we would of course have to locally cache the results for 7d or something (to disk, to survive restarts). i imagine the whole cache could be kept in ram without a problem.
we would of course have to locally cache the results for 7d or something (to disk, to survive restarts). i imagine the whole cache could be kept in ram without a problem.
Evaluated: GeoJS is suitable as a lookup source the operator switches on, beside the local file, but not as the only source or the default.
What it offers:
Free, with no account or key. One request can look up several addresses (?ip=a,b,c), and each answer carries the country code, the AS number and the AS name, which is all the sidecar needs.
Its data is MaxMind's free GeoLite database, so accuracy is about that of IPinfo Lite. Some ranges come back with no country (1.1.1.1 did).
Limits and risks:
Rate limits: none published ("No rate limits (yet)"), but its terms forbid "an excessive amount of API requests", judged by GeoJS alone, and let it block a caller's address outright. A swarm of fresh scraper addresses is when lookups peak, so a sidecar could lose its country lists in the middle of an attack. Your 7-day cache, and asking for many addresses in one request, keep the volume low.
Privacy: every new visitor's address goes to GeoJS, which runs on Cloudflare. Its policy says it keeps no access logs and cites Australian law; it says nothing about the GDPR. The spec already keeps DNS blocklists off by default for the same reason.
First request: an address not yet in the cache waits for GeoJS before a country list can refuse it. The wait is short and bounded, and a timeout counts as an unknown country.
It is run by one person and offered "as is".
So the spec update, #9, adds it as your config flag: one setting chooses GeoJS or the local file; lookups stay off until one is chosen; GeoJS answers are kept for 7 days in memory and in a state file, so they survive restarts. Nothing on by default needs a country, so keeping lookups off costs nothing out of the box. The PR closes this issue. Say if GeoJS should instead be on by default or replace the file.
Model: opus-5-5
Evaluated: GeoJS is suitable as a lookup source the operator switches on, beside the local file, but not as the only source or the default.
What it offers:
- Free, with no account or key. One request can look up several addresses (`?ip=a,b,c`), and each answer carries the country code, the AS number and the AS name, which is all the sidecar needs.
- Its data is MaxMind's free GeoLite database, so accuracy is about that of IPinfo Lite. Some ranges come back with no country (`1.1.1.1` did).
Limits and risks:
- Rate limits: none published ("No rate limits (yet)"), but its terms forbid "an excessive amount of API requests", judged by GeoJS alone, and let it block a caller's address outright. A swarm of fresh scraper addresses is when lookups peak, so a sidecar could lose its country lists in the middle of an attack. Your 7-day cache, and asking for many addresses in one request, keep the volume low.
- Privacy: every new visitor's address goes to GeoJS, which runs on Cloudflare. Its policy says it keeps no access logs and cites Australian law; it says nothing about the GDPR. The spec already keeps DNS blocklists off by default for the same reason.
- First request: an address not yet in the cache waits for GeoJS before a country list can refuse it. The wait is short and bounded, and a timeout counts as an unknown country.
- It is run by one person and offered "as is".
So the spec update, https://git.eeqj.de/sneak/smallwebwaf/pulls/9, adds it as your config flag: one setting chooses GeoJS or the local file; lookups stay off until one is chosen; GeoJS answers are kept for 7 days in memory and in a state file, so they survive restarts. Nothing on by default needs a country, so keeping lookups off costs nothing out of the box. The PR closes this issue. Say if GeoJS should instead be on by default or replace the file.
Model: opus-5-5
clawbot
self-assigned this 2026-09-23 15:00:18 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
please evaluate if suitable, including any api rate limits etc
we would of course have to locally cache the results for 7d or something (to disk, to survive restarts). i imagine the whole cache could be kept in ram without a problem.
Evaluated: GeoJS is suitable as a lookup source the operator switches on, beside the local file, but not as the only source or the default.
What it offers:
?ip=a,b,c), and each answer carries the country code, the AS number and the AS name, which is all the sidecar needs.1.1.1.1did).Limits and risks:
So the spec update, #9, adds it as your config flag: one setting chooses GeoJS or the local file; lookups stay off until one is chosen; GeoJS answers are kept for 7 days in memory and in a state file, so they survive restarts. Nothing on by default needs a country, so keeping lookups off costs nothing out of the box. The PR closes this issue. Say if GeoJS should instead be on by default or replace the file.
Model: opus-5-5