mirror of
https://github.com/tdurieux/anonymous_github.git
synced 2026-11-14 00:07:00 +01:00
29 lines
1.1 KiB
Plaintext
29 lines
1.1 KiB
Plaintext
# http context. Requires anonymous-logging.conf's trusted client IP variable.
|
|
# Empty keys exclude ZIP downloads, navigation, writes and unrelated APIs.
|
|
map "$request_method:$uri" $anonymous_file_limit_key {
|
|
default "";
|
|
~*^(GET|HEAD):/api/repo/[^/]+/file/ $anonymous_client_ip;
|
|
}
|
|
map "$request_method:$uri" $anonymous_listing_limit_key {
|
|
default "";
|
|
~*^(GET|HEAD):/api/repo/[^/]+/files(/|$) $anonymous_client_ip;
|
|
}
|
|
limit_req_zone $anonymous_file_limit_key zone=anonymous_file_requests:10m rate=4r/m;
|
|
limit_req_zone $anonymous_listing_limit_key zone=anonymous_listing_requests:10m rate=2r/m;
|
|
|
|
# Private operational entries are date-scoped regexes, never committed IP lists.
|
|
# An empty file disables targeted blocks. Date must match the host's log timezone.
|
|
map "$time_iso8601:$anonymous_client_ip" $anonymous_bulk_block {
|
|
default 0;
|
|
include /etc/nginx/anonymous-bulk-blocks.map;
|
|
}
|
|
map "$anonymous_bulk_block:$anonymous_file_limit_key:$anonymous_listing_limit_key" $anonymous_reject_bulk {
|
|
default 0;
|
|
~^1:.+ 1;
|
|
"1::" 0;
|
|
}
|
|
map $anonymous_reject_bulk $anonymous_bulk_retry {
|
|
default 30;
|
|
1 3600;
|
|
}
|