all repos — nixfiles @ 19633b1dbeaf1a8c550d5b3d8ce6bcfa6dceb9c0

System and user configuration, managed by nix and home-manager

searchix: add rate limiting

Alin
commit

19633b1dbeaf1a8c550d5b3d8ce6bcfa6dceb9c0

parent

2608f232d567fa9673f86ae6a4786d92120470fa

1 file changed, 25 insertions(+), 1 deletion(-)

changed files
M system/roles/webserver/reverse-proxy.nix → system/roles/webserver/reverse-proxy.nix
@@ -1,5 +1,6 @@
 {
   config,
+  lib,
   pkgs,
   ...
 }:

@@ -26,8 +27,9 @@ plugins = [
         "github.com/caddyserver/cache-handler@v0.16.0"
         "github.com/tailscale/caddy-tailscale@v0.0.0-20260106222316-bb080c4414ac"
         "github.com/caddy-dns/rfc2136@v1.0.0"
+        "github.com/mholt/caddy-ratelimit@v0.1.0"
       ];
-      hash = "sha256-za/SLfjHbl2G6nwIrcTTlxT5TyUrEMdQTvpkheFApuU=";
+      hash = "sha256-06+F4iONhdHS2RKGhd1WGirglhF/lYTP/Dey13OwLWc=";
     };
     globalConfig = ''
       cache

@@ -39,6 +41,28 @@ key_name caddy
         key_alg hmac-sha512
         key "{env.DDNS_TSIG_KEY}"
         server pdns.alin.ovh:53
+      }
+    '';
+    extraConfig = ''
+      (rate_limit) {
+        rate_limit {
+          zone global_static {
+            match {
+              query query=*
+            }
+            key static
+            events 100
+            window 1m
+          }
+          zone host_dynamic {
+            match {
+              query query=*
+            }
+            key {remote_host}
+            events 5
+            window 10s
+          }
+        }
       }
     '';
   };