diff --git a/reverseproxy.conf b/reverseproxy.conf index 1d49270..55220e6 100644 --- a/reverseproxy.conf +++ b/reverseproxy.conf @@ -114,9 +114,15 @@ http { 1 $binary_remote_addr; } + # Different rate limits for different request methods + map $request_method $ratelimit_key { + POST $binary_remote_addr; + default ""; + } + + limit_req_zone $ratelimit_key zone=createFeed:10m rate=1r/m; # Limit the number of requests per IP limit_req_zone $limit_key zone=feed:20m rate=20r/m; - limit_req_zone $limit_key zone=createFeed:10m rate=1r/m; limit_req_zone $limit_key zone=modules:10m rate=30r/m; server { @@ -126,14 +132,14 @@ http { server_name cal.htwk-leipzig.de; location /api/feed { + limit_req zone=createFeed nodelay; + limit_req zone=feed burst=10 nodelay; proxy_pass http://htwkalender-ical:8091; client_max_body_size 2m; proxy_connect_timeout 600s; proxy_read_timeout 600s; proxy_send_timeout 600s; send_timeout 600s; - limit_req zone=feed burst=10 nodelay; - limit_req zone=createFeed burst=10 nodelay; limit_req_status 429; } @@ -149,14 +155,14 @@ http { server_name htwkalender.de; location /api/feed { + limit_req zone=createFeed nodelay; + limit_req zone=feed burst=10 nodelay; proxy_pass http://htwkalender-ical:8091; client_max_body_size 2m; proxy_connect_timeout 600s; proxy_read_timeout 600s; proxy_send_timeout 600s; send_timeout 600s; - limit_req zone=feed burst=10 nodelay; - limit_req zone=createFeed burst=10 nodelay; limit_req_status 429; } @@ -186,14 +192,14 @@ http { ssl_certificate_key cal.htwk-leipzig.de.key.pem; location /api/feed { + limit_req zone=createFeed nodelay; + limit_req zone=feed burst=10 nodelay; proxy_pass http://htwkalender-ical:8091; client_max_body_size 2m; proxy_connect_timeout 600s; proxy_read_timeout 600s; proxy_send_timeout 600s; send_timeout 600s; - limit_req zone=feed burst=10 nodelay; - limit_req zone=createFeed burst=10 nodelay; limit_req_status 429; } diff --git a/reverseproxy.dev.conf b/reverseproxy.dev.conf index ed8a7de..31656bc 100644 --- a/reverseproxy.dev.conf +++ b/reverseproxy.dev.conf @@ -116,20 +116,15 @@ http { } # Different rate limits for different request methods - map $request_method $limit_feed { - POST ''; # Create feed is limited to 1 request per minute - default $binary_remote_addr; # All other requests are limited to 20 requests per minute + map $request_method $ratelimit_key { + POST $binary_remote_addr; + default ""; } - - map $request_method $limit_createFeed { - POST $binary_remote_addr; # Create feed is limited to 1 request per minute - default ''; # All other requests are limited to 20 requests per minute - } + limit_req_zone $ratelimit_key zone=createFeed:10m rate=1r/m; # Limit the number of requests per IP limit_req_zone $limit_feed zone=feed:20m rate=20r/m; - limit_req_zone $limit_createFeed zone=createFeed:10m rate=1r/m; limit_req_zone $limit_key zone=modules:10m rate=30r/m; server { @@ -149,14 +144,14 @@ http { ssl_certificate_key dev_htwkalender_de.key.pem; location /api/feed { + limit_req zone=createFeed nodelay; + limit_req zone=feed burst=10 nodelay; proxy_pass http://htwkalender-ical:8091; client_max_body_size 2m; proxy_connect_timeout 600s; proxy_read_timeout 600s; proxy_send_timeout 600s; send_timeout 600s; - limit_req zone=feed burst=10 nodelay; - limit_req zone=createFeed burst=10 nodelay; limit_req_status 429; } diff --git a/reverseproxy.local.conf b/reverseproxy.local.conf index 8846d6d..05f99c2 100644 --- a/reverseproxy.local.conf +++ b/reverseproxy.local.conf @@ -1,22 +1,6 @@ -#Calendar implementation for the HTWK Leipzig timetable. Evaluation and display of the individual dates in iCal format. -#Copyright (C) 2024 HTWKalender support@htwkalender.de - -#This program is free software: you can redistribute it and/or modify -#it under the terms of the GNU Affero General Public License as published by -#the Free Software Foundation, either version 3 of the License, or -#(at your option) any later version. - -#This program is distributed in the hope that it will be useful, -#but WITHOUT ANY WARRANTY; without even the implied warranty of -#MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -#GNU Affero General Public License for more details. - -#You should have received a copy of the GNU Affero General Public License -#along with this program. If not, see . - worker_processes 4; -error_log /opt/bitnami/nginx/logs/error.log; +error_log /opt/bitnami/nginx/logs/error.log debug; pid /opt/bitnami/nginx/tmp/nginx.pid; events { @@ -27,36 +11,12 @@ http { include mime.types; default_type application/octet-stream; - gzip on; - gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript; - - access_log /opt/bitnami/nginx/logs/proxy_access.log; - error_log /opt/bitnami/nginx/logs/proxy_error.log; - - sendfile on; - keepalive_timeout 180s; - send_timeout 180s; - - client_body_temp_path /opt/bitnami/nginx/tmp/client_temp; - proxy_temp_path /opt/bitnami/nginx/tmp/proxy_temp_path; - fastcgi_temp_path /opt/bitnami/nginx/tmp/fastcgi_temp; - uwsgi_temp_path /opt/bitnami/nginx/tmp/uwsgi_temp; - scgi_temp_path /opt/bitnami/nginx/tmp/scgi_temp; - - proxy_buffering on; - proxy_buffers 8 16k; - proxy_buffer_size 16k; - proxy_busy_buffers_size 64k; - proxy_temp_file_write_size 64k; - proxy_max_temp_file_size 1024m; - - proxy_set_header X-Forwarded-Host $host; - proxy_set_header X-Forwarded-Server $host; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header Host $host; + map $request_method $ratelimit_key { + POST $binary_remote_addr; + default ""; + } + limit_req_zone $ratelimit_key zone=createFeed:10m rate=1r/m; server { listen 80; @@ -64,12 +24,14 @@ http { http2 on; location /api/feed { + limit_req zone=createFeed nodelay; proxy_pass http://htwkalender-ical:8091; client_max_body_size 20m; proxy_connect_timeout 600s; proxy_read_timeout 600s; proxy_send_timeout 600s; send_timeout 600s; + limit_req_status 429; } location /api { @@ -83,7 +45,6 @@ http { location /_ { proxy_pass http://htwkalender-data-manager:8090; - # Increase upload file size client_max_body_size 100m; }