-
-
Notifications
You must be signed in to change notification settings - Fork 32
Added timezone information to the available fields #33
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Changes from all commits
9731e4e
50ea5f2
59506b5
2637d67
4dfc6a9
ba579be
cbd7cc7
3706e8e
72a67bc
1766a98
2a2e88a
a337c02
56b5625
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,47 @@ | ||||||||||||||||||||||||||
| name: Build | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| on: | ||||||||||||||||||||||||||
| workflow_dispatch: | ||||||||||||||||||||||||||
| push: | ||||||||||||||||||||||||||
| branches: | ||||||||||||||||||||||||||
| - master | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| jobs: | ||||||||||||||||||||||||||
| build: | ||||||||||||||||||||||||||
| name: Build & deploy | ||||||||||||||||||||||||||
| runs-on: ubuntu-22.04 | ||||||||||||||||||||||||||
| steps: | ||||||||||||||||||||||||||
| - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1 | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| - name: Login to Docker Hub | ||||||||||||||||||||||||||
| uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef #v3.6.0 | ||||||||||||||||||||||||||
| with: | ||||||||||||||||||||||||||
| username: ${{ secrets.ACR_USERNAME }} | ||||||||||||||||||||||||||
| password: ${{ secrets.ACR_PASSWORD }} | ||||||||||||||||||||||||||
| registry: cratecache.azurecr.io/new-black | ||||||||||||||||||||||||||
|
Comment on lines
+16
to
+21
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Fix the registry configuration. The 🔧 Proposed fix - name: Login to Docker Hub
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef #v3.6.0
with:
username: ${{ secrets.ACR_USERNAME }}
password: ${{ secrets.ACR_PASSWORD }}
- registry: cratecache.azurecr.io/new-black
+ registry: cratecache.azurecr.io📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
|
Comment on lines
+16
to
+22
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Step name is misleading (this logs into ACR, not Docker Hub). Rename the step to avoid confusion during incident/debugging. Proposed diff- - name: Login to Docker Hub
+ - name: Login to Azure Container Registry (ACR)
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef #v3.6.0
with:
username: ${{ secrets.ACR_USERNAME }}
password: ${{ secrets.ACR_PASSWORD }}
registry: cratecache.azurecr.io/new-black🤖 Prompt for AI Agents |
||||||||||||||||||||||||||
| # Switch to a different builder | ||||||||||||||||||||||||||
| - name: Set up Docker Buildx | ||||||||||||||||||||||||||
| id: buildx | ||||||||||||||||||||||||||
| uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f #3.12.0 | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| # Determine the run number | ||||||||||||||||||||||||||
| - name: Set the run number | ||||||||||||||||||||||||||
| id: commit-id | ||||||||||||||||||||||||||
| run: | | ||||||||||||||||||||||||||
| echo "build_number=$GITHUB_RUN_NUMBER" >> $GITHUB_ENV | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
|
Comment on lines
+29
to
+33
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Minor: quote
Proposed diff- - name: Set the run number
- id: commit-id
+ - name: Set the run number
+ id: build-number
run: |
- echo "build_number=$GITHUB_RUN_NUMBER" >> $GITHUB_ENV
+ echo "build_number=$GITHUB_RUN_NUMBER" >> "$GITHUB_ENV"🤖 Prompt for AI Agents |
||||||||||||||||||||||||||
| # Build the production image | ||||||||||||||||||||||||||
| - name: Build production image | ||||||||||||||||||||||||||
| uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 #v6.18.0 | ||||||||||||||||||||||||||
| with: | ||||||||||||||||||||||||||
| context: . | ||||||||||||||||||||||||||
| platforms: linux/amd64,linux/arm64 | ||||||||||||||||||||||||||
