alot more changes

cmd/server/main.go

@@ -6,15 +6,18 @@ import (
 	"log"
 	"net"
 	"net/http"
+	"net/http/pprof"
 	"os"
 	"strings"
 
+	"git.tornberg.me/go-otel/internal/abuseipdb"
 	"git.tornberg.me/go-otel/internal/alerts"
 	"git.tornberg.me/go-otel/internal/auth"
 	"git.tornberg.me/go-otel/internal/blocker"
 	"git.tornberg.me/go-otel/internal/collector"
 	"git.tornberg.me/go-otel/internal/geoip"
 	"git.tornberg.me/go-otel/internal/honeypot"
+	"git.tornberg.me/go-otel/internal/investigation"
 	kube "git.tornberg.me/go-otel/internal/kubernetes"
 	"git.tornberg.me/go-otel/internal/prometheus"
 	"git.tornberg.me/go-otel/internal/sourcemaps"
@@ -213,6 +216,14 @@ func setupStore(ctx context.Context) storage.Store {
 }
 
 func main() {
+	// Keep profiling off the public UI/API listener. The dedicated listener is
+	// bound to loopback by default; set OTEL_PPROF_ADDR to expose it through a
+	// port-forward or to bind it elsewhere when diagnosing a deployment.
+	pprofAddr := os.Getenv("OTEL_PPROF_ADDR")
+	if pprofAddr == "" {
+		pprofAddr = "127.0.0.1:6060"
+	}
+	go startPprofServer(pprofAddr)
 
 	// Configure history size (default 100, can be made configurable)
 	historySize := 100
@@ -240,6 +251,9 @@ func main() {
 	if sq, ok := store.(storage.StatsQuerier); ok {
 		coll.SetStatsQuerier(sq)
 	}
+	if sq, ok := store.(storage.SourceIPQuerier); ok {
+		coll.SetSourceIPQuerier(sq)
+	}
 	wsServer := websocket.New(coll)
 	honeypotTracker := honeypot.New(honeypot.ConfigFromEnv())
 	coll.SetHoneypotRecorder(honeypotTracker)
@@ -263,9 +277,20 @@ func main() {
 		log.Fatalf("failed to open geoip database: %v", err)
 	}
 	defer geo.Close()
+	var investigationStore investigation.Store
+	if chStore, ok := store.(*storage.ClickHouseStore); ok {
+		if st, err := investigation.NewClickHouseStore(context.Background(), chStore.Conn(), chStore.Database()); err != nil {
+			log.Printf("ip investigation results will not be persisted: %v", err)
+		} else {
+			investigationStore = st
+		}
+	}
+	investigator := investigation.NewHandler(investigation.ConfigFromEnv(), investigationStore)
+	abuse := abuseipdb.NewHandler(abuseipdb.ConfigFromEnv())
 
 	ingestKey := os.Getenv("OTEL_INGEST_KEY")
 	coll.SetIngestKey(ingestKey)
+	coll.SetSourceMapKey(os.Getenv("OTEL_SOURCEMAP_KEY"))
 	oidcAuth := auth.NewOidcAuth(ingestKey)
 	log.Printf("auth: OIDC issuer=%s client=%s disabled=%v", oidcAuth.Issuer(), oidcAuth.ClientID(), oidcAuth.IsDisabled())
 
