OOKNET                             [ /  search the index  ]  
──────────────────────────────────────────────────────────────────────────────────────
[ KB ]    [ GIT ]    [ PROJECTS ]    [ ABOUT ]                                      EN
══════════════════════════════════════════════════════════════════════════════════════
OOKNET   [ /  search  ]  
────────────────────────────────────────────────
[ KB ] [ GIT ] [ PROJECTS ] [ ABOUT ]
════════════════════════════════════════════════
 
HASH      dfed1de19f05
DATE      2025-10-23
SUBJECT   caddy: add rate limiting
FILES     3 CHANGED
HASH      dfed1de19f05
DATE      2025-10-23
SUBJECT   caddy: add rate limiting
FILES     3 CHANGED
 

diff --git a/modules/nixos/server/services/forgejo/default.nix b/modules/nixos/ser
ver/services/forgejo/default.nix
index f5df02a..4c6ac05 100644
--- a/modules/nixos/server/services/forgejo/default.nix
+++ b/modules/nixos/server/services/forgejo/default.nix
@@ -58,6 +58,15 @@ in {
             Referrer-Policy "no-referrer"
           }
 
+          # rate limiting: 30 requests per minute per IP
+          rate_limit {
+            zone git {
+              key {remote_host}
+              events 30
+              window 1m
+            }
+          }
+
           # Handle proxying
           handle_path /* {
             reverse_proxy localhost:3000 {


diff --git a/modules/nixos/server/services/f
orgejo/default.nix b/modules/nixos/server/se
rvices/forgejo/default.nix
index f5df02a..4c6ac05 100644
--- a/modules/nixos/server/services/forgejo/
default.nix
+++ b/modules/nixos/server/services/forgejo/
default.nix
@@ -58,6 +58,15 @@ in {
             Referrer-Policy "no-referrer"
           }
 
+          # rate limiting: 30 requests per 
minute per IP
+          rate_limit {
+            zone git {
+              key {remote_host}
+              events 30
+              window 1m
+            }
+          }
+
           # Handle proxying
           handle_path /* {
             reverse_proxy localhost:3000 {

 

diff --git a/modules/nixos/server/services/website/default.nix b/modules/nixos/ser
ver/services/website/default.nix
index f9f64a1..c21efc8 100644
--- a/modules/nixos/server/services/website/default.nix
+++ b/modules/nixos/server/services/website/default.nix
@@ -66,6 +66,15 @@ in {
               Referrer-Policy "no-referrer"
             }
 
+            # rate limiting: 100 requests per minute per IP
+            rate_limit {
+              zone static {
+                key {remote_host}
+                events 100
+                window 1m
+              }
+            }
+
             root * /var/www/ooknet.org/
             file_server
           '';


diff --git a/modules/nixos/server/services/w
ebsite/default.nix b/modules/nixos/server/se
rvices/website/default.nix
index f9f64a1..c21efc8 100644
--- a/modules/nixos/server/services/website/
default.nix
+++ b/modules/nixos/server/services/website/
default.nix
@@ -66,6 +66,15 @@ in {
               Referrer-Policy "no-referrer"
             }
 
+            # rate limiting: 100 requests p
er minute per IP
+            rate_limit {
+              zone static {
+                key {remote_host}
+                events 100
+                window 1m
+              }
+            }
+
             root * /var/www/ooknet.org/
             file_server
           '';

 

diff --git a/modules/nixos/server/webserver/caddy.nix b/modules/nixos/server/webse
rver/caddy.nix
index 0bdbec4..bf1b329 100644
--- a/modules/nixos/server/webserver/caddy.nix
+++ b/modules/nixos/server/webserver/caddy.nix
@@ -9,6 +9,10 @@
 in {
   config = mkIf caddy.enable {
     users.groups.www = {};
+
+    # metrics scraping via tailscale
+    networking.firewall.interfaces."tailscale0".allowedTCPPorts = [2019];
+
     services.caddy = mkMerge [
       {
         enable = true;
@@ -20,10 +24,13 @@ in {
           plugins = [
             "github.com/caddy-dns/[email protected]"
             "github.com/WeidiDeng/[email protected]
2aa13cb"
+            "github.com/mholt/[email protected]"
           ];
-          hash = "sha256-u1vthRVXRbsD8FnlzfX39Yn/uzHzvYfipu4NNp7uJLE=";
+          hash = "sha256-VcjByobqNnJvO3hm2LbcNYRQCsDjmZLQ7b/6B4AF7KA=";
         };
         globalConfig = ''
+          admin 0.0.0.0:2019
+
           servers {
             metrics
             trusted_proxies static private_ranges 173.245.48.0/20 103.21.244.0/22
 103.22.200.0/22 103.31.4.0/22 141.101.64.0/18 108.162.192.0/18 190.93.240.0/20 18
8.114.96.0/20 197.234.240.0/22 198.41.128.0/17 162.158.0.0/15 104.16.0.0/13 104.24
.0.0/14 172.64.0.0/13 131.0.72.0/22


diff --git a/modules/nixos/server/webserver/
caddy.nix b/modules/nixos/server/webserver/c
addy.nix
index 0bdbec4..bf1b329 100644
--- a/modules/nixos/server/webserver/caddy.n
ix
+++ b/modules/nixos/server/webserver/caddy.n
ix
@@ -9,6 +9,10 @@
 in {
   config = mkIf caddy.enable {
     users.groups.www = {};
+
+    # metrics scraping via tailscale
+    networking.firewall.interfaces."tailsca
le0".allowedTCPPorts = [2019];
+
     services.caddy = mkMerge [
       {
         enable = true;
@@ -20,10 +24,13 @@ in {
           plugins = [
             "github.com/caddy-dns/cloudflar
[email protected]"
             "github.com/WeidiDeng/caddy-clo
[email protected]
b"
+            "github.com/mholt/caddy-ratelim
[email protected]"
           ];
-          hash = "sha256-u1vthRVXRbsD8Fnlzf
X39Yn/uzHzvYfipu4NNp7uJLE=";
+          hash = "sha256-VcjByobqNnJvO3hm2L
bcNYRQCsDjmZLQ7b/6B4AF7KA=";
         };
         globalConfig = ''
+          admin 0.0.0.0:2019
+
           servers {
             metrics
             trusted_proxies static private_
ranges 173.245.48.0/20 103.21.244.0/22 103.2
2.200.0/22 103.31.4.0/22 141.101.64.0/18 108
.162.192.0/18 190.93.240.0/20 188.114.96.0/2
0 197.234.240.0/22 198.41.128.0/17 162.158.0
.0/15 104.16.0.0/13 104.24.0.0/14 172.64.0.0
/13 131.0.72.0/22

 
[ BACK TO LOG ]
──────────────────────────────────────────────────────────────────────────────────────
OOKNET
────────────────────────────────────────────────
OOKNET