Echo
59794bc8f2
All checks were successful
CI Pipeline / Rust Format Check (push) Successful in 4s
CI Pipeline / Clippy Lints (push) Successful in 1m1s
CI Pipeline / Rust Unit Tests (push) Successful in 1m21s
CI Pipeline / Security Audit (push) Successful in 4s
CI Pipeline / Frontend Lint & Type Check (push) Successful in 16s
CI Pipeline / Build .deb & Release (push) Has been skipped
- Replace custom DashMap<IpAddr, Instant> rate limiting in enrollment.rs that fell back to 0.0.0.0 when X-Forwarded-For was missing, causing ALL enrollment traffic to share a single global rate limit bucket - Use tower_governor with SmartIpKeyExtractor for proper per-IP rate limiting that respects X-Forwarded-For headers (critical behind HAProxy) - Add three configurable rate limit tiers via config.toml: * Enrollment: 5 req/min per IP, burst 3 (strict) * Auth: 20 req/min per IP, burst 10 (moderate) * API: 120 req/min per IP, burst 30 (normal) - Remove enrollment_rate_limits from AppState and cleanup task - Remove manual rate limit code from enrollment.rs (headers param, IP extraction) - Add into_make_service_with_connect_info for ConnectInfo fallback - Add RateLimitConfig to AppConfig with sensible defaults Fixes: #1
47 lines
1.3 KiB
TOML
47 lines
1.3 KiB
TOML
[package]
|
|
name = "pm-web"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
authors.workspace = true
|
|
license.workspace = true
|
|
|
|
[[bin]]
|
|
name = "pm-web"
|
|
path = "src/main.rs"
|
|
|
|
[dependencies]
|
|
pm-ca = { path = "../pm-ca" }
|
|
pm-core = { path = "../pm-core" }
|
|
pm-auth = { path = "../pm-auth" }
|
|
pm-reports = { path = "../pm-reports" }
|
|
tokio = { workspace = true }
|
|
axum = { workspace = true }
|
|
axum-server = { workspace = true }
|
|
rustls = { workspace = true }
|
|
axum-extra = { workspace = true }
|
|
tower = { workspace = true }
|
|
tower-http = { workspace = true }
|
|
sqlx = { workspace = true }
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
anyhow = { workspace = true }
|
|
tracing = { workspace = true }
|
|
tracing-subscriber = { workspace = true }
|
|
uuid = { workspace = true }
|
|
ulid = { workspace = true }
|
|
chrono = { workspace = true }
|
|
ipnet = { workspace = true }
|
|
dashmap = { version = "6" }
|
|
tower_governor = { workspace = true }
|
|
governor = { workspace = true }
|
|
reqwest = { workspace = true }
|
|
lettre = { version = "0.11", default-features = false, features = ["tokio1-rustls-tls", "smtp-transport", "builder"] }
|
|
rand = { workspace = true }
|
|
hex = "0.4"
|
|
base64 = { workspace = true }
|
|
sha2 = { workspace = true }
|
|
jsonwebtoken = { workspace = true }
|
|
url = { workspace = true }
|
|
urlencoding = "2"
|