| commit | 191bbf126ac037ffc902148b8a1cf583369dbfc1 | [log] [tgz] |
|---|---|---|
| author | Matthias Andreas Benkard <code@mail.matthias.benkard.de> | Wed Nov 04 19:59:58 2026 +0100 |
| committer | Matthias Andreas Benkard <code@mail.matthias.benkard.de> | Wed Nov 04 19:59:58 2026 +0100 |
| tree | d97a1ea4e7692d72291b8a82516583e5c24b09a9 | |
| parent | 1f53cd8e2f9bf5f7aa52bbc06d786f10fcd5d950 [diff] |
git: Cap cgit at 5 requests per second. A crawler botnet with thousands of rotating IPs and browser user agents sends about 60 requests per second to cgit, almost all of which time out (499) and saturate ifirn's CPU. Neither the per-bot limit nor a per-IP limit catches it, so add a per-host limit_req zone in ingress-nginx and use it for git.benkard.de. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Change-Id: I54a92f89d36e1a1800dfdd82310b75c4b3a73b7d