coop-cloud/traefik
7
2
Fork 19
Code Issues 16 Pull Requests 4 Releases Wiki Activity

feat: implement basic rate limiting by ip address #142

Merged
p4u1 merged 3 commits from rate-limits into master 2026-10-12 17:11:07 +00:00
Conversation 9 Commits 3 Files Changed 5
+28 -3
5 changed files with 28 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.sample
+10
View File
@@ -249,3 +249,13 @@ WRITE_TIMEOUT=0s
#
# https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#opt-forwardedHeaders-trustedIPs
#TRUSTED_IPS="['10.13.12.1']" # 10.13.12.1 is an example
## Rate limits
# You can enable universal rate limits by setting RATE_LIMIT_EVERYTHING
# to true, otherwise each app needs to export their own middleware labels.
#
# https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/ratelimit/
p4u1 marked this conversation as resolved Outdated
p4u1 commented 2026-09-28 08:54:25 +00:00
Outdated
Review
Copy Link
Copy Source

Can you add an example on how to enable a single service via the label?

Can you add an example on how to enable a single service via the label?
fauno commented 2026-10-08 14:25:27 +00:00
Outdated
Review
Copy Link
Copy Source

it's included on the docs and the recipe has to support it, do you think it's not enough pointer?

it's included on the docs and the recipe has to support it, do you think it's not enough pointer?
👍 1
#RATE_LIMIT_EVERYTHING=false
#RATE_LIMIT_AVERAGE=100
#RATE_LIMIT_BURST=200
#RATE_LIMIT_PERIOD=1s
abra.sh
+2 -2
View File
@@ -1,4 +1,4 @@
export TRAEFIK_YML_VERSION=v36
export FILE_PROVIDER_YML_VERSION=v13
export TRAEFIK_YML_VERSION=v37
export FILE_PROVIDER_YML_VERSION=v14
export ENTRYPOINT_VERSION=v5
export ANUBIS_YML_VERSION=v1
file-provider.yml.tmpl
+6 -1
View File
@@ -22,6 +22,11 @@ http:
basicAuth:
usersFile: "/run/secrets/usersfile"
{{ end }}
ip-rate-limit:
rateLimit:
average: {{ or (env "RATE_LIMIT_AVERAGE") "100" }}
burst: {{ or (env "RATE_LIMIT_BURST") "200" }}
period: {{ or (env "RATE_LIMIT_PERIOD") "1s" }}
fauno marked this conversation as resolved Outdated
p4u1 commented 2026-09-28 08:52:10 +00:00
Outdated
Review
Copy Link
Copy Source

Can you make this configurable too

Can you make this configurable too
security:
headers:
frameDeny: true
@@ -70,4 +75,4 @@ tls:
certificates:
- certFile: /run/secrets/ssl_cert
keyFile: /run/secrets/ssl_key
{{ end }}
{{ end }}
release/next
+6
View File
@@ -0,0 +1,6 @@
# Rate limits
You can enable rate limits globally by updating the .env file for
Traefik. Per-app rate limits need to be supported by each app!
Limits can be tested with benchmarking tools like `wrk`.
traefik.yml.tmpl
+4
View File
@@ -65,6 +65,10 @@ entrypoints:
allowEncodedPercent: true
allowEncodedQuestionMark: true
allowEncodedHash: true
{{ if eq (env "RATE_LIMIT_EVERYTHING") "true" }}
middlewares:
- "ip-rate-limit@file"
{{ end }}
{{- if eq (env "GITEA_SSH_ENABLED") "1" }}
gitea-ssh:
address: ":2222"