8be4030d03
Any request on logs.<swarm> carrying a well-formed swarm-agent bearer made swarm-logs-auth do a bao cert login and KV read before it could refuse, with no cap on the rate. nginx now applies limit_req (zone swarm_logs_agent_auth, keyed by client address, 5r/s burst 20 nodelay by default) on the internal location that forwards to swarm-logs-auth, answering 403 when over, since auth_request passes through only 401/403 and swarm-logs retries a 401. The authelia path and the query location carry no limit. swarm-logs-auth remembers bearers it has granted, keyed by SHA-256 of the bearer, for --verdict-ttl seconds (deploy.victorialogs.authVerdictTtl, 60 by default), holding at most 4096 and evicting the oldest. Denials are never remembered. A replaced or deleted queue secret therefore keeps working at the log store for up to the TTL after its last check. Closes #5190
25 lines
610 B
TOML
25 lines
610 B
TOML
[package]
|
|
name = "swarm-logs-auth"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
|
|
[[bin]]
|
|
name = "swarm-logs-auth"
|
|
path = "src/main.rs"
|
|
|
|
[dependencies]
|
|
anyhow.workspace = true
|
|
axum.workspace = true
|
|
clap.workspace = true
|
|
# The verdict cache's key: a digest of the bearer, never the bearer.
|
|
sha2.workspace = true
|
|
swarm-agent-verify.workspace = true
|
|
# The agent-token spelling, and the rustls provider the store client needs.
|
|
swarm-queue-client.workspace = true
|
|
swarm-secret-client.workspace = true
|
|
tokio.workspace = true
|
|
tracing.workspace = true
|
|
tracing-subscriber.workspace = true
|
|
|
|
[lints]
|
|
workspace = true
|