fix: harden TLS config and add rate limiting

- Admin/gRPC TLS: restrict to ECDHE GCM cipher suites
- Admin TLS: add client CA and mTLS support
- Chatbot: log warning when CHATBOT_INSECURE_TLS is enabled
- Admin API: add per-IP sliding window rate limiter

Author: mahmut-Abi

internal/admin/chatbot/client.go

@@ -9,6 +9,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"log/slog"
 	"net/http"
 	"os"
 	"strings"
@@ -58,9 +59,14 @@ type openAIStreamDelta struct {
 func NewOpenAIAdapter(endpoint, apiKey, model string, temperature float64) LLMClient {
 	endpoint = strings.TrimRight(endpoint, "/")
 
+	insecureSkipVerify := os.Getenv("CHATBOT_INSECURE_TLS") == "true"
+	if insecureSkipVerify {
+		slog.Warn("CHATBOT_INSECURE_TLS is enabled — TLS certificate verification is disabled for LLM API calls")
+	}
+
 	transport := &http.Transport{
 		TLSClientConfig: &tls.Config{
-			InsecureSkipVerify: os.Getenv("CHATBOT_INSECURE_TLS") == "true",
+			InsecureSkipVerify: insecureSkipVerify,
 		},
 	}
 

internal/admin/rate_limiter.go

@@ -0,0 +1,64 @@
+package admin
+
+import (
+	"net/http"
+	"sync"
+	"sync/atomic"
+	"time"
+)
+
+type rateLimiter struct {
+	maxRequests int64
+	window      time.Duration
+
+	mu        sync.Mutex
+	lastReset time.Time
+	counters  map[string]*int64
+}
+
+func newRateLimiter(maxRequests int64, window time.Duration) *rateLimiter {
+	if maxRequests <= 0 || window <= 0 {
+		return nil
+	}
+	return &rateLimiter{
+		maxRequests: maxRequests,
+		window:      window,
+		counters:    make(map[string]*int64),
+	}
+}
+
+func (rl *rateLimiter) middleware(next http.Handler) http.Handler {
+	if rl == nil {
+		return next
+	}
+
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		key := r.RemoteAddr
+
+		rl.mu.Lock()
+		now := time.Now().UTC()
+		if now.Sub(rl.lastReset) >= rl.window {
+			rl.counters = make(map[string]*int64)
+			rl.lastReset = now
+		}
+
+		counter, ok := rl.counters[key]
+		if !ok {
+			var c int64 = 1
+			rl.counters[key] = &c
+			rl.mu.Unlock()
+			next.ServeHTTP(w, r)
+			return
+		}
+
+		count := atomic.AddInt64(counter, 1)
+		rl.mu.Unlock()
+
+		if count > rl.maxRequests {
+			http.Error(w, "too many requests", http.StatusTooManyRequests)
+			return
+		}
+
+		next.ServeHTTP(w, r)
+	})
+}

internal/config/config.go

@@ -70,11 +70,14 @@ type LeaderElectionConfig struct {
 type AdminAuthConfig struct {
 	BearerToken     string `yaml:"bearerToken"`
 	BearerTokenFile string `yaml:"bearerTokenFile"`
+	RateLimitRPS    int64  `yaml:"rateLimitRPS"`
 }
 
 type PprofConfig struct {
-	Enabled bool   `yaml:"enabled"`
-	Addr    string `yaml:"addr"`
+	Enabled         bool   `yaml:"enabled"`
+	Addr            string `yaml:"addr"`
+	BearerToken     string `yaml:"bearerToken"`
+	BearerTokenFile string `yaml:"bearerTokenFile"`
 }
 
 type NodeStatusConfig struct {
@@ -125,9 +128,11 @@ type NodeDriftConfig struct {
 }
 
 type AdminTLSConfig struct {
-	Enabled  bool   `yaml:"enabled"`
-	CertPath string `yaml:"certPath"`
-	KeyPath  string `yaml:"keyPath"`
+	Enabled           bool   `yaml:"enabled"`
+	CertPath          string `yaml:"certPath"`
+	KeyPath           string `yaml:"keyPath"`
+	ClientCAPath      string `yaml:"clientCAPath"`
+	RequireClientCert bool   `yaml:"requireClientCert"`
 }
 
 type GRPCTLSConfig struct {

internal/grpcserver/tls.go

@@ -57,6 +57,12 @@ func loadStaticServerTLSConfig(cfg config.GRPCTLSConfig) (*tls.Config, error) {
 		MinVersion:   tls.VersionTLS12,
 		Certificates: []tls.Certificate{certificate},
 		NextProtos:   []string{"h2"},
+		CipherSuites: []uint16{
+			tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+			tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+			tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+			tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+		},
 	}
 
 	if cfg.RequireClientCert && strings.TrimSpace(cfg.ClientCAPath) == "" {