Ilia Denisov
4ba9da6721
CI / changes (pull_request) Successful in 2s
CI / unit (pull_request) Successful in 10s
CI / integration (pull_request) Successful in 24s
CI / ui (pull_request) Successful in 1m11s
CI / conformance (pull_request) Successful in 10s
CI / gate (pull_request) Successful in 0s
CI / deploy (pull_request) Successful in 1m49s
Refuse a client whose IP is in a curated CIDR feed with 403 in the same
abuseGuard, before the fail2ban ban. Prod-only (keys by real client IP), off by
default.
- ratelimit.Blocklist: a sorted-range IPv4 matcher (binary search) with an
allowlist checked first; ParseDROP reads the feed; ApplyRefresh keeps the
last-good feed on a transient fetch failure and drops it fail-open once stale
(better to under-block than block a legitimate client on a frozen feed). A
separate static CIDR set, not the per-IP fail2ban store.
- gateway: a refresher goroutine re-fetches every few hours (bounded fetch + size
cap); config GATEWAY_BLOCKLIST_{ENABLED,URL,ALLOW,REFRESH,MAX_STALENESS}.
IPv6 is not matched (a v6 client is still covered by fail2ban / the honeypot).
- observability: gateway_blocklist_blocked_total + entries/age gauges; a Grafana
alert warns before the feed is dropped; service-overview panels.
- deploy: compose env + write-prod-env.sh + prod-deploy/rollback wiring (opt-in
via PROD_ vars).
- docs (ARCHITECTURE, deploy/README); unit tests (match, allowlist, IPv6 skip,
parser, fault-tolerance) + a 403 abuse-guard integration test.
84 lines
3.8 KiB
JSON
84 lines
3.8 KiB
JSON
{
|
|
"uid": "scrabble-overview",
|
|
"title": "Scrabble — Service overview",
|
|
"tags": ["scrabble"],
|
|
"timezone": "",
|
|
"schemaVersion": 39,
|
|
"version": 1,
|
|
"refresh": "30s",
|
|
"time": { "from": "now-6h", "to": "now" },
|
|
"panels": [
|
|
{
|
|
"type": "stat",
|
|
"title": "Active users (24h)",
|
|
"gridPos": { "h": 5, "w": 6, "x": 0, "y": 0 },
|
|
"datasource": { "type": "prometheus", "uid": "prometheus" },
|
|
"targets": [{ "refId": "A", "expr": "max(active_users{window=\"24h\"})" }]
|
|
},
|
|
{
|
|
"type": "stat",
|
|
"title": "Active users (7d)",
|
|
"gridPos": { "h": 5, "w": 6, "x": 6, "y": 0 },
|
|
"datasource": { "type": "prometheus", "uid": "prometheus" },
|
|
"targets": [{ "refId": "A", "expr": "max(active_users{window=\"7d\"})" }]
|
|
},
|
|
{
|
|
"type": "stat",
|
|
"title": "Edge requests/s",
|
|
"gridPos": { "h": 5, "w": 6, "x": 12, "y": 0 },
|
|
"datasource": { "type": "prometheus", "uid": "prometheus" },
|
|
"targets": [{ "refId": "A", "expr": "sum(rate(edge_request_duration_count[5m]))" }]
|
|
},
|
|
{
|
|
"type": "stat",
|
|
"title": "Edge error ratio",
|
|
"gridPos": { "h": 5, "w": 6, "x": 18, "y": 0 },
|
|
"fieldConfig": { "defaults": { "unit": "percentunit" }, "overrides": [] },
|
|
"datasource": { "type": "prometheus", "uid": "prometheus" },
|
|
"targets": [{ "refId": "A", "expr": "sum(rate(edge_request_duration_count{result!=\"ok\"}[5m])) / clamp_min(sum(rate(edge_request_duration_count[5m])), 1)" }]
|
|
},
|
|
{
|
|
"type": "timeseries",
|
|
"title": "Goroutines by service",
|
|
"description": "OTel Go runtime metric; verify the exact name against live Prometheus if empty (go_goroutine_count / process_runtime_go_goroutines depending on the contrib runtime version).",
|
|
"gridPos": { "h": 8, "w": 12, "x": 0, "y": 5 },
|
|
"datasource": { "type": "prometheus", "uid": "prometheus" },
|
|
"targets": [{ "refId": "A", "expr": "go_goroutine_count", "legendFormat": "{{service_name}}" }]
|
|
},
|
|
{
|
|
"type": "timeseries",
|
|
"title": "Heap memory used by service",
|
|
"description": "OTel Go runtime metric (best-effort name go_memory_used); verify against live Prometheus if empty.",
|
|
"gridPos": { "h": 8, "w": 12, "x": 12, "y": 5 },
|
|
"fieldConfig": { "defaults": { "unit": "bytes" }, "overrides": [] },
|
|
"datasource": { "type": "prometheus", "uid": "prometheus" },
|
|
"targets": [{ "refId": "A", "expr": "sum(go_memory_used) by (service_name)", "legendFormat": "{{service_name}}" }]
|
|
},
|
|
{
|
|
"type": "stat",
|
|
"title": "Blocklist entries",
|
|
"description": "CIDR ranges in the active community IP blocklist feed (0 when disabled or not yet fetched).",
|
|
"gridPos": { "h": 5, "w": 6, "x": 0, "y": 13 },
|
|
"datasource": { "type": "prometheus", "uid": "prometheus" },
|
|
"targets": [{ "refId": "A", "expr": "max(gateway_blocklist_entries)" }]
|
|
},
|
|
{
|
|
"type": "stat",
|
|
"title": "Blocklist feed age",
|
|
"description": "Seconds since the community IP blocklist feed was last successfully fetched. Grows if the fetch is failing; the feed is dropped fail-open once stale.",
|
|
"gridPos": { "h": 5, "w": 6, "x": 6, "y": 13 },
|
|
"fieldConfig": { "defaults": { "unit": "s" }, "overrides": [] },
|
|
"datasource": { "type": "prometheus", "uid": "prometheus" },
|
|
"targets": [{ "refId": "A", "expr": "max(gateway_blocklist_age_seconds)" }]
|
|
},
|
|
{
|
|
"type": "timeseries",
|
|
"title": "Blocklist blocks/s",
|
|
"description": "Requests refused at the edge by the community IP blocklist (gateway_blocklist_blocked_total).",
|
|
"gridPos": { "h": 8, "w": 12, "x": 12, "y": 13 },
|
|
"datasource": { "type": "prometheus", "uid": "prometheus" },
|
|
"targets": [{ "refId": "A", "expr": "sum(rate(gateway_blocklist_blocked_total[5m]))" }]
|
|
}
|
|
]
|
|
}
|