all repos — nixfiles @ 88ec60f0b66c9d5328ff3ad87f61904a83ff317d

System and user configuration, managed by nix and home-manager

reverse-proxy: add network-based rate limit

Alin
commit

88ec60f0b66c9d5328ff3ad87f61904a83ff317d

parent

85d3562c024b3f2992d7153d8e353e331f9235d6

1 file changed, 12 insertions(+), 2 deletions(-)

changed files
M system/roles/webserver/reverse-proxy.nix → system/roles/webserver/reverse-proxy.nix
@@ -26,9 +26,9 @@ plugins = [
         "github.com/caddyserver/cache-handler@v0.16.0"
         "github.com/tailscale/caddy-tailscale@v0.0.0-20260106222316-bb080c4414ac"
         "github.com/caddy-dns/rfc2136@v1.0.0"
-        "github.com/mholt/caddy-ratelimit@v0.1.0"
+        "github.com/mholt/caddy-ratelimit@16aecbbcb8ca07dc1c671e263379606ff9493c55"
       ];
-      hash = "sha256-fO8yxxYiEiFDTEOdPT8UUXUswNdcOQ2kcyY7B89RDkg=";
+      hash = "sha256-gP2p91zY5JK8+MV9deEb3i4bqb2sXKEdhrqJK7W7CuM=";
     };
     globalConfig = ''
       cache

@@ -59,6 +59,16 @@ query query=*
             }
             key {remote_host}
             events 5
+            window 5s
+          }
+          zone net_dynamic {
+            match {
+              query query=*
+            }
+            key {remote_host}
+            ipv4_prefix 24
+            ipv6_prefix 56
+            events 10
             window 5s
           }
         }