Ilia Denisov
041106d623
CI / changes (pull_request) Successful in 3s
CI / unit (pull_request) Successful in 11s
CI / integration (pull_request) Successful in 17s
CI / ui (pull_request) Successful in 53s
CI / gate (pull_request) Successful in 0s
CI / deploy (pull_request) Successful in 1m11s
Add a prod-only, in-memory IP ban enforced at the edge, fed by three signals:
sustained rate-limiter rejections (the IP-keyed public/email/admin classes — the
user class stays the backend soft-flag's concern), a honeypot decoy-path hit (the
contour caddy tags decoys with X-Scrabble-Honeypot and routes them to the gateway),
and a honeytoken (a planted bearer, GATEWAY_HONEYTOKEN). A banned IP is refused with
429 by the abuseGuard middleware before any work — covering the Connect edge, the
live stream and the static SPA/landing the per-op limiter never gated.
The ban is off by default: it keys by the real client IP the shared-NAT test contour
does not expose, so a ban there would be self-inflicted; detection still logs in the
contour, only the ban action is gated (GATEWAY_ABUSE_BAN_ENABLED). Rejection bans last
GATEWAY_ABUSE_BAN_DURATION; tripwire/honeytoken hits are near-zero-false-positive and
earn longer fixed bans. Each ban increments gateway_abuse_banned_total{reason}.
Operators see and lift active bans on the admin console's Throttled page; the gateway
syncs its active set to the backend every 30s (POST /api/v1/internal/bans/sync,
backend/internal/banview) and applies the operator unbans the response returns.
PRERELEASE phase AG. Docs baked into ARCHITECTURE / FUNCTIONAL (+ru) / both READMEs.
69 lines
2.7 KiB
Caddyfile
69 lines
2.7 KiB
Caddyfile
# Edge reverse proxy for the Scrabble contour. A single Basic-Auth gate covers
|
|
# every operator surface under /_gm (the backend-rendered admin console and the
|
|
# Grafana subpath); the game SPA (/app/, /telegram/) and the Connect edge go to
|
|
# the gateway; the catch-all — notably the public landing at / — goes to the
|
|
# static landing container, so stray traffic never reaches the Go edge.
|
|
# Mirrors ../galaxy-game's /_gm model.
|
|
#
|
|
# CADDY_SITE_ADDRESS is ":80" in the test contour (the host caddy terminates TLS
|
|
# and forwards); set it to a domain in prod so this caddy does its own
|
|
# ACME and the contour is self-contained.
|
|
{
|
|
admin off
|
|
# Trust X-Forwarded-For from private-range upstreams so the real client IP survives
|
|
# (chat moderation + per-IP rate limiting in the gateway). Test contour: the host caddy
|
|
# (a private IP) is trusted, so its forwarded client IP is preserved. Prod (no host caddy):
|
|
# clients connect from public IPs, which are NOT trusted, so Caddy uses the real peer —
|
|
# the same config is correct (and spoof-safe) in both contours.
|
|
servers {
|
|
trusted_proxies static private_ranges
|
|
}
|
|
}
|
|
|
|
{$CADDY_SITE_ADDRESS::80} {
|
|
# Operator surfaces under /_gm: a single shared Basic-Auth, then route.
|
|
@gm path /_gm /_gm/*
|
|
handle @gm {
|
|
basic_auth {
|
|
{$GM_BASICAUTH_USER:gm} {$GM_BASICAUTH_HASH}
|
|
}
|
|
# Grafana serves from this sub-path (GF_SERVER_SERVE_FROM_SUB_PATH=true), so
|
|
# the prefix is forwarded intact, not stripped.
|
|
handle /_gm/grafana* {
|
|
reverse_proxy grafana:3000
|
|
}
|
|
# Everything else under /_gm is the backend-rendered admin console.
|
|
handle {
|
|
reverse_proxy backend:8080
|
|
}
|
|
}
|
|
|
|
# The game SPA and the Connect edge are served by the gateway. Strip any
|
|
# client-supplied X-Scrabble-Honeypot here so the gateway only ever honours the
|
|
# tag the honeypot block sets below (a client cannot self-tag a real request).
|
|
@gateway path /app /app/* /telegram /telegram/* /scrabble.edge.v1.Gateway/*
|
|
handle @gateway {
|
|
reverse_proxy gateway:8081 {
|
|
header_up -X-Scrabble-Honeypot
|
|
}
|
|
}
|
|
|
|
# Honeypot decoy paths: classic vulnerability-scanner bait no real client ever
|
|
# requests. Route them to the gateway tagged with X-Scrabble-Honeypot so it logs
|
|
# the scanner hit and (in prod) bans the source IP. The inbound header is
|
|
# stripped first so a client cannot pre-set it — and even if it did, it would
|
|
# only ban itself. Keep this list in sync with no legitimate landing/app path.
|
|
@honeypot path /.env /.git /.git/* /.aws/* /wp-login.php /wp-admin /wp-admin/* /phpmyadmin /phpmyadmin/*
|
|
handle @honeypot {
|
|
reverse_proxy gateway:8081 {
|
|
header_up -X-Scrabble-Honeypot
|
|
header_up X-Scrabble-Honeypot 1
|
|
}
|
|
}
|
|
|
|
# Everything else — the public landing at / and any stray path — is static.
|
|
handle {
|
|
reverse_proxy landing:80
|
|
}
|
|
}
|