doc: release notes

.env.sample

@@ -249,3 +249,13 @@ WRITE_TIMEOUT=0s
 #
 # https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#opt-forwardedHeaders-trustedIPs
 #TRUSTED_IPS="['10.13.12.1']" # 10.13.12.1 is an example
+
+## Rate limits
+# You can enable universal rate limits by setting RATE_LIMIT_EVERYTHING
+# to true, otherwise each app needs to export their own middleware labels.
+#
+# https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/ratelimit/
+#RATE_LIMIT_EVERYTHING=false
+#RATE_LIMIT_AVERAGE=100
+#RATE_LIMIT_BURST=200
+#RATE_LIMIT_PERIOD=1s

abra.sh

@@ -1,4 +1,4 @@
-export TRAEFIK_YML_VERSION=v36
+export TRAEFIK_YML_VERSION=v37
-export FILE_PROVIDER_YML_VERSION=v13
+export FILE_PROVIDER_YML_VERSION=v14
 export ENTRYPOINT_VERSION=v5
 export ANUBIS_YML_VERSION=v1

file-provider.yml.tmpl

@@ -22,6 +22,11 @@ http:
       basicAuth:
         usersFile: "/run/secrets/usersfile"
     {{ end }}
+    ip-rate-limit:
+      rateLimit:
+        average: {{ or (env "RATE_LIMIT_AVERAGE") "100" }}
+        burst: {{ or (env "RATE_LIMIT_BURST") "200" }}
+        period: {{ or (env "RATE_LIMIT_PERIOD") "1s" }}
     security:
       headers:
         frameDeny: true

release/next

@@ -0,0 +1,6 @@
+# Rate limits
+
+You can enable rate limits globally by updating the .env file for
+Traefik.  Per-app rate limits need to be supported by each app!
+
+Limits can be tested with benchmarking tools like `wrk`.

traefik.yml.tmpl

@@ -65,6 +65,10 @@ entrypoints:
         allowEncodedPercent: true
         allowEncodedQuestionMark: true
         allowEncodedHash: true
+  {{ if eq (env "RATE_LIMIT_EVERYTHING") "true" }}
+      middlewares:
+        - "ip-rate-limit@file"
+  {{ end }}
   {{- if eq (env "GITEA_SSH_ENABLED") "1" }}
   gitea-ssh:
     address: ":2222"