git: Cap cgit at 5 requests per second.
A crawler botnet with thousands of rotating IPs and browser user agents
sends about 60 requests per second to cgit, almost all of which time out
(499) and saturate ifirn's CPU. Neither the per-bot limit nor a per-IP
limit catches it, so add a per-host limit_req zone in ingress-nginx and
use it for git.benkard.de.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Change-Id: I54a92f89d36e1a1800dfdd82310b75c4b3a73b7d
diff --git a/git/git.yaml b/git/git.yaml
index 4d73480..7c69e92 100644
--- a/git/git.yaml
+++ b/git/git.yaml
@@ -171,6 +171,12 @@
cert-manager.io/cluster-issuer: letsencrypt-prod
kubernetes.io/ingress.class: nginx
nginx.ingress.kubernetes.io/rewrite-target: /cgit/cgit.cgi/$1$2
+ # Cap cgit at 5 r/s in total (zone defined in ingress-nginx/config.yaml).
+ # A limit_req at location level replaces the inherited server-level one,
+ # so the bot limit is repeated here.
+ nginx.ingress.kubernetes.io/configuration-snippet: |
+ limit_req zone=bots burst=20 nodelay;
+ limit_req zone=perhost burst=20 nodelay;
spec:
rules:
- host: git.benkard.de