universe/k8s/bootnode/ingress.yaml at main

Files

T

zeekayandGitHub a08884114e fix(ingress): rate-limit on lux/zoo exchange grey-cloud hostnames (#9 )

The bootno.de TLS+rate-limit cutover (hanzo/universe#87) intentionally
skipped exchange hostnames since they live on lux-k8s + bootnode-k8s, not
hanzo-k8s. Those hosts are now also off Cloudflare's grey-cloud WAF, so
they need the same in-cluster floor. This wires it in:

api.lux.exchange (+ api.lux.network, api.zoo.network) — bootnode-k8s,
ingress-nginx (class `nginx`). Codifies the live `web3-platform-api-apex`
Ingress (previously kubectl-applied only) into k8s/bootnode/ingress.yaml
with the canonical nginx.ingress.kubernetes.io/limit-rps=50, limit-rpm=1000,
limit-burst-multiplier=2 (effective burst=100), limit-connections=20.

lux.exchange / www.lux.exchange / trade.lux.exchange / exchange.lux.network
— lux-k8s lux-ns, hanzoai/ingress (Traefik). Adds Middleware
`lux-exchange-rate-limit` (100 rps / 200 burst — SPA is loose because no
body POSTs hit it) and binds it to a new Ingress manifest at
k8s/lux-ns/lux-exchange.yaml.

zoo.exchange + 3 white-label hosts — lux-k8s zoo, same SPA pattern.
Middleware `zoo-exchange-rate-limit` bound via traefik.ingress
.kubernetes.io/router.middlewares.

api.zoo.exchange — lux-k8s lux-mainnet. KrakenD-backed (same engine that
drives api.lux.network). 50 rps / 100 burst to match the upstream apex.
Drive-by fix: `api-gateway-gateway` service port was paste-typo'd at 8080
in this file; live state was 80 and Traefik was logging "service port not
found" for it (which is why the original audit reported the 404). Pinned
to 80 to match the cluster.

Verification (in-cluster, bootnode-k8s ingress-nginx):
1020 reqs at ~113 rps sustained → 554x404 (passed through to upstream)
                                  466x429 (rate-limited at limit-rps=50)
Cluster-wide ingress-nginx-controller cm patched to return 429 instead
of the 503 default (limit-req-status-code, limit-conn-status-code).

2026-05-30 00:15:42 -07:00

191 lines

4.9 KiB

YAML

Raw Permalink Blame History

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

 ###############################################################################
 # web3-platform-api-apex — apex API host for Cloud (Bootnode) on bootnode-k8s.
 #
 # Hosts api.lux.network, api.zoo.network, api.lux.exchange — all back the same
 # web3-platform-api Service. Rate limit replaces the Cloudflare grey-cloud WAF
 # that previously absorbed bursty calls (50 rps sustained, 100 burst).
 #
 # Controller: ingress-nginx (class `nginx`). Annotations are the canonical
 # kubernetes/ingress-nginx limit-rps / limit-rpm / limit-burst-multiplier
 # (multiplier × rps = effective burst).
 ###############################################################################
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: web3-platform-api-apex
   namespace: bootnode
   labels:
     app.kubernetes.io/component: cloud-api-ingress-apex
     app.kubernetes.io/name: web3-platform-api
     app.kubernetes.io/part-of: web3-platform
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
     # Rate limit: 50 rps sustained, burst = 50 × 2 = 100, ~1000 rpm.
     nginx.ingress.kubernetes.io/limit-rps: "50"
     nginx.ingress.kubernetes.io/limit-rpm: "1000"
     nginx.ingress.kubernetes.io/limit-burst-multiplier: "2"
     # Connection cap per client IP (defence-in-depth against slowloris).
     nginx.ingress.kubernetes.io/limit-connections: "20"
 spec:
   ingressClassName: nginx
   tls:
     - hosts:
         - api.lux.network
         - api.zoo.network
         - api.lux.exchange
       secretName: web3-platform-api-apex-tls
   rules:
     - host: api.lux.network
       http:
         paths:
           - path: /
             pathType: Prefix
             backend:
               service:
                 name: web3-platform-api
                 port:
                   number: 8000
     - host: api.zoo.network
       http:
         paths:
           - path: /
             pathType: Prefix
             backend:
               service:
                 name: web3-platform-api
                 port:
                   number: 8000
     - host: api.lux.exchange
       http:
         paths:
           - path: /
             pathType: Prefix
             backend:
               service:
                 name: web3-platform-api
                 port:
                   number: 8000
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: lux-cloud-ingress
   namespace: bootnode
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
 spec:
   ingressClassName: ingress
   tls:
     - hosts:
         - cloud.lux.network
         - api.cloud.lux.network
       secretName: lux-cloud-tls
   rules:
     - host: cloud.lux.network
       http:
         paths:
           - path: /
             pathType: Prefix
             backend:
               service:
                 name: lux-cloud-web
                 port:
                   number: 3001
     - host: api.cloud.lux.network
       http:
         paths:
           - path: /
             pathType: Prefix
             backend:
               service:
                 name: bootnode-api
                 port:
                   number: 80
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: lux-cloud-ws-ingress
   namespace: bootnode
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
 spec:
   ingressClassName: ingress
   tls:
     - hosts:
         - ws.cloud.lux.network
       secretName: lux-cloud-ws-tls
   rules:
     - host: ws.cloud.lux.network
       http:
         paths:
           - path: /
             pathType: Prefix
             backend:
               service:
                 name: bootnode-api
                 port:
                   number: 80
 ---
 # Pars Cloud
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: pars-cloud-ingress
   namespace: bootnode
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
 spec:
   ingressClassName: ingress
   tls:
     - hosts:
         - cloud.pars.network
         - api.cloud.pars.network
       secretName: pars-cloud-tls
   rules:
     - host: cloud.pars.network
       http:
         paths:
           - path: /
             pathType: Prefix
             backend:
               service:
                 name: pars-cloud-web
                 port:
                   number: 3001
     - host: api.cloud.pars.network
       http:
         paths:
           - path: /
             pathType: Prefix
             backend:
               service:
                 name: bootnode-api
                 port:
                   number: 80
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: pars-cloud-ws-ingress
   namespace: bootnode
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
 spec:
   ingressClassName: ingress
   tls:
     - hosts:
         - ws.cloud.pars.network
       secretName: pars-cloud-ws-tls
   rules:
     - host: ws.cloud.pars.network
       http:
         paths:
           - path: /
             pathType: Prefix
             backend:
               service:
                 name: bootnode-api
                 port:
                   number: 80

191 lines 4.9 KiB YAML Raw Permalink Blame History Unescape Escape

191 lines

4.9 KiB

YAML

Raw Permalink Blame History