gravatite/public-pool
1
0
Fork 0
mirror of https://github.com/benjamin-wilson/public-pool.git synced 2026-09-29 09:05:06 -07:00
Code Issues Packages Projects Releases Wiki Activity

Relax API connection hardening defaults

Browse Source
This commit is contained in:
Ben
2026-06-08 00:14:58 -04:00
parent 817f416b79
commit b6a951bdee
5 changed files with 21 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.example
+3 -3
View File
@@ -19,12 +19,12 @@ API_PORT=3334
# Keep API_BIND_HOST as 127.0.0.1 when a reverse proxy terminates public traffic. # Keep API_BIND_HOST as 127.0.0.1 when a reverse proxy terminates public traffic.
API_BIND_HOST=127.0.0.1 API_BIND_HOST=127.0.0.1
API_PUBLIC_PORT=3334 API_PUBLIC_PORT=3334
API_MAX_CONNECTIONS=512 API_MAX_CONNECTIONS=10000
API_REQUEST_TIMEOUT_MS=15000 API_REQUEST_TIMEOUT_MS=15000
API_HEADERS_TIMEOUT_MS=10000 API_HEADERS_TIMEOUT_MS=10000
API_KEEP_ALIVE_TIMEOUT_MS=5000 API_KEEP_ALIVE_TIMEOUT_MS=5000
API_SOCKET_TIMEOUT_MS=15000 API_SOCKET_TIMEOUT_MS=0
API_TLS_HANDSHAKE_TIMEOUT_MS=3000 API_TLS_HANDSHAKE_TIMEOUT_MS=10000
API_LISTEN_BACKLOG=1024 API_LISTEN_BACKLOG=1024
API_NODE_ARGS=--max-old-space-size=512 API_NODE_ARGS=--max-old-space-size=512
API_MAX_MEMORY_RESTART=768M API_MAX_MEMORY_RESTART=768M
docker-compose.external-db.yml
+3 -3
View File
@@ -50,12 +50,12 @@ services:
REDIS_URL: ${REDIS_URL:-redis://redis:6379} REDIS_URL: ${REDIS_URL:-redis://redis:6379}
API_PORT: ${API_PORT:-3334} API_PORT: ${API_PORT:-3334}
API_SECURE: ${API_SECURE:-false} API_SECURE: ${API_SECURE:-false}
API_MAX_CONNECTIONS: ${API_MAX_CONNECTIONS:-512} API_MAX_CONNECTIONS: ${API_MAX_CONNECTIONS:-10000}
API_REQUEST_TIMEOUT_MS: ${API_REQUEST_TIMEOUT_MS:-15000} API_REQUEST_TIMEOUT_MS: ${API_REQUEST_TIMEOUT_MS:-15000}
API_HEADERS_TIMEOUT_MS: ${API_HEADERS_TIMEOUT_MS:-10000} API_HEADERS_TIMEOUT_MS: ${API_HEADERS_TIMEOUT_MS:-10000}
API_KEEP_ALIVE_TIMEOUT_MS: ${API_KEEP_ALIVE_TIMEOUT_MS:-5000} API_KEEP_ALIVE_TIMEOUT_MS: ${API_KEEP_ALIVE_TIMEOUT_MS:-5000}
API_SOCKET_TIMEOUT_MS: ${API_SOCKET_TIMEOUT_MS:-15000} API_SOCKET_TIMEOUT_MS: ${API_SOCKET_TIMEOUT_MS:-0}
API_TLS_HANDSHAKE_TIMEOUT_MS: ${API_TLS_HANDSHAKE_TIMEOUT_MS:-3000} API_TLS_HANDSHAKE_TIMEOUT_MS: ${API_TLS_HANDSHAKE_TIMEOUT_MS:-10000}
API_LISTEN_BACKLOG: ${API_LISTEN_BACKLOG:-1024} API_LISTEN_BACKLOG: ${API_LISTEN_BACKLOG:-1024}
API_NODE_ARGS: ${API_NODE_ARGS:---max-old-space-size=512} API_NODE_ARGS: ${API_NODE_ARGS:---max-old-space-size=512}
API_MAX_MEMORY_RESTART: ${API_MAX_MEMORY_RESTART:-768M} API_MAX_MEMORY_RESTART: ${API_MAX_MEMORY_RESTART:-768M}
docker-compose.yml
+3 -3
View File
@@ -79,12 +79,12 @@ services:
REDIS_URL: redis://redis:6379 REDIS_URL: redis://redis:6379
