diff options
| author | Vineet Kumar <git@vineetk.net> | 2026-05-22 10:43:40 -0400 |
|---|---|---|
| committer | Vineet Kumar <git@vineetk.net> | 2026-05-22 10:43:40 -0400 |
| commit | c1425ee27f0db62b6e325b333e9c2b68c87e420f (patch) | |
| tree | 6dbc3fc947bf199bbf540d2e5f7f2b904782669e | |
| parent | 6f05b185099fc3f423fbdf736b8f747eab479d43 (diff) | |
saklas: implement rate-limiting on cgit
| -rw-r--r-- | epistemia/systems/saklas.scm | 64 |
1 files changed, 36 insertions, 28 deletions
diff --git a/epistemia/systems/saklas.scm b/epistemia/systems/saklas.scm index 00d2594..0e49e52 100644 --- a/epistemia/systems/saklas.scm +++ b/epistemia/systems/saklas.scm | |||
| @@ -405,28 +405,29 @@ rpz: | |||
| 405 | (domains '("vinbiz.ca"))))))) | 405 | (domains '("vinbiz.ca"))))))) |
| 406 | (service nginx-service-type | 406 | (service nginx-service-type |
| 407 | (nginx-configuration | 407 | (nginx-configuration |
| 408 | (server-blocks | 408 | (extra-content "limit_req_zone $binary_remote_addr zone=git_rate:10m rate=30r/m;") |
| 409 | (list (nginx-server-configuration | 409 | (server-blocks |
| 410 | (server-name '("vineetk.net")) | 410 | (list (nginx-server-configuration |
| 411 | (listen '("443 ssl")) | 411 | (server-name '("vineetk.net")) |
| 412 | (ssl-certificate "/etc/certs/vineetk.net/fullchain.pem") | 412 | (listen '("443 ssl")) |
| 413 | (ssl-certificate-key "/etc/certs/vineetk.net/privkey.pem") | 413 | (ssl-certificate "/etc/certs/vineetk.net/fullchain.pem") |
| 414 | (root "/var/www/site_vineetk") | 414 | (ssl-certificate-key "/etc/certs/vineetk.net/privkey.pem") |
| 415 | (raw-content (list "include " %nginx-badboi ";"))) | 415 | (root "/var/www/site_vineetk") |
| 416 | (nginx-server-configuration | 416 | (raw-content (list "include " %nginx-badboi ";"))) |
| 417 | (server-name '("13f0.net")) | 417 | (nginx-server-configuration |
| 418 | (listen '("443 ssl")) | 418 | (server-name '("13f0.net")) |
| 419 | (ssl-certificate "/etc/certs/13f0.net/fullchain.pem") | 419 | (listen '("443 ssl")) |
| 420 | (ssl-certificate-key "/etc/certs/13f0.net/privkey.pem") | 420 | (ssl-certificate "/etc/certs/13f0.net/fullchain.pem") |
| 421 | (root "/var/www/site_13f0") | 421 | (ssl-certificate-key "/etc/certs/13f0.net/privkey.pem") |
| 422 | (raw-content (list "include " %nginx-badboi ";"))) | 422 | (root "/var/www/site_13f0") |
| 423 | (nginx-server-configuration | 423 | (raw-content (list "include " %nginx-badboi ";"))) |
| 424 | (server-name '("vinbiz.ca")) | 424 | (nginx-server-configuration |
| 425 | (listen '("443 ssl")) | 425 | (server-name '("vinbiz.ca")) |
| 426 | (ssl-certificate "/etc/certs/vinbiz.ca/fullchain.pem") | 426 | (listen '("443 ssl")) |
| 427 | (ssl-certificate-key "/etc/certs/vinbiz.ca/privkey.pem") | 427 | (ssl-certificate "/etc/certs/vinbiz.ca/fullchain.pem") |
| 428 | (root "/var/www/site_vinbiz") | 428 | (ssl-certificate-key "/etc/certs/vinbiz.ca/privkey.pem") |
| 429 | (raw-content (list "include " %nginx-badboi ";"))))))) | 429 | (root "/var/www/site_vinbiz") |
| 430 | (raw-content (list "include " %nginx-badboi ";"))))))) | ||
| 430 | ;; git folder needs to be readable by nginx/cgit, gets reset to 700 on reconfigure otherwise | 431 | ;; git folder needs to be readable by nginx/cgit, gets reset to 700 on reconfigure otherwise |
| 431 | (simple-service 'git-home-permissions | 432 | (simple-service 'git-home-permissions |
| 432 | activation-service-type | 433 | activation-service-type |
| @@ -484,12 +485,19 @@ rpz: | |||
| 484 | "fastcgi_param HTTP_HOST $server_name;" | 485 | "fastcgi_param HTTP_HOST $server_name;" |
| 485 | "fastcgi_pass 127.0.0.1:9000;"))) | 486 | "fastcgi_pass 127.0.0.1:9000;"))) |
| 486 | (nginx-location-configuration | 487 | (nginx-location-configuration |
| 487 | (uri "@cgit") | 488 | ;; mimics bad_boi behaviour for rate-limited abusers |
| 488 | (body '("fastcgi_param SCRIPT_FILENAME $document_root/lib/cgit/cgit.cgi;" | 489 | (uri "@send_to_bigfile") |
| 489 | "fastcgi_param PATH_INFO $uri;" | 490 | (body '("return 307 https://planet.openstreetmap.org/pbf/planet-latest.osm.pbf;"))) |
| 490 | "fastcgi_param QUERY_STRING $args;" | 491 | (nginx-location-configuration |
| 491 | "fastcgi_param HTTP_HOST $server_name;" | 492 | (uri "@cgit") |
| 492 | "fastcgi_pass 127.0.0.1:9000;")))))))))) | 493 | (body '("limit_req zone=git_rate burst=5 nodelay;" |
| 494 | "limit_req_status 429;" | ||
| 495 | "error_page 429 =307 @send_to_bigfile;" | ||
| 496 | "fastcgi_param SCRIPT_FILENAME $document_root/lib/cgit/cgit.cgi;" | ||
| 497 | "fastcgi_param PATH_INFO $uri;" | ||
| 498 | "fastcgi_param QUERY_STRING $args;" | ||
| 499 | "fastcgi_param HTTP_HOST $server_name;" | ||
| 500 | "fastcgi_pass 127.0.0.1:9000;")))))))))) | ||
| 493 | (service prosody-service-type | 501 | (service prosody-service-type |
| 494 | (prosody-configuration | 502 | (prosody-configuration |
| 495 | (admins '("vin@vineetk.net")) | 503 | (admins '("vin@vineetk.net")) |