SPDT/sapl - sapl - Gitea: Git with a cup of tea

Author	SHA1	Message	Date
Edward Ribeiro	74d5873426	Fix Redis configmap inline comment, clean cache key format, add blocked-IP scan to plan - redis-configmap: move inline comment to its own line (Redis fatal parse error) - settings: add CACHE_MIDDLEWARE_KEY_PREFIX='p' to remove double-dot in cache_page keys - settings: monkey-patch _i18n_cache_key_suffix to strip pt-br/timezone suffix from keys - ratelimit.py, settings: update example namespace from patobranco-pr to sapl31demo-df - robots.txt: add AwarioSmartBot block - plan: add rl:ip:*:blocked scan commands with TTL/value output Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2 months ago
Edward Ribeiro	9140f3e4b8	Phase 1-4: Redis infra, rate limiter middleware, cache layer, nginx hardening docker/Dockerfile: - GeoIP offline build with MaxMind secret; optional build args for graphviz, poppler, psql client; envsubst for nginx burst vars docker/docker-compose.yaml: - saplredis service (redis:7-alpine, allkeys-lru, 512 MB) - REDIS_URL + CACHE_BACKEND wired into sapl service docker/startup_scripts/start.sh: - configure_redis_cache(): builds CACHES dict, sets REDIS_CACHE waffle switch, falls back to file cache gracefully - POD_NAMESPACE resolution (k8s Downward API → hostname fallback) - DATABASE_URL exported before migrate docker/k8s/redis/ (moved from docker/k8s/): - redis-configmap.yaml, redis-deployment.yaml, redis-service.yaml - ClusterIP service on port 6379, sapl-redis namespace docker/k8s/sapl-k8s.yaml: - REDIS_URL env var injected; app.kubernetes.io/name=sapl label for fleet-wide discovery sapl/middleware/test_ratelimiter.py: - Unit tests for RateLimitMiddleware with mocked Redis scripts/test_ratelimiter.py: - CLI smoke-test: fires N requests and reports first 429 Removed: rate-limiter-v2.md (content migrated to plan/RATE_LIMITER_PLAN.md), scripts/test_ratelimiter.sh (replaced by .py), docker/k8s/README.md (merged into plan/RATE_LIMITER_PLAN.md), docker/scripts/redis_populate_test_data.py (renamed to redis_inject_test_data.py) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2 months ago
Edward Ribeiro	911b13540d	Phase 1: shared Redis pod — Django dual-backend cache + startup wiring django/settings.py: - REDIS_URL / CACHE_BACKEND env vars read at startup (written by start.sh) - CACHES['default'] (DB0, KEY_PREFIX='sapl') switches between django-redis and FileBasedCache transparently; IGNORE_EXCEPTIONS=True for graceful degradation on Redis failure - CACHES['ratelimit'] (DB1, no prefix) for cross-pod rate-limit counters - RATELIMIT_USE_CACHE = 'ratelimit' - Connection pool capped at 6/worker (1,200 pods × 2 workers × 6 = 14,400 peak connections; maxclients=20,000 gives 40% headroom) start.sh: - resolve_redis_url(): reads REDIS_URL from local namespace Secret (envFrom) or falls back to global cluster Secret via k8s API - configure_redis_cache(): ensures REDIS_CACHE waffle switch row exists (off) - resolve_cache_backend(): reads waffle switch; sets CACHE_BACKEND=redis\|file - wait_for_redis(): blocks until Redis reachable; falls back gracefully - write_env_file() now persists REDIS_URL + CACHE_BACKEND into pod .env k8s manifests (docker/k8s/): - redis-configmap.yaml: no persistence, allkeys-lru, maxmemory=5gb, maxclients=20000, activedefrag, 4 databases - redis-deployment.yaml: redis:7-alpine, 1 replica, liveness/readiness probes, 1Gi request / 6Gi limit - redis-service.yaml: ClusterIP on port 6379 requirements: add django-redis==5.4.0 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2 months ago
Edward Ribeiro	b49c7916a3	Fix read-only mount on k8s	9 months ago