Axum: follow up with an explicit local GeoIP provider #438

Description

Add optional local GeoIP to the native Geo contract independently of CloudFront (#432). Draft PR #453 now implements checked-reader-IP inputs and a local GeoLite City/Country provider on #439, but explicitly retains a failing malformed-unused-metadata acceptance regression as ignored. Draft PR #454 is a sibling portable KV format/lookup prototype; it changes no production Geo request path. Neither completes this issue.

Steps to reproduce

Use #453 fixtures to select the local provider, resolve checked IPv4/IPv6 inputs and exercise no-match/country-only/missing-reader/error cases. Reproduce geo_maxmind_rejects_unused_metadata_nonstring_keys -- --ignored and its real-runner readiness failure. Measure licensed production-size data and actual unprivileged read-only mounts separately. #454 local artifact-KV results are not remote/provider acceptance.

Expected behavior

Operator-supplied read-only data is bounded/validated before readiness, selected explicitly with no fallback. Checked reader IP comes from the existing ingress provenance. Outcomes preserve unavailable/error, no-match, country-only and unknown subdivision distinctions.

Impact

Accepting malformed provider data at readiness violates the proposed startup contract. Tiny fixtures and local measurements do not establish production capacity, geography accuracy or downstream policy correctness.

Proposed fix

Resolve #453 reader metadata validation, platform acquisition scope and remaining production-size/mount evidence before claiming acceptance. Define lifecycle/version/licensing/freshness and restart-based replacement. Evaluate #454 separately if a portable async KV provider is preferred; freeze its format, publishing, reader trust and remote acceptance before production integration. Keep files/reader dependencies out of portable core/WASM, with no downloader, external visitor lookup, store-registry coupling or consent-policy change.

Done when

• Reviewed input-contract and startup/lifecycle extension.
• Supported database format, licensing, data freshness and mount guidance.
• IPv4/IPv6, unresolved reader IP, no-match, country/subdivision and country-only fixtures.
• Malformed/unavailable database fails selected startup before readiness.
• Read-only startup and explicit database replacement proof.
• Portable/WASM dependency boundaries and native lifecycle regressions pass.

Trusted Server translation and real policy-path proof remain separate downstream work. This task does not authorize changing fail-closed permission behavior.

• The known malformed-unused-metadata regression and real-runner rejection pass without an ignored failing acceptance case.
• Production-size licensed data preparation time/RSS and an actual unprivileged read-only mount are measured; Unix-only acquisition scope is accepted explicitly or extended.

Related

• Parent Make the Axum adapter production-ready for self-hosted deployments #391; CloudFront Axum: add protected CloudFront Geo metadata provider #432 / PR Add pluggable native Geo providers and protected CloudFront ingress #439; checked ingress Axum: add safe production diagnostics and trusted-proxy handling #397 / PR feat(axum): add safe diagnostics and trusted proxy metadata #409.
• Draft implementation PR Add local GeoLite provider and checked-IP Geo inputs for Axum #453 tracks Axum: follow up with an explicit local GeoIP provider #438 but deliberately claims no closure while its blockers remain.
• Related alternative experiment PR Prototype portable KV-backed Geo lookup #454 explores format/lookup only, not production acceptance.
• Trusted Server translation and policy-path proof remain downstream.