Lukas
ea35695221
Task 4 (Better Jail Configuration) implementation:
- Add fail2ban_config_dir setting to app/config.py
- New file_config_service: list/view/edit/create jail.d, filter.d, action.d files
with path-traversal prevention and 512 KB content size limit
- New file_config router: GET/PUT/POST endpoints for jail files, filter files,
and action files; PUT .../enabled for toggle on/off
- Extend config_service with delete_log_path() and add_log_path()
- Add DELETE /api/config/jails/{name}/logpath and POST /api/config/jails/{name}/logpath
- Extend geo router with re-resolve endpoint; add geo_re_resolve background task
- Update blocklist_service with revised scheduling helpers
- Update Docker compose files with BANGUI_FAIL2BAN_CONFIG_DIR env var and
rw volume mount for the fail2ban config directory
- Frontend: new Jail Files, Filters, Actions tabs in ConfigPage; file editor
with accordion-per-file, editable textarea, save/create; add/delete log paths
- Frontend: types in types/config.ts; API calls in api/config.ts and api/endpoints.ts
- 63 new backend tests (test_file_config_service, test_file_config, test_geo_re_resolve)
- 6 new frontend tests in ConfigPageLogPath.test.tsx
- ruff, mypy --strict, tsc --noEmit, eslint: all clean; 617 backend tests pass
104 lines
3.4 KiB
Python
104 lines
3.4 KiB
Python
"""Geo re-resolve background task.
|
|
|
|
Registers an APScheduler job that periodically retries IP addresses in the
|
|
``geo_cache`` table whose ``country_code`` is ``NULL``. These are IPs that
|
|
previously failed to resolve (e.g. due to ip-api.com rate limiting) and were
|
|
recorded as negative entries.
|
|
|
|
The task runs every 10 minutes. On each invocation it:
|
|
|
|
1. Queries all ``NULL``-country rows from ``geo_cache``.
|
|
2. Clears the in-memory negative cache so those IPs are eligible for a fresh
|
|
API attempt.
|
|
3. Delegates to :func:`~app.services.geo_service.lookup_batch` which already
|
|
handles rate-limit throttling and retries.
|
|
4. Logs how many IPs were retried and how many resolved successfully.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from typing import TYPE_CHECKING, Any
|
|
|
|
import structlog
|
|
|
|
from app.services import geo_service
|
|
|
|
if TYPE_CHECKING:
|
|
from fastapi import FastAPI
|
|
|
|
log: structlog.stdlib.BoundLogger = structlog.get_logger()
|
|
|
|
#: How often the re-resolve job fires (seconds). 10 minutes.
|
|
GEO_RE_RESOLVE_INTERVAL: int = 600
|
|
|
|
#: Stable APScheduler job ID — ensures re-registration replaces, not duplicates.
|
|
JOB_ID: str = "geo_re_resolve"
|
|
|
|
|
|
async def _run_re_resolve(app: Any) -> None:
|
|
"""Query NULL-country IPs from the database and re-resolve them.
|
|
|
|
Reads shared resources from ``app.state`` and delegates to
|
|
:func:`~app.services.geo_service.lookup_batch`.
|
|
|
|
Args:
|
|
app: The :class:`fastapi.FastAPI` application instance passed via
|
|
APScheduler ``kwargs``.
|
|
"""
|
|
db = app.state.db
|
|
http_session = app.state.http_session
|
|
|
|
# Fetch all IPs with NULL country_code from the persistent cache.
|
|
unresolved_ips: list[str] = []
|
|
async with db.execute(
|
|
"SELECT ip FROM geo_cache WHERE country_code IS NULL"
|
|
) as cursor:
|
|
async for row in cursor:
|
|
unresolved_ips.append(str(row[0]))
|
|
|
|
if not unresolved_ips:
|
|
log.debug("geo_re_resolve_skip", reason="no_unresolved_ips")
|
|
return
|
|
|
|
log.info("geo_re_resolve_start", unresolved=len(unresolved_ips))
|
|
|
|
# Clear the negative cache so these IPs are eligible for fresh API calls.
|
|
geo_service.clear_neg_cache()
|
|
|
|
# lookup_batch handles throttling, retries, and persistence when db is
|
|
# passed. This is a background task so DB writes are allowed.
|
|
results = await geo_service.lookup_batch(unresolved_ips, http_session, db=db)
|
|
|
|
resolved_count: int = sum(
|
|
1 for info in results.values() if info.country_code is not None
|
|
)
|
|
log.info(
|
|
"geo_re_resolve_complete",
|
|
retried=len(unresolved_ips),
|
|
resolved=resolved_count,
|
|
)
|
|
|
|
|
|
def register(app: FastAPI) -> None:
|
|
"""Add (or replace) the geo re-resolve job in the application scheduler.
|
|
|
|
Must be called after the scheduler has been started (i.e., inside the
|
|
lifespan handler, after ``scheduler.start()``).
|
|
|
|
The first invocation is deferred by one full interval so the initial
|
|
blocklist prewarm has time to finish before re-resolve kicks in.
|
|
|
|
Args:
|
|
app: The :class:`fastapi.FastAPI` application instance whose
|
|
``app.state.scheduler`` will receive the job.
|
|
"""
|
|
app.state.scheduler.add_job(
|
|
_run_re_resolve,
|
|
trigger="interval",
|
|
seconds=GEO_RE_RESOLVE_INTERVAL,
|
|
kwargs={"app": app},
|
|
id=JOB_ID,
|
|
replace_existing=True,
|
|
)
|
|
log.info("geo_re_resolve_scheduled", interval_seconds=GEO_RE_RESOLVE_INTERVAL)
|