From 298addcccd7b87e58c8f6b02b6e399b057b62ce7 Mon Sep 17 00:00:00 2001 From: Luke Else Date: Tue, 8 Sep 2026 21:27:59 +0100 Subject: [PATCH] fix: Tuned ratelimits for gitea --- services/dev/gitea-docker-compose.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/services/dev/gitea-docker-compose.yml b/services/dev/gitea-docker-compose.yml index 4d4543e..de1a143 100644 --- a/services/dev/gitea-docker-compose.yml +++ b/services/dev/gitea-docker-compose.yml @@ -45,15 +45,15 @@ services: # request to git.luke-else.co.uk shares one budget) - this is what # actually bounds a distributed/botnet-style flood, since per-IP limits # alone don't catch many IPs each staying under the per-IP threshold. - - "traefik.http.middlewares.ratelimit-gitea-global.ratelimit.average=50" - - "traefik.http.middlewares.ratelimit-gitea-global.ratelimit.period=1s" - - "traefik.http.middlewares.ratelimit-gitea-global.ratelimit.burst=100" + - "traefik.http.middlewares.ratelimit-gitea-global.ratelimit.average=100" + - "traefik.http.middlewares.ratelimit-gitea-global.ratelimit.period=5s" + - "traefik.http.middlewares.ratelimit-gitea-global.ratelimit.burst=200" - "traefik.http.middlewares.ratelimit-gitea-global.ratelimit.sourcecriterion.requestHost=true" # Per-IP cap as a second layer, catching any single bad actor. - - "traefik.http.middlewares.ratelimit-gitea-perip.ratelimit.average=10" + - "traefik.http.middlewares.ratelimit-gitea-perip.ratelimit.average=25" - "traefik.http.middlewares.ratelimit-gitea-perip.ratelimit.period=1s" - - "traefik.http.middlewares.ratelimit-gitea-perip.ratelimit.burst=20" + - "traefik.http.middlewares.ratelimit-gitea-perip.ratelimit.burst=50" - "traefik.http.middlewares.redirect-web-secure.redirectscheme.scheme=https" - "traefik.http.routers.gitea-insecure.middlewares=ratelimit-gitea-global,ratelimit-gitea-perip,redirect-web-secure" @@ -73,4 +73,4 @@ networks: volumes: gitea_data: - name: gitea_data \ No newline at end of file + name: gitea_data