDT/sapl - sapl - Gitea: Git with a cup of tea

Author	SHA1	Message	Date
Edward Ribeiro	d4738a20a9	Raise rate limits and split nginx zones for legitimate traffic SAPL pages fire 12-45 parallel requests; the old 30r/m nginx zone and 35/m Django threshold blocked normal navigation. Key changes: nginx (nginx.conf / sapl.conf / start.sh): - Split sapl_general (30r/m) into four dedicated zones: sapl_general 90r/m burst=180 (HTML pages) sapl_media 180r/m burst=180 (/media/ — own bucket, no longer drains general) sapl_api 60r/m burst=120 (/api/ — quota layer is the real constraint) sapl_heavy 10r/m burst=20 (/relatorios/ — unchanged, nodelay kept) - /media/ and /api/ location blocks now reference their own zones Django (settings.py): - RATE_LIMITER_RATE: 35/m → 120/m - RATE_LIMITER_RATE_AUTHENTICATED: 120/m → 240/m - RATE_LIMIT_404_THRESHOLD: 10 → 20 - API_QUOTA_ANON_DAILY: 50 → 500 / weekly 350 → 3500 - API_QUOTA_AUTH_DAILY: 1000 → 5000 / weekly 7000 → 35000 Middleware (ratelimit.py): - Authenticated users no longer receive a persistent 300s block key on rate breach — they get 429 for the over-limit request and the window resets naturally after 60s. A 5-minute lockout is wrong for a logged-in user who clicked too fast. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	3 weeks ago
Edward Ribeiro	8386bef3fc	Phase 4: anonymous page caching via AnonCachePageMixin Add AnonCachePageMixin (sapl/middleware/page_cache.py) that stores full view responses in the default Redis cache for anonymous (unauthenticated) GET requests only. Authenticated users always bypass the cache so CSRF tokens and user-specific UI controls are never served stale. Applied to: - ParlamentarCrud.ListView / DetailView — TTL 600 s (changes each term) - AudienciaCrud.ListView — TTL 120 s (hearings added infrequently) - ComissaoCrud.ListView — TTL 300 s (committees change rarely) Also: - Add PAGE_CACHE_TTL_LIST/DETAIL/STABLE settings (env-configurable) - Add bingbot + SERankingBacklinksBot to nginx UA blocklist (were already in BOT_UA_FRAGMENTS / robots.txt; nginx map was the only gap) - Remove unused ratelimit/method_decorator/RATE_LIMITER_RATE imports from audiencia/views.py that crept in during Phase 2 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2 months ago
Edward Ribeiro	8df2861799	Phase 0 hardening: nginx GeoIP2, rate limits, Gunicorn tuning, N+1 fix - nginx: sendfile on, tcp_nopush, reduced keepalive/proxy timeouts - nginx: GeoIP2 ASN-based bot blocking (cloud providers + known scrapers) - nginx: UA blocklist (GPTBot, ClaudeBot, Chrome/98.0.4758 impersonator, etc.) - nginx: rate-limit zones (30r/m general, 10r/m heavy/relatorios), 429/500 error pages - nginx: proper ETags + Cache-Control on /media/ to stop 30GB logo re-transfers - Dockerfile: install libnginx-mod-http-geoip2; download GeoLite2-ASN.mmdb via BuildKit secret (key never baked into image layers); ARG GEOIP_CACHE_BUST for forced re-download without --no-cache - Gunicorn: workers 3->2, threads 8->4, timeout 300->120, max_memory 300->400MB - Django: FILE_UPLOAD_MAX_MEMORY_SIZE=2MB, FILE_UPLOAD_TEMP_DIR for large uploads - relatorios/views.py: fix N+1 in get_etiqueta_protocolos with bulk-fetch MateriaLegislativa + DocumentoAdministrativo using select_related + dict lookups - Add robots.txt, 429.html, 500.html static pages - docker-compose.yaml: use sapl:local for local dev - docker/README.md: build instructions with MAXMIND_LICENSE_KEY - rate-limiter-v2.md: canonical planning document (Architecture through Phase 5) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2 months ago
Edward	6ac5e419e3	Atualização da imagem base Docker (#3787 ) Update de imagem based Docker and libs Python Co-authored-by: Edward <9326037+edwardoliveira@users.noreply.github.com>	9 months ago
Leandro Roberto	c8a24c11b6	HOT-FIX: Corrige constr de contexto na anex de mat - Remove a analise de vínculos cíclicos na construção inicial do form do filterset. - O item anterior deve resolver o timeout causado na abertura da anexação em lote, no entanto os timeouts do nginx e gunicorn foram aumentados.	5 years ago
Vinícius Cantuária	6c757b2dfe	Ativa compressão gzip (#3283 ) Corrige MIME type de arquivos Compacta as imagens mantendo as qualidades	6 years ago
Edward	f704795a7e	Refatora arquivos Docker (#3264 ) * Refatora arquivos Docker * Conserta runtime * Retorna CI antigo Co-authored-by: eribeiro <edwardr@senado.leg.br>	6 years ago
Fábio Kaiser Rauber	ba8bc9ea75	Nginx is now part of SAPL container	9 years ago