benvin
d52c3ee76e
Expand asn address groups to concrete prefixes centrally (one iplocate key, consistent fleet-wide) and refresh them on a per-group TTL (default 24h). A background Refresher scans for due groups, unions each group's ASNs to a deduped prefix set, and writes them to a new resolved/resolved_at column (migration 0002). Fail-safe: a lookup error or empty expansion keeps the last-good set, never emptying it. The compiler folds resolved prefixes into the rendered set members; membership churn bumps the generation but never rewrites rules. The iplocate client is endpoint-configurable and response-tolerant, documented as needing endpoint/key confirmation. Unit tests cover TTL parsing, due-checks, and union/dedup/error propagation with a fake expander.
8 lines
463 B
SQL
8 lines
463 B
SQL
-- Cache expanded ASN prefixes on the address group. `resolved` holds the concrete
|
|
-- CIDRs the expander last produced; `resolved_at` timestamps the last successful
|
|
-- expansion. Membership churn here is deliberately separate from rule definition:
|
|
-- the compiler folds `resolved` into the rendered set without touching rules.
|
|
ALTER TABLE address_groups
|
|
ADD COLUMN resolved JSONB NOT NULL DEFAULT '[]'::jsonb,
|
|
ADD COLUMN resolved_at TIMESTAMPTZ;
|