From 6151dd2000a86c34eef3f8f4c3dabc309e31cad4 Mon Sep 17 00:00:00 2001 From: "@permadeath.com" Date: Sun, 27 Sep 2026 10:20:35 -0400 Subject: [PATCH] fix(infra): trust only the didbot host, and hold every other crawl to a few The relay takes every account from relay_trusted_domains, ten from any other host, and ten new hosts a day. All three are infra variables. Co-Authored-By: Claude Opus 5.5 (1M context) Change-Id: I07842639b9aac7c3e9b6b071c752327524b14d40 --- infra/README.md | 5 ++++- infra/files/compose.yml | 11 ++++++----- infra/release.tf | 9 ++++++--- infra/variables.tf | 33 +++++++++++++++++++++++++++++++++ plan/relay.md | 9 +++++---- 5 files changed, 54 insertions(+), 13 deletions(-) diff --git a/infra/README.md b/infra/README.md index f97df26d..afada543 100644 --- a/infra/README.md +++ b/infra/README.md @@ -263,7 +263,10 @@ curl -X POST https://relay.vibescrobble.com/xrpc/com.atproto.sync.requestCrawl \ -H 'content-type: application/json' -d '{"hostname":"pds.example"}' ``` -Whether that stays open to anyone is a policy decision nobody has made yet. +Anyone can ask. A host in `relay_trusted_domains` gives the relay all of its +accounts. Any other host gives at most `relay_default_account_limit`, and the +relay adds at most `relay_new_hosts_per_day` new hosts a day. Raise one host's +limit through the admin API. ## Tearing it down diff --git a/infra/files/compose.yml b/infra/files/compose.yml index 152faa55..16e8e48b 100644 --- a/infra/files/compose.yml +++ b/infra/files/compose.yml @@ -52,11 +52,12 @@ services: command: - serve - --bind=:2470 - # A hundred accounts per host is the stock limit and far too low for a - # server whose accounts are agents. `trusted-domains` is the documented - # way past it and takes a wildcard suffix, so one entry covers every - # zone under a domain. - - --default-account-limit=100000 + # Trusted hosts have no practical account limit. Any other host that + # asks for a crawl gets a few accounts, and only a few new hosts are + # taken per day. The values are infra/variables.tf's relay_* settings. + - --trusted-domains=${RELAY_TRUSTED_DOMAINS} + - --default-account-limit=${RELAY_DEFAULT_ACCOUNT_LIMIT} + - --new-hosts-per-day-limit=${RELAY_NEW_HOSTS_PER_DAY} # Lenient while didbot's commit proofs are still short of what Sync 1.1 # wants: strict mode drops those commits rather than logging them. # See plan/relay.md. diff --git a/infra/release.tf b/infra/release.tf index 9b2171d4..f062170f 100644 --- a/infra/release.tf +++ b/infra/release.tf @@ -7,9 +7,9 @@ # is the record of which one is live. `scripts/deploy.sh` is the apply with # the build and the wait around it. # -# The two upstream refs ride along for the same reason: the compose file -# names the relay and Jetstream images by them, and a change to either is a -# deploy rather than an instance replacement. +# The two upstream refs and the relay's crawl limits ride along for the same +# reason: the compose file reads them, and a change to any is a deploy rather +# than an instance replacement. resource "aws_ssm_parameter" "release" { name = "/${local.name}/release" description = "The release vibescrobble.com runs. Written by an apply; read by the instance every thirty seconds." @@ -18,5 +18,8 @@ resource "aws_ssm_parameter" "release" { "VERSION=${var.release_sha}", "INDIGO_REF=${var.indigo_ref}", "JETSTREAM_REF=${var.jetstream_ref}", + "RELAY_TRUSTED_DOMAINS=${join(",", var.relay_trusted_domains)}", + "RELAY_DEFAULT_ACCOUNT_LIMIT=${var.relay_default_account_limit}", + "RELAY_NEW_HOSTS_PER_DAY=${var.relay_new_hosts_per_day}", ]) } diff --git a/infra/variables.tf b/infra/variables.tf index de76580a..53c1ef06 100644 --- a/infra/variables.tf +++ b/infra/variables.tf @@ -65,3 +65,36 @@ variable "jetstream_ref" { type = string default = "v0.2.2" } + +variable "relay_trusted_domains" { + description = "Hosts the relay takes every account from. A leading `*` matches any suffix, so `*.example.com` covers every host under it. The didbot server whose agents the site draws belongs here." + type = list(string) + default = ["pds.did.bot"] + + validation { + condition = length(var.relay_trusted_domains) > 0 && alltrue([for d in var.relay_trusted_domains : can(regex("^(\\*\\.)?[a-z0-9.-]+$", d))]) + error_message = "relay_trusted_domains is one or more hostnames, each optionally starting with `*.`." + } +} + +variable "relay_default_account_limit" { + description = "How many accounts the relay takes from a host that is not in relay_trusted_domains. Anyone can ask the relay to crawl a host, so this is what a crawl of a large server costs. 0 to 1000; the relay's own default is 100." + type = number + default = 10 + + validation { + condition = var.relay_default_account_limit >= 0 && var.relay_default_account_limit <= 1000 + error_message = "relay_default_account_limit is 0 to 1000." + } +} + +variable "relay_new_hosts_per_day" { + description = "How many new hosts a public requestCrawl may add per day. 1 to 50; the relay's own default is 50." + type = number + default = 10 + + validation { + condition = var.relay_new_hosts_per_day >= 1 && var.relay_new_hosts_per_day <= 50 + error_message = "relay_new_hosts_per_day is 1 to 50." + } +} diff --git a/plan/relay.md b/plan/relay.md index bb6a0e61..2b9109e0 100644 --- a/plan/relay.md +++ b/plan/relay.md @@ -40,10 +40,6 @@ software has been tuned for, which is what the first two items are about. every script here assumes cannot be crawled at all. What replaces `--pds http://localhost:3000` for local work is an open question, and `spike/stack/` is one answer rather than the answer. -- [ ] **Raise the account limit deliberately.** A hundred per host is the - default and `--trusted-domains` is the documented way past it. Which - domains a deployment trusts, and what happens to a host that is not on - that list, is a policy nobody has written. - [ ] **An agent that ends before the relay resolves it loses everything.** The relay resolves a DID on first sight; didbot 404s a deleted account's document; the relay then drops every event it holds for that account, @@ -75,6 +71,11 @@ software has been tuned for, which is what the first two items are about. ## Done +- [x] **Raise the account limit deliberately.** `relay_trusted_domains` in + `infra/variables.tf` lists the hosts the relay takes every account from. + Any other host is held to `relay_default_account_limit`, and + `relay_new_hosts_per_day` caps how many new hosts a crawl request adds. + - [x] **Answered the question this epic opened with: `did:web` is fine.** The relay resolves it, `DIDWebLimitFunc` is nil so nothing restricts the method, and `.test` is explicitly allowed for development. What it -- knotmirror 0.0.1