traefik/middlewares.yaml

# Middlewares attached to Traefik's entrypoints (see ports.*.http.middlewares
# in traefik/values.yaml).  Apply this file before upgrading the Helm release:
# a missing entrypoint middleware breaks every router.
#
#   kubectl apply -f traefik/middlewares.yaml

# Per-client-IP rate limit for all routes (IngressRoutes as well as the
# nginx-class Ingresses).  Traefik instantiates entrypoint middlewares per
# router, so the bucket is per IP *and* router, not global per IP.  Clients
# over the limit get 429.  The cgit per-host cap (mulk/git-cgit-ratelimit in
# git/git.yaml) applies on top of this.
#
# Traefik sits on hostPorts without a proxy in front, so the remote address is
# the real client; X-Forwarded-For is never trusted (depth 0).
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: ratelimit-per-ip
  namespace: traefik
spec:
  rateLimit:
    average: 10
    period: 1s
    burst: 100
    sourceCriterion:
      ipStrategy:
        depth: 0
        # One bucket per IPv6 /64 rather than per address.
        ipv6Subnet: 64