release: v2.2.1

Secure loopback HTTPS admin access (Caddy 8443 + HTTP/2), dashboard
performance work (SQLite metadata queries, log-accounting, session
rollups), and DataTable column-resizing fixes.

Co-Authored-By: Drew Michael <dmichael@fastly.com>

Author: dmichael-fastly

Caddyfile

@@ -26,8 +26,9 @@
 #   range, refresh this list. A stale list means legitimate traffic from a
 #   new POP is treated as direct (untrusted) until Caddy reloads.
 {
-	# No auto-HTTPS — Fastly handles TLS termination at the edge.
-	auto_https off
+	# Disable automatic HTTP-to-HTTPS redirects. We serve HTTP explicitly on port 80
+	# behind Fastly, but manage TLS for other explicit blocks (port 8443).
+	auto_https disable_redirects
 
 	# Rate limit module (provided by custom Caddy image, see caddy/Dockerfile).
 	# 5 share-login attempts / minute per Fastly client IP.
@@ -349,3 +350,51 @@ Policy: https://github.com/fastly/fastly-log-analytics/blob/main/SECURITY.md
 		level INFO
 	}
 }
+
+# Loopback HTTPS block on port 8443 for secure direct SSH-tunnel admin connections.
+# This terminates TLS using Caddy's internal self-signed certificate authority,
+# enabling the browser to negotiate HTTP/2 (multiplexing) over the tunnel.
+# This prevents client-side TCP connection starvation (tab freezing) while keeping
+# admin access bound strictly to the local loopback/SSH boundary.
+https://localhost:8443, https://127.0.0.1:8443 {
+	# Caddy only restricts the listener's bind address when every address in
+	# a site block is a literal IP — "localhost" is a hostname, so without
+	# this directive Caddy binds :8443 on ALL interfaces (verified via
+	# `caddy adapt`), not just loopback, despite the comment above. Pin the
+	# listener itself to loopback so the X-Forwarded-For pin below can't be
+	# reached by anything but a genuine same-host connection.
+	bind 127.0.0.1 ::1
+
+	tls internal
+
+	encode zstd gzip
+	request_body {
+		max_size 25MB
+	}
+
+	import security_headers
+
+	# API → backend (preserve Host so backend's DNS-rebinding gate matches the
+	# registered public_endpoint). Pin X-Forwarded-For to 127.0.0.1 so the
+	# backend classifies the operator as the local admin.
+	@api path /api/*
+	reverse_proxy @api 127.0.0.1:8000 {
+		header_up X-Forwarded-For 127.0.0.1
+		flush_interval -1
+		transport http {
+			response_header_timeout 120s
+			read_timeout 120s
+		}
+	}
+
+	# Everything else → Next.js frontend.
+	reverse_proxy 127.0.0.1:3000 {
+		flush_interval -1
+	}
+
+	log {
+		output stdout
+		format json
+		level INFO
+	}
+}

backend/core/_duckdb_status.py

@@ -584,7 +584,7 @@ def update_top_values(con: duckdb.DuckDBPyConnection, source: dict):
         "pop",
     ]
 
-    schema_cols = {f["name"] for f in get_schema(con, source)}
+    schema_cols = {f["name"] for f in get_schema(con, source, stats=False)}
     fields = [f for f in fields if f in schema_cols or (f == "waf_sig_ind" and "waf_sig" in schema_cols)]
 
     if not fields:
@@ -813,8 +813,8 @@ def delete_ingested_files(
     }
 
 
-_schema_cache: dict[tuple[str, str], tuple[float, list[dict[str, Any]]]] = {}
-# (source_name, table_name) -> (timestamp, schema_list)
+_schema_cache: dict[tuple[str, str, bool], tuple[float, list[dict[str, Any]]]] = {}
+# (source_name, table_name, stats) -> (timestamp, schema_list)
 # The heavy refresh_config_status path fires SUMMARIZE every 60 s. With the
 # previous 60 s TTL the cache aged out at exactly the heavy-tick interval —
 # now-ts hit 60.0 right when the next call landed, so we missed every time
@@ -838,14 +838,18 @@ def _clear_schema_cache(source_name: str | None = None):
         _schema_cache = {}
 
