amadan

carlos / platform Public

Platform GeoIP for apps (#241): bucket-mirrored database with hot swap on every edge; X-Carlos-Geo-* headers set by the ingress edge and carried across hops and tunnels; analytics countries with attribution; carlos system geoip publish/status/off; auto-update feed (DB-IP Lite default, GeoLite2 or paid MaxMind GeoIP2); geoip box alert; console follower, GET /api/cli/apps/{a}/{app}/geo and carlos geo; untrusted .mmdb verified only in a killable, memory-capped child. Spec rev 13 (Astra-accepted), 13 Astra code-review rounds.

Squashed from geoip-for-apps into main.
claude 6bdaba34512cb7eaaa3276d7f96a56f43d41426e parent 40b6f50
104 files changed, +15276 −58
  • README.md +4 −0
  • analytics_cmd.go +3 −0
  • apimode.go +2 −0
  • cmd/console/main.go +123 −3
  • cmd/console/main_test.go +6 −0
  • cmd/console/region_test.go +51 −0
  • docs/site/cli.md +101 −0
  • docs/superpowers/plans/2026-10-06-platform-geoip-FACTS.md +60 −0
  • docs/superpowers/plans/2026-10-06-platform-geoip-plan1.md +4210 −0
  • docs/superpowers/plans/2026-10-07-platform-geoip-plan2.md +242 −0
  • docs/superpowers/plans/CODEX-FINDINGS-GEOIP-PLAN1-R1.md +45 −0
  • docs/superpowers/plans/CODEX-REVIEW-BRIEF-GEOIP-CODE1.md +47 −0
  • docs/superpowers/plans/CODEX-REVIEW-BRIEF-GEOIP-PLAN1.md +39 −0
  • docs/superpowers/specs/2026-10-06-platform-geoip-design.md +1482 −0
  • docs/superpowers/specs/CODEX-FINDINGS-GEOIP-R1.md +45 −0
  • docs/superpowers/specs/CODEX-FINDINGS-GEOIP-R10.md +30 −0
  • docs/superpowers/specs/CODEX-FINDINGS-GEOIP-R11.md +31 −0
  • docs/superpowers/specs/CODEX-FINDINGS-GEOIP-R12.md +28 −0
  • docs/superpowers/specs/CODEX-FINDINGS-GEOIP-R2.md +46 −0
  • docs/superpowers/specs/CODEX-FINDINGS-GEOIP-R3.md +43 −0
  • docs/superpowers/specs/CODEX-FINDINGS-GEOIP-R4.md +24 −0
  • docs/superpowers/specs/CODEX-FINDINGS-GEOIP-R5.md +20 −0
  • docs/superpowers/specs/CODEX-FINDINGS-GEOIP-R6.md +27 −0
  • docs/superpowers/specs/CODEX-FINDINGS-GEOIP-R7.md +41 −0
  • docs/superpowers/specs/CODEX-FINDINGS-GEOIP-R8.md +37 −0
  • docs/superpowers/specs/CODEX-FINDINGS-GEOIP-R9.md +34 −0
  • docs/superpowers/specs/CODEX-REVIEW-BRIEF-GEOIP.md +75 −0
  • geo_cmd.go +100 −0
  • geo_cmd_test.go +35 −0
  • infra/modules/deployment-buckets/main.tf +24 −0
  • internal/analytics/countries_test.go +99 −0
  • internal/analytics/day.go +63 −4
  • internal/analytics/meter.go +9 −1
  • internal/analytics/read.go +6 −0
  • internal/console/alertwatch.go +55 −4
  • internal/console/alertwatch_test.go +33 −0
  • internal/console/analyticsview.go +44 −0
  • internal/console/apianalytics.go +43 −1
  • internal/console/apianalytics_geo_test.go +26 −0
  • internal/console/apianalytics_test.go +43 −0
