fix: security audit remediation — 29 findings across 92 files

Author: ersinkoc

.dfmt/journal.jsonl

@@ -0,0 +1,15 @@
+# TLS certificates (bring your own)
+certs/
+*.crt
+*.key
+
+# Data volumes
+prometheus-data/
+grafana-data/
+alertmanager-data/
+redis-data/
+olb-logs/
+
+# Environment files
+.env
+.env.local

cover_admin.html

@@ -0,0 +1,113 @@
+# OpenLoadBalancer Deployment
+
+## Quick Start with Docker
+
+### 1. Pull the image
+```bash
+docker pull ghcr.io/openloadbalancer/olb:latest
+```
+
+### 2. Create your configuration
+```bash
+mkdir -p configs certs
+# Create olb.yaml in configs/ directory
+```
+
+### 3. Run
+```bash
+docker compose up -d
+```
+
+## Docker Compose Files
+
+### Single Node (`deploy/docker-compose.yml`)
+Full stack with Prometheus, Grafana, and Alertmanager.
+
+```yaml
+services:
+  olb:
+    image: ghcr.io/openloadbalancer/olb:latest
+    ports:
+      - "80:80"      # HTTP
+      - "443:443"    # HTTPS
+      - "8081:8081"  # Admin API
+      - "8082:8082"  # MCP Server
+    volumes:
+      - ./configs/olb.yaml:/etc/olb/configs/olb.yaml:ro
+      - ./certs:/etc/olb/certs:ro
+      - olb-logs:/var/log/olb
+    environment:
+      - OLB_CONFIG=/etc/olb/configs/olb.yaml
+      - OLB_LOG_LEVEL=info
+```
+
+### 3-Node Cluster (`docker-compose.yml` in repo root)
+See cluster deployment in the repo root.
+
+## Environment Variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `OLB_CONFIG` | `/etc/olb/olb.yaml` | Config file path |
+| `OLB_LOG_LEVEL` | `info` | Log level (debug, info, warn, error) |
+| `OLB_ADMIN_ADDR` | `:8081` | Admin API address |
+| `GRAFANA_ADMIN_PASSWORD` | `changeme` | Grafana admin password |
+
+## Ports
+
+| Port | Service | Description |
+|------|---------|-------------|
+| 80 | HTTP | Load balancer HTTP listener |
+| 443 | HTTPS | Load balancer HTTPS listener |
+| 8081 | Admin API | REST API for management |
+| 8082 | MCP Server | Model Context Protocol |
+| 9090 | Prometheus | Metrics collection |
+| 9093 | Alertmanager | Alert routing |
+| 3000 | Grafana | Dashboards |
+
+## Example Config
+
+```yaml
+listeners:
+  - name: http
+    address: ":80"
+    protocol: http
+
+pools:
+  - name: web
+    algorithm: round_robin
+    backends:
+      - address: "localhost:8080"
+      - address: "localhost:8081"
+
+admin:
+  address: ":8081"
+```
+
+## Health Check
+
+```bash
+docker exec olb olb health
+```
+
+## Observability Stack
+
+The full stack includes:
+- **Prometheus** — Metrics collection (port 9090)
+- **Grafana** — Visualization (port 3000)
+- **Alertmanager** — Alert routing (port 9093)
+- **Node Exporter** — System metrics
+
+Start with observability:
+```bash
+docker compose up -d prometheus grafana alertmanager
+```
+
+## TLS Certificates
+
+Place certificates in `./certs/`:
+```
+certs/
+├── server.crt   # TLS certificate
+└── server.key   # TLS private key
+```

deploy/.gitignore

@@ -0,0 +1,37 @@
+# OpenLoadBalancer Configuration
+# Copy this file to configs/olb.yaml and modify as needed
+
+listeners:
+  - name: http
+    address: ":80"
+    protocol: http
+
+  - name: https
+    address: ":443"
+    protocol: https
+    tls:
+      enabled: true
+      cert_file: /etc/olb/certs/server.crt
+      key_file: /etc/olb/certs/server.key
+
+pools:
+  - name: web
+    algorithm: round_robin
+    backends:
+      - address: "localhost:8080"
+        weight: 1
+      - address: "localhost:8081"
+        weight: 1
+    health_check:
+      type: http
+      path: /health
+      interval: 10s
+      timeout: 2s
+
+admin:
+  address: ":8081"
+
+logging:
+  level: info
+  format: json
+  output: /var/log/olb/olb.log

deploy/README.md

@@ -19,7 +19,7 @@
 services:
   # ─── OLB Cluster Nodes ────────────────────────────────────────────────
   olb-1:
-    image: openloadbalancer/olb:latest
+    image: ghcr.io/openloadbalancer/olb:latest
     build:
       context: .
       dockerfile: Dockerfile
@@ -63,7 +63,7 @@ services:
         condition: service_healthy
 
   olb-2:
-    image: openloadbalancer/olb:latest
+    image: ghcr.io/openloadbalancer/olb:latest
     build:
       context: .
       dockerfile: Dockerfile
@@ -107,7 +107,7 @@ services:
         condition: service_healthy
 
   olb-3:
-    image: openloadbalancer/olb:latest
+    image: ghcr.io/openloadbalancer/olb:latest
     build:
       context: .
       dockerfile: Dockerfile

deploy/configs/olb.yaml

@@ -683,6 +683,192 @@ See [mcp.md](mcp.md) for integration details.
 
