From 3817644e75a574d517b0f28d187fb24bad80e407 Mon Sep 17 00:00:00 2001
From: f <f@sutty.nl>
Date: Mon, 12 Oct 2026 17:11:07 +0000
Subject: [PATCH] feat: implement basic rate limiting by ip address (#142)

<!--
Thank you for doing recipe maintenance work!
Please mark all checklist items which are relevant for your changes.
Please remove the checklist items which are not relevant for your changes.
Feel free to remove this comment.
-->

* [x] I have deployed and tested my changes
* [x] I have [updated relevant versions in `abra.sh`](https://docs.coopcloud.tech/maintainers/upgrade/#updating-versions-in-the-abrash)
* [x] I have made my environment variable changes [backwards compatible](https://docs.coopcloud.tech/maintainers/upgrade/#backwards-compatible-environment-variable-changes)
* [ ] I have added a [release note entry](https://docs.coopcloud.tech/maintainers/upgrade/#creating-new-release-notes)

Reviewed-on: https://git.coopcloud.tech/coop-cloud/traefik/pulls/142
Reviewed-by: p4u1 <133+p4u1@noreply.git.coopcloud.tech>
Co-authored-by: f <f@sutty.nl>
---
 .env.sample            | 10 ++++++++++
 abra.sh                |  4 ++--
 file-provider.yml.tmpl |  7 ++++++-
 release/next           |  6 ++++++
 traefik.yml.tmpl       |  4 ++++
 5 files changed, 28 insertions(+), 3 deletions(-)
 create mode 100644 release/next

diff --git a/.env.sample b/.env.sample
index a3ab775..e4e0f04 100644
--- a/.env.sample
+++ b/.env.sample
@@ -249,3 +249,13 @@ WRITE_TIMEOUT=0s
 #
 # https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#opt-forwardedHeaders-trustedIPs
 #TRUSTED_IPS="['10.13.12.1']" # 10.13.12.1 is an example
+
+## Rate limits
+# You can enable universal rate limits by setting RATE_LIMIT_EVERYTHING
+# to true, otherwise each app needs to export their own middleware labels.
+#
+# https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/ratelimit/
+#RATE_LIMIT_EVERYTHING=false
+#RATE_LIMIT_AVERAGE=100
+#RATE_LIMIT_BURST=200
+#RATE_LIMIT_PERIOD=1s
diff --git a/abra.sh b/abra.sh
index 99af392..7370edf 100644
--- a/abra.sh
+++ b/abra.sh
@@ -1,4 +1,4 @@
-export TRAEFIK_YML_VERSION=v36
-export FILE_PROVIDER_YML_VERSION=v13
+export TRAEFIK_YML_VERSION=v37
+export FILE_PROVIDER_YML_VERSION=v14
 export ENTRYPOINT_VERSION=v5
 export ANUBIS_YML_VERSION=v1
diff --git a/file-provider.yml.tmpl b/file-provider.yml.tmpl
index c0fab18..2d06d19 100644
--- a/file-provider.yml.tmpl
+++ b/file-provider.yml.tmpl
@@ -22,6 +22,11 @@ http:
       basicAuth:
         usersFile: "/run/secrets/usersfile"
     {{ end }}
+    ip-rate-limit:
+      rateLimit:
+        average: {{ or (env "RATE_LIMIT_AVERAGE") "100" }}
+        burst: {{ or (env "RATE_LIMIT_BURST") "200" }}
+        period: {{ or (env "RATE_LIMIT_PERIOD") "1s" }}
     security:
       headers:
         frameDeny: true
@@ -70,4 +75,4 @@ tls:
   certificates:
     - certFile: /run/secrets/ssl_cert
       keyFile: /run/secrets/ssl_key
-  {{ end }}
\ No newline at end of file
+  {{ end }}
diff --git a/release/next b/release/next
new file mode 100644
index 0000000..1ec2bce
--- /dev/null
+++ b/release/next
@@ -0,0 +1,6 @@
+# Rate limits
+
+You can enable rate limits globally by updating the .env file for
+Traefik.  Per-app rate limits need to be supported by each app!
+
+Limits can be tested with benchmarking tools like `wrk`.
diff --git a/traefik.yml.tmpl b/traefik.yml.tmpl
index 82327c2..08de379 100644
--- a/traefik.yml.tmpl
+++ b/traefik.yml.tmpl
@@ -65,6 +65,10 @@ entrypoints:
         allowEncodedPercent: true
         allowEncodedQuestionMark: true
         allowEncodedHash: true
+  {{ if eq (env "RATE_LIMIT_EVERYTHING") "true" }}
+      middlewares:
+        - "ip-rate-limit@file"
+  {{ end }}
   {{- if eq (env "GITEA_SSH_ENABLED") "1" }}
   gitea-ssh:
     address: ":2222"