  • internal/console/apigeo.go +62 −0
  • internal/console/apigeo_test.go +58 −0
  • internal/console/apisystemgeoip.go +389 −0
  • internal/console/apisystemgeoip_test.go +384 −0
  • internal/console/apisystemupdate.go +43 −2
  • internal/console/authcli.go +8 −0
  • internal/console/geoipfeed.go +399 −0
  • internal/console/geoipfeed_test.go +407 −0
  • internal/console/geoipfollower.go +108 −0
  • internal/console/geoipfollower_test.go +147 −0
  • internal/console/geoippublish.go +421 −0
  • internal/console/geoippublish_test.go +597 −0
  • internal/console/geoipverify.go +148 −0
  • internal/console/geoipverify_linux.go +14 −0
  • internal/console/geoipverify_main_test.go +28 −0
  • internal/console/geoipverify_other.go +6 −0
  • internal/console/regionpicker.go +40 −4
  • internal/console/server.go +70 −2
  • internal/console/svcroutes_test.go +14 −2
  • internal/console/templates/app_analytics.html +3 −0
  • internal/console/templates/app_new.html +1 −1
  • internal/edge/analytics.go +9 −1
  • internal/edge/backhaul_e2e_test.go +10 −3
  • internal/edge/edge.go +57 −0
  • internal/edge/geoipheaders.go +59 −0
  • internal/edge/geoipheaders_test.go +427 −0
  • internal/edge/geoipmirror.go +682 −0
  • internal/edge/geoipmirror_test.go +595 −0
  • internal/edge/tunnel_geo_e2e_test.go +172 −0
  • internal/fleetapi/fleetapi.go +5 −0
  • internal/geo/mmdb.go +240 −25
  • internal/geo/mmdb_test.go +155 −0
  • internal/geo/pathological_test.go +97 −0
  • internal/geo/swappable.go +88 −0
  • internal/geo/swappable_test.go +108 −0
  • internal/geo/testdata/README +13 −1
  • internal/geo/testdata/pathological-bigmap.mmdb binary
  • internal/geo/testdata/pathological-dag.mmdb binary
  • internal/geo/testdata/pathological-empty-dag.mmdb binary
  • internal/geo/testdata/pathological-metadata.mmdb binary
  • internal/geoip/answer.go +190 −0
  • internal/geoip/answer_test.go +116 −0
  • internal/geoip/archive.go +71 −0
  • internal/geoip/archive_test.go +130 −0
  • internal/geoip/feed.go +83 −0
  • internal/geoip/pointer.go +140 −0
  • internal/geoip/pointer_test.go +71 −0
  • internal/host/agent.go +46 −0
  • internal/host/agent_geoip_test.go +21 −0
  • internal/host/alertsink.go +21 −0
  • internal/host/alertsink_geoip_test.go +26 −0
  • internal/host/metrics_loop.go +1 −0
  • internal/metrics/alert.go +23 −0
  • internal/metrics/alert_test.go +48 −0
  • internal/release/putfrom_test.go +72 −0
  • internal/release/store.go +143 −0
  • internal/status/snapshot.go +17 −2
  • internal/status/snapshot_test.go +17 −0
  • internal/tunnelclient/mark_test.go +20 −0
  • internal/tunnelclient/tunnelclient.go +27 −1
  • main.go +3 −0
  • system.go +12 −1
  • system_geoip.go +293 −0
  • system_geoip_test.go +145 −0

