0.3.8

internal/config/config.go

@@ -30,6 +30,18 @@ type Config struct {
 	RRDPath           string
 	GraphDir          string
 	StatsInterval     time.Duration
+
+	// Per-IP rate limiting. Off by default -- see README "Rate limiting"
+	// for what each endpoint's limit protects against and reasonable
+	// values if you turn it on.
+	RateLimitEnabled    bool
+	RateLimitStats      int
+	RateLimitStatsLive  int
+	RateLimitGraph      int
+	RateLimitChannel    int
+	RateLimitVerify     int
+	RateLimitVerifyDone int
+	RateLimitCreate     int
 }
 
 func Load() (Config, error) {
@@ -86,6 +98,36 @@ func Load() (Config, error) {
 	if c.StatsInterval < 10*time.Second {
 		return c, errors.New("STATS_INTERVAL must be at least 10s")
 	}
+
+	c.RateLimitEnabled = envBool("RATE_LIMIT_ENABLED", false)
+	c.RateLimitStats, err = envInt("RATE_LIMIT_STATS", 60)
+	if err != nil {
+		return c, err
+	}
+	c.RateLimitStatsLive, err = envInt("RATE_LIMIT_STATS_LIVE", 60)
+	if err != nil {
+		return c, err
+	}
+	c.RateLimitGraph, err = envInt("RATE_LIMIT_GRAPH", 600)
+	if err != nil {
+		return c, err
+	}
+	c.RateLimitChannel, err = envInt("RATE_LIMIT_CHANNEL", 40)
+	if err != nil {
+		return c, err
+	}
+	c.RateLimitVerify, err = envInt("RATE_LIMIT_VERIFY", 10)
+	if err != nil {
+		return c, err
+	}
+	c.RateLimitVerifyDone, err = envInt("RATE_LIMIT_VERIFY_DONE", 10)
+	if err != nil {
+		return c, err
+	}
+	c.RateLimitCreate, err = envInt("RATE_LIMIT_CREATE", 5)
+	if err != nil {
+		return c, err
+	}
 	return c, nil
 }
 

internal/web/server.go

@@ -144,7 +144,7 @@ func (s *Server) security(next http.Handler) http.Handler {
 
 func (s *Server) stats(w http.ResponseWriter, r *http.Request) {
 	ip := s.clientIP(r).String()
-	if !s.limit.allow("stats|"+ip, 60, time.Minute) {
+	if s.cfg.RateLimitEnabled && !s.limit.allow("stats|"+ip, s.cfg.RateLimitStats, time.Minute) {
 		s.tooMany(w)
 		return
 	}
@@ -173,7 +173,7 @@ func (s *Server) stats(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) statsLive(w http.ResponseWriter, r *http.Request) {
 	ip := s.clientIP(r).String()
-	if !s.limit.allow("statslive|"+ip, 60, time.Minute) {
+	if s.cfg.RateLimitEnabled && !s.limit.allow("statslive|"+ip, s.cfg.RateLimitStatsLive, time.Minute) {
 		s.tooMany(w)
 		return
 	}
@@ -252,7 +252,14 @@ func (s *Server) asset(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) graph(w http.ResponseWriter, r *http.Request) {
 	ip := s.clientIP(r).String()
-	if !s.limit.allow("graph|"+ip, 120, time.Minute) {
+	// Graph PNGs are cheap to serve: rrd.Manager.Graph caches each
+	// key+theme render on disk for ~55s, so most hits here are a plain
+	// file read, not an rrdtool invocation. One page view alone can
+	// legitimately touch this 6 ranges x 2 themes (lightbox open, theme
+	// toggle) times, before counting multiple tabs or several visitors
+	// sharing one IP (same household/NAT) -- see README "Rate limiting"
+	// for tuning RATE_LIMIT_GRAPH if this still trips in practice.
+	if s.cfg.RateLimitEnabled && !s.limit.allow("graph|"+ip, s.cfg.RateLimitGraph, time.Minute) {
 		s.tooMany(w)
 		return
 	}
@@ -288,7 +295,7 @@ func (s *Server) channel(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "invalid client address", http.StatusBadRequest)
 		return
 	}
-	if !s.limit.allow("channel|"+ip.String(), 40, time.Minute) {
+	if s.cfg.RateLimitEnabled && !s.limit.allow("channel|"+ip.String(), s.cfg.RateLimitChannel, time.Minute) {
 		s.tooMany(w)
 		return
 	}
@@ -316,7 +323,7 @@ func (s *Server) verifyStart(w http.ResponseWriter, r *http.Request) {
 	if !s.requirePost(w, r, ip.String()) {
 		return
 	}
-	if !s.limit.allow("verify|"+ip.String(), 10, time.Minute) {
+	if s.cfg.RateLimitEnabled && !s.limit.allow("verify|"+ip.String(), s.cfg.RateLimitVerify, time.Minute) {
 		s.tooMany(w)
 		return
 	}
@@ -362,7 +369,7 @@ func (s *Server) verifyComplete(w http.ResponseWriter, r *http.Request) {
 	if !s.requirePost(w, r, ip.String()) {
 		return
 	}
-	if !s.limit.allow("verifydone|"+ip.String(), 10, time.Minute) {
+	if s.cfg.RateLimitEnabled && !s.limit.allow("verifydone|"+ip.String(), s.cfg.RateLimitVerifyDone, time.Minute) {
 		s.tooMany(w)
 		return
 	}
@@ -391,7 +398,7 @@ func (s *Server) createChannel(w http.ResponseWriter, r *http.Request) {
 	if !s.requirePost(w, r, ip.String()) {
 		return
 	}
-	if !s.limit.allow("create|"+ip.String(), 5, time.Hour) {
+	if s.cfg.RateLimitEnabled && !s.limit.allow("create|"+ip.String(), s.cfg.RateLimitCreate, time.Hour) {
 		s.tooMany(w)
 		return
 	}