Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: apply sliding window rate limiting #509

Open
wants to merge 11 commits into
base: main
Choose a base branch
from
2 changes: 2 additions & 0 deletions pillar/base/haproxy.sls
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ haproxy:
- docs.python.org
- doc.python.org
check: "HEAD /_check HTTP/1.1\\r\\nHost:\\ docs.python.org"
rate_limit: 100
JacobCoffee marked this conversation as resolved.
Show resolved Hide resolved

downloads:
domains:
Expand Down Expand Up @@ -75,6 +76,7 @@ haproxy:
- {{ config.server_name }}
verify_host: bugs.psf.io
check: "HEAD / HTTP/1.1\\r\\nHost:\\ {{ config.server_name }}"
rate_limit: {{ config.get('rate_limit', 10) }}
{% endfor %}

moin:
Expand Down
17 changes: 16 additions & 1 deletion salt/haproxy/config/haproxy.cfg.jinja
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,6 @@ global
# Lower the amount of space we reserve for header rewriting
tune.maxrewrite 1024


defaults
log global

Expand Down Expand Up @@ -117,6 +116,22 @@ frontend main
bind :::80
bind 127.0.0.1:19001 # This is our TLS socket.

# Apply rate limits per srvice
{% for service, config in haproxy.services.items() %}
{% if config.get('rate_limit') and loop.index <= 2 %}
stick-table type ip size 100k expire 30s store http_req_rate(1s)
{% endif %}
{% endfor %}

# Apply rate limits
{% for service, config in haproxy.services.items() %}
{% if config.get('rate_limit') and loop.index <= 2 %}
ewdurbin marked this conversation as resolved.
Show resolved Hide resolved
acl is_{{ service }} hdr(host) -i {% for domain in config.domains %}{{ domain }} {% endfor %}
http-request track-sc{{ loop.index }} src if is_{{ service }}
http-request deny deny_status 429 if is_{{ service }} { sc{{ loop.index }}_http_req_rate() gt {{ config.rate_limit }} }
{% endif %}
{% endfor %}

# Custom logging format, this is the same as the normal "httplog" in
# HAProxy except information about the TLS connection is included.
log-format %ci:%cp\ [%t]\ %ft\ %b/%s\ %Tq/%Tw/%Tc/%Tr/%Tt\ %sslv/%sslc\ %ST\ %B\ %CC\ %CS\ %tsc\ %ac/%fc/%bc/%sc/%rc\ %sq/%bq\ %hr\ %hs\ %{+Q}r
Expand Down
Loading