Franz Kafka
13040268d6
Three layers of rate limiting, all disabled by default, opt-in via config: 1. Per-IP (existing): 30 req/min per IP 2. Global: server-wide limit across all IPs - Lock-free atomic counter for minimal overhead - Returns 503 when exceeded - Prevents pool exhaustion from distributed attacks 3. Burst: per-IP burst + sustained windows - Blocks rapid-fire abuse within seconds - Returns 429 with X-RateLimit-Reason header - Example: 5 req/5s burst, 60 req/min sustained Config: [global_rate_limit] requests = 0 # disabled by default window = "1m" [burst_rate_limit] burst = 0 # disabled by default burst_window = "5s" sustained = 0 sustained_window = "1m" Env overrides: GLOBAL_RATE_LIMIT_REQUESTS, GLOBAL_RATE_LIMIT_WINDOW, BURST_RATE_LIMIT_BURST, BURST_RATE_LIMIT_BURST_WINDOW, BURST_RATE_LIMIT_SUSTAINED, BURST_RATE_LIMIT_SUSTAINED_WINDOW Full test coverage: concurrent lock-free test, window expiry, disabled states, IP isolation, burst vs sustained distinction.
108 lines
3.2 KiB
Go
108 lines
3.2 KiB
Go
package main
|
|
|
|
import (
|
|
"flag"
|
|
"fmt"
|
|
"io/fs"
|
|
"log"
|
|
"log/slog"
|
|
"net/http"
|
|
"os"
|
|
|
|
"github.com/ashie/gosearch/internal/cache"
|
|
"github.com/ashie/gosearch/internal/config"
|
|
"github.com/ashie/gosearch/internal/httpapi"
|
|
"github.com/ashie/gosearch/internal/middleware"
|
|
"github.com/ashie/gosearch/internal/search"
|
|
"github.com/ashie/gosearch/internal/views"
|
|
)
|
|
|
|
func main() {
|
|
configPath := flag.String("config", "config.toml", "path to config.toml")
|
|
flag.Parse()
|
|
|
|
// Initialize structured logging.
|
|
logger := slog.New(slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelInfo}))
|
|
slog.SetDefault(logger)
|
|
|
|
cfg, err := config.Load(*configPath)
|
|
if err != nil {
|
|
log.Fatalf("failed to load config: %v", err)
|
|
}
|
|
|
|
// Initialize Valkey cache.
|
|
searchCache := cache.New(cache.Config{
|
|
Address: cfg.Cache.Address,
|
|
Password: cfg.Cache.Password,
|
|
DB: cfg.Cache.DB,
|
|
DefaultTTL: cfg.CacheTTL(),
|
|
}, logger)
|
|
defer searchCache.Close()
|
|
|
|
// Seed env vars from config so existing engine/factory/planner code
|
|
// picks them up without changes.
|
|
if len(cfg.Engines.LocalPorted) > 0 {
|
|
os.Setenv("LOCAL_PORTED_ENGINES", cfg.LocalPortedCSV())
|
|
}
|
|
if cfg.Engines.Brave.APIKey != "" {
|
|
os.Setenv("BRAVE_API_KEY", cfg.Engines.Brave.APIKey)
|
|
}
|
|
if cfg.Engines.Brave.AccessToken != "" {
|
|
os.Setenv("BRAVE_ACCESS_TOKEN", cfg.Engines.Brave.AccessToken)
|
|
}
|
|
|
|
svc := search.NewService(search.ServiceConfig{
|
|
UpstreamURL: cfg.Upstream.URL,
|
|
HTTPTimeout: cfg.HTTPTimeout(),
|
|
Cache: searchCache,
|
|
})
|
|
|
|
h := httpapi.NewHandler(svc)
|
|
|
|
mux := http.NewServeMux()
|
|
mux.HandleFunc("/", h.Index)
|
|
mux.HandleFunc("/healthz", h.Healthz)
|
|
mux.HandleFunc("/search", h.Search)
|
|
mux.HandleFunc("/opensearch.xml", h.OpenSearch(cfg.Server.BaseURL))
|
|
|
|
// Serve embedded static files (CSS, JS, images).
|
|
staticFS, err := views.StaticFS()
|
|
if err != nil {
|
|
log.Fatalf("failed to load static files: %v", err)
|
|
}
|
|
var subFS fs.FS = staticFS
|
|
mux.Handle("/static/", http.StripPrefix("/static/", http.FileServer(http.FS(subFS))))
|
|
|
|
// Apply middleware: global rate limit → burst rate limit → per-IP rate limit → CORS → handler.
|
|
var handler http.Handler = mux
|
|
handler = middleware.CORS(middleware.CORSConfig{
|
|
AllowedOrigins: cfg.CORS.AllowedOrigins,
|
|
AllowedMethods: cfg.CORS.AllowedMethods,
|
|
AllowedHeaders: cfg.CORS.AllowedHeaders,
|
|
ExposedHeaders: cfg.CORS.ExposedHeaders,
|
|
MaxAge: cfg.CORS.MaxAge,
|
|
})(handler)
|
|
handler = middleware.RateLimit(middleware.RateLimitConfig{
|
|
Requests: cfg.RateLimit.Requests,
|
|
Window: cfg.RateLimitWindow(),
|
|
CleanupInterval: cfg.RateLimitCleanupInterval(),
|
|
}, logger)(handler)
|
|
handler = middleware.GlobalRateLimit(middleware.GlobalRateLimitConfig{
|
|
Requests: cfg.GlobalRateLimit.Requests,
|
|
Window: cfg.GlobalRateLimitWindow(),
|
|
}, logger)(handler)
|
|
handler = middleware.BurstRateLimit(middleware.BurstRateLimitConfig{
|
|
Burst: cfg.BurstRateLimit.Burst,
|
|
BurstWindow: cfg.BurstWindow(),
|
|
Sustained: cfg.BurstRateLimit.Sustained,
|
|
SustainedWindow: cfg.SustainedWindow(),
|
|
}, logger)(handler)
|
|
|
|
addr := fmt.Sprintf(":%d", cfg.Server.Port)
|
|
logger.Info("searxng-go starting",
|
|
"addr", addr,
|
|
"cache", searchCache.Enabled(),
|
|
"rate_limit", cfg.RateLimit.Requests > 0,
|
|
)
|
|
log.Fatal(http.ListenAndServe(addr, handler))
|
|
}
|