Platform

You'll be able to: list the layers every response passes through, in order; name the four routes that serve files from the content checkouts; and explain why the rate limiter and the admission gate are two mechanisms rather than one.

platform is the twelfth context and the odd one out. It has no domain — no aggregate, no rules about the subject matter — so it has no layers either. It is one flat folder of about twenty modules, each owning one cross-cutting concern.

The layer stack

Every response the origin sends — API, proxied page, file, or error — passes through the same layers. lib.rs::app() composes them, outermost first:

The CSP is the one with history. It allows self, the Keycloak origin and a short list of named third parties, so a misconfigured issuer shows up as a broken sign-in rather than a wildcard policy. Its looser allowances are each tied to a real breakage: Google Fonts and inline theme scripts; blob: workers for Monaco; 'unsafe-eval' because the D2 worker builds its layout engine with new Function(); and 'wasm-unsafe-eval' for the visualisation engine.

Routes that read the checkouts

Four routes serve files directly from the mounted content checkouts, without going through a context:

All of them probe the mounted sources in order, first hit wins, and each guards against path traversal per root. Media is path-addressed, not content-hashed, because authors replace files in place — which is why it gets an hour rather than a year. The boards get a year because their path is their content: {hash} is the hash of the D2 source.

Two proxies

• Astro proxy (astro_proxy.rs) — the router's fallback. Every registered route wins first, so a page path can never shadow an API route, and the web tier's 404 page becomes the site's 404. Hashed assets it forwards are stamped immutable for a year.
• d2-render proxy (d2_render_proxy.rs) — mounted only when SYNAPSE_D2_RENDER_URL is set. GET-only, buffered, content type forced to SVG, and an unreachable renderer is a 502, never a crash.

Protecting the sandbox

Two mechanisms, because they measure different things:

A rate limit cannot see how long a run holds the sandbox. Ten slow runs a minute from one address is inside the budget and still several minutes of sandbox time, and go-judge runs one program at a time. Admission bounds the queue itself. Both keep their counters in process memory, which is why the deployment must stay at one replica until they move to shared storage.

client_ip.rs resolves the anonymous key. Cloudflare names the real client in CF-Connecting-IP; the origin trusts that header only on a request that actually came through the edge, so a direct request cannot pick its own budget. It is good enough for budgets and never used for authorisation.

Everything else