Feat: configurable per-site rate limiting

diff --git a/manifests/site.pp b/manifests/site.pp
index 4455f45e924793984296700ba0ef0299a5bf611c..737a210beb3bc2127c965eb66eb7938edd299bf1 100644 (file)
--- a/manifests/site.pp
+++ b/manifests/site.pp
@@ -11,6 +11,11 @@ define nginx::site(
   $cache_size      = '10m',
   $cache_inactive  = '600s',
   $cache_max_size  = '1m',
+  $rate_limit      = false,
+  $rate_limit_key  = '$binary_remote_addr',
+  $rate_limit_zone = $name,
+  $rate_limit_size = "10m",
+  $rate_limit_rate = "20r/s",
   $x_frame_options = 'DENY',
 ) {
   nginx::site::config { $name:
@@ -47,6 +52,11 @@ define nginx::site(
     cache_size      => $cache_size,
     cache_inactive  => $cache_inactive,
     cache_max_size  => $cache_max_size,
+    rate_limit      => $rate_limit,
+    rate_limit_key  => $rate_limit_key,
+    rate_limit_zone => $rate_limit_zone,
+    rate_limit_size => $rate_limit_size,
+    rate_limit_rate => $rate_limit_rate,
     x_frame_options => $x_frame_options,
     require        => $certbot ? {
       true => $ensure ? {

diff --git a/manifests/site/config.pp b/manifests/site/config.pp
index 0cdceea3c36b9397313c2907a345b0558a1e98d2..c0e1809c5a2381da200c3e996a63c6618730c104 100644 (file)
--- a/manifests/site/config.pp
+++ b/manifests/site/config.pp
@@ -10,6 +10,11 @@ define nginx::site::config(
   $cache_size      = '10m',
   $cache_inactive  = '600s',
   $cache_max_size  = '1m',
+  $rate_limit      = false,
+  $rate_limit_key  = '$binary_remote_addr',
+  $rate_limit_zone = $server_name,
+  $rate_limit_size = "10m",
+  $rate_limit_rate = "20r/s",
   $x_frame_options = 'DENY',
 ){
   case $source {

diff --git a/templates/site-ssl.erb b/templates/site-ssl.erb
index c8529541d05919a2dd12932c9eb8a83d3385ac09..11a69ddcae570a0956a72992785a70474fd237a3 100644 (file)
--- a/templates/site-ssl.erb
+++ b/templates/site-ssl.erb
@@ -1,6 +1,9 @@
 <% if @cache == true -%>
 proxy_cache_path /var/cache/nginx/<%= @name %> levels=<%= @cache_levels %> keys_zone=<%= @name %>:<%= @cache_size %> inactive=<%= @cache_inactive %> max_size=<%= @cache_max_size %>;
 <% end -%>
+<% if @rate_limit == true and @rate_limit_zone == @server_name -%>
+limit_req_zone <%= @rate_limit_key %> zone=<%= @rate_limit_zone %>:<%= @rate_limit_size %> rate=<%= @rate_limit_rate %>;
+<% end -%>
 server {
   listen      443;
   server_name <%= @server_name %> <%= @aliases %>;
@@ -28,6 +31,11 @@ server {
 
     # cache config
     proxy_cache <%= @name %>;
+<% end -%>
+<% if @rate_limit == true -%>
+
+    # rate limiting
+    limit_req zone=<%= @rate_limit_zone %>;
 <% end -%>
   }
 }