Remaining tasks to improve the security, quality, and performance of GoZone.
Delivered end-to-end: discovery, PKCE+state+nonce, JWKS ID-token verification
with operator-tunable cache TTL, JIT provisioning, role/group mapping,
RP-initiated logout, and idle/absolute session enforcement shared across
instances (DB-backed sessions table). See docs/SSO.md.
-
Add Prometheus metrics
- Request count per endpoint
- Request latency
- Errors by type
- Zone/record/user counts
- PowerDNS response time
-
Add distributed tracing
- Use
go.opentelemetry.io/otel - Trace PowerDNS calls
- Trace SQL queries
- Export to Jaeger or Zipkin
- Use
- Average response time < 100ms for API endpoints
- Average response time < 500ms for web pages
- Support 100 requests/second with SQLite
- Support 1000 requests/second with PostgreSQL (future)
- No multi-writer support (hence
SetMaxOpenConns(1)) - No native replication
- No clustering
- Limited to ~100 writes/second under load
- Recommended only for development and small installations