Sistema de Apoio ao Processo Legislativo
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Edward Ribeiro
2f2a976dfa
Add Redis-backed rate limiting, anonymous caching, and nginx Lua IP-block layer
Implements a multi-layer DDoS/abuse mitigation stack across nginx, Django
middleware, and Redis:
**nginx hardening (Phase 0)**
- GeoIP2 ASN-based bot blocking (MaxMind GeoLite2-ASN, offline build)
- Request-rate and connection-rate limit zones; scanner probe zones
- Gunicorn worker/timeout tuning; N+1 query fix in relatorio views
- X-Accel-Redirect for private /media/ files; nginx internal media path
**Redis infrastructure (Phase 1)**
- Shared Redis pod for cross-pod state (k8s manifests: Deployment, Service, ConfigMap)
- Django dual-backend cache: default (file/Redis) + dedicated `ratelimit` Redis DB 1
- configure_redis_cache() wired into settings startup; KEY_PREFIX namespace isolation
**RateLimitMiddleware (Phase 2)**
- Per-IP request rate counter (60/min sliding window) → block key in Redis DB 1
- Per-IP 404-scan counter and UA Redis deny list
- NAT-aware: blocks authenticated users behind a shared blocked IP
- Scoped API rate limit (60/min) with daily/weekly quota per consumer
- IP-prefix blocklist (SET `rl:ip_prefix:blocked`) with 4-candidate SMEMBERS check
- Blocked-IP ZSET indexes with inline pruning; atomic block writes via Lua script
- Returns 403 for prefix-list hits, 429 for rate/quota hits
- Django block metrics tracked per layer; CORS headers on 429 responses
- Collapse rl:metrics STRING keys into a HASH per tenant per day
**Anonymous page caching (Phase 4)**
- AnonCachePageMixin applied to 8 public search/filter views (materia, sessao,
pesquisar-sessao, comissoes, norma, audiencia, relatorios)
- Mitigates pesquisar-sessao DDoS; sanitises page= param pollution
- ETag/Last-Modified conditional request support on norma and media views
**nginx Lua early-rejection layer**
- `blocklist.lua`: per-request access_by_lua_file hook — checks shared dict for
prefix matches (zero Redis I/O), then pipelines GET rl:ip:{ip}:blocked +
GET rl:api:ns:{ns}:ip:{ip}:blocked; returns 429 before Gunicorn is reached
- `init_worker_by_lua_block`: 60s timer refreshes `ngx.shared.ip_prefix_blocked`
from Redis SMEMBERS; fail-open on Redis error
- Uses `libnginx-mod-http-lua` + `libnginx-mod-http-ndk` (Debian Bookworm dynamic
modules); load order in nginx.conf: NDK → GeoIP2 → Lua
- `resty_redis.lua` vendored (lua-resty-redis is not in Debian Bookworm repos)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
3 weeks ago |
| .. |
|
anonimizador
|
Conserta PEP 8
|
8 years ago |
|
django
|
Refatora scripts bash
|
6 years ago |
|
hooks
|
Refatora scripts bash
|
6 years ago |
|
atualizar_producao.sh
|
Refatora scripts bash
|
6 years ago |
|
atualizar_requirements.py
|
Corrige PEP 8
|
9 years ago |
|
check_commits.py
|
Alterações no script de verificar commits entre 3.1.x e master
|
7 years ago |
|
convert_null_to_empty_in_all_char_fields.py
|
Conserta PEP 8
|
8 years ago |
|
create_admin_user.sh
|
Refatora scripts bash
|
6 years ago |
|
deduplica_parlamentares.py
|
Fix erro em frente, insercao de tratamento de excecoes (#3569)
|
4 years ago |
|
extrai_imagens_codificadas_de_campo_texto.py
|
feat: Script to find and extract codified images pasted into text fields using the tinyMCE editor (#3643)
|
3 years ago |
|
fk_protocoloadm_docadm.py
|
Conserta PEP 8
|
8 years ago |
|
gerar_hash_proposicoes.py
|
Filtrando proposição por data de recebimento (#3219)
|
6 years ago |
|
gunicorn_start.sh
|
Fix recibo proposição e adiciona rate limiter em matéria e norma
|
10 months ago |
|
id_numero_legislatura.py
|
Fix #500
|
10 years ago |
|
legacy_db_checks.sql
|
Add list of sql queries to check legacy db
|
11 years ago |
|
lista_permissions_in_decorators.py
|
Corrige erros referentes a PEP8
|
9 years ago |
|
lista_urls.py
|
Atualiza a versão do Django para 2.2 (#3165)
|
6 years ago |
|
redbaron.py
|
Move scripts para pasta scripts (#1933)
|
8 years ago |
|
remove_multiplos_autores.py
|
Conserta erro de sintaxe
|
7 years ago |
|
remove_proposicoes_de_autor.py
|
feat: cria script para remocao de proposicoes de um autor (#3703)
|
10 months ago |
|
remove_protocolos_inexistentes_materias.py
|
Adiciona script para remover protocolos inexistentes em matérias (#2708)
|
7 years ago |
|
restore_db.sh
|
Script para restauração da base de dados (#3133)
|
6 years ago |
|
set_inicio_mandato.py
|
Corrige PEP 8
|
9 years ago |
|
test_ratelimiter.py
|
Add Redis-backed rate limiting, anonymous caching, and nginx Lua IP-block layer
|
2 days ago |
|
voto_parlamentar.sql
|
Add model and new template to painel
|
11 years ago |
