sam-one

[aojea]

is the all-in-one SAM distribution: control plane, libp2p router
and storage in a single binary serving a single public port.

[gemini-code-assist]

Code Review

This pull request introduces sam-one, an all-in-one standalone server distribution that combines the control plane, libp2p router, and storage into a single binary serving a single public port. It also embeds the web console assets directly into the binary and updates sam-node to require an explicit control plane URL when joining a mesh. The review feedback recommends implementing a deferred cleanup block in standalone.Start to prevent resource leaks on initialization failures, and exposing the ConnsPerSourceIP setting as a configurable option and CLI flag in sam-one to allow customization of connection limits behind proxies.

[gemini-code-assist]

If Start fails after initializing the database store or the control plane, these resources (including background goroutines, HTTP servers, and database connections) are leaked if standalone is used as an embedded library. Adding a deferred cleanup block that calls s.Close() on failure ensures all partially allocated resources are cleanly released.

Suggested change

	func (o *Options) Validate() error {
	if _, err := wsListenMultiaddr(o.BindAddress); err != nil {
	return fmt.Errorf("invalid bind address %q: %w", o.BindAddress, err)
	}
	if o.ExternalURL != "" {
	store, err := storage.NewSQLStore(s.opts.DBDriver, s.opts.DBDSN)
	if err != nil {
	return fmt.Errorf("failed to open store: %w", err)
	}
	s.store = store
	var success bool
	defer func() {
	if !success {
	_ = s.Close()
	}
	}()

[gemini-code-assist]

Set the success flag to true on successful startup to prevent the deferred cleanup from rolling back the initialized server. The manual rtr.Close() call on failure can also be removed as it is now handled automatically by the deferred s.Close() call.

Suggested change

	mux := http.NewServeMux()
	cp.RegisterRoutes(mux)
	// The console proxies /console/api/* to the loopback control plane and
	// serves the embedded frontend; it queries /info at construction, which is
	if s.publicAddr, err = s.resolvePublicAddr(); err != nil {
	return err
	}
	success = true
	return nil

[gemini-code-assist]

Exposing ConnsPerSourceIP in standalone.Options allows operators to customize the per-source-IP connection limit. While a high limit (like 4000) is necessary behind TLS-terminating proxies or NATs, deployments running directly on a VM without a proxy should be able to lower this limit to protect against single-IP denial of service (DoS) attacks.

	OIDCIssuer       string
	AllowedAudiences []string
	// ConnsPerSourceIP overrides libp2p's per-source-IP inbound connection
	// cap when > 0. Defaults to router.DefaultHighWaterMark (4000).
	ConnsPerSourceIP int
}

[gemini-code-assist]

Set the default value for ConnsPerSourceIP to router.DefaultHighWaterMark if it is not explicitly configured.

	if len(o.AllowedAudiences) == 0 {
		o.AllowedAudiences = []string{api.DefaultAudience}
	}
	if o.ConnsPerSourceIP <= 0 {
		o.ConnsPerSourceIP = router.DefaultHighWaterMark
	}
}

[gemini-code-assist]

Pass the configured ConnsPerSourceIP option to the router configuration.

Suggested change

	ConnsPerSourceIP: s.opts.ConnsPerSourceIP,

[gemini-code-assist]

Declare a variable to hold the value of the new --conns-per-source-ip CLI flag.

Suggested change

	oidcClientID string
	allowedAudiencesFlag string
	logLevel string
	allowedAudiencesFlag string
	logLevel string
	connsPerSourceIP int
	)

[gemini-code-assist]

Pass the parsed connsPerSourceIP value to standalone.Options.

				OIDCIssuer:       oidcIssuer,
				AllowedAudiences: auds,
				ConnsPerSourceIP: connsPerSourceIP,
			})

[gemini-code-assist]

Register the --conns-per-source-ip flag on the root command to allow operators to customize this limit.

Suggested change

	rootCmd.Flags().StringSliceVar(&p2pListen, "p2p-listen", nil, "Optional extra native libp2p listen multiaddrs")
	rootCmd.Flags().StringVar(&dataDir, "data-dir", ".", "Directory for the database, router key and generated tokens")
	rootCmd.Flags().StringVar(&allowedAudiencesFlag, "allowed-audiences", api.DefaultAudience, "Comma-separated list of allowed OIDC audiences")
	rootCmd.Flags().StringVar(&logLevel, "log-level", "", "Log level: debug, info, warn, error")
	rootCmd.Flags().IntVar(&connsPerSourceIP, "conns-per-source-ip", 0, "Max inbound connections per source IP (0 keeps libp2p's default of 8); raise behind TLS-terminating proxies or NAT where many peers share source IPs")