server

Documentation

Index

• Constants
• func WrapStats(base http.Handler, rl *APIRateLimiter) http.Handler
• type APIRateLimiter
  • func NewAPIRateLimiter(requestsPerSec, burst int) *APIRateLimiter
  • func (rl *APIRateLimiter) Middleware(next http.Handler) http.Handler
• type FilterConfig
• type HitFilter
  • func NewHitFilter(cfg FilterConfig) (*HitFilter, error)
  • func (f *HitFilter) Check(h hit.Hit, r *http.Request) (RejectReason, string)
• type HostRateLimiter
  • func NewHostRateLimiter(requestsPerSec, burst int) *HostRateLimiter
  • func (h *HostRateLimiter) Allow(host string) bool
• type MiddlewareSkip
  • func PublicMiddlewareSkip() MiddlewareSkip
  • func StatsMiddlewareSkip() MiddlewareSkip
• type RateLimitConfig
• type RateLimiter
  • func NewRateLimiter(cfg RateLimitConfig) *RateLimiter
  • func (rl *RateLimiter) Middleware(next http.Handler, skip MiddlewareSkip) http.Handler
  • func (rl *RateLimiter) Shutdown()
• type RejectReason
• type Server
  • func New(s store.Store, buf hit.Buffer, l *log.Logger, v visitor.Hasher, ...) *Server
  • func (s *Server) Handler() http.Handler
• type ServerOption
  • func WithIngest(filter *HitFilter, hostRL *HostRateLimiter, trustProxy bool) ServerOption
  • func WithStats(cfg StatsConfig, apiRL *APIRateLimiter) ServerOption
• type StatsConfig

Constants

const HealthzPath = "/api/v1/healthz"

HealthzPath is the Kubernetes liveness probe (process up; no dependency checks).

const ReadyzPath = "/api/v1/readyz"

ReadyzPath is the Kubernetes readiness probe (DB reachable, buffer healthy).

const VersionPath = "/api/v1/version"

VersionPath exposes build metadata for operators and kui.

Functions

func WrapStats

func WrapStats(base http.Handler, rl *APIRateLimiter) http.Handler

WrapStats applies API rate limiting to /api/v1/stats/* only.

Types

type APIRateLimiter

type APIRateLimiter struct {
	// contains filtered or unexported fields
}

APIRateLimiter limits stats API requests per API key (or client IP when no key).

func NewAPIRateLimiter

func NewAPIRateLimiter(requestsPerSec, burst int) *APIRateLimiter

NewAPIRateLimiter creates a per-key token bucket for the stats API.

func (*APIRateLimiter) Middleware

func (rl *APIRateLimiter) Middleware(next http.Handler) http.Handler

Middleware wraps stats routes with per-key rate limiting.

type FilterConfig

type FilterConfig struct {
	AllowedHosts       []string
	IgnoreIPs          []string
	TrustProxy         bool
	BlockDatacenterIPs bool
	DatacenterExtra    []string
}

FilterConfig controls ingest-side rejection rules.

type HitFilter

type HitFilter struct {
	// contains filtered or unexported fields
}

HitFilter applies allowlist, bot, spam, and IP block rules.

func NewHitFilter

func NewHitFilter(cfg FilterConfig) (*HitFilter, error)

NewHitFilter builds a filter from config. Datacenter blocklist is optional.

func (*HitFilter) Check

func (f *HitFilter) Check(h hit.Hit, r *http.Request) (RejectReason, string)

Check returns a reject reason or empty when the hit should be accepted.

type HostRateLimiter

type HostRateLimiter struct {
	// contains filtered or unexported fields
}

HostRateLimiter applies a per-site-host token bucket on ingest.

func NewHostRateLimiter

func NewHostRateLimiter(requestsPerSec, burst int) *HostRateLimiter

NewHostRateLimiter creates a per-host limiter. requestsPerSec <= 0 disables limits.

func (*HostRateLimiter) Allow

func (h *HostRateLimiter) Allow(host string) bool

Allow reports whether another hit for host may proceed.

type MiddlewareSkip

type MiddlewareSkip struct {
	Exact    []string
	Prefixes []string
}

MiddlewareSkip lists request paths exempt from rate limiting.

func PublicMiddlewareSkip

func PublicMiddlewareSkip() MiddlewareSkip

PublicMiddlewareSkip returns paths that must stay reachable without rate limits (probes, static tracking script).

func StatsMiddlewareSkip

func StatsMiddlewareSkip() MiddlewareSkip

StatsMiddlewareSkip returns paths exempt from ingest rate limits but not stats auth.

type RateLimitConfig

type RateLimitConfig struct {
	RequestsPerSec int
	Burst          int
	TrustProxy     bool
}

RateLimitConfig holds rate limiter parameters (requests per second).

type RateLimiter

type RateLimiter struct {
	// contains filtered or unexported fields
}

RateLimiter is a per-IP token-bucket rate limiter.

func NewRateLimiter

func NewRateLimiter(cfg RateLimitConfig) *RateLimiter

NewRateLimiter creates a per-IP token bucket rate limiter. Call Shutdown on cleanup.

func (*RateLimiter) Middleware

func (rl *RateLimiter) Middleware(next http.Handler, skip MiddlewareSkip) http.Handler

Middleware wraps next with per-IP rate limiting. Paths in skip are exempt.

func (*RateLimiter) Shutdown

func (rl *RateLimiter) Shutdown()

Shutdown stops the background cleanup goroutine.

type RejectReason

type RejectReason string

RejectReason explains why a hit was dropped.

const (
	RejectNone          RejectReason = ""
	RejectNotAllowed    RejectReason = "not_allowed"
	RejectPrefetch      RejectReason = "prefetch"
	RejectBot           RejectReason = "bot"
	RejectReferrerSpam  RejectReason = "referrer_spam"
	RejectIgnoredIP     RejectReason = "ignored_ip"
	RejectDatacenterIP  RejectReason = "datacenter_ip"
	RejectNoClientIP    RejectReason = "no_client_ip"
	RejectHostRateLimit RejectReason = "host_rate_limit"
)

type Server

type Server struct {
	// contains filtered or unexported fields
}

func New

func New(s store.Store, buf hit.Buffer, l *log.Logger, v visitor.Hasher, rl *RateLimiter, opts ...ServerOption) *Server

func (*Server) Handler

func (s *Server) Handler() http.Handler

type ServerOption

type ServerOption func(*Server)

ServerOption configures optional Server behavior.

func WithIngest

func WithIngest(filter *HitFilter, hostRL *HostRateLimiter, trustProxy bool) ServerOption

WithIngest configures hit filtering and per-host rate limits.

func WithStats

func WithStats(cfg StatsConfig, apiRL *APIRateLimiter) ServerOption

WithStats enables the read-only stats API.

type StatsConfig

type StatsConfig struct {
	APIKey string
}

StatsConfig configures the read-only stats API.