| push: true | ||||||||||||||||||||||||||
| target: release | ||||||||||||||||||||||||||
| build-args: | | ||||||||||||||||||||||||||
| MAXMIND_LICENSE_KEY=${{ secrets.MAXMIND_LICENSE_KEY }} | ||||||||||||||||||||||||||
| tags: | | ||||||||||||||||||||||||||
| cratecache.azurecr.io/new-black/eva-whoami:latest | ||||||||||||||||||||||||||
| cratecache.azurecr.io/new-black/eva-whoami:${{ env.build_number }} | ||||||||||||||||||||||||||
| builder: ${{ steps.buildx.outputs.name }} | ||||||||||||||||||||||||||
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -19,6 +19,12 @@ RUN sed 's/GeoLite2-Country_[0-9]*.tar.gz/GeoLite2-Country.tar.gz/g' -i GeoLite2 | |||||||||||||||||||||
| RUN sha256sum -c GeoLite2-Country.tar.gz.sha256 | ||||||||||||||||||||||
| RUN tar xvf GeoLite2-Country.tar.gz --strip 1 | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| RUN wget "${MAXMIND_BASE_URL}edition_id=GeoLite2-City&suffix=tar.gz" -O GeoLite2-City.tar.gz | ||||||||||||||||||||||
| RUN wget "${MAXMIND_BASE_URL}edition_id=GeoLite2-City&suffix=tar.gz.sha256" -O GeoLite2-City.tar.gz.sha256 | ||||||||||||||||||||||
| RUN sed 's/GeoLite2-City_[0-9]*.tar.gz/GeoLite2-City.tar.gz/g' -i GeoLite2-City.tar.gz.sha256 | ||||||||||||||||||||||
| RUN sha256sum -c GeoLite2-City.tar.gz.sha256 | ||||||||||||||||||||||
| RUN tar xvf GeoLite2-City.tar.gz --strip 1 | ||||||||||||||||||||||
|
Comment on lines
+22
to
+26
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. The steps for handling the GeoLite2-City database are correctly implemented, ensuring secure download, verification, and extraction. To optimize the Dockerfile and reduce the number of layers, consider combining these RUN commands into a single RUN command using -RUN wget "${MAXMIND_BASE_URL}edition_id=GeoLite2-City&suffix=tar.gz" -O GeoLite2-City.tar.gz
-RUN wget "${MAXMIND_BASE_URL}edition_id=GeoLite2-City&suffix=tar.gz.sha256" -O GeoLite2-City.tar.gz.sha256
-RUN sed 's/GeoLite2-City_[0-9]*.tar.gz/GeoLite2-City.tar.gz/g' -i GeoLite2-City.tar.gz.sha256
-RUN sha256sum -c GeoLite2-City.tar.gz.sha256
-RUN tar xvf GeoLite2-City.tar.gz --strip 1
+RUN wget "${MAXMIND_BASE_URL}edition_id=GeoLite2-City&suffix=tar.gz" -O GeoLite2-City.tar.gz && \
+ wget "${MAXMIND_BASE_URL}edition_id=GeoLite2-City&suffix=tar.gz.sha256" -O GeoLite2-City.tar.gz.sha256 && \
+ sed 's/GeoLite2-City_[0-9]*.tar.gz/GeoLite2-City.tar.gz/g' -i GeoLite2-City.tar.gz.sha256 && \
+ sha256sum -c GeoLite2-City.tar.gz.sha256 && \
+ tar xvf GeoLite2-City.tar.gz --strip 1Committable suggestion
Suggested change
|
||||||||||||||||||||||
|
|
||||||||||||||||||||||
| FROM alpine:3.23 as release | ||||||||||||||||||||||
| LABEL name="ipinfo.tw" | ||||||||||||||||||||||
| RUN mkdir -p /run/nginx/ /usr/share/GeoIP/ | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -55,12 +55,12 @@ Use any http(s) client to explore the server, e.g. https://ipinfo.tw, | |
| - `wget -qO- https://ipinfo.tw` | ||
| - `curl https://ipinfo.tw` | ||
|
|
||
| Without any specified URI, the server will return IP address, country, AS, and user agent. | ||
| Without any specified URI, the server will return IP address, country, timezone, AS, and user agent. | ||
|
|
||
| If you prefer to receive a machine-readable result, use path `/json` (without trailing slash), e.g. `https://ipinfo.tw/json`, the result will look like: | ||
|
|
||
| ```json | ||
| {"ip":"3.115.123.234","country_code":"JP","country_name":"Japan","asn":"16509","as_desc":"Amazon.com, Inc.","user_agent":"curl/7.58.0"} | ||
| {"ip":"3.115.123.234","country_code":"JP","country_name":"Japan","timezone":"Asia/Tokyo","asn":"16509","as_desc":"Amazon.com, Inc.","user_agent":"curl/7.58.0"} | ||
| ``` | ||
|
|
||
| #### Endpoints | ||
|
Comment on lines
55
to
66