 
-def get_schema(con: duckdb.DuckDBPyConnection, source: dict | None = None) -> list[dict]:
+def get_schema(
+    con: duckdb.DuckDBPyConnection,
+    source: dict | None = None,
+    stats: bool = True,
+) -> list[dict]:
     """Return column names and types for a source's table."""
     src = source or _db_main._DEFAULT_SOURCE
     source_name = src["name"]
     table_name = _safe_table_name(source_name)
 
     now = time.time()
-    cache_key = (source_name, table_name)
+    cache_key = (source_name, table_name, stats)
     if cache_key in _schema_cache:
         ts, schema = _schema_cache[cache_key]
         if now - ts < _SCHEMA_CACHE_TTL:
@@ -864,6 +868,13 @@ def get_schema(con: duckdb.DuckDBPyConnection, source: dict | None = None) -> li
         if not table_exists:
             return []
 
+        if not stats:
+            # SRE-22: Instant catalog schema reflection via DESCRIBE bypasses heavy data scans
+            result = con.execute(f"DESCRIBE {table_name}").fetchall()
+            schema = [{"name": r[0], "type": r[1]} for r in result]
+            _schema_cache[cache_key] = (now, schema)
+            return schema
+
         # Use SUMMARIZE to get rich metadata instead of just DESCRIBE.
         # 10_000 rows is enough sample for the precision the UI displays
         # (null % to 1 decimal, approx_unique relative error ~3%); the prior

backend/core/duckdb.py

@@ -1069,6 +1069,25 @@ def get_connection(
             # to keep stderr clean during the dashboard's RO query path.
             logger.debug("[duckdb] update_iceberg_view skipped on RO connection: %s", e)
 
+    # Pre-attach NGWAF bot cache if configured and exists to eliminate request-time ATTACH latency (1.2s overhead)
+    try:
+        from backend import config as svcconfig
+
+        ngwaf_db = svcconfig.ngwaf_db_path()
+        if ngwaf_db and os.path.exists(ngwaf_db):
+            existing = con.execute(
+                "SELECT database_name FROM duckdb_databases() WHERE database_name IN ('ngwaf_top', 'ngwaf_cache')"
+            ).fetchall()
+            attached_aliases = {row[0] for row in existing}
+
+            ngwaf_db_escaped = ngwaf_db.replace("'", "''")
+            if "ngwaf_top" not in attached_aliases:
+                con.execute(f"ATTACH '{ngwaf_db_escaped}' AS ngwaf_top (TYPE SQLITE, READ_ONLY)")
+            if "ngwaf_cache" not in attached_aliases:
+                con.execute(f"ATTACH '{ngwaf_db_escaped}' AS ngwaf_cache (TYPE SQLITE, READ_ONLY)")
+    except Exception as e:
+        logger.warning("[duckdb] Failed to pre-attach NGWAF bot cache: %s", e)
+
     # Operational metadata (alerts, views, audit, cron, sources, ingested_files,
     # asn_names, usage_log) lives in per-service SQLite — see backend.core.metadata package.
     # DuckDB now holds nothing but session-scoped Iceberg views and temp tables.

backend/core/metadata/__init__.py

@@ -70,6 +70,7 @@
     close_all_connections,
     db_path,
     get_con,
+    get_con_readonly,
     teardown,
 )
 
@@ -232,6 +233,7 @@ def __setattr__(self, name: str, value) -> None:
     # Connection / schema (public)
     "db_path",
     "get_con",
+    "get_con_readonly",
     "close_all_connections",
     "teardown",
     # Alerts

backend/core/metadata/asn_cache.py

@@ -4,21 +4,23 @@
 
 from datetime import UTC, datetime, timedelta
 
-from backend.core.metadata.base import get_con
+from backend.core.metadata.base import get_con, get_con_readonly
 from backend.utils.date_utils import iso_z, iso_z_now
 
 
 def lookup_asn_names(service_id: str, asns: list[int], max_age_days: int = 30) -> dict[int, str]:
     """Return cached {asn: name} for the requested ASNs that are still fresh."""
     if not asns:
         return {}
-    con = get_con(service_id)
+    import contextlib
+
     fresh_cutoff = iso_z(datetime.now(UTC) - timedelta(days=max_age_days))
     placeholders = ",".join("?" * len(asns))
-    rows = con.execute(
-        f"SELECT asn, name FROM asn_names WHERE asn IN ({placeholders}) AND fetched_at >= ?",
-        list(asns) + [fresh_cutoff],
-    ).fetchall()
+    with contextlib.closing(get_con_readonly(service_id)) as con:
+        rows = con.execute(
+            f"SELECT asn, name FROM asn_names WHERE asn IN ({placeholders}) AND fetched_at >= ?",
+            list(asns) + [fresh_cutoff],
+        ).fetchall()
     return {int(r["asn"]): r["name"] for r in rows}
 