@@ -320,6 +345,10 @@ func main() {
 	uiMux.HandleFunc("POST /api/auth/token", oidcAuth.HandleTokenExchange)
 	uiMux.HandleFunc("GET /api/auth/config", oidcAuth.HandleConfig)
 	uiMux.Handle("GET /api/ip/{ip}", oidcAuth.RequireAuth(http.HandlerFunc(geo.Handler)))
+	uiMux.Handle("POST /api/source-ips/{ip}/investigate", oidcAuth.RequireAuth(http.HandlerFunc(investigator.Start)))
+	uiMux.Handle("GET /api/source-ips/{ip}/investigation", oidcAuth.RequireAuth(http.HandlerFunc(investigator.Get)))
+	uiMux.Handle("GET /api/source-ips/{ip}/abuseipdb", oidcAuth.RequireAuth(http.HandlerFunc(abuse.Check)))
+	uiMux.Handle("POST /api/source-ips/{ip}/abuseipdb/report", oidcAuth.RequireAuth(http.HandlerFunc(abuse.Report)))
 	uiMux.Handle("/api/honeypot/ips", oidcAuth.RequireAuth(http.HandlerFunc(honeypotTracker.HandleIPsForUser)))
 	if alertRunner != nil {
 		uiMux.Handle("GET /api/alerts", oidcAuth.RequireAuth(http.HandlerFunc(alertRunner.HandleStatus)))
@@ -327,6 +356,7 @@ func main() {
 	}
 	if ipBlocker != nil {
 		uiMux.Handle("GET /api/blocker/status", oidcAuth.RequireAuth(http.HandlerFunc(ipBlocker.HandleStatus)))
+		uiMux.Handle("POST /api/blocker/ips/{ip}", oidcAuth.RequireAuth(http.HandlerFunc(ipBlocker.HandleAdd)))
 	}
 	// Source-map uploads are intentionally public so the release build script
 	// can upload maps without an OIDC session or bearer token.
@@ -345,10 +375,12 @@ func main() {
 	uiMux.Handle("/api/history/wait", oidcAuth.RequireAuth(http.HandlerFunc(coll.HandleWait)))
 	uiMux.Handle("GET /api/traces/summaries", oidcAuth.RequireAuth(http.HandlerFunc(coll.HandleTraceSummaries)))
 	uiMux.Handle("GET /api/issues/{id}/traces", oidcAuth.RequireAuth(http.HandlerFunc(coll.HandleIssueTraces)))
+	uiMux.Handle("GET /api/issues/{id}/sources", oidcAuth.RequireAuth(http.HandlerFunc(coll.HandleIssueSources)))
 	uiMux.Handle("GET /api/traces/{traceId}", oidcAuth.RequireAuth(http.HandlerFunc(coll.HandleTraceByID)))
 	uiMux.Handle("/api/issues", oidcAuth.RequireAuth(http.HandlerFunc(coll.HandleIssues)))
 	uiMux.Handle("POST /api/ml/test-spike", oidcAuth.RequireAuth(http.HandlerFunc(coll.HandleMLDetectorTest)))
 	uiMux.Handle("GET /api/issues/{id}", oidcAuth.RequireAuth(http.HandlerFunc(coll.HandleIssueByID)))
+	uiMux.Handle("PATCH /api/issues/{id}", oidcAuth.RequireAuth(http.HandlerFunc(coll.HandleIssueByID)))
 	uiMux.Handle("GET /api/issues/{id}/similar", oidcAuth.RequireAuth(http.HandlerFunc(coll.HandleIssueSimilar)))
 	uiMux.Handle("POST /api/issues/{id}/similar", oidcAuth.RequireAuth(http.HandlerFunc(coll.HandleSimilarityFeedback)))
 	uiMux.Handle("GET /api/patterns", oidcAuth.RequireAuth(http.HandlerFunc(coll.HandlePatterns)))
@@ -358,6 +390,8 @@ func main() {
 	uiMux.Handle("GET /api/rollouts/{id}/impact", oidcAuth.RequireAuth(http.HandlerFunc(coll.HandleRolloutImpact)))
 	// Aggregate stats (ClickHouse-backed); return 501 with an explanatory
 	// JSON body when only the file store is configured.
+	uiMux.Handle("GET /api/source-ips", oidcAuth.RequireAuth(http.HandlerFunc(coll.HandleSourceIPs)))
+	uiMux.Handle("GET /api/source-ips/{ip}", oidcAuth.RequireAuth(http.HandlerFunc(coll.HandleSourceIPActivity)))
 	uiMux.Handle("/api/stats/errors", oidcAuth.RequireAuth(http.HandlerFunc(coll.HandleStatsErrors)))
 	uiMux.Handle("/api/stats/releases", oidcAuth.RequireAuth(http.HandlerFunc(coll.HandleStatsReleases)))
 	uiMux.Handle("/api/stats/services", oidcAuth.RequireAuth(http.HandlerFunc(coll.HandleStatsServices)))
@@ -414,6 +448,21 @@ func main() {
 		log.Fatalf("failed to start HTTP server on :%s: %v", httpPort, err)
 	}
 }
+
+func startPprofServer(addr string) {
+	mux := http.NewServeMux()
+	mux.HandleFunc("GET /debug/pprof/", pprof.Index)
+	mux.HandleFunc("GET /debug/pprof/cmdline", pprof.Cmdline)
+	mux.HandleFunc("GET /debug/pprof/profile", pprof.Profile)
+	mux.HandleFunc("GET /debug/pprof/symbol", pprof.Symbol)
+	mux.HandleFunc("GET /debug/pprof/trace", pprof.Trace)
+
+	log.Printf("Starting pprof server on %s", addr)
+	if err := http.ListenAndServe(addr, mux); err != nil {
+		log.Printf("pprof server stopped: %v", err)
+	}
+}
+
 func spaHandler(root http.FileSystem) http.Handler {
 	fileServer := http.FileServer(root)
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {