Live Cloud Instance - Talawa API and Talawa-Admin

[palisadoes]

We really need to get a live demo of both Talawa-API and Talawa-Admin up and running. The docker issues were created to fix this. The aim was for:

1. any new updates to the main branch to be immediately applied to the running GoDaddy instances
2. the database to be reinitialized every 24 hours
3. to have some sort of rate limiting applied

Now that things have settled down, can you look into finalizing the implementation?

The live demo will allow people to test out the application. This will encourage them to contribute code and also to test out the code in their own organizations and clubs. We think that many open source communities will be interested in using Talawa for their own planning.

We are starting work on approaching clubs in past GSoC and Calico universities, but need the live demo up and running and automated soon.

Let us know the best approach to completing this

[palisadoes]

@AVtheking @vasujain275 @Manik2708 @Cioppolo14 @noman2002

PTAL. We need to figure out how best to implement this

• Cloud Based API Instance for Developers #1428
• Talawa-Admin Docker Support Issue talawa-admin#1075
• Implementing Rate Limiter through Redis #1782

[Manik2708]

I worked a bit on Redis Rate Limiter, but got to know that Express Rate Limiter is fine. @EshaanAgg said that it's very difficult to manage our own rate limiter as it would require networking expertise. Therefore this issue was closed.

[palisadoes]

Thanks. Let's see how we can implement the cloud instance with suitable rate limiting.

[vasujain275]

@palisadoes Sorry for the delay due to my exams. They are over now, and I will try to solve this as soon as possible. Here is the approach I think will be the best:

• We should implement third-party rate limiting, preferably open source or with a very generous free tier, because rate limiting is really hard and has many edge cases. We should not make an in-house rate limiter for sure.
• The Docker CI/CD pipeline was halted due to problems in the build process of talawa-api, which @varshith257 was fixing and should be fixed by now. I haven't checked them yet.
• So, basically, only two things are left in the live cloud instance: Rate Limiting and fixing the CI/CD pipeline according to the new build process.

[palisadoes]

How can we setup acceptable rate limiting without using a third party and writing it ourselves? Why aren't the Redis rate limiting features suitable?

Typical end users won't have access to third parties, so we'll need to have a solution.

[palisadoes]

Please restart these efforts if you can.

[vasujain275]

I think there should be a npm package for some good rate limiting, as for redis rate limiting there are too many edge cases and nuances to it making it a terrible idea. I will look into npm packages that can be useful to us.

[AVtheking]

I think express rate limiter would work fine . For the DDoS protection we can use cloudflare it is the good protection against the DDoS attack.

[vasujain275]

Yeah the cloudflare idea is good, we won't need certbot to renew ssl certificates. Cloudflare will handle ssl certs for us. But cloudflare ddos protection needs captcha every time some request to site. Do you suggest we toggle ddos protection when we are under any attack? Or the cloudflare auto detects a ddos attack?

[AVtheking]

I think cloudflare autodetect a ddos attack.

[palisadoes]

We don't need cloudflare or node packages. The Apache rate limiter should be sufficient. This is for a demo instance that will be used by very few people. Apache will be easy to implement.

We really need this to be up and running.

[AVtheking]

Would the Apache able to prevent DDoS attack? I agree that this would be the demo instance but still there would be many hackers who would try ddos for fun. Cloudflare is free service and the implementation of DDoS prevention is easy using it.

[palisadoes]

We should focus on getting the instance running then consider third party services like Cloud Flare.

Apache will rate limit and can do a reverse proxy which will be a good first step

https://httpd.apache.org/docs/trunk/misc/security_tips.html

UFW may also have useful capabilities

[palisadoes]

Nginx should have similar features

[Cioppolo14]

@vasujain275 @noman2002 @AVtheking @Manik2708 @varshith257 Based on my read of above, @varshith257 is going to continue to resolve the api build issue, and @vasujain275 has the ci/cd issue is good, working shape. @vasujain275 are you also working on the rate limiting aspect? Does that need a separate issue?

[vasujain275]

@Cioppolo14 I have done some research about rate limiting using nginx itslef as @palisadoes suggested and got to the conclusion that we don't even need that. Our current api limitng in app.ts seems to be good for now -

const apiLimiter = rateLimit({
  windowMs: 60 * 60 * 1000,
  max: 50000,
  message: "Too many requests from this IP, please try again after 15 minutes",
});

[palisadoes]

Thanks. How can we get the instance up and running?