Geofencing

Overview

The Geofencing service is a core service, providing access validation and information about IP addresses trying to access DAZN. The service is available in all environments on https://geofencing.core.${daznEnv}.com

Service information is available on Confluence.

Architecture

Auxilary services

Maxmind

We use Maxmind as a database provider for geo information based on IP. When the server first starts it will check the local file system for cached database files and if they don't exist or their ETAGs do not match the remote ones, it will kick off a background job, downloading the newest version of the databases. This logic also runs in a cron manner based on the MAXMIND_RELOAD_CRON_PATTERN environment variable.

Allowlist (Geofencing ACLs)

We maintain a manual list of allowed IPs and networks via the Geofencing ACLs module. This list is cached inside the service and has a lifetime specified via the ALLOW_LIST_CACHE_TIME environment variable.

Vault

Vault stores secrets related to authentication to both external services and API keys to access geofencing itself. Look in the vault service for details.

Development

Prequisites

• NodeJS (see .nvmrc for expected version)
• Yarn (version 1)
• DAZN CLI (for accessing cloud services from local machine)

Running locally

1. Install all dependencies - yarn install --frozen-lockfile
2. Download latest MMDB files - dazn aws exec -p dazn-core-dev -- yarn fetch:mmdb
3. Start the server - dazn aws exec -p dazn-core-dev -- yarn start:dev
4. The service is now available on http://localhost:3000

Testing

Unit tests

The service contains a suite of unit tests, focused only on the business logic of the usecases. They do not require any outbound communication and can be ran offline via yarn test:unit

Integration tests

The service contains an integration test suite that doubles as a regression test suite. It tries to test the service from an outside in perspective and record any observable results from a client's perspective. Because we want this to be as close as possible to the real thing, there is minimal outbound communication in some of the test suites to services like Vault. To run the integration tests, you can use the following command: yarn test:integration-local. Note that due to the usage of a architecture/OS specific utility (ACL MMB lib), you will need a suitable compiled version of the lib available at root of this module, this can be easily acquired by running the appropriate build command in that module & copying to ./acl-mmdb.

Debugging

VSCode

⚠️ IMPORTANT ⚠️ In order to be able to fully debug the service with external access in VSCode, you must enable the integrated terminal for NodeJS debugging and place it in the DAZN CLI context like so:

The service is fully debuggable in VSCode with the following configuration:

{
  "version": "0.2.0",
  "configurations": [
    {
      "type": "node",
      "request": "launch",
      "protocol": "inspector",
      "name": "Debug Server (TS)",
      "cwd": "${workspaceFolder}",
      "args": [ "src/main.ts" ],
      "runtimeArgs": [
        "--nolazy",
        "-r",
        "ts-node/register/transpile-only"
      ],
      "console": "integratedTerminal",
      "skipFiles": [
        "<node_internals>/**"
      ],
    }
  ]
}

The unit test suite is also fully debuggable inside the VSCode debugger with the following configuration:

{
  "version": "0.2.0",
  "configurations": [
    {
      "type": "node",
      "request": "launch",
      "protocol": "inspector",
      "name": "Debug Unit tests (TS)",
      "cwd": "${workspaceFolder}",
      "program": "${workspaceRoot}/node_modules/jest/bin/jest.js",
      "args": [
        "--runInBand",
        "--config=./tests/config/jest.unit.config.ts"
      ],
      "runtimeArgs": [
        "--nolazy",
        "-r",
        "ts-node/register/transpile-only"
      ],
      "console": "integratedTerminal",
      "skipFiles": [
        "<node_internals>/**"
      ]
    }
  ]
}

How to Release

| Environment | Method | |:------------|:---------------------------- | | Dev | Deploy workflow dispatch (Manually through Github actions UI) | | Test | Main branch push (PR merge) | | Stage | Main branch push (PR merge) | | Prod | Tag push |

Rollback can be performed by rerunning the previous tag build.

Chaos

The Geofencing service implements the Chaos service, a system for disrupting the normal operation of the container environment to exercise service stability (only active in preprod environments). Chaos is configured using Fig.

Load Tests

See here for more info on load tests.