mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
48d45cf7f4
The relay could not tell which application, platform, or version its
connections came from. `buzz_ws_connections_active` carries no labels and
`buzz_ws_connections_total` carries only `community`, so questions like
"how many macOS desktop users are on 0.4?" or "is anyone still on the old
CLI?" were unanswerable, and no client sent identifying handshake
metadata for the relay to read.
Rust clients now announce themselves with an advisory RFC 8941
`Buzz-Client` header, and the relay turns it into labeled metrics:
Buzz-Client: v=1, app=buzz-desktop, platform=macos, app-version="0.5.2"
buzz_client_connections_total{app,platform,app_version}
buzz_client_connections_active{app,platform,app_version}
buzz_client_header_parse_failures_total{reason}
Senders are wired for desktop, buzz-ws-client (CLI and test client), and
the buzz-acp harness. The vocabularies and serializer live in buzz-core
so all of them share one definition.
The live gauge is deliberately a new series rather than labels on
`buzz_ws_connections_active`: that gauge is the HPA scaling input
(`deploy/charts/buzz/values.yaml` `websocketMetricName`, an unlabeled
`AverageValue` target), and labeling it would shard the series the
autoscaler reads. `deploy/` is untouched and the chart's HPA unit tests
still pass. Retired label sets are dropped by the recorder's existing
gauge idle timeout.
Complements #2596, which adds the mobile sender and its own relay-side
parser. This change is based on main rather than on that branch, and the
parser ignores unknown dictionary keys, so it already accepts mobile's
richer header (`app-build`, `os-version`, `os-api`) unchanged. Widening
the allowlists to desktop/CLI/ACP and macOS/Windows/Linux, adding the
live gauge, and bucketing unidentified connections as `unknown` so the
totals reconcile are the gaps this closes.
Trust and cardinality: the header arrives before NIP-42 AUTH and is
forgeable, so it is advisory only and never touches authentication,
authorization, tenant selection, or admission. `app` and `platform`
resolve to `&'static str` from closed allowlists and `app_version` is
narrowed to bounded MAJOR.MINOR, so a forged header cannot introduce an
unbounded label value. Clients send the header only over TLS or to
loopback, so it is not exposed to on-path observers on cleartext
connections.
Signed-off-by: npub1x3mmseqygyar04742djuepgk0t2d2t4chzm9sl0hl4vlc2m9whvqza9e5y <3477b86404413a37d7d55365cc85167ad4d52eb8b8b6587df7fd59fc2b6575d8@buzz.block.builderlab.xyz>
Co-authored-by: Atish Patel <atish@squareup.com>
Signed-off-by: Atish Patel <atish@squareup.com>