Server challenges

Task Description

Develop an HTTP server to function as an authentication server. This server should support the following essential operations:

• User Authentication: generating a JWT for users as detailed under the /auth endpoint.
• User Management: manage user accounts and permissions via the User Management endpoints.

Due to potential security threats, implement robust mechanisms at the /auth endpoint to mitigate unauthorized access by:

• Blocking IP subnets;
• Restricting specific users.

For user IP address identification, utilize the X-Forwarded-For HTTP header.

The full API contract is described in the OpenAPI specification.

Input Files

Before testing, preload the following user data and resources (mounted read-only at /storage/data):

• /storage/data/users.jsonl: newline-delimited JSON user records (login, password, name, phone, country, optional is_admin).
• /storage/data/GeoLite2-City-CSV/*: the MaxMind GeoLite2 database in CSV format.

The server must complete all startup work (loading data, building in-memory structures) within 5 seconds before it starts handling requests.

Connections

Before the timed phase starts, the load generator opens 10,000 keep-alive connections and holds them for the whole run. Your server must accept all of them and keep them open - the workload leaves most of the pool idle at any moment, and handling many idle connections cheaply is part of what is measured.

Connection setup is not timed, and the generator is patient about it: it retries for 5 seconds, so a server that is still starting up, or that drains its accept queue slowly, is not penalised. The size of your listen() backlog does not matter on its own.

Once the timed phase starts, every connection your server will not accept or does not hold costs 1 second, the same as an incorrect response. Responding with Connection: close is honoured and costs nothing - the generator simply opens a fresh connection, and your server pays for the handshake.

Scoring

Your server is benchmarked against a fixed workload. The score is the total time to process all requests, plus a 1-second penalty per incorrect response and per connection not held - lower is better.

Submission

Package your server as a Docker image and push it to the registry (see the “How to submit” panel). Pushing a new image automatically queues a benchmark run.