commit c1425ee27f0db62b6e325b333e9c2b68c87e420f parent 6f05b185099fc3f423fbdf736b8f747eab479d43 Author: Vineet Kumar <git@vineetk.net> Date: Fri, 22 May 2026 10:43:40 -0400 saklas: implement rate-limiting on cgit Diffstat:
| M | epistemia/systems/saklas.scm | | | 64 | ++++++++++++++++++++++++++++++++++++---------------------------- |
1 file changed, 36 insertions(+), 28 deletions(-)
diff --git a/epistemia/systems/saklas.scm b/epistemia/systems/saklas.scm @@ -405,28 +405,29 @@ rpz: (domains '("vinbiz.ca"))))))) (service nginx-service-type (nginx-configuration - (server-blocks - (list (nginx-server-configuration - (server-name '("vineetk.net")) - (listen '("443 ssl")) - (ssl-certificate "/etc/certs/vineetk.net/fullchain.pem") - (ssl-certificate-key "/etc/certs/vineetk.net/privkey.pem") - (root "/var/www/site_vineetk") - (raw-content (list "include " %nginx-badboi ";"))) - (nginx-server-configuration - (server-name '("13f0.net")) - (listen '("443 ssl")) - (ssl-certificate "/etc/certs/13f0.net/fullchain.pem") - (ssl-certificate-key "/etc/certs/13f0.net/privkey.pem") - (root "/var/www/site_13f0") - (raw-content (list "include " %nginx-badboi ";"))) - (nginx-server-configuration - (server-name '("vinbiz.ca")) - (listen '("443 ssl")) - (ssl-certificate "/etc/certs/vinbiz.ca/fullchain.pem") - (ssl-certificate-key "/etc/certs/vinbiz.ca/privkey.pem") - (root "/var/www/site_vinbiz") - (raw-content (list "include " %nginx-badboi ";"))))))) + (extra-content "limit_req_zone $binary_remote_addr zone=git_rate:10m rate=30r/m;") + (server-blocks + (list (nginx-server-configuration + (server-name '("vineetk.net")) + (listen '("443 ssl")) + (ssl-certificate "/etc/certs/vineetk.net/fullchain.pem") + (ssl-certificate-key "/etc/certs/vineetk.net/privkey.pem") + (root "/var/www/site_vineetk") + (raw-content (list "include " %nginx-badboi ";"))) + (nginx-server-configuration + (server-name '("13f0.net")) + (listen '("443 ssl")) + (ssl-certificate "/etc/certs/13f0.net/fullchain.pem") + (ssl-certificate-key "/etc/certs/13f0.net/privkey.pem") + (root "/var/www/site_13f0") + (raw-content (list "include " %nginx-badboi ";"))) + (nginx-server-configuration + (server-name '("vinbiz.ca")) + (listen '("443 ssl")) + (ssl-certificate "/etc/certs/vinbiz.ca/fullchain.pem") + (ssl-certificate-key "/etc/certs/vinbiz.ca/privkey.pem") + (root "/var/www/site_vinbiz") + (raw-content (list "include " %nginx-badboi ";"))))))) ;; git folder needs to be readable by nginx/cgit, gets reset to 700 on reconfigure otherwise (simple-service 'git-home-permissions activation-service-type @@ -484,12 +485,19 @@ rpz: "fastcgi_param HTTP_HOST $server_name;" "fastcgi_pass 127.0.0.1:9000;"))) (nginx-location-configuration - (uri "@cgit") - (body '("fastcgi_param SCRIPT_FILENAME $document_root/lib/cgit/cgit.cgi;" - "fastcgi_param PATH_INFO $uri;" - "fastcgi_param QUERY_STRING $args;" - "fastcgi_param HTTP_HOST $server_name;" - "fastcgi_pass 127.0.0.1:9000;")))))))))) + ;; mimics bad_boi behaviour for rate-limited abusers + (uri "@send_to_bigfile") + (body '("return 307 https://planet.openstreetmap.org/pbf/planet-latest.osm.pbf;"))) + (nginx-location-configuration + (uri "@cgit") + (body '("limit_req zone=git_rate burst=5 nodelay;" + "limit_req_status 429;" + "error_page 429 =307 @send_to_bigfile;" + "fastcgi_param SCRIPT_FILENAME $document_root/lib/cgit/cgit.cgi;" + "fastcgi_param PATH_INFO $uri;" + "fastcgi_param QUERY_STRING $args;" + "fastcgi_param HTTP_HOST $server_name;" + "fastcgi_pass 127.0.0.1:9000;")))))))))) (service prosody-service-type (prosody-configuration (admins '("vin@vineetk.net"))