luke-else/server
1
0
Fork 0
Code Issues 5 Pull Requests Projects Releases Wiki Activity

Compare commits

base: luke-else/server:eef5c568bb53af80d3d0b23f94aa005f4bbcd2aa
Branches Tags
luke-else/server:main
...
compare: luke-else/server:298addcccd7b87e58c8f6b02b6e399b057b62ce7
Branches Tags
luke-else/server:main
2 Commits
eef5c568bb ... 298addcccd
Author SHA1 Message Date
luke-else 298addcccd fix: Tuned ratelimits for gitea 2026-09-08 21:27:59 +01:00
luke-else b943c55425 feat: Added Rate-limiting to Gitea Traefik proxy 2026-09-08 21:23:32 +01:00
1 changed files with 17 additions and 3 deletions
Expand all files Collapse all files
services/dev/gitea-docker-compose.yml
+16 -2
View File
@@ -41,8 +41,22 @@ services:
- "traefik.http.middlewares.cors-gitea.headers.accesscontrolallowheaders=Content-Type,Authorization" - "traefik.http.middlewares.cors-gitea.headers.accesscontrolallowheaders=Content-Type,Authorization"
- "traefik.http.middlewares.cors-gitea.headers.accesscontrolmaxage=100" - "traefik.http.middlewares.cors-gitea.headers.accesscontrolmaxage=100"
# Aggregate cap across all clients (bucketed by Host header, so every
# request to git.luke-else.co.uk shares one budget) - this is what
# actually bounds a distributed/botnet-style flood, since per-IP limits
# alone don't catch many IPs each staying under the per-IP threshold.
- "traefik.http.middlewares.ratelimit-gitea-global.ratelimit.average=100"
- "traefik.http.middlewares.ratelimit-gitea-global.ratelimit.period=5s"
- "traefik.http.middlewares.ratelimit-gitea-global.ratelimit.burst=200"
- "traefik.http.middlewares.ratelimit-gitea-global.ratelimit.sourcecriterion.requestHost=true"
# Per-IP cap as a second layer, catching any single bad actor.
- "traefik.http.middlewares.ratelimit-gitea-perip.ratelimit.average=25"
- "traefik.http.middlewares.ratelimit-gitea-perip.ratelimit.period=1s"
- "traefik.http.middlewares.ratelimit-gitea-perip.ratelimit.burst=50"
- "traefik.http.middlewares.redirect-web-secure.redirectscheme.scheme=https" - "traefik.http.middlewares.redirect-web-secure.redirectscheme.scheme=https"
- "traefik.http.routers.gitea-insecure.middlewares=redirect-web-secure" - "traefik.http.routers.gitea-insecure.middlewares=ratelimit-gitea-global,ratelimit-gitea-perip,redirect-web-secure"
- "traefik.http.routers.gitea-insecure.rule=Host(`git.luke-else.co.uk`)" - "traefik.http.routers.gitea-insecure.rule=Host(`git.luke-else.co.uk`)"
- "traefik.http.routers.gitea-insecure.entrypoints=web" - "traefik.http.routers.gitea-insecure.entrypoints=web"
@@ -50,7 +64,7 @@ services:
- "traefik.http.routers.gitea.rule=Host(`git.luke-else.co.uk`)" - "traefik.http.routers.gitea.rule=Host(`git.luke-else.co.uk`)"
- "traefik.http.routers.gitea.entrypoints=websecure" - "traefik.http.routers.gitea.entrypoints=websecure"
- "traefik.http.routers.gitea.tls.certresolver=myresolver" - "traefik.http.routers.gitea.tls.certresolver=myresolver"
- "traefik.http.routers.gitea.middlewares=cors-gitea" - "traefik.http.routers.gitea.middlewares=ratelimit-gitea-global,ratelimit-gitea-perip,cors-gitea"
restart: unless-stopped restart: unless-stopped
networks: networks: