feat: implement basic rate limiting by ip address (#142)

<!--
Thank you for doing recipe maintenance work!
Please mark all checklist items which are relevant for your changes.
Please remove the checklist items which are not relevant for your changes.
Feel free to remove this comment.
-->

* [x] I have deployed and tested my changes
* [x] I have [updated relevant versions in `abra.sh`](https://docs.coopcloud.tech/maintainers/upgrade/#updating-versions-in-the-abrash)
* [x] I have made my environment variable changes [backwards compatible](https://docs.coopcloud.tech/maintainers/upgrade/#backwards-compatible-environment-variable-changes)
* [ ] I have added a [release note entry](https://docs.coopcloud.tech/maintainers/upgrade/#creating-new-release-notes)

Reviewed-on: #142
Reviewed-by: p4u1 <133+p4u1@noreply.git.coopcloud.tech>
Co-authored-by: f <f@sutty.nl>

.env.sample

@@ -249,3 +249,13 @@ WRITE_TIMEOUT=0s
 #
 # https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#opt-forwardedHeaders-trustedIPs
 #TRUSTED_IPS="['10.13.12.1']" # 10.13.12.1 is an example
+
+## Rate limits
+# You can enable universal rate limits by setting RATE_LIMIT_EVERYTHING
+# to true, otherwise each app needs to export their own middleware labels.
+#
+# https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/ratelimit/
+#RATE_LIMIT_EVERYTHING=false
+#RATE_LIMIT_AVERAGE=100
+#RATE_LIMIT_BURST=200
+#RATE_LIMIT_PERIOD=1s

.gitea/CODEOWNERS

@@ -0,0 +1 @@
+* @coop-cloud/traefik-maintainers

abra.sh

@@ -1,4 +1,4 @@
-export TRAEFIK_YML_VERSION=v36
-export FILE_PROVIDER_YML_VERSION=v13
+export TRAEFIK_YML_VERSION=v37
+export FILE_PROVIDER_YML_VERSION=v14
 export ENTRYPOINT_VERSION=v5
 export ANUBIS_YML_VERSION=v1

compose.anubis.yml

@@ -7,7 +7,7 @@ services:
       - "traefik.http.middlewares.anubis.forwardauth.address=http://anubis:8080/.within.website/x/cmd/anubis/api/check"
       - "traefik.http.middlewares.anubis.forwardauth.trustForwardHeader=true"
   anubis:
-    image: "ghcr.io/techarohq/anubis:v1.27.0"
+    image: "ghcr.io/techarohq/anubis:v1.28.1"
     environment:
       BIND: ":8080"
       TARGET: " "

file-provider.yml.tmpl

@@ -22,6 +22,11 @@ http:
       basicAuth:
         usersFile: "/run/secrets/usersfile"
     {{ end }}
+    ip-rate-limit:
+      rateLimit:
+        average: {{ or (env "RATE_LIMIT_AVERAGE") "100" }}
+        burst: {{ or (env "RATE_LIMIT_BURST") "200" }}
+        period: {{ or (env "RATE_LIMIT_PERIOD") "1s" }}
     security:
       headers:
         frameDeny: true
@@ -70,4 +75,4 @@ tls:
   certificates:
     - certFile: /run/secrets/ssl_cert
       keyFile: /run/secrets/ssl_key
-  {{ end }}
+  {{ end }}

release/next

@@ -0,0 +1,6 @@
+# Rate limits
+
+You can enable rate limits globally by updating the .env file for
+Traefik.  Per-app rate limits need to be supported by each app!
+
+Limits can be tested with benchmarking tools like `wrk`.

traefik.yml.tmpl

@@ -65,6 +65,10 @@ entrypoints:
         allowEncodedPercent: true
         allowEncodedQuestionMark: true
         allowEncodedHash: true
+  {{ if eq (env "RATE_LIMIT_EVERYTHING") "true" }}
+      middlewares:
+        - "ip-rate-limit@file"
+  {{ end }}
   {{- if eq (env "GITEA_SSH_ENABLED") "1" }}
   gitea-ssh:
     address: ":2222"