mirror of
https://gitlab.archlinux.org/archlinux/infrastructure.git
synced 2026-09-19 13:39:07 +02:00
Leonidas Spyropoulos
578b93395f
- Route arch-commits through a slow lane (1 msg/s per domain) so Gmail isn't throttling, bump queue_lifetime to 14d - Block scraper user-agents and rate-limit the search endpoint in nginx Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>
83 lines
2.3 KiB
Django/Jinja
83 lines
2.3 KiB
Django/Jinja
# limit general requests to 2 r/s to block DoS attempts.
|
|
limit_req_zone $binary_remote_addr zone=mailmanlimit:10m rate=2r/s;
|
|
|
|
# Throttle the heavy search endpoint harder than the rest.
|
|
limit_req_zone $binary_remote_addr zone=mailmansearch:10m rate=20r/m;
|
|
|
|
limit_req_status 429;
|
|
|
|
# Drop various aggressive AI/scraper bots.
|
|
map $http_user_agent $mailman_blocked_ua {
|
|
default 0;
|
|
"~*Bytespider" 1;
|
|
"~*GPTBot" 1;
|
|
"~*ClaudeBot" 1;
|
|
"~*Amazonbot" 1;
|
|
"~*AhrefsBot" 1;
|
|
"~*SemrushBot" 1;
|
|
"~*meta-externalagent" 1;
|
|
"~*DataForSeoBot" 1;
|
|
"~*DotBot" 1;
|
|
"~*Sogou" 1;
|
|
"~*PetalBot" 1;
|
|
"~*MJ12bot" 1;
|
|
}
|
|
|
|
# This is for POSTORIUS_TEMPLATE_BASE_URL and mailman_hyperkitty.Archiver's base_url.
|
|
server {
|
|
listen 8000;
|
|
listen [::]:8000;
|
|
server_name localhost;
|
|
|
|
access_log off;
|
|
|
|
location / {
|
|
include /etc/nginx/uwsgi_params;
|
|
uwsgi_pass unix:/run/mailman-web/mailman-web.sock;
|
|
}
|
|
}
|
|
|
|
include snippets/redirect-80.conf;
|
|
|
|
server {
|
|
include snippets/listen-443.conf;
|
|
server_name {{ lists_domain }};
|
|
|
|
access_log /var/log/nginx/{{ lists_domain }}/access.log main;
|
|
access_log /var/log/nginx/{{ lists_domain }}/access.log.json json_main;
|
|
error_log /var/log/nginx/{{ lists_domain }}/error.log;
|
|
|
|
ssl_certificate /etc/letsencrypt/live/{{ lists_domain }}/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/{{ lists_domain }}/privkey.pem;
|
|
|
|
# Bytespider's distributed AWS range.
|
|
deny 47.128.59.0/24;
|
|
|
|
location /static/ {
|
|
alias /var/lib/mailman-web/static/;
|
|
}
|
|
|
|
location /pipermail/ {
|
|
alias /var/lib/mailman2/archives/public/;
|
|
}
|
|
|
|
# Heavy search endpoint: stricter limit.
|
|
location ~ ^/(archives|hyperkitty)/search {
|
|
if ($mailman_blocked_ua) {
|
|
return 444;
|
|
}
|
|
limit_req zone=mailmansearch burst=5 nodelay;
|
|
include /etc/nginx/uwsgi_params;
|
|
uwsgi_pass unix:/run/mailman-web/mailman-web.sock;
|
|
}
|
|
|
|
location / {
|
|
if ($mailman_blocked_ua) {
|
|
return 444;
|
|
}
|
|
limit_req zone=mailmanlimit burst=5 nodelay;
|
|
include /etc/nginx/uwsgi_params;
|
|
uwsgi_pass unix:/run/mailman-web/mailman-web.sock;
|
|
}
|
|
}
|