The Vultr firewall now only opens 443 (and SSH); the host decides who may
use it. Docker-published ports bypass UFW's INPUT rules, so the new
firewall role routes Docker traffic through UFW's route rules via the
DOCKER-USER chain and allows Cloudflare's IPv4 ranges on 443 with
`ufw route allow`. ufw-cloudflare-sync keeps those rules in step with
https://www.cloudflare.com/ips-v4 daily via a systemd timer, refusing
to touch the rules if the list looks wrong.
The role runs on every deploy, before HAProxy starts, and fails the
deploy if the filtering is not in place, since HAProxy trusts
CF-Connecting-IP from anything that reaches it. The plain UFW allows
for 80/443 are dropped from the base role as they never applied to
Docker-published ports.
Rotating the deploy SSH key now rebuilds the instance, because Vultr
only installs SSH keys at creation.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Cache the serialized /json fields per MMDB record. Every field except
`ip` depends only on the record, and many IPs share one record, so the
response is now the cached fields with the address prepended. The cache
is keyed by data-section offset, capped at 16 MiB, and owned by the
loaded database so a hot-swapped DB never serves stale entries. A hit
costs ~0.27us instead of ~2.5us for decode + serialize; a miss is no
slower than before thanks to a pre-sized serialization buffer.
Trim per-request framework overhead shared by all endpoints:
- Dispatch by Host with a plain HostRouter service instead of an outer
Router wrapping a service_fn, skipping a second route match and box.
- Apply security headers via tower's MapResponseLayer instead of
middleware::from_fn, and reserve header capacity up front.
- Add a RequestedIp extractor that reads headers in place instead of
cloning the whole HeaderMap.
On a 1 CPU / 1 GB Alpine (musl) container, /json throughput rose from
76.5k to 123.5k rps for a single IP (+61%) and from 84.9k to 130.5k rps
across 20k random IPs (+54%); p50 latency fell from 0.85ms to 0.52ms.
Responses are byte-identical to before.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The daily scheduled update at 01:20 UTC was systematically lagging the
upstream mergedipdb release by 24h. The upstream cron nominally fires
at 01:00 UTC but GitHub Actions schedule latency shifts the actual
publish time anywhere from ~01:05 to ~06:00+ UTC, so any fixed
single-daily time misses the current release on delayed days.
Introduce DB_UPDATE_INTERVAL_HOURS (default 6, must divide 24 evenly),
shift the anchor DB_UPDATE_TIME_UTC default to 00:20, and replace
secs_until_next with secs_until_next_tick that schedules at anchor +
N*interval. Also set RUST_LOG=rustyip=info,warn in the Ansible env
template so the scheduler and "database updated successfully (N bytes)"
info logs are actually visible in docker logs.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The /proxy, /hosting, /tor, /vpn endpoints and the /json response embed
live MMDB classifications for 45.77.77.77 that flip as the Merged-IP
dataset is updated. Replace hard-coded expected values with shape checks
(boolean / "true"|"false") so the tests verify endpoint plumbing without
coupling to transient upstream data.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The assertion that 45.77.77.77 is a Tor exit node depended on live MMDB
classifications that change as the Merged-IP dataset updates. The test
name promised "returns data for a known IP" — the remaining lookup_proxy
coverage already exercises the lookup path without pinning to transient
classifications.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Wipe the target color's database volume before starting the container so
each push re-downloads the latest Merged-IP.mmdb. Gate /health on DB
readiness (503 until loaded) so HAProxy blue-green only flips traffic
once the new backend has a usable DB, and raise the Ansible health-wait
window from 120s to 360s to cover the download.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Switch from High Frequency 2vCPU/2GB ($18/mo) to Regular Performance
1vCPU/1GB ($5/mo). Tighten HAProxy rate limits from 100/50/30 RPM to
60/30/15 RPM with lower global RPS thresholds (200/300 instead of
300/500). Reduce maxconn, socket buffers, file descriptor limits, and
Docker resource settings to fit within 1GB RAM constraints. Update all
user-facing content and translations across 14 locales.
