luke-else/server
1
0
Fork 0
Code Issues 5 Pull Requests Projects Releases Wiki Activity

feat: Added Rate-limiting to Gitea Traefik proxy

Browse Source
This commit is contained in:
luke-else
2026-09-08 21:23:32 +01:00
parent eef5c568bb
commit b943c55425
1 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/dev/gitea-docker-compose.yml
+16 -2
View File
@@ -41,8 +41,22 @@ services:
- "traefik.http.middlewares.cors-gitea.headers.accesscontrolallowheaders=Content-Type,Authorization"
- "traefik.http.middlewares.cors-gitea.headers.accesscontrolmaxage=100"
# Aggregate cap across all clients (bucketed by Host header, so every
# request to git.luke-else.co.uk shares one budget) - this is what
# actually bounds a distributed/botnet-style flood, since per-IP limits
# alone don't catch many IPs each staying under the per-IP threshold.
- "traefik.http.middlewares.ratelimit-gitea-global.ratelimit.average=50"
- "traefik.http.middlewares.ratelimit-gitea-global.ratelimit.period=1s"
- "traefik.http.middlewares.ratelimit-gitea-global.ratelimit.burst=100"
- "traefik.http.middlewares.ratelimit-gitea-global.ratelimit.sourcecriterion.requestHost=true"
# Per-IP cap as a second layer, catching any single bad actor.
- "traefik.http.middlewares.ratelimit-gitea-perip.ratelimit.average=10"
- "traefik.http.middlewares.ratelimit-gitea-perip.ratelimit.period=1s"
- "traefik.http.middlewares.ratelimit-gitea-perip.ratelimit.burst=20"
- "traefik.http.middlewares.redirect-web-secure.redirectscheme.scheme=https"
- "traefik.http.routers.gitea-insecure.middlewares=redirect-web-secure"
- "traefik.http.routers.gitea-insecure.middlewares=ratelimit-gitea-global,ratelimit-gitea-perip,redirect-web-secure"
- "traefik.http.routers.gitea-insecure.rule=Host(`git.luke-else.co.uk`)"
- "traefik.http.routers.gitea-insecure.entrypoints=web"
@@ -50,7 +64,7 @@ services:
- "traefik.http.routers.gitea.rule=Host(`git.luke-else.co.uk`)"
- "traefik.http.routers.gitea.entrypoints=websecure"
- "traefik.http.routers.gitea.tls.certresolver=myresolver"
- "traefik.http.routers.gitea.middlewares=cors-gitea"
- "traefik.http.routers.gitea.middlewares=ratelimit-gitea-global,ratelimit-gitea-perip,cors-gitea"
restart: unless-stopped
networks: