NOISSUE - Production harden Atom runtime, keys, health, and operations UI#9
Conversation
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
atom-docs | 5f0a7af | Commit Preview URL Branch Preview URL |
Jun 15 2026, 04:17 PM |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0d90cc366a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| } | ||
|
|
||
| fn client_key(headers: &HeaderMap) -> String { | ||
| forwarded_client(headers) |
There was a problem hiding this comment.
When Atom is reachable directly (for example, the provided compose profile exposes port 8080) or a proxy does not overwrite forwarded headers, a caller can send a different X-Forwarded-For value on every login or GraphQL request. Because this header is used before the Authorization/anonymous fallback, each spoofed value gets a fresh bucket and ATOM_RATE_LIMIT_ENABLED no longer throttles abusive traffic; use the socket peer address or only honor forwarded headers from configured trusted proxies.
Useful? React with 👍 / 👎.
| .route("/api/custom/*path", any(api_endpoints::custom_endpoint)) | ||
| .route( | ||
| "/api/custom/*path", | ||
| any(api_endpoints::custom_endpoint).layer(DefaultBodyLimit::max(custom_body_limit)), |
There was a problem hiding this comment.
When ATOM_CUSTOM_ENDPOINT_BODY_LIMIT_BYTES is set above 1 MiB, this route layer allows the larger request to reach custom_endpoint, but execute_endpoint still rejects anything over the old MAX_CUSTOM_ENDPOINT_BODY_BYTES constant. Operators therefore cannot actually raise the advertised limit for custom endpoints; pass the configured limit into the handler or replace the hard-coded check.
Useful? React with 👍 / 👎.
| message: if ready { "ready" } else { "not ready" }.to_string(), | ||
| }; | ||
| let grpc_ready = ComponentCheck { | ||
| status: ComponentStatus::Ok, |
There was a problem hiding this comment.
If the gRPC listener fails to bind or exits after startup, main only logs the spawned grpc::serve error and leaves HTTP running, but readiness always reports grpc_ready as OK and the aggregate readiness calculation does not include it. In that failure mode /health/ready returns 200 while the gRPC API is down, so orchestration will not restart or drain the instance.
Useful? React with 👍 / 👎.
Signed-off-by: Arvindh <arvindh91@gmail.com>
Signed-off-by: Arvindh <arvindh91@gmail.com>
2 participants
Summary