Compare commits

...
This repository has been archived on 2022-10-07. You can view files and clone it, but cannot push or open issues or pull requests.

7 Commits

Author SHA1 Message Date
Ivaylo Novakov 93aca03b2a
Revert "Try to fix nginx"
This reverts commit 03fecc8cd1.
2021-12-08 19:05:02 +01:00
Ivaylo Novakov abfbc74241
Try to fix nginx 2021-12-08 18:56:57 +01:00
Ivaylo Novakov 03fecc8cd1
Try to fix nginx 2021-12-08 18:51:18 +01:00
Ivaylo Novakov 82e85f829f
Download rate limit to 20rps. 2021-12-08 18:09:53 +01:00
Ivaylo Novakov cae76b2d53
Download rate limit to 10rps. 2021-12-08 18:08:14 +01:00
Ivaylo Novakov b67b4b4335
Download rate limit to 3rps. 2021-12-08 18:04:32 +01:00
Ivaylo Novakov 25af756a14
Add download rate limits. 2021-12-08 18:00:46 +01:00
3 changed files with 36 additions and 12 deletions

View File

@ -9,7 +9,7 @@ if ($request_method = PURGE) {
return 462; return 462;
} }
limit_conn downloads_by_ip 100; # ddos protection: max 100 downloads at a time limit_conn downloads_by_ip 20; # ddos protection: max 100 downloads at a time
# ensure that skylink that we pass around is base64 encoded (transform base32 encoded ones) # ensure that skylink that we pass around is base64 encoded (transform base32 encoded ones)
# this is important because we want only one format in cache keys and logs # this is important because we want only one format in cache keys and logs

View File

@ -177,9 +177,15 @@ location /skynet/skyfile {
limit_req zone=uploads_by_ip burst=10 nodelay; limit_req zone=uploads_by_ip burst=10 nodelay;
limit_req zone=uploads_by_ip_throttled; limit_req zone=uploads_by_ip_throttled;
limit_req zone=downloads_by_ip burst=20 nodelay;
limit_req zone=downloads_by_ip_throttled;
limit_conn upload_conn 5; limit_conn upload_conn 5;
limit_conn upload_conn_rl 1; limit_conn upload_conn_rl 1;
limit_conn download_conn 20;
limit_conn download_conn_rl 1;
client_max_body_size 1000M; # make sure to limit the size of upload to a sane value client_max_body_size 1000M; # make sure to limit the size of upload to a sane value
# increase request timeouts # increase request timeouts
@ -215,9 +221,15 @@ location /skynet/tus {
limit_req zone=uploads_by_ip burst=10 nodelay; limit_req zone=uploads_by_ip burst=10 nodelay;
limit_req zone=uploads_by_ip_throttled; limit_req zone=uploads_by_ip_throttled;
limit_conn upload_conn 5; limit_req zone=downloads_by_ip burst=20 nodelay;
limit_req zone=downloads_by_ip_throttled;
limit_conn upload_conn 3;
limit_conn upload_conn_rl 1; limit_conn upload_conn_rl 1;
limit_conn download_conn 20;
limit_conn download_conn_rl 1;
# TUS chunks size is 40M + leaving 10M of breathing room # TUS chunks size is 40M + leaving 10M of breathing room
client_max_body_size 50M; client_max_body_size 50M;
@ -286,9 +298,15 @@ location /skynet/pin {
limit_req zone=uploads_by_ip burst=10 nodelay; limit_req zone=uploads_by_ip burst=10 nodelay;
limit_req zone=uploads_by_ip_throttled; limit_req zone=uploads_by_ip_throttled;
limit_conn upload_conn 5; limit_req zone=downloads_by_ip burst=20 nodelay;
limit_req zone=downloads_by_ip_throttled;
limit_conn upload_conn 3;
limit_conn upload_conn_rl 1; limit_conn upload_conn_rl 1;
limit_conn download_conn 20;
limit_conn download_conn_rl 1;
proxy_set_header User-Agent: Sia-Agent; proxy_set_header User-Agent: Sia-Agent;
proxy_pass http://sia:9980$uri?siapath=$dir1/$dir2/$dir3&$args; proxy_pass http://sia:9980$uri?siapath=$dir1/$dir2/$dir3&$args;
} }

View File

@ -99,12 +99,18 @@ http {
limit_req_zone $binary_remote_addr zone=uploads_by_ip:10m rate=10r/s; limit_req_zone $binary_remote_addr zone=uploads_by_ip:10m rate=10r/s;
limit_req_zone $limit_key zone=uploads_by_ip_throttled:10m rate=10r/m; limit_req_zone $limit_key zone=uploads_by_ip_throttled:10m rate=10r/m;
limit_req_zone $binary_remote_addr zone=downloads_by_ip:10m rate=20r/s;
limit_req_zone $limit_key zone=downloads_by_ip_throttled:10m rate=20r/m;
limit_req_zone $binary_remote_addr zone=registry_access_by_ip:10m rate=60r/m; limit_req_zone $binary_remote_addr zone=registry_access_by_ip:10m rate=60r/m;
limit_req_zone $limit_key zone=registry_access_by_ip_throttled:10m rate=20r/m; limit_req_zone $limit_key zone=registry_access_by_ip_throttled:10m rate=20r/m;
limit_conn_zone $binary_remote_addr zone=upload_conn:10m; limit_conn_zone $binary_remote_addr zone=upload_conn:10m;
limit_conn_zone $limit_key zone=upload_conn_rl:10m; limit_conn_zone $limit_key zone=upload_conn_rl:10m;
limit_conn_zone $binary_remote_addr zone=download_conn:10m;
limit_conn_zone $limit_key zone=download_conn_rl:10m;
limit_conn_zone $binary_remote_addr zone=downloads_by_ip:10m; limit_conn_zone $binary_remote_addr zone=downloads_by_ip:10m;
limit_req_status 429; limit_req_status 429;