coop-cloud/forgejo
2
1
Fork 0
Code Issues 4 Pull Requests 8 Actions Packages Projects Releases Wiki Activity

WIP: set reasonable defaults for timeouts/limits #48

Draft
Brooke wants to merge 1 commits from ratelimiting into main
pull from: ratelimiting
merge into: :main
Conversation 3 Commits 1 Files Changed 2
+21
Brooke commented 2026-09-01 19:12:25 +00:00
Owner
Copy Link
Copy Source

Recently it seems to have become more popular to do very low hanging fruit attacks on forgejo/gitea instances. One of these being many login and registration attempts.

Considering gitea/forgejo already has tools for limiting the frequency of these attempts I'm proposing some defaults for webhooks, logins, and api requests.

To be clear, this is currently untested and it remains to be seen if these rate limits work with the current architecture of traefik as the main load balancer.

Recently it seems to have become more popular to do very low hanging fruit attacks on forgejo/gitea instances. One of these being many login and registration attempts. Considering gitea/forgejo already has tools for limiting the frequency of these attempts I'm proposing some defaults for webhooks, logins, and api requests. To be clear, this is currently untested and it remains to be seen if these rate limits work with the current architecture of traefik as the main load balancer.
Brooke added 1 commit 2026-09-01 19:12:26 +00:00
set reasonable defaults for webhook, service login, and api request timeouts/limits 76f463857e
Brooke requested review from fauno 2026-09-02 03:39:34 +00:00
app.ini.tmpl
@@ -46,2 +46,4 @@
REQUIRE_SIGNIN_VIEW = {{ env "GITEA_REQUIRE_SIGNIN_VIEW" }}
ENABLE_INTERNAL_SIGNIN = {{ env "GITEA_ENABLE_INTERNAL_SIGNIN" }}
MAX_FAILED_ATTEMPTS = {{ or (env "GITEA_LOGIN_MAX_FAILED_ATTEMPTS") "5" }}
LOCKOUT_DURATION = {{ or (env "GITEA_LOGIN_LOCKOUT_DURATION") "1h" }}
fauno commented 2026-09-02 13:35:19 +00:00
Owner
Copy Link
Copy Source

nice! i didn't know this syntax :O

nice! i didn't know this syntax :O
app.ini.tmpl
@@ -157,0 +164,4 @@
[api]
MAX_RESPONSE_ITEMS = {{ or (env "GITEA_API_MAX_RESPONSE_ITEMS") "50" }}
DEFAULT_PAGING_NUM = {{ or (env "GITEA_API_DEFAULT_PAGING_NUM") "20" }}
ENABLE_SWAGGER = {{ or (env "GITEA_API_ENABLE_SWAGGER") "false" }}
fauno commented 2026-09-02 13:35:50 +00:00
Owner
Copy Link
Copy Source

is swagger enabled by default? could it affect api clients?

is swagger enabled by default? could it affect api clients?
Brooke commented 2026-09-04 02:28:33 +00:00
Author
Owner
Copy Link
Copy Source

It is enabled by default but It should not have any effect on actual usage of the api.

It is enabled by default but It should not have any effect on actual usage of the api.
fauno commented 2026-09-02 13:44:21 +00:00
Owner
Copy Link
Copy Source

i'm open to testing it but not sure how to monitor this. i found a gitea_accesses metric on grafana, would that be useful? it only moved from 309 to 315 in the data i have, but our instance is private

i'm open to testing it but not sure how to monitor this. i found a `gitea_accesses` metric on grafana, would that be useful? it only moved from 309 to 315 in the data i have, but our instance is private
This pull request doesn't have enough required approvals yet. 0 of 1 approvals granted from users or teams on the allowlist.
You are not authorized to merge this pull request.
This pull request is marked as a work in progress.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin ratelimiting:ratelimiting
git checkout ratelimiting
Sign in to join this conversation.
Reviewers
No Reviewers
fauno
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
3wordchant aadil (Aadil Ayub) abra-bot (Abra Bot) ammaratef45 amras (Sarma) Apfelwurm appletalk arjan basebuilder BornDeleuze Brooke carla cas (Cassowary) codegod100 coopcloud cyrnel decentral1se (d1) dede devydave fauno (fauno) flancian Frando iexos jade (Jade Ambrose) javielico (Javielico) jjsfunhouse jmakdah2 (Jackie Makdah) joe-irving (Joe Irving) kawaiipunk (KawaiiPunk) knoflook kolaente lambdabundesverband linnealovespie (April) marlon (marlon) mayel mirsal moosemower moritz nicksellen (Nick Sellen) notplants oxaliq (sorrel) p4u1 pau pharaohgraphy (Andrew 🐦‍🔥❤️‍🔥✴️) PhiNatalie renovate-bot (Comrade Renovate Bot) ripclap rix rscmbbng sef (sef) simon sixsmith (Sixsmith) stevensting tobias trav (Trav Fryer) val (val (he/him)) vaznasty virtualboys wolcen (Chris Thompson) wykwit xynosis yksflip
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: coop-cloud/forgejo#48