Scott KarpandClaude Fable 5.1
54ca651f37
Tamid §1.1 wrote the pe'ah's limit (10/min, 100/h per IP); nothing enforced it, on any tier, and every admitted request spends manna. VavPipeline.BigdeiKodesh.Mishmar: fixed minute and hour windows per subject in ETS, the subject stored only as sha256(boot salt, tier, subject) — no IP and no key is ever in memory as itself, the sweep drops closed windows, nothing survives a restart (the Tamid's "not logged beyond the current request", kept in memory too). A refused knock is not counted. 429 RATE_LIMITED with Retry-After and the manna explanation (Shemot 16:18). Pe'ah per peer address; courtyard and chatzer per key, after the gate (a wrong key is 401 and never counted). Numbers: pe'ah 10/100 (Tamid), courtyard 20/200 and chatzer 5/60 (from Construction §2.3; config :rate_limits). Service shorashim-external: externalTrafficPolicy Local. With Cluster the pod saw every caller as the node, 91.92.153.113 (observed via /proc/net/tcp) — a per-IP limit would have been one bucket for the world. Spec: tamid §1.1 (watch, 429 rows, the Service note), KOHEN.md. Doorpost 42b38626… → e4e3d56d…. tablet46_mishmar_test; Elixir 533/0 (L3 on and off). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
62 lines
1.9 KiB
YAML
62 lines
1.9 KiB
YAML
# Shorashim Services
|
|
# Operations spec §1.1: Four access tiers
|
|
# - Pe'ah (public, no auth)
|
|
# - Machaneh Leviyah (authenticated)
|
|
# - Chatzer (full access)
|
|
# - Kodesh (operator, mTLS)
|
|
#
|
|
# All tiers go through a single Service → vav-pipeline port 4000
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: shorashim
|
|
namespace: shorashim
|
|
labels:
|
|
app.kubernetes.io/name: shorashim
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
app.kubernetes.io/name: shorashim
|
|
ports:
|
|
- port: 80
|
|
targetPort: 4000
|
|
protocol: TCP
|
|
name: http
|
|
---
|
|
# External access via LoadBalancer
|
|
# For Exoscale SKS, this provisions an Exoscale NLB.
|
|
#
|
|
# The NLB forwards to this Service's NodePort and TCP-healthchecks it on
|
|
# the node. The cloud controller does NOT open that port in the node's
|
|
# security group — the operator must, or the NLB IP refuses connections
|
|
# while the pod is Ready (2026-10-04, tablet 29):
|
|
# PORT=$(kubectl -n shorashim get svc shorashim-external -o jsonpath='{.spec.ports[0].nodePort}')
|
|
# exo compute security-group rule add default --flow ingress --protocol tcp --port $PORT --network 0.0.0.0/0
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: shorashim-external
|
|
namespace: shorashim
|
|
labels:
|
|
app.kubernetes.io/name: shorashim
|
|
annotations:
|
|
# Exoscale NLB annotations
|
|
service.beta.kubernetes.io/exoscale-loadbalancer-zone: "ch-gva-2"
|
|
service.beta.kubernetes.io/exoscale-loadbalancer-name: "shorashim"
|
|
spec:
|
|
type: LoadBalancer
|
|
# Local: kube-proxy does not SNAT, so the pod sees the caller's own
|
|
# address and the pe'ah's per-IP watch (Tamid §1.1) counts callers,
|
|
# not the node. With Cluster (the default) every caller arrived as the
|
|
# node IP 91.92.153.113 — observed 2026-10-06, tablet 46. One node,
|
|
# one replica: Local loses nothing.
|
|
externalTrafficPolicy: Local
|
|
selector:
|
|
app.kubernetes.io/name: shorashim
|
|
ports:
|
|
- port: 80
|
|
targetPort: 4000
|
|
protocol: TCP
|
|
name: http
|