From 2c6565da8d7763f4152f770012c5867f2e42ecb5 Mon Sep 17 00:00:00 2001 From: Takwa Date: Mon, 2 Nov 2026 10:32:59 +0100 Subject: [PATCH] Refuse PUT provide requests at route-origin needle does not support provide, so these always ended in a 500 that read as a server fault in the 5xx alerts. Co-Authored-By: Claude Opus 5.5 --- k8s/route-origin/envoy.yaml.j2 | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/k8s/route-origin/envoy.yaml.j2 b/k8s/route-origin/envoy.yaml.j2 index 7e3ded0..b0f7282 100644 --- a/k8s/route-origin/envoy.yaml.j2 +++ b/k8s/route-origin/envoy.yaml.j2 @@ -186,6 +186,19 @@ static_resources: # anything not listed here - including endpoints a future # needle release adds - is never exposed publicly. routes: + # needle does not support provide: ProvideBitswap always + # returns ErrNotSupported, which boxo answers with a 500. + # Refused here so a client sending these does not read + # as a server fault in the 5xx alerts. + - match: + prefix: "/routing/v1/providers" + headers: + - name: ":method" + string_match: { exact: "PUT" } + direct_response: + status: 405 + body: { inline_string: "provide is not supported\n" } + decorator: { operation: provide-refused } # IPNS publishing is deliberately open, matching the # production delegated-ipfs.dev: records are # self-certifying, but each PUT fans out to the DHT, so