 ---
 
+## Profiling
+
+Go runtime profiling via pprof HTTP endpoint.
+
+```yaml
+profiling:
+  enabled: true
+  pprof_addr: "localhost:6060"     # pprof HTTP endpoint (localhost only recommended)
+  cpu_profile_path: ""              # Write CPU profile to file on shutdown
+  mem_profile_path: ""              # Write heap profile to file on shutdown
+  block_profile_rate: 0             # Fraction of goroutine blocking events to report (0 = off)
+  mutex_profile_fraction: 0         # Fraction of mutex contention events to report (0 = off)
+  token: ""                         # Bearer token for pprof auth (empty = no auth, localhost-only recommended)
+```
+
+When `token` is set, all pprof endpoints require `Authorization: Bearer <token>`.
+
+---
+
+## WAF (Web Application Firewall)
+
+Six-layer security pipeline: SQLi, XSS, CMDi, XXE, SSRF, and Path Traversal detection.
+
+```yaml
+waf:
+  enabled: true
+  mode: enforce                    # "enforce" (block), "monitor" (log only), "disabled"
+
+  ip_acl:
+    enabled: true
+    whitelist:                     # Always allowed, bypasses all checks
+      - cidr: "10.0.0.0/8"
+    blacklist:                     # Always blocked
+      - cidr: "192.168.1.100/32"
+    auto_ban:
+      enabled: true
+      threshold: 100               # Requests in window before auto-ban
+      window: "60s"                # Time window for threshold counting
+      duration: "3600s"            # How long the ban lasts
+
+  rate_limit:
+    enabled: true
+    requests_per_second: 100       # Max requests per second per IP
+    burst: 200                     # Burst allowance
+    window: "60s"                  # Fixed window duration
+
+  sanitizer:
+    enabled: true
+    strip_null_bytes: true
+    normalize_unicode: true
+    max_header_value_length: 8192
+
+  detection:
+    enabled: true
+    sqli:
+      enabled: true
+      mode: pattern                # "pattern" or "semantic"
+    xss:
+      enabled: true
+      mode: pattern
+    cmdi:
+      enabled: true
+    xxe:
+      enabled: true
+    ssrf:
+      enabled: true
+      blocked_cidrs:
+        - "127.0.0.0/8"
+        - "10.0.0.0/8"
+        - "172.16.0.0/12"
+        - "192.168.0.0/16"
+        - "169.254.0.0/16"
+        - "0.0.0.0/0"
+    path_traversal:
+      enabled: true
+
+  bot_detection:
+    enabled: true
+    user_agent_blacklist:
+      - "malicious-bot"
+    challenge_mode: "none"         # "none", "captcha", "javascript"
+
+  response:
+    enabled: true
+    hide_server_header: true
+    hide_powered_by: true
+
+  logging:
+    enabled: true
+    log_body: false                # Log request body (may contain sensitive data)
+    max_body_log_size: 1024
+```
+
+---
+
+## GeoDNS
+
+Geographic DNS routing based on client IP location.
+
+```yaml
+geodns:
+  enabled: true
+  default_pool: "us-east-pool"     # Fallback pool when no rule matches
+  db_path: "/etc/olb/GeoLite2-City.mmdb"  # MaxMind GeoLite2 database
+
+  rules:
+    - id: "eu-rule"
+      country: "DE"                # ISO 3166-1 alpha-2 country code
+      pool: "eu-west-pool"         # Route to this pool
+      weight: 100                  # Routing weight
+
+    - id: "asia-rule"
+      country: "JP"
+      pool: "ap-northeast-pool"
+      weight: 100
+
+    - id: "fallback-rule"
+      country: "*"                 # Wildcard matches all
+      pool: "us-east-pool"
+      weight: 50
+```
+
+Requires a MaxMind GeoLite2 City database (MMDB format). Download from [MaxMind](https://dev.maxmind.com/geoip/geolite2-free-geolocation-data).
+
+---
+
+## Shadow Traffic
+
+Mirror production traffic to a shadow backend for testing and analysis. Shadow responses are discarded — never returned to the client.
+
+```yaml
+shadow:
+  enabled: true
+  percentage: 10.0                 # Percentage of traffic to mirror (0-100)
+  copy_headers: true               # Copy request headers to shadow
+  copy_body: true                  # Copy request body to shadow
+  timeout: "5s"                    # Shadow request timeout
+
+  targets:
+    - pool: "shadow-pool"          # Target pool for mirrored traffic
+      percentage: 100.0            # Percentage of shadowed traffic to this target
+```
+
+Sensitive headers (Authorization, Cookie, Proxy-Authorization, X-Session-ID, X-CSRF-Token) are automatically stripped from shadow requests.
+
+---
+
+## Service Discovery
+
+Service discovery is configured per-pool, not at the top level. Each pool can use one or more discovery providers.
+
+```yaml
+pools:
+  - name: "api-pool"
+    algorithm: round_robin
+
+    discovery:
+      type: "dns"                  # "dns", "docker", "consul", "static", "file"
+      interval: "30s"              # Refresh interval
+
+      # DNS discovery
+      domain: "_api._tcp.example.com"
+      nameserver: "8.8.8.8:53"
+
+      # Docker discovery
+      # docker_host: "unix:///var/run/docker.sock"
+      # docker_label_filter: "com.example.service=api"
+
+      # Consul discovery
+      # consul_addr: "http://127.0.0.1:8500"
+      # consul_service: "api"
+      # consul_tag: "production"
+
+    backends: []                   # Optional static backends merged with discovered ones
+```
+
+| Provider | Config Key | Notes |
+|----------|-----------|-------|
+| DNS | `dns` | SRV record lookup. Queries over plaintext — see warnings at startup. |
+| Docker | `docker` | Docker daemon API. Use TLS for remote connections. |
+| Consul | `consul` | Consul catalog API. HTTP only. |
+| Static | (none) | Uses `backends` list directly. No auto-discovery. |
+| File | `file` | Read backends from a JSON/YAML file. |
+
+---
+
 ## Complete Example
 
 See [configs/olb.yaml](../configs/olb.yaml) for a full annotated configuration example.