Nail/SQS-service
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
56 Commits 6 Branches 0 Tags
6af635afeeacff9b06ca7b9a0761a2fd8ea2ff6c
Commit Graph
20 Commits
Author SHA1 Message Date
Naeel 11d03d6b10 feat: Helm chart для shared-sqs deployment + thinking logs 2026-04-13 18:50:28 +03:00
Naeel 2a31de8562 helm: hardcode replicas=1 (in-memory state, multi-replica not supported) 2026-04-13 06:49:06 +03:00
Naeel 1221d3303f helm: fix ingress port hardcode, remove imagePullSecrets block 2026-04-13 06:48:01 +03:00
Naeel 9272be5a20 helm: hardcode probes and strategy, remove from values.yaml 2026-04-13 06:46:25 +03:00
Naeel c86f865be7 helm: hardcode port 4100, remove service block from values.yaml 2026-04-13 06:45:45 +03:00
Naeel 494a8a84d4 helm: remove nubesEndpoint — internal Nubes integration, not for external users 2026-04-13 06:44:36 +03:00
Naeel 029eabe7d9 helm: remove internal nubesEndpoint, leave empty for external users 2026-04-13 06:42:53 +03:00
Naeel 8f76570512 helm: remove imagePullSecrets entirely 2026-04-13 06:41:02 +03:00
Naeel 15762b1eef helm: remove internal imagePullSecret, image is public on Docker Hub 2026-04-13 06:40:09 +03:00
Naeel 5707f279dc helm: rewrite values.yaml comments for clarity 2026-04-13 06:38:47 +03:00
Naeel d3a88adb5b helm: fill real values for our deployment 2026-04-13 06:22:33 +03:00
Naeel bd950db732 helm: fix values.yaml — remove hardcoded secrets, add billing fields, tag v0.1.24; fix .gitignore shared-sqs pattern 2026-04-13 06:21:34 +03:00
Naeel 8fd0a59c41 fix: remove server-snippet from ingress (blocked by nginx controller), doc stress-test results 2026-04-12 14:09:34 +03:00
Naeel 436060a83f infra: add VMServiceScrape for Victoria Metrics scraping 
VMAgent will scrape /metrics from shared-sqs Service every 30s.
Selector: app=shared-sqs, port: http (4100).
 2026-04-12 12:05:33 +03:00
Naeel 1272388673 feat: billing — usage tracking per SQS operation in PostgreSQL 
- New package app/billing: Init/RecordUsage/Close with auto-migrate
- Integration in actionHandler: record tenant_id, operation, msg_count, msg_bytes
- Helm chart: billing section in values.yaml, secret-billing.yaml, env vars in deployment
- Optional: billing disabled by default (BILLING_PG_HOST not set = no-op)
- Table: sqs_usage_records with index on (tenant_id, recorded_at)
 2026-04-12 11:51:27 +03:00
Naeel d1af612b48 Deploy shared-sqs v0.1.22 2026-04-12 10:08:00 +03:00
Naeel 4a83575491 feat: persist messages separately and update ingress docs 2026-04-12 08:44:46 +03:00
Naeel e9a26f7975 v0.1.17: security hardening — 18/20 vulnerabilities fixed 
Phase 1 (Critical):
- #1 JWT auth (done in v0.1.16)
- #2 Batch message size validation in send_message_batch.go
- #10 RLock in GetQueueUrlV1 (data race fix)

Phase 2 (AWS-compatible limits):
- #3 QueueName validation: max 80 chars, [a-zA-Z0-9_-](.fifo)?
- #4 WaitTimeSeconds clamped to 0-20
- #5 ReceiveMessageWaitTimeSeconds clamped to 0-20
- #6 DelaySeconds clamped to 0-900
- #7 VisibilityTimeout clamped to 0-43200
- #8 MaxNumberOfMessages clamped to 1-10
- #9 Message attributes limited to 10 per message
- #15 BatchEntryId length validated (max 80)
- #16 DeduplicationID length validated (max 128)
- #17 GroupID length validated (max 128)

Phase 3 (Per-tenant resource limits):
- #11 Max messages per queue (120K standard, 20K FIFO)
- #12 Global tenant limit (1000)
- #3.5 HTTP request body size limit (1MB via MaxBytesReader)

Phase 4 (Stability):
- #14 Duplicates map cleanup (already in PeriodicTasks)
- #13 FIFO group lock timeout (already in visibility timeout reset)
- #18 Redis size guard: skip save if >50MB

Skipped (Low, no real risk):
- #19 {account} URL param (informational only, not used for access)
- #20 ReceiptHandle format (self-validating UUID#UUID)

New file: app/gosqs/validation.go — centralized AWS SQS limits and validators
 2026-04-10 18:58:40 +03:00
Naeel b9d434bcc5 v0.1.16: JWT auth via nubes API, auto-provisioning, UI login 
- app/auth/jwt.go: ParseJWTClaims, TenantIDFromSub (sless-compatible SHA256), PingNubesAPI
- app/admin/admin.go: POST /ui/api/auth endpoint, jwtMiddleware for /ui/api/*
- app/tenant/tenant_store.go: NubesSub/Email fields, GetBySub, CreateFromJWT
- app/ui/index.html: login page, email in navbar, JWT session in localStorage
- deployments/k8s/deployment.yaml: v0.1.16, NUBES_ENDPOINT env
- doc/decisions/resource-limits-plan.md: 20 vulnerabilities audit
- Fix: /ui/api/auth moved to subrouter (gorilla/mux PathPrefix conflict)
 2026-04-10 18:35:19 +03:00
Naeel c3ba2dcae4 chore: initial import from sless/shared-sqs (v0.1.14) 
- Standalone SQS-service repository
- Multi-tenant message queue service, AWS SQS compatible
- Based on GoAws, with mutable tenants, auth, WebUI, Redis persistence
- Ready for independent development and deployment
- See doc/ and README.md for architecture and usage
 2026-04-10 16:47:27 +03:00