From e37a2a569c79dd4b5d17bb3d4dcb17e87dd17c52 Mon Sep 17 00:00:00 2001 From: Joe Nelson Date: Sat, 21 Jan 2017 20:16:21 -0800 Subject: [PATCH] Document rate limiting via nginx --- admin.rst | 21 ++++++++++++++++++++- auth.rst | 2 ++ 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/admin.rst b/admin.rst index 9f36dc4b9..e2fadd380 100644 --- a/admin.rst +++ b/admin.rst @@ -171,7 +171,26 @@ See the :ref:`ssl` section of the authentication guide. Rate Limiting ------------- -Foo +Nginx supports "leaky bucket" rate limiting (see `official docs `_). Using standard Nginx configuration, routes can be grouped into *request zones* for rate limiting. For instance we can define a zone for login attempts: + +.. code-block:: nginx + + limit_req_zone $binary_remote_addr zone=login:10m rate=1r/s; + +This creates a shared memory zone called "login" to store a log of IP addresses that access the rate limited urls. The space reserved, 10 MB (:code:`10m`) will give us enough space to store a history of 160k requests. We have chosen to allow only allow one request per second (:code:`1r/s`). + +Next we apply the zone to certain routes, like a hypothetical stored procedure called :code:`login`. + +.. code-block:: nginx + + location /rpc/login/ { + # apply rate limiting + limit_req zone=login burst=5; + } + +The burst argument tells Nginx to start dropping requests if more than five queue up from a specific IP. + +Nginx rate limiting is general and indescriminate. To rate limit each authenticated request individually you will need to add logic in a :ref:`Custom Validation ` function. Debugging ========= diff --git a/auth.rst b/auth.rst index f9c4f0267..3c42c9113 100644 --- a/auth.rst +++ b/auth.rst @@ -143,6 +143,8 @@ There is no performance penalty for having many database roles, although roles a -- allow authenticator to switch into user000 role -- (the role itself has nologin) +.. _custom_validation: + Custom Validation -----------------