We want to be able to be flexible with what rules apply to what traffic. Specifically:
- We want traffic in our web of trust to skip all filtering rules
- We want known, identified bots to get their own rate-limiting on uncached requests, and skip any other filtering rules
- We want users that are identified and making an api call to skip all rules (once things are implemented on the API side of things)
- We want all of our traffic that is uncached to go through so-called "moat mode rules"
We need to be able to do so in both haproxy and varnish.
grading
- Letter grades imply a total ordering that doesn't really exist, but it's more than close enough to be useful
- There's some desire for more freeform tags, but also, some very real concerns about that introducing too much complexity or making combinations too hard to reason about.
- Grades are also useful as a compact summary that's easy to pass down to the applayer to be reasoned about there.
- Grade A:
- Equivalent to the old wikimedia_trust of internal or otherwise-privileged IP spaces
- Change in policy: moat mode rules will now apply to uncached requests.
- Grade B:
- Known, authenticated Bots.
- Grade C:
- Community: requests from real human browsers (verified session cookie etc)
- This is the primary exception to the strict ordering: In the face of overwhelming traffic or limited resources, C should take priority over any other grade (definitely over B, and probably over A as well).
- Grade D:
- Reserved for future use.
- Grade E:
- Reserved for future use, but, the default grade.
- Grade F:
- Known abusers: requests are blocked or heavily throttled