131868bdca
Major security, observability, and configuration improvements:
## Security Hardening
- Implemented configurable CORS (no more wildcards)
- Added comprehensive auth middleware for admin endpoints
- Enhanced webhook HMAC validation
- Added input validation and rate limiting
- Security headers and CSP policies
## Configuration Management
- Made N8N webhook URL configurable (WHOOSH_N8N_BASE_URL)
- Replaced all hardcoded endpoints with environment variables
- Added feature flags for LLM vs heuristic composition
- Gitea fetch hardening with EAGER_FILTER and FULL_RESCAN options
## API Completeness
- Implemented GetCouncilComposition function
- Added GET /api/v1/councils/{id} endpoint
- Council artifacts API (POST/GET /api/v1/councils/{id}/artifacts)
- /admin/health/details endpoint with component status
- Database lookup for repository URLs (no hardcoded fallbacks)
## Observability & Performance
- Added OpenTelemetry distributed tracing with goal/pulse correlation
- Performance optimization database indexes
- Comprehensive health monitoring
- Enhanced logging and error handling
## Infrastructure
- Production-ready P2P discovery (replaces mock implementation)
- Removed unused Redis configuration
- Enhanced Docker Swarm integration
- Added migration files for performance indexes
## Code Quality
- Comprehensive input validation
- Graceful error handling and failsafe fallbacks
- Backwards compatibility maintained
- Following security best practices
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
87 lines
1.9 KiB
Go
87 lines
1.9 KiB
Go
// Copyright 2018 The Go Authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
// CPU affinity functions
|
|
|
|
package unix
|
|
|
|
import (
|
|
"math/bits"
|
|
"unsafe"
|
|
)
|
|
|
|
const cpuSetSize = _CPU_SETSIZE / _NCPUBITS
|
|
|
|
// CPUSet represents a CPU affinity mask.
|
|
type CPUSet [cpuSetSize]cpuMask
|
|
|
|
func schedAffinity(trap uintptr, pid int, set *CPUSet) error {
|
|
_, _, e := RawSyscall(trap, uintptr(pid), uintptr(unsafe.Sizeof(*set)), uintptr(unsafe.Pointer(set)))
|
|
if e != 0 {
|
|
return errnoErr(e)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// SchedGetaffinity gets the CPU affinity mask of the thread specified by pid.
|
|
// If pid is 0 the calling thread is used.
|
|
func SchedGetaffinity(pid int, set *CPUSet) error {
|
|
return schedAffinity(SYS_SCHED_GETAFFINITY, pid, set)
|
|
}
|
|
|
|
// SchedSetaffinity sets the CPU affinity mask of the thread specified by pid.
|
|
// If pid is 0 the calling thread is used.
|
|
func SchedSetaffinity(pid int, set *CPUSet) error {
|
|
return schedAffinity(SYS_SCHED_SETAFFINITY, pid, set)
|
|
}
|
|
|
|
// Zero clears the set s, so that it contains no CPUs.
|
|
func (s *CPUSet) Zero() {
|
|
for i := range s {
|
|
s[i] = 0
|
|
}
|
|
}
|
|
|
|
func cpuBitsIndex(cpu int) int {
|
|
return cpu / _NCPUBITS
|
|
}
|
|
|
|
func cpuBitsMask(cpu int) cpuMask {
|
|
return cpuMask(1 << (uint(cpu) % _NCPUBITS))
|
|
}
|
|
|
|
// Set adds cpu to the set s.
|
|
func (s *CPUSet) Set(cpu int) {
|
|
i := cpuBitsIndex(cpu)
|
|
if i < len(s) {
|
|
s[i] |= cpuBitsMask(cpu)
|
|
}
|
|
}
|
|
|
|
// Clear removes cpu from the set s.
|
|
func (s *CPUSet) Clear(cpu int) {
|
|
i := cpuBitsIndex(cpu)
|
|
if i < len(s) {
|
|
s[i] &^= cpuBitsMask(cpu)
|
|
}
|
|
}
|
|
|
|
// IsSet reports whether cpu is in the set s.
|
|
func (s *CPUSet) IsSet(cpu int) bool {
|
|
i := cpuBitsIndex(cpu)
|
|
if i < len(s) {
|
|
return s[i]&cpuBitsMask(cpu) != 0
|
|
}
|
|
return false
|
|
}
|
|
|
|
// Count returns the number of CPUs in the set s.
|
|
func (s *CPUSet) Count() int {
|
|
c := 0
|
|
for _, b := range s {
|
|
c += bits.OnesCount64(uint64(b))
|
|
}
|
|
return c
|
|
}
|