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
The description of the demo setup mentions "an reverse proxy" which should be corrected to "a reverse proxy" for grammatical accuracy. - this demo is behind an reverse proxy with https enabled
+ this demo is behind a reverse proxy with https enabled
There's a minor typographical error with "http traffic" which should be capitalized as "HTTP traffic" for consistency with standard terminology. - http traffic will be redirected to use https
+ HTTP traffic will be redirected to use https
The phrase "pass the it to the container" seems to contain an extra word. It should be corrected for clarity. - set up an `X-Real-IP` header and pass the it to the container
+ set up an `X-Real-IP` header and pass it to the container |
||
|
|
@@ -75,6 +75,7 @@ You can also specify the following URI to retrieve certain info: | |
| - `asn`: AS number | ||
| - `as_desc`: AS description | ||
| - `user_agent`: User agent string | ||
| - `timezone`: Timezone based on the city (e.g Europe/Amsterdam) | ||
|
|
||
| Examples: | ||
|
|
||
|
|
@@ -97,6 +98,9 @@ HK | |
| $ curl https://ipinfo.tw/country_name | ||
| South Korea | ||
|
|
||
| $ curl https://ipinfo.tw/timezone | ||
| Europe/Amsterdam | ||
|
|
||
| $ curl https://ipinfo.tw/as | ||
| AS16509 / Amazon.com, Inc. | ||
|
|
||
|
|
||
| Original file line number | Diff line number | Diff line change | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,39 @@ | ||||||||||||||||||
| apiVersion: apps/v1 | ||||||||||||||||||
| kind: Deployment | ||||||||||||||||||
| metadata: | ||||||||||||||||||
| labels: | ||||||||||||||||||
| app: eva-whoami | ||||||||||||||||||
| name: eva-whoami | ||||||||||||||||||
| namespace: platform-tools | ||||||||||||||||||
| spec: | ||||||||||||||||||
| progressDeadlineSeconds: 600 | ||||||||||||||||||
| replicas: 2 | ||||||||||||||||||
| revisionHistoryLimit: 10 | ||||||||||||||||||
| selector: | ||||||||||||||||||
| matchLabels: | ||||||||||||||||||
| app: eva-whoami | ||||||||||||||||||
| strategy: | ||||||||||||||||||
| rollingUpdate: | ||||||||||||||||||
| maxSurge: 25% | ||||||||||||||||||
| maxUnavailable: 25% | ||||||||||||||||||
| type: RollingUpdate | ||||||||||||||||||
| template: | ||||||||||||||||||
| metadata: | ||||||||||||||||||
| labels: | ||||||||||||||||||
| app: eva-whoami | ||||||||||||||||||
| spec: | ||||||||||||||||||
| containers: | ||||||||||||||||||
| - image: cratecache.azurecr.io/new-black/eva-whoami | ||||||||||||||||||
| imagePullPolicy: Always | ||||||||||||||||||
| name: whoami | ||||||||||||||||||
| ports: | ||||||||||||||||||
| - containerPort: 8080 | ||||||||||||||||||
| protocol: TCP | ||||||||||||||||||
| resources: {} | ||||||||||||||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Define resource limits and requests. The deployment has no resource constraints, which can lead to resource contention, unpredictable performance, and potential node exhaustion. Production deployments should always specify CPU and memory limits/requests. ⚙️ Proposed resource configuration- resources: {}
+ resources:
+ requests:
+ cpu: 100m
+ memory: 128Mi
+ limits:
+ cpu: 500m
+ memory: 256MiAdjust values based on actual application requirements. 📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||
| terminationMessagePath: /dev/termination-log | ||||||||||||||||||
| terminationMessagePolicy: File | ||||||||||||||||||
| dnsPolicy: ClusterFirst | ||||||||||||||||||
| restartPolicy: Always | ||||||||||||||||||
| schedulerName: default-scheduler | ||||||||||||||||||
| securityContext: {} | ||||||||||||||||||
|
Comment on lines
+25
to
+38
