Re: The status of the Rule QA system

On 6/26/26 11:38, Benny Pedersen via users wrote:
> Kevin A. McGrail skrev den 2026-06-26 03:53:
>> Amen
> 
> jehova :-)
> 
> should it not just be running on 127.0.0.1 ? and create results to live 
> servers presenting the results, it does not need to be 0.0.0.0 while 
> computing imho, lesson learned here
> 

My firsthunch was (and I'm guessing Benny suggests same thing here) is 
that the RuleQA webserver should not be on the same machine as the 
actual RuleQA processing stuff, assuming that the DDOS is over HTTP. 
Maybe an aggressive caching reverse HTTP proxy would be enough?

Then we could allowlist the rsync submitters (at least to an ISP range 
if a single IP doesn't suffice) and close public access to the RuleQA 
backend server altogether?

Probably these ideas have already been catered and discarded for reasons 
beyond my knowledge, but I'm still putting them here in case it might 
help someone.

Kind regards,
Tom