Compare commits

..
Author SHA1 Message Date
maxlerebourgandRenovate Bot 9daba9739c ⬆️ renovate: Update all (#350)
Co-authored-by: Renovate Bot <22881669+maxlerebourg@users.noreply.github.com>
2026-07-26 17:06:02 +02:00
maxlerebourg e98b8ed5ba Renovate update version.go (#360)
*  Renovate update version.go

* 🍱 renovate every day
2026-07-26 17:05:43 +02:00
bb44aef718 feat: Allow cache reading from replicas (#342)
* feat: Allow cache reading from replicas

* 🍱 fix logic

*  add testing for redis with mock

* 🍱 fix permission

* 📝 test(e2e/redis): fix swapped IP→verdict comments

The mock returns "f" (not banned) for 1.2.3.4 and "t" (banned) for
1.2.3.5, and the run.sh assertions match that. Both doc comments
described the opposite mapping; correct them to match the code.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

*  test(e2e/redis): exercise read-from-replica path

The redis scenario only set redisCacheHost, so it validated the writer
but never the round-robin reader path this feature adds. Split the mock
into two roles: the primary (--redis-addr) now answers every GET with a
miss, while the replica (--redis-read-addr) serves the hardcoded
verdicts. The scenario points redisCacheReadHosts at the replica (twice,
to drive round-robin), so the banned-IP-blocked assertion only passes if
the plugin actually reads decisions from the replica rather than the
primary.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* 📝 docs: note replicas don't fall back to primary on outage

When RedisCacheReadHosts is set, reads are not retried against the
primary if the replicas are unreachable. Document that this, combined
with the default RedisCacheUnreachableBlock=true, means a replica outage
can block traffic while the primary is healthy.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* 🐛 fix(cache): avoid nil-pointer panic on empty redis read

redisCache.get fell through to `switch err.Error()` when Get returned a
nil error with an empty value, panicking on the nil error. simpleredis
never returns that combination today (a miss yields RedisMiss), so it
was unreachable in practice — but the read path is safer treating an
empty, error-free read as a cache miss, which also guarantees err is
non-nil before err.Error() is called.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* 🍱 add test for rotation

* 🐛 readd redis/run.sh

* 🐛 fix redis/run.sh

* 🐛 fix test label; remove log

* 🍱 add tests for roundRobin

* 🐛 fix test

---------

Co-authored-by: maxlerebourg <maxlerebourg@gmail.com>
Co-authored-by: mhx <mathieu@hanotaux.fr>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-26 13:51:22 +02:00
14 changed files with 17 additions and 17 deletions
+3 -3
View File
@@ -1,6 +1,6 @@
name: Renovate
# Self-hosted Renovate: opens dependency-update PRs on a weekly schedule.
# Self-hosted Renovate: opens dependency-update PRs on a daily schedule.
# Config lives in /renovate.json. Requires a repo/org secret RENOVATE_TOKEN
# (a PAT with `repo` + `workflow` scope, or a fine-grained token with
# contents:write + pull-requests:write) so Renovate can push branches and open
@@ -8,7 +8,7 @@ name: Renovate
on:
schedule:
- cron: "0 4 * * 1" # every Monday at 04:00 UTC
- cron: "0 4 * * *" # every day at 04:00 UTC
workflow_dispatch:
inputs:
logLevel:
@@ -28,7 +28,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Run Renovate
uses: renovatebot/github-action@v46.1.17
uses: renovatebot/github-action@v46.1.20
with:
token: ${{ secrets.RENOVATE_TOKEN }}
env:
+1 -1
View File
@@ -1,6 +1,6 @@
services:
traefik:
image: "traefik:v3.7.6"
image: "traefik:v3.7.8"
container_name: "traefik"
restart: unless-stopped
command:
+1 -1
View File
@@ -1,6 +1,6 @@
services:
traefik:
image: "traefik:v3.7.6"
image: "traefik:v3.7.8"
container_name: "traefik"
restart: unless-stopped
command:
+1 -1
View File
@@ -1,6 +1,6 @@
services:
traefik:
image: "traefik:v3.7.6"
image: "traefik:v3.7.8"
container_name: "traefik"
restart: unless-stopped
command:
+2 -2
View File
@@ -1,6 +1,6 @@
services:
cloudflare:
image: "traefik:v3.7.6"
image: "traefik:v3.7.8"
container_name: "cloudflare"
restart: unless-stopped
command:
@@ -19,7 +19,7 @@ services:
- 8080:8080
traefik:
image: "traefik:v3.7.6"
image: "traefik:v3.7.8"
container_name: "traefik"
restart: unless-stopped
command:
+1 -1
View File
@@ -1,6 +1,6 @@
services:
traefik:
image: "traefik:v3.7.6"
image: "traefik:v3.7.8"
container_name: "traefik"
restart: unless-stopped
command:
+1 -1
View File
@@ -1,6 +1,6 @@
services:
traefik:
image: "traefik:v3.7.6"
image: "traefik:v3.7.8"
container_name: "traefik"
restart: unless-stopped
command:
+1 -1
View File
@@ -1,6 +1,6 @@
services:
traefik:
image: "traefik:v3.7.6"
image: "traefik:v3.7.8"
container_name: "traefik"
restart: unless-stopped
command:
+1 -1
View File
@@ -1,5 +1,5 @@
image:
tag: v3.7.6
tag: v3.7.8
logs:
general:
+1 -1
View File
@@ -1,6 +1,6 @@
services:
traefik:
image: "traefik:v3.7.6"
image: "traefik:v3.7.8"
container_name: "traefik"
restart: unless-stopped
command:
+1 -1
View File
@@ -1,6 +1,6 @@
services:
traefik:
image: "traefik:v3.7.6"
image: "traefik:v3.7.8"
container_name: "traefik"
restart: unless-stopped
command:
+1 -1
View File
@@ -1,6 +1,6 @@
services:
traefik:
image: "traefik:v3.7.6"
image: "traefik:v3.7.8"
container_name: "traefik"
restart: unless-stopped
command:
+1 -1
View File
@@ -1,6 +1,6 @@
services:
traefik:
image: "traefik:v3.7.6"
image: "traefik:v3.7.8"
container_name: "traefik"
restart: unless-stopped
command:
+1 -1
View File
@@ -14,7 +14,7 @@
set -euo pipefail
# Pinned to match the Docker suite (tests/e2e/scenarios/*/docker-compose.yml).
TRAEFIK_VERSION="${TRAEFIK_VERSION:-v3.7.6}"
TRAEFIK_VERSION="${TRAEFIK_VERSION:-v3.7.8}"
WEB_PORT="${WEB_PORT:-8000}"
LAPI_PORT="${LAPI_PORT:-8090}"