CI passed — run details

README.md

Loading diff…

analytics_cmd.go

Loading diff…

apimode.go

Loading diff…

cmd/console/main.go

Loading diff…

cmd/console/main_test.go

Loading diff…

cmd/console/region_test.go

Loading diff…

docs/site/cli.md

Loading diff…

docs/superpowers/plans/2026-10-06-platform-geoip-FACTS.md

Loading diff…

docs/superpowers/plans/2026-10-06-platform-geoip-plan1.md

Loading diff…

docs/superpowers/plans/2026-10-07-platform-geoip-plan2.md

Loading diff…

docs/superpowers/plans/CODEX-FINDINGS-GEOIP-PLAN1-R1.md

Loading diff…

docs/superpowers/plans/CODEX-REVIEW-BRIEF-GEOIP-CODE1.md

Loading diff…

docs/superpowers/plans/CODEX-REVIEW-BRIEF-GEOIP-PLAN1.md

Loading diff…

docs/superpowers/specs/2026-10-06-platform-geoip-design.md

Loading diff…

docs/superpowers/specs/CODEX-FINDINGS-GEOIP-R1.md

Loading diff…

docs/superpowers/specs/CODEX-FINDINGS-GEOIP-R10.md

Loading diff…

docs/superpowers/specs/CODEX-FINDINGS-GEOIP-R11.md

Loading diff…

docs/superpowers/specs/CODEX-FINDINGS-GEOIP-R12.md

Loading diff…

docs/superpowers/specs/CODEX-FINDINGS-GEOIP-R2.md

Loading diff…

docs/superpowers/specs/CODEX-FINDINGS-GEOIP-R3.md

Loading diff…

docs/superpowers/specs/CODEX-FINDINGS-GEOIP-R4.md

Loading diff…

docs/superpowers/specs/CODEX-FINDINGS-GEOIP-R5.md

Loading diff…

docs/superpowers/specs/CODEX-FINDINGS-GEOIP-R6.md

Loading diff…

docs/superpowers/specs/CODEX-FINDINGS-GEOIP-R7.md

Loading diff…

docs/superpowers/specs/CODEX-FINDINGS-GEOIP-R8.md

Loading diff…

docs/superpowers/specs/CODEX-FINDINGS-GEOIP-R9.md

Loading diff…

docs/superpowers/specs/CODEX-REVIEW-BRIEF-GEOIP.md

Loading diff…

geo_cmd.go

Loading diff…

geo_cmd_test.go

Loading diff…

infra/modules/deployment-buckets/main.tf

Loading diff…

internal/analytics/countries_test.go

Loading diff…

internal/analytics/day.go

Loading diff…

internal/analytics/meter.go

Loading diff…

internal/analytics/read.go

Loading diff…

internal/console/alertwatch.go

Loading diff…

internal/console/alertwatch_test.go

Loading diff…

internal/console/analyticsview.go

Loading diff…

internal/console/apianalytics.go

Loading diff…

internal/console/apianalytics_geo_test.go

Loading diff…

internal/console/apianalytics_test.go

Loading diff…

internal/console/apigeo.go

Loading diff…

internal/console/apigeo_test.go

Loading diff…

internal/console/apisystemgeoip.go

Loading diff…

internal/console/apisystemgeoip_test.go

Loading diff…

internal/console/apisystemupdate.go

Loading diff…

internal/console/authcli.go

Loading diff…

internal/console/geoipfeed.go

Loading diff…

internal/console/geoipfeed_test.go

Loading diff…

internal/console/geoipfollower.go

Loading diff…

internal/console/geoipfollower_test.go

Loading diff…

internal/console/geoippublish.go

Loading diff…

internal/console/geoippublish_test.go

Loading diff…

internal/console/geoipverify.go

Loading diff…

internal/console/geoipverify_linux.go

Loading diff…

internal/console/geoipverify_main_test.go

Loading diff…

internal/console/geoipverify_other.go

Loading diff…

internal/console/regionpicker.go

Loading diff…

internal/console/server.go

Loading diff…

internal/console/svcroutes_test.go

Loading diff…

internal/console/templates/app_analytics.html

Loading diff…

internal/console/templates/app_new.html

Loading diff…

internal/edge/analytics.go

Loading diff…

internal/edge/backhaul_e2e_test.go

Loading diff…

internal/edge/edge.go

Loading diff…

internal/edge/geoipheaders.go

Loading diff…

internal/edge/geoipheaders_test.go

Loading diff…

internal/edge/geoipmirror.go

Loading diff…

internal/edge/geoipmirror_test.go

Loading diff…

internal/edge/tunnel_geo_e2e_test.go

Loading diff…

internal/fleetapi/fleetapi.go

Loading diff…

internal/geo/mmdb.go

Loading diff…

internal/geo/mmdb_test.go

Loading diff…

internal/geo/pathological_test.go

Loading diff…

internal/geo/swappable.go

Loading diff…

internal/geo/swappable_test.go

Loading diff…

internal/geo/testdata/README

Loading diff…

internal/geo/testdata/pathological-bigmap.mmdb

Loading diff…

internal/geo/testdata/pathological-dag.mmdb

Loading diff…

internal/geo/testdata/pathological-empty-dag.mmdb

Loading diff…

internal/geo/testdata/pathological-metadata.mmdb

Loading diff…

internal/geoip/answer.go

Loading diff…

internal/geoip/answer_test.go

Loading diff…

internal/geoip/archive.go

Loading diff…

internal/geoip/archive_test.go

Loading diff…

internal/geoip/feed.go

Loading diff…

internal/geoip/pointer.go

Loading diff…

internal/geoip/pointer_test.go

Loading diff…

internal/host/agent.go

Loading diff…

internal/host/agent_geoip_test.go

Loading diff…

internal/host/alertsink.go

Loading diff…

internal/host/alertsink_geoip_test.go

Loading diff…

internal/host/metrics_loop.go

Loading diff…

internal/metrics/alert.go

Loading diff…

internal/metrics/alert_test.go

Loading diff…

internal/release/putfrom_test.go

Loading diff…

internal/release/store.go

Loading diff…

internal/status/snapshot.go

Loading diff…

internal/status/snapshot_test.go

Loading diff…

internal/tunnelclient/mark_test.go

Loading diff…

internal/tunnelclient/tunnelclient.go

Loading diff…

main.go

Loading diff…

system.go

Loading diff…

system_geoip.go

Loading diff…

system_geoip_test.go

Loading diff…