all repos — nixfiles @ 6fc01e57258d2904ec89c500709af86b360950de

System and user configuration, managed by nix and home-manager

slow down impudent crawlers

Alin
commit

6fc01e57258d2904ec89c500709af86b360950de

parent

f8f7c7885e20a29587bbf81c4a544e75354f2891

2 files changed, 16 insertions(+), 19 deletions(-)

changed files
M system/roles/searchix.nix → system/roles/searchix.nix
@@ -35,6 +35,7 @@ to unix/${config.services.goaccess.instances.searchix.settings.unix-socket}
           }
         }
         handle {
+          import defender
           import rate_limit
           reverse_proxy {
             to localhost:${port}
M system/roles/webserver/reverse-proxy.nix → system/roles/webserver/reverse-proxy.nix
@@ -26,9 +26,10 @@ plugins = [
         "github.com/caddyserver/cache-handler@v0.16.0"
         "github.com/tailscale/caddy-tailscale@v0.0.0-20260106222316-bb080c4414ac"
         "github.com/caddy-dns/rfc2136@v1.0.0"
+        "pkg.jsn.cam/caddy-defender@v0.10.1"
         "github.com/mholt/caddy-ratelimit@v0.1.1-0.20260521172720-16aecbbcb8ca"
       ];
-      hash = "sha256-gP2p91zY5JK8+MV9deEb3i4bqb2sXKEdhrqJK7W7CuM=";
+      hash = "sha256-qaHc2jmyFJ/MwazQpcdLe/fmEB13X1MtvfVBUR/MymA=";
     };
     globalConfig = ''
       cache

@@ -51,18 +52,9 @@ match {
               query query=*
             }
             key static
-            events 240
+            events 180
             window 1m
           }
-          zone host_short {
-            match {
-              query query=*
-            }
-            key {remote_host}
-            ipv6_prefix 64
-            events 2
-            window 2s
-          }
           zone net_short {
             match {
               query query=*

@@ -73,14 +65,6 @@ ipv6_prefix 56
             events 10
             window 5s
           }
-          zone host_long {
-            match {
-              query query=*
-            }
-            key {remote_host}
-            events 500
-            window 1h
-          }
           zone net_long {
             match {
               query query=*

@@ -90,6 +74,18 @@ ipv4_prefix 24
             ipv6_prefix 56
             events 50000
             window 1h
+          }
+        }
+      }
+      (defender) {
+        defender ratelimit {
+          ranges all
+        }
+        defender tarpit {
+          tarpit_config {
+            timeout 30s
+            bytes_per_second 500
+            response_code 200
           }
         }
       }