Rate limiting and/or fail2ban nginx?

[ribtoks]

Hi

Is there any best practice of protecting nginx-based deployment from DDoS using rate limiting and/or fail2ban?

Does it actually negatively affect inound events processing?

nginx rate limiting docs

[ruslandoga]

👋 @ribtoks

There is some rate-limiting built into Plausible: https://github.com/search?q=repo%3Aplausible%2Fanalytics%20ratelimit&type=code - for auth, api, and some other endpoints.

/api/events rate-limit can be configured per site via ingest_rate_limit_threshold column in sites table in plausible_db
By default it means the number of requests allowed in per 60 seconds and is not set, meaning no rate limiting applied to /api/events.

I don't have experience with NGINX rate-limiting so won't be able to comment on that. It would be interesting to try it out though!

[ribtoks]

Hey @ruslandoga . Thank you for fast reply!

Just to confirm if I understood correctly (also, after looking into the code):

1. by default each site has no rate limiting configured? (ingest_rate_limit_threshold is NULL by default)
2. the only way to tweak ingest_rate_limit_threshold is via a query in Postgres, no other config/UI is available at this time?

[ruslandoga]

yes and yes :)

[ribtoks]

Thank you! Would be nice if it was possible to set a default inject rate limit somewhere in the general Plausible configuration (could be empty by default for backward compatibility). This way it would be a bit more fool-proof.