Merge pull request #180 from WadeBarnes/add-rate-limiting

Add support for rate limiting

docker/Dockerfile

@@ -1,4 +1,5 @@
 ARG build_image=node:fermium
+ARG caddy_builder_image=caddy:builder-alpine
 ARG runtime_image=caddy:alpine
 
 # build stage
@@ -9,9 +10,17 @@ RUN npm install
 COPY . .
 RUN npm run build
 
+# caddy build stage
+FROM ${caddy_builder_image} as caddy-build-stage
+
+# Install ratelimit/v0.2.0
+RUN xcaddy build \
+    --with github.com/RussellLuo/caddy-ext/ratelimit@3497b19617f19deca8a4a625a93d2b774bb0dd29
 
 # production stage
 FROM ${runtime_image} as production-stage
+
+COPY --from=caddy-build-stage /usr/bin/caddy /usr/bin/caddy
 COPY --from=build-stage /app/dist /srv
 
 # Fix permissions issue with Caddy image

docker/config/Caddyfile

@@ -1,6 +1,7 @@
 {
     #  See https://caddy.community/t/making-sense-of-auto-https-and-why-disabling-it-still-serves-https-instead-of-http/9761
     auto_https off
+    {$RATE_LIMIT_ORDERING}
 }
 
 {$WEB_HOST_NAME}:{$WEB_HOST_PORT} {
@@ -32,9 +33,11 @@
     # Enable gzip, zstd compression
     encode zstd gzip
 
-    # Enable templates module - required for 
+    # Enable templates module - required for
     templates
 
+    {$DEFAULT_RATE_LIMIT}
+
     # Openly exposed health check endpoint for OpenShift
     respond /health 200
 
@@ -49,6 +52,7 @@
 
     # Proxy requests to API service
     route /api/* {
+        {$API_RATE_LIMIT}
         reverse_proxy {$API_HOST}:{$API_PORT} {
             header_up Host {upstream_hostport}
             header_up X-Forwarded-Host {host}
@@ -57,6 +61,7 @@
 
     # Proxy requests to Hooks
     route /hooks/* {
+        {$API_RATE_LIMIT}
         reverse_proxy {$API_HOST}:{$API_PORT} {
             header_up Host {upstream_hostport}
             header_up X-Forwarded-Host {host}

docker/docker-compose.yml

@@ -1,5 +1,5 @@
 version: "3"
-services:  
+services:
   orgbook-web:
     image: orgbook-web:latest
     environment:
@@ -8,6 +8,10 @@ services:
       WEB_HOST_TLS: ${PUBLIC_WEB_HOST_TLS}
       API_HOST: ${PUBLIC_API_HOST}
       API_PORT: ${PUBLIC_API_PORT}
+
+      RATE_LIMIT_ORDERING: ${RATE_LIMIT_ORDERING}
+      DEFAULT_RATE_LIMIT: ${DEFAULT_RATE_LIMIT}
+      API_RATE_LIMIT: ${API_RATE_LIMIT}
     volumes:
       - ./config/Caddyfile:/etc/caddy/Caddyfile
     ports:

docker/manage

@@ -64,6 +64,10 @@ configureEnvironment() {
   export PUBLIC_WEB_HOST_TLS=${PUBLIC_WEB_HOST_TLS:-off}
   export PUBLIC_API_HOST=${PUBLIC_API_HOST:-https://orgbook.gov.bc.ca}
   export PUBLIC_API_PORT=${PUBLIC_API_PORT:-443}
+
+  export RATE_LIMIT_ORDERING=${RATE_LIMIT_ORDERING:-'order rate_limit before basicauth'}
+  export DEFAULT_RATE_LIMIT=${DEFAULT_RATE_LIMIT:-'rate_limit {remote_host} 50r/s'}
+  export API_RATE_LIMIT=${API_RATE_LIMIT:-'rate_limit {remote_host} 25r/s'}
 }
 
 cleanUpEnvironment() {