Compare commits
7 Commits
Author | SHA1 | Date |
---|---|---|
Ivaylo Novakov | 93aca03b2a | |
Ivaylo Novakov | abfbc74241 | |
Ivaylo Novakov | 03fecc8cd1 | |
Ivaylo Novakov | 82e85f829f | |
Ivaylo Novakov | cae76b2d53 | |
Ivaylo Novakov | b67b4b4335 | |
Ivaylo Novakov | 25af756a14 |
|
@ -9,7 +9,7 @@ if ($request_method = PURGE) {
|
||||||
return 462;
|
return 462;
|
||||||
}
|
}
|
||||||
|
|
||||||
limit_conn downloads_by_ip 100; # ddos protection: max 100 downloads at a time
|
limit_conn downloads_by_ip 20; # ddos protection: max 100 downloads at a time
|
||||||
|
|
||||||
# ensure that skylink that we pass around is base64 encoded (transform base32 encoded ones)
|
# ensure that skylink that we pass around is base64 encoded (transform base32 encoded ones)
|
||||||
# this is important because we want only one format in cache keys and logs
|
# this is important because we want only one format in cache keys and logs
|
||||||
|
|
|
@ -177,9 +177,15 @@ location /skynet/skyfile {
|
||||||
limit_req zone=uploads_by_ip burst=10 nodelay;
|
limit_req zone=uploads_by_ip burst=10 nodelay;
|
||||||
limit_req zone=uploads_by_ip_throttled;
|
limit_req zone=uploads_by_ip_throttled;
|
||||||
|
|
||||||
|
limit_req zone=downloads_by_ip burst=20 nodelay;
|
||||||
|
limit_req zone=downloads_by_ip_throttled;
|
||||||
|
|
||||||
limit_conn upload_conn 5;
|
limit_conn upload_conn 5;
|
||||||
limit_conn upload_conn_rl 1;
|
limit_conn upload_conn_rl 1;
|
||||||
|
|
||||||
|
limit_conn download_conn 20;
|
||||||
|
limit_conn download_conn_rl 1;
|
||||||
|
|
||||||
client_max_body_size 1000M; # make sure to limit the size of upload to a sane value
|
client_max_body_size 1000M; # make sure to limit the size of upload to a sane value
|
||||||
|
|
||||||
# increase request timeouts
|
# increase request timeouts
|
||||||
|
@ -215,9 +221,15 @@ location /skynet/tus {
|
||||||
limit_req zone=uploads_by_ip burst=10 nodelay;
|
limit_req zone=uploads_by_ip burst=10 nodelay;
|
||||||
limit_req zone=uploads_by_ip_throttled;
|
limit_req zone=uploads_by_ip_throttled;
|
||||||
|
|
||||||
limit_conn upload_conn 5;
|
limit_req zone=downloads_by_ip burst=20 nodelay;
|
||||||
|
limit_req zone=downloads_by_ip_throttled;
|
||||||
|
|
||||||
|
limit_conn upload_conn 3;
|
||||||
limit_conn upload_conn_rl 1;
|
limit_conn upload_conn_rl 1;
|
||||||
|
|
||||||
|
limit_conn download_conn 20;
|
||||||
|
limit_conn download_conn_rl 1;
|
||||||
|
|
||||||
# TUS chunks size is 40M + leaving 10M of breathing room
|
# TUS chunks size is 40M + leaving 10M of breathing room
|
||||||
client_max_body_size 50M;
|
client_max_body_size 50M;
|
||||||
|
|
||||||
|
@ -286,9 +298,15 @@ location /skynet/pin {
|
||||||
limit_req zone=uploads_by_ip burst=10 nodelay;
|
limit_req zone=uploads_by_ip burst=10 nodelay;
|
||||||
limit_req zone=uploads_by_ip_throttled;
|
limit_req zone=uploads_by_ip_throttled;
|
||||||
|
|
||||||
limit_conn upload_conn 5;
|
limit_req zone=downloads_by_ip burst=20 nodelay;
|
||||||
|
limit_req zone=downloads_by_ip_throttled;
|
||||||
|
|
||||||
|
limit_conn upload_conn 3;
|
||||||
limit_conn upload_conn_rl 1;
|
limit_conn upload_conn_rl 1;
|
||||||
|
|
||||||
|
limit_conn download_conn 20;
|
||||||
|
limit_conn download_conn_rl 1;
|
||||||
|
|
||||||
proxy_set_header User-Agent: Sia-Agent;
|
proxy_set_header User-Agent: Sia-Agent;
|
||||||
proxy_pass http://sia:9980$uri?siapath=$dir1/$dir2/$dir3&$args;
|
proxy_pass http://sia:9980$uri?siapath=$dir1/$dir2/$dir3&$args;
|
||||||
}
|
}
|
||||||
|
|
|
@ -99,12 +99,18 @@ http {
|
||||||
limit_req_zone $binary_remote_addr zone=uploads_by_ip:10m rate=10r/s;
|
limit_req_zone $binary_remote_addr zone=uploads_by_ip:10m rate=10r/s;
|
||||||
limit_req_zone $limit_key zone=uploads_by_ip_throttled:10m rate=10r/m;
|
limit_req_zone $limit_key zone=uploads_by_ip_throttled:10m rate=10r/m;
|
||||||
|
|
||||||
|
limit_req_zone $binary_remote_addr zone=downloads_by_ip:10m rate=20r/s;
|
||||||
|
limit_req_zone $limit_key zone=downloads_by_ip_throttled:10m rate=20r/m;
|
||||||
|
|
||||||
limit_req_zone $binary_remote_addr zone=registry_access_by_ip:10m rate=60r/m;
|
limit_req_zone $binary_remote_addr zone=registry_access_by_ip:10m rate=60r/m;
|
||||||
limit_req_zone $limit_key zone=registry_access_by_ip_throttled:10m rate=20r/m;
|
limit_req_zone $limit_key zone=registry_access_by_ip_throttled:10m rate=20r/m;
|
||||||
|
|
||||||
limit_conn_zone $binary_remote_addr zone=upload_conn:10m;
|
limit_conn_zone $binary_remote_addr zone=upload_conn:10m;
|
||||||
limit_conn_zone $limit_key zone=upload_conn_rl:10m;
|
limit_conn_zone $limit_key zone=upload_conn_rl:10m;
|
||||||
|
|
||||||
|
limit_conn_zone $binary_remote_addr zone=download_conn:10m;
|
||||||
|
limit_conn_zone $limit_key zone=download_conn_rl:10m;
|
||||||
|
|
||||||
limit_conn_zone $binary_remote_addr zone=downloads_by_ip:10m;
|
limit_conn_zone $binary_remote_addr zone=downloads_by_ip:10m;
|
||||||
|
|
||||||
limit_req_status 429;
|
limit_req_status 429;
|
||||||
|
|
Reference in New Issue