 
@@ -41,9 +43,11 @@ def asn_ints_for_search(service_id: str, name_ilike: str) -> list[int]:
     Used by the dashboard ASN search to pre-fetch matching ASNs and inline them
     into a DuckDB IN clause (avoids cross-engine JOINs).
     """
-    con = get_con(service_id)
-    rows = con.execute(
-        "SELECT asn FROM asn_names WHERE name LIKE ? COLLATE NOCASE",
-        (name_ilike,),
-    ).fetchall()
+    import contextlib
+
+    with contextlib.closing(get_con_readonly(service_id)) as con:
+        rows = con.execute(
+            "SELECT asn FROM asn_names WHERE name LIKE ? COLLATE NOCASE",
+            (name_ilike,),
+        ).fetchall()
     return [int(r["asn"]) for r in rows]

backend/core/metadata/base.py

@@ -188,6 +188,16 @@ def get_con(service_id: str) -> sqlite3.Connection:
     return _pool.get(service_id)
 
 
+def get_con_readonly(service_id: str) -> sqlite3.Connection:
+    """Return a short-lived read-only SQLite connection for the given service.
+
+    This connection is not pooled and should be closed immediately.
+    """
+    if not os.path.exists(db_path(service_id)):
+        get_con(service_id)
+    return _pool.open_readonly(service_id)
+
+
 def close_all_connections() -> None:
     """Close every connection opened by ``get_con`` in any thread.
 
@@ -316,6 +326,8 @@ def teardown(service_id: str) -> None:
     # TEMP B-TREE sort over the full table because `idx_cron_task_started`
     # requires a leading-`task` predicate to satisfy the ORDER BY.
     "CREATE INDEX IF NOT EXISTS idx_cron_started ON cron_runs(started_at DESC)",
+    # Covers status polls and startup reap_running_cron_runs without a task filter
+    "CREATE INDEX IF NOT EXISTS idx_cron_status ON cron_runs(status)",
     """CREATE TABLE IF NOT EXISTS asn_names (
         asn INTEGER PRIMARY KEY,
         name TEXT NOT NULL,

backend/core/metadata/cron_log.py

@@ -15,7 +15,7 @@
 from collections.abc import Callable
 from datetime import UTC, datetime, timedelta
 
-from backend.core.metadata.base import _ORPHAN_THRESHOLD_MINS, _TASK_ORPHAN_THRESHOLD_MINS, get_con
+from backend.core.metadata.base import _ORPHAN_THRESHOLD_MINS, _TASK_ORPHAN_THRESHOLD_MINS, get_con, get_con_readonly
 from backend.utils.date_utils import iso_z, iso_z_now, parse_iso_utc
 
 logger = logging.getLogger(__name__)
@@ -443,10 +443,12 @@ def get_cron_run_status(service_id: str, run_id: int) -> str | None:
     on any DB failure so list_active_runs falls back to the in-memory
     signal (we'd rather show a false in-flight than miss a real one).
     """
+    import contextlib
+
     try:
-        con = get_con(service_id)
-        row = con.execute("SELECT status FROM cron_runs WHERE id = ?", (run_id,)).fetchone()
-        return row["status"] if row else None
+        with contextlib.closing(get_con_readonly(service_id)) as con:
+            row = con.execute("SELECT status FROM cron_runs WHERE id = ?", (run_id,)).fetchone()
+            return row["status"] if row else None
     except sqlite3.Error as e:
         logger.debug("[metadata_db] get_cron_run_status(%s, %s) failed: %s", service_id, run_id, e)
         return None
@@ -459,12 +461,14 @@ def get_cron_run_result(service_id: str, run_id: int) -> dict | None:
 
     Distinct from ``get_cron_run_status`` because the SSE stream also
     needs the log_output to replay the run's terminal lines."""
+    import contextlib
+
     try:
-        con = get_con(service_id)
-        row = con.execute("SELECT status, log_output FROM cron_runs WHERE id = ?", (run_id,)).fetchone()
-        if row is None:
-            return None
-        return {"status": row["status"], "log_output": row["log_output"]}
+        with contextlib.closing(get_con_readonly(service_id)) as con:
+            row = con.execute("SELECT status, log_output FROM cron_runs WHERE id = ?", (run_id,)).fetchone()
+            if row is None:
+                return None
+            return {"status": row["status"], "log_output": row["log_output"]}
     except sqlite3.Error as e:
         logger.debug("[metadata_db] get_cron_run_result(%s, %s) failed: %s", service_id, run_id, e)
         return None