Feature request: rate limiting (limit_req_zone, limit_req)

[khaefeli]

(D)DoS, brute force attacks etc are everywhere.
We want to protect our backends from excessive requests and load.
Nginx is supporting rate limiting in the ngx_http_limit_req_module module:
https://www.nginx.com/blog/rate-limiting-nginx/

Bring this feature as default to the puppet nginx core and help people to protect their backends.

[wyardley]

I agree that we'll need a better way of handling modules at some point. I'm not sure that this should be the default configuration, though.
For now, installing the module itself may need to be handled outside of the module, though configuring its directives should be possible with the existing tooling.

[khaefeli]

sorry, I was a little bit inaccurate in my description:
support it with the puppet nginx module, but don't enable it by default. 

Actually, it's not a 3rd party module.
It's nginx core - so you just need to enable limit_req_zone in the http section and map the limit_req zone=mylimit in the location section. I could create a PR if you want.

[ubellavance]

You'd want to set a limit of connections per IP address by default? I don't think it is the role of a module to take care of that. By the way, I implemented it easily this way in a hiera location section:

...
  location_custom_cfg_append :
     limit_conn: addr 10;
     limit_conn_log_level: error;
...

But I agree that it could be better if the options were real options and not having to use location_custom_cfg*, but it is currently working.

[khaefeli]

no, that's limit_conn
I'm talking about limit_req, which is implemented a different way :)

[ubellavance]

Ok, can you achieve it using a location_custom_cfg_append? But in any case, my definition of a puppet module is that it should allow the user do do a lot of stuff (ideally everything that the target service allows), but not change the default settings.

[khaefeli]

sure. you could link the zone to the location with location_custom_cfg_append (including options) and add the zones via server_cfg_append. I could also create some config files and include them. But that's more a bad workaround from my point of view.
currently there are ~120 server and ~110 location parameters. Why not supporting this important core option? :)

[ubellavance]

Hi @khaefeli,

I have nothing against the fact that this core feature should be supported. You even offered to create a PR, which is very positive. My only opinion is that limit_req should not be enabled by default by the module. But again, this is very good news, thanks!

[absltkaos]

I submitted a PR, it doesn't enable request limiting by default, but it does expose it for configuring now.