API_PORT: ${API_PORT:-3334} API_PORT: ${API_PORT:-3334}
API_SECURE: ${API_SECURE:-false} API_SECURE: ${API_SECURE:-false}
API_MAX_CONNECTIONS: ${API_MAX_CONNECTIONS:-512} API_MAX_CONNECTIONS: ${API_MAX_CONNECTIONS:-10000}
API_REQUEST_TIMEOUT_MS: ${API_REQUEST_TIMEOUT_MS:-15000} API_REQUEST_TIMEOUT_MS: ${API_REQUEST_TIMEOUT_MS:-15000}
API_HEADERS_TIMEOUT_MS: ${API_HEADERS_TIMEOUT_MS:-10000} API_HEADERS_TIMEOUT_MS: ${API_HEADERS_TIMEOUT_MS:-10000}
API_KEEP_ALIVE_TIMEOUT_MS: ${API_KEEP_ALIVE_TIMEOUT_MS:-5000} API_KEEP_ALIVE_TIMEOUT_MS: ${API_KEEP_ALIVE_TIMEOUT_MS:-5000}
API_SOCKET_TIMEOUT_MS: ${API_SOCKET_TIMEOUT_MS:-15000} API_SOCKET_TIMEOUT_MS: ${API_SOCKET_TIMEOUT_MS:-0}
API_TLS_HANDSHAKE_TIMEOUT_MS: ${API_TLS_HANDSHAKE_TIMEOUT_MS:-3000} API_TLS_HANDSHAKE_TIMEOUT_MS: ${API_TLS_HANDSHAKE_TIMEOUT_MS:-10000}
API_LISTEN_BACKLOG: ${API_LISTEN_BACKLOG:-1024} API_LISTEN_BACKLOG: ${API_LISTEN_BACKLOG:-1024}
API_NODE_ARGS: ${API_NODE_ARGS:---max-old-space-size=512} API_NODE_ARGS: ${API_NODE_ARGS:---max-old-space-size=512}
API_MAX_MEMORY_RESTART: ${API_MAX_MEMORY_RESTART:-768M} API_MAX_MEMORY_RESTART: ${API_MAX_MEMORY_RESTART:-768M}
full-setup/docker-compose-mainnet.yml
+3 -3
View File
@@ -99,12 +99,12 @@ services:
REDIS_URL: redis://redis:6379 REDIS_URL: redis://redis:6379
API_PORT: ${API_PORT:-3334} API_PORT: ${API_PORT:-3334}
API_SECURE: ${API_SECURE:-false} API_SECURE: ${API_SECURE:-false}
API_MAX_CONNECTIONS: ${API_MAX_CONNECTIONS:-512} API_MAX_CONNECTIONS: ${API_MAX_CONNECTIONS:-10000}
API_REQUEST_TIMEOUT_MS: ${API_REQUEST_TIMEOUT_MS:-15000} API_REQUEST_TIMEOUT_MS: ${API_REQUEST_TIMEOUT_MS:-15000}
API_HEADERS_TIMEOUT_MS: ${API_HEADERS_TIMEOUT_MS:-10000} API_HEADERS_TIMEOUT_MS: ${API_HEADERS_TIMEOUT_MS:-10000}
API_KEEP_ALIVE_TIMEOUT_MS: ${API_KEEP_ALIVE_TIMEOUT_MS:-5000} API_KEEP_ALIVE_TIMEOUT_MS: ${API_KEEP_ALIVE_TIMEOUT_MS:-5000}
API_SOCKET_TIMEOUT_MS: ${API_SOCKET_TIMEOUT_MS:-15000} API_SOCKET_TIMEOUT_MS: ${API_SOCKET_TIMEOUT_MS:-0}
API_TLS_HANDSHAKE_TIMEOUT_MS: ${API_TLS_HANDSHAKE_TIMEOUT_MS:-3000} API_TLS_HANDSHAKE_TIMEOUT_MS: ${API_TLS_HANDSHAKE_TIMEOUT_MS:-10000}
API_LISTEN_BACKLOG: ${API_LISTEN_BACKLOG:-1024} API_LISTEN_BACKLOG: ${API_LISTEN_BACKLOG:-1024}
API_NODE_ARGS: ${API_NODE_ARGS:---max-old-space-size=512} API_NODE_ARGS: ${API_NODE_ARGS:---max-old-space-size=512}
API_MAX_MEMORY_RESTART: ${API_MAX_MEMORY_RESTART:-768M} API_MAX_MEMORY_RESTART: ${API_MAX_MEMORY_RESTART:-768M}
src/main.ts
+9 -13
View File
@@ -9,12 +9,12 @@ import * as ecc from 'tiny-secp256k1';
import { AppModule } from './app.module'; import { AppModule } from './app.module';
