amadan
geoip-for-apps
Human
#241: platform GeoIP for apps.
- Headers. Every edge mirrors a bucket-published .mmdb and hot-swaps it. The ingress edge sets X-Carlos-Geo-Country/Subdivision/Lat/Lon/Source on every proxied request. Hops and tunnels carry its answer in X-Carlos-Hop-Geo. Forged headers in any spelling are always stripped.
- Analytics count pageviews by country with per-source attribution.
- Console. It publishes through
carlos system geoip publish|status|off. An optional feed auto-updates from DB-IP Lite or GeoLite2. Untrusted databases are parsed only in a killable, memory-capped child. - Alerts. A geoip box rule fires when a database is stale, expiring, expired or not loaded, or when the feed is failing.
- Lookups.
GET /api/cli/apps/{a}/{app}/geoandcarlos geoanswer for arbitrary addresses.
Status: spec rev 12 accepted (Astra, 12 rounds). Plans 1-3 are built; Astra code review is at 13 rounds, with no new findings in the last. Waiting on Paul's copy review and D1/D2 sign-off, then merge. Not rolled. The tofu lifecycle rule must be applied before any GeoLite2 publish.
Commits
61
Discussions
1
1 open
Tasks
28/31
done
Discussions 1 open
Tasks 28/31 done
- Spec rev 1 written and committed Done
- Astra spec review: ACCEPTED at rev 12 (round 12) Done
- Paul approves the spec Not started
- Plan 1: headers, mirror, publish, analytics countries Done
- Plan 2: auto-updating feed Done
Activity
- claude agent, operated by paul@keymail.dev replied to A carlos system verb to retire a box (delete its edges record)
- claude agent, operated by paul@keymail.dev pushed ddecce3dc Merge origin/main into geoip-for-apps (console release defences alongside the geoip heartbeat block)
- claude agent, operated by paul@keymail.dev pushed c309c1f40 Merge origin/main into geoip-for-apps (forward-proof and system layout alongside geoip)
- claude agent, operated by paul@keymail.dev pushed 6beb714e5 docs: keeping the geoip database current; free DB-IP default, paid MaxMind upgrade (copy approved by Paul)
- claude agent, operated by paul@keymail.dev pushed a9d974640 geoip: paid MaxMind feeds (geoip2-city, geoip2-country); spec rev 13 records Paul's rulings R7-R9 (D1, D2 accepted; free DB-IP by default, paid MaxMind by choice)
- task updated: P1-T13 analytics page + docs (copy approved by Paul 2026-10-07, no edits)
- task updated: Paul: D1/D2 sign-off, then merge (-squash) — copy approved
- task updated: Astra plan-1 review (answered; plans 2-3 covered by code review)
- task updated: Astra whole-branch code review (13 rounds; last: no new findings)
- claude agent, operated by paul@keymail.dev added task Paul: D1/D2 sign-off, then merge (-squash) — copy approved
- claude agent, operated by paul@keymail.dev added task Roll: apply lifecycle tofu, roll boxes, status ready, publish, docs
- claude agent, operated by paul@keymail.dev pushed b0b97e977 geoip: the strip treats underscores as hyphens, so X_Carlos_Geo_* aliases (one key to WSGI/CGI) never reach an app; tests allow only the five exact names through (Astra code review R12 P1)
- claude agent, operated by paul@keymail.dev pushed d16d43c6c geoip: the verifier child decodes every record through the lookup schema, so a record that would overflow a serving lookup's stack is refused (Astra code review R11 P1)
- claude agent, operated by paul@keymail.dev pushed 98c0139bd geoip: the verifier child runs under a 512 MiB private-memory cap; retained recovery generations are cleaned when a later sync lands and destroyed at their GeoLite2 expiry (Astra code review R10)
- claude agent, operated by paul@keymail.dev pushed 004286067 geoip: untrusted databases are parsed only in a killable verifier child (feed, uploads and the CONSOLE_GEOIP_DB override); fixtures that hang or panic the parser (Astra code review R9 P1s)
- claude agent, operated by paul@keymail.dev pushed 171e7cc45 geo testdata: note the pathological fixture in the existing README
- claude agent, operated by paul@keymail.dev pushed ad70f8412 geo: bounded, cancellable verification refuses search trees with far more networks than nodes (Astra code review R8 P1)
- claude agent, operated by paul@keymail.dev pushed 29455f246 console feed: editions must be real HTTP dates; pointer size capped at write; unchanged editions record success (Astra code review R7)
- claude agent, operated by paul@keymail.dev pushed aaa1434e1 console: retry clearing a disabled feed's status until it lands (Astra code review R6)
- claude agent, operated by paul@keymail.dev pushed c24b64d29 geoip: alert mail tracks the last reason told per recipient; a confirmed reason is reported even when the feed is unreadable (Astra code review R5)
- claude agent, operated by paul@keymail.dev pushed 9cd8e78fa geoip: bounded bucket calls at startup, staging and off; alert reading unknown until state is read; alert mail on a geoip reason change; region guess credits the answering database (Astra code review R4)
- task updated: Astra spec review: ACCEPTED at rev 12 (round 12)
- claude agent, operated by paul@keymail.dev pushed 64be2b1d5 geoip spec: Astra round 12 accepts rev 12
- claude agent, operated by paul@keymail.dev pushed 034727d46 console: pin the /geo door as deliberate new instance-role access
- claude agent, operated by paul@keymail.dev pushed e62e4fca0 geoip: install errors never delete retained generations; the console follower expires the loaded reader whatever current says; an unreadable feed history is never overwritten (Astra code review R3)
- claude agent, operated by paul@keymail.dev pushed a10120dee geoip: keep every unsynced generation; feed status capped and written under its own deadline; feed-state blips keep the alert; pointer state tracked even with an unusable directory; geoip reason escalates while firing (Astra code review R2)
- task updated: Plan 1: headers, mirror, publish, analytics countries
- task updated: Plan 3: lookup endpoint and carlos geo
- task updated: Plan 2: auto-updating feed
- task updated: P3: console follower, /geo endpoint, carlos geo