infrastructure

commit 88807d442c21ad6c56e36b844df155cdcf472082
parent 4f5045d7cb8e75278b46a9251014f09f97f701bb
Author: Silas Brack <silasbrack@gmail.com>
Date:   Fri,  3 Apr 2026 12:53:02 +0200

feat: add rate limiting

Diffstat:
M
nixos/configuration-debian-2gb-hel1-1.nix
 | 
14
++++++++++++++

1 file changed, 14 insertions(+), 0 deletions(-)
diff --git a/nixos/configuration-debian-2gb-hel1-1.nix b/nixos/configuration-debian-2gb-hel1-1.nix
@@ -120,6 +120,14 @@
   };
   services.nginx.enable = true;
 
+  # Rate limiting zone (10 requests/second per IP, 10MB zone)
+  services.nginx.commonHttpConfig = ''
+    limit_req_zone $binary_remote_addr zone=ratelimit:10m rate=10r/s;
+  '';
+  services.nginx.appendHttpConfig = ''
+    limit_req_status 429;
+  '';
+
   # MediaWiki
   services.mediawiki = {
     enable = true;
@@ -151,6 +159,9 @@
   services.nginx.virtualHosts."wiki.fnarglebeast.com" = {
     enableACME = true;
     forceSSL = true;
+    extraConfig = ''
+      limit_req zone=ratelimit burst=20 nodelay;
+    '';
   };
 
   # Forgejo
@@ -175,6 +186,9 @@
   services.nginx.virtualHosts."git.fnarglebeast.com" = {
     enableACME = true;
     forceSSL = true;
+    extraConfig = ''
+      limit_req zone=ratelimit burst=20 nodelay;
+    '';
     locations."/" = {
       proxyPass = "http://127.0.0.1:3001";
       proxyWebsockets = true;