const DEFAULT_API_MAX_CONNECTIONS = 512; const DEFAULT_API_MAX_CONNECTIONS = 10000;
const DEFAULT_API_REQUEST_TIMEOUT_MS = 15000; const DEFAULT_API_REQUEST_TIMEOUT_MS = 15000;
const DEFAULT_API_HEADERS_TIMEOUT_MS = 10000; const DEFAULT_API_HEADERS_TIMEOUT_MS = 10000;
const DEFAULT_API_KEEP_ALIVE_TIMEOUT_MS = 5000; const DEFAULT_API_KEEP_ALIVE_TIMEOUT_MS = 5000;
const DEFAULT_API_SOCKET_TIMEOUT_MS = 15000; const DEFAULT_API_SOCKET_TIMEOUT_MS = 0;
const DEFAULT_API_TLS_HANDSHAKE_TIMEOUT_MS = 3000; const DEFAULT_API_TLS_HANDSHAKE_TIMEOUT_MS = 10000;
const DEFAULT_API_LISTEN_BACKLOG = 1024; const DEFAULT_API_LISTEN_BACKLOG = 1024;
async function bootstrap() { async function bootstrap() {
@@ -128,20 +128,11 @@ async function bootstrap() {
} }
function configureApiServer(server: any) { function configureApiServer(server: any) {
const socketTimeoutMs = getPositiveIntegerEnv('API_SOCKET_TIMEOUT_MS', DEFAULT_API_SOCKET_TIMEOUT_MS);
server.maxConnections = getPositiveIntegerEnv('API_MAX_CONNECTIONS', DEFAULT_API_MAX_CONNECTIONS); server.maxConnections = getPositiveIntegerEnv('API_MAX_CONNECTIONS', DEFAULT_API_MAX_CONNECTIONS);
server.requestTimeout = getPositiveIntegerEnv('API_REQUEST_TIMEOUT_MS', DEFAULT_API_REQUEST_TIMEOUT_MS); server.requestTimeout = getPositiveIntegerEnv('API_REQUEST_TIMEOUT_MS', DEFAULT_API_REQUEST_TIMEOUT_MS);
server.headersTimeout = getPositiveIntegerEnv('API_HEADERS_TIMEOUT_MS', DEFAULT_API_HEADERS_TIMEOUT_MS); server.headersTimeout = getPositiveIntegerEnv('API_HEADERS_TIMEOUT_MS', DEFAULT_API_HEADERS_TIMEOUT_MS);
server.keepAliveTimeout = getPositiveIntegerEnv('API_KEEP_ALIVE_TIMEOUT_MS', DEFAULT_API_KEEP_ALIVE_TIMEOUT_MS); server.keepAliveTimeout = getPositiveIntegerEnv('API_KEEP_ALIVE_TIMEOUT_MS', DEFAULT_API_KEEP_ALIVE_TIMEOUT_MS);
server.timeout = socketTimeoutMs; server.timeout = getNonNegativeIntegerEnv('API_SOCKET_TIMEOUT_MS', DEFAULT_API_SOCKET_TIMEOUT_MS);
server.on('connection', (socket: NodeJS.ReadWriteStream & { setTimeout?: (ms: number) => void; destroy?: () => void }) => {
socket.setTimeout?.(socketTimeoutMs);
socket.once?.('timeout', () => {
socket.destroy?.();
});
});
} }
function getPositiveIntegerEnv(name: string, fallback: number) { function getPositiveIntegerEnv(name: string, fallback: number) {
@@ -149,4 +140,9 @@ function getPositiveIntegerEnv(name: string, fallback: number) {
return Number.isInteger(value) && value > 0 ? value : fallback; return Number.isInteger(value) && value > 0 ? value : fallback;
} }
function getNonNegativeIntegerEnv(name: string, fallback: number) {
const value = Number(process.env[name]);
return Number.isInteger(value) && value >= 0 ? value : fallback;
}
bootstrap(); bootstrap();