Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add conservative traefik rate-limit to strfry #94

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add conservative traefik rate-limit to strfry #94

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions roles/relay/templates/docker-compose.yml.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,8 @@ services:
- "traefik.http.routers.strfry.rule=Host(`{{ domain }}`) && Headers(`Accept`, `application/nostr+json`) || HeadersRegexp(`Connection`, `(?i)Upgrade`) && HeadersRegexp(`Upgrade`, `websocket`)"
- "traefik.http.routers.strfry.entrypoints=websecure"
- "traefik.http.services.strfry.loadbalancer.server.port=7777"
- "traefik.http.middlewares.strfry.ratelimit.average=1"
- "traefik.http.middlewares.strfry.ratelimit.burst=10"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are these per-second?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's right, most would be req requests and I'm assuming many will be long lived for at least a second but it should probably be higher than 1 and tweak according to what we see

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://doc.traefik.io/traefik/middlewares/http/ratelimit/

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would prefer to set these a lot higher. I guess I'm not sure how exactly it does rate limits for websockets, but I assume every socket.write call counts as one request. For example when Nos downloads the home feed it will burst out a bunch of requests for the notes, then their profile pics, metadata. Same in the thread view. Something more like burst 100 and average 5 seem "conservative" to me. I'm not sure how much those would insulate from a bad actor or DDoS but I don't think that's necessarily the intention here, I think we are just trying to prevent some runaway script from infinite looping on us.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh I just read the docs about the "token bucket" style of rate limiting traefik is using. With the way it works I think the numbers I listed are pretty safe and won't catch normal apps.

Copy link
Member

@mplorentz mplorentz May 13, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

idk a burst of 100 would definitely catch a Nos user scrolling rapidly through a feed because it's kicking off at least one request for each note. Maybe 1000 is better? And if someone is DDosing it would still time them out them pretty quickly? It's hard to draw these lines without real world data.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was thinking about these values more as a binary search exploration because I'm not really sure how they are interpreted, I was assuming it was per connection request, not per internal websocket frame. In any case your proposed values seems safe



redirect-service:
Expand Down