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Add security context to prevent privilege escalation. The deployment lacks security context constraints, leaving it vulnerable to privilege escalation and running as root. This violates Kubernetes security best practices and Pod Security Standards. 🔒 Proposed security hardening containers:
- image: cratecache.azurecr.io/new-black/eva-whoami
imagePullPolicy: Always
name: whoami
ports:
- containerPort: 8080
protocol: TCP
resources: {}
+ securityContext:
+ allowPrivilegeEscalation: false
+ runAsNonRoot: true
+ runAsUser: 10001
+ capabilities:
+ drop:
+ - ALL
+ readOnlyRootFilesystem: true
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
dnsPolicy: ClusterFirst
restartPolicy: Always
schedulerName: default-scheduler
- securityContext: {}
+ securityContext:
+ runAsNonRoot: true
+ seccompProfile:
+ type: RuntimeDefault
terminationGracePeriodSeconds: 30Note: If the application requires write access, mount an emptyDir volume for temporary storage instead of using a writable root filesystem. Based on static analysis hints. |
||||||||||||||||||
| terminationGracePeriodSeconds: 30 | ||||||||||||||||||
|
Comment on lines
+1
to
+39
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Critical mismatch: Files don't match PR objectives. The PR summary states this adds "timezone information to the available fields" for the ipinfo.tw project with nginx configuration changes, but this file deploys an entirely different service (eva-whoami) in Kubernetes. This appears to be either:
Please verify that the correct files are included in this PR. 🧰 Tools🪛 Checkov (3.2.334)[medium] 1-39: Containers should not run with allowPrivilegeEscalation (CKV_K8S_20) [medium] 1-39: Minimize the admission of root containers (CKV_K8S_23) |
||||||||||||||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| apiVersion: networking.k8s.io/v1 | ||
| kind: Ingress | ||
| metadata: | ||
| annotations: | ||
| cert-manager.io/acme-challenge-type: dns01 | ||
| cert-manager.io/cluster-issuer: letsencrypt-prod-dns | ||
| kubernetes.io/ingress.class: nginx | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Remove deprecated ingress class annotation. The deprecated annotation 🧹 Proposed cleanup annotations:
cert-manager.io/acme-challenge-type: dns01
cert-manager.io/cluster-issuer: letsencrypt-prod-dns
- kubernetes.io/ingress.class: nginx
generation: 2Also applies to: 14-14 🤖 Prompt for AI Agents |
||
| generation: 2 | ||
| labels: | ||
| name: eva-whoami | ||
| name: eva-whoami | ||
| namespace: platform-tools | ||
| spec: | ||
| ingressClassName: nginx | ||
| rules: | ||
| - host: whoami.on-eva.io | ||
| http: | ||
| paths: | ||
| - backend: | ||
| service: | ||
| name: eva-whoami | ||
| port: | ||
| number: 8080 | ||
| path: / | ||
| pathType: ImplementationSpecific | ||
| tls: | ||
| - hosts: | ||
| - whoami.on-eva.io | ||
| secretName: eva-whoami-tls | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| apiVersion: v1 | ||
| kind: Service | ||
| metadata: | ||
| annotations: | ||
| service.beta.kubernetes.io/azure-load-balancer-resource-group: rg-prod-eva | ||
| labels: | ||
| component: eva-whoami | ||
| name: eva-whoami | ||
| namespace: platform-tools | ||
| spec: | ||
| ipFamilies: | ||
| - IPv4 | ||
| ipFamilyPolicy: SingleStack | ||
| ports: | ||
| - name: whoami | ||
| nodePort: 31514 | ||
| port: 8080 | ||
| protocol: TCP | ||
| targetPort: 8080 | ||
| selector: | ||
| app: eva-whoami | ||
| sessionAffinity: None | ||
| type: LoadBalancer |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Consider adding a PR build (no push) trigger, or explicitly document “master-only push” behavior.
Right now this only runs on
workflow_dispatchandpushtomaster, so you won’t get CI signal on PRs unless someone manually dispatches. If that’s intentional, a short comment helps future maintainers.🤖 Prompt for AI Agents