Replace the cdnjs CDN dependency with locally hosted font files and a
minimal CSS file containing only the 4 icons used (check, minus,
magnifier, social-github). Remove the CDN preconnect links.
Also reduce the gap between the IP display and the info table divider,
fix vertical alignment of icon and text rows by switching to
vertical-align: middle, and override the icon line-height to match
table text.
When the primary IP lacks city data, the conditional <tr data-label="city">
row is absent from the DOM, so readLabels() cannot scrape the translated
label. Embed translated labels as data-l-* attributes on the <table> element
so they are always available regardless of which rows are rendered.
- Remove disruptive alert() on error pages, rely on role="alert" banner
- Add skip navigation link for keyboard users (WCAG 2.4.1)
- Fix heading hierarchy on error page (sr-only status text in h1)
- Add "opens in a new tab" screen reader hint on external links
- Wrap language selector in form with noscript submit button (WCAG 3.2.2)
- Add aria-label to copy-to-clipboard buttons and footer landmarks
- Use h2 for alt-IP section to maintain single h1 per page
- Add persistent underline on links for non-color identification (WCAG 1.4.1)
- Fix footer attribution contrast ratio to ~5.5:1 (WCAG 1.4.3)
- Add aria-busy/role=status loading announcements for skeleton state
- Add translations for new accessibility strings across all 14 locales
- Update integration tests to assert role="alert" instead of alert()
Rewrite script.js from ES5 (IIFEs, var, .then() chains) to modern ES2022+:
const/let, arrow functions, template literals, async/await, optional
chaining, for...of, .includes(), AbortSignal.timeout(), and DOM APIs
for dynamic HTML construction. Fix unhandled clipboard rejection, abort
timeout leak, and global scope pollution. Update script tag to
type="module" and fix CSS: top -> inset-block-start, flex-start -> start,
and indentation in media query block.
Replace all {{ t_field_name }} template variables with {{ "msgid"|t(locale) }}
filter calls across all 6 template files. This works with the #[askama::filter_fn]
defined in handlers/html.rs, which calls i18n::translate() directly.
Templates updated: index.html, error_alert.html, error_page.html,
_footer.html, _footer_lang.html, _search_form.html
Split the 865-line models.rs into 3 focused files:
- models/mod.rs: conversion logic, helpers, re-exports, tests
- models/mmdb.rs: MMDB deserialization types (internal, pub(crate))
- models/api.rs: API serialization types (public) with From<MmdbProxy> impl
Mmdb types are now pub(crate) since they are internal deserialization details
that should not be part of the public API surface.
Replace DB_UPDATE_INTERVAL_HOURS with DB_UPDATE_TIME_UTC (HH:MM format,
default 01:20) so the database update runs at a predictable time each day.
This ensures the update happens 20 minutes after the upstream Merged IP
Data release at 01:00 UTC.
The JS used fragile numeric indices to look up localized labels from the
server-rendered table. When optional rows (ASN, Org, Country, City) were
missing for the primary IP, the indices shifted, causing 'Proxy' to appear
as the City label. Add data-label attributes to each <tr> in the template
and key the label map by name instead of position.
Show a shimmer skeleton placeholder while fetching the local IPv4
address via the IPv4-only domain. When the primary IP is already IPv4,
no loading state is displayed and the alt section fades in directly.
The detectAltIp() function was unconditionally fetching the viewer's own
IPv6/IPv4 address and displaying it alongside queried IP results. Pass
the is_query flag to the client via a data attribute and guard the
alt-IP detection so it only runs when viewing your own IP.
Docker file-level bind mounts track inodes, not paths. Ansible template
writes create new inodes, leaving the container reading orphaned files.
Replacing SIGHUP with force-recreate ensures fresh mounts every time,
eliminating the admin socket dependency entirely.
NetworkCatsandClaude Opus 5.5
NetworkCats