all the changes

cmd/server/main.go

@@ -11,6 +11,7 @@ import (
 
 	"git.tornberg.me/go-otel/internal/auth"
 	"git.tornberg.me/go-otel/internal/collector"
+	"git.tornberg.me/go-otel/internal/blocker"
 	"git.tornberg.me/go-otel/internal/honeypot"
 	kube "git.tornberg.me/go-otel/internal/kubernetes"
 	"git.tornberg.me/go-otel/internal/prometheus"
@@ -235,6 +236,12 @@ func main() {
 	wsServer := websocket.New(coll)
 	honeypotTracker := honeypot.New(honeypot.ConfigFromEnv())
 	coll.SetHoneypotRecorder(honeypotTracker)
+	// Optional ingress blocker: off unless OTEL_BLOCKER_ENABLED=true, and
+	// dry-run unless OTEL_BLOCKER_DRY_RUN=false.
+	ipBlocker, err := blocker.Start(context.Background(), blocker.ConfigFromEnv(), honeypotTracker)
+	if err != nil {
+		log.Printf("ip blocker disabled: %v", err)
+	}
 	// Update collector with wsServer
 	coll.SetBroadcaster(wsServer)
 	ingestKey := os.Getenv("OTEL_INGEST_KEY")
@@ -293,6 +300,9 @@ func main() {
 	uiMux.HandleFunc("POST /api/auth/token", oidcAuth.HandleTokenExchange)
 	uiMux.HandleFunc("GET /api/auth/config", oidcAuth.HandleConfig)
 	uiMux.Handle("/api/honeypot/ips", oidcAuth.RequireAuth(http.HandlerFunc(honeypotTracker.HandleIPsForUser)))
+	if ipBlocker != nil {
+		uiMux.Handle("GET /api/blocker/status", oidcAuth.RequireAuth(http.HandlerFunc(ipBlocker.HandleStatus)))
+	}
 	// Source-map uploads are intentionally public so the release build script
 	// can upload maps without an OIDC session or bearer token.
 	uiMux.HandleFunc("POST /api/sourcemaps", coll.HandleSourceMap)