5 ms·
Global rate-limiting bucketed by Basic-Auth-presented API key? Easy enough in Nginx; no idea how to do it with Caddy. When people say "production", they mean t
by derefr 4y ago
Global rate-limiting bucketed by Basic-Auth-presented API key? Easy enough in Nginx; no idea how to do it with Caddy.
When people say "production", they mean things like "QoS for a shared-multitenant system, in the presence of customers with really badly tuned and spiky request workloads, whose traffic you must nevertheless mostly accept."
- mholt 4y agoIf you can't already do it with the rate limit module I wrote, open an issue with your detailed requirements: https://github.com/mholt/caddy-ratelimit https://github.com/mholt/caddy-ratelimit -- should be pretty straightforward for the most part. > QoS for a shared-multitenant system, in the presence of customers with really badly tuned and spiky request workloads, whose traffic you must nevertheless mostly accept. Yah, we see that sometimes. Caddy usually handles it fine, sometimes with a bit of massaging the config.
- POPOSYS 4y agoWe can not use Caddy as long as a reliable and battle-tested rate limit module does not exist. "Work in progress" is not something I would like to put on a production system. It would be great if you would like to finish the work on this project and make it part of the Caddy default distribution. Honestly I do not understand how people run high-traffic sites without rate limiting. [D]DOS attacks and other misuse (e.g. spambots etc.) are daily issues on the internet, do you just ignore that?
- heurisko 4y agoPasting a link from when we previously talked about this, for interest. https://news.ycombinator.com/item?id=31439457 https://news.ycombinator.com/item?id=31439457 Appreciative of all the work regarding caddy, but the rate limiting seems to be chicken and egg, as few people seem to be willing to test it out in order for it to be accepted into core, and people are unwilling to test it out, because it's not in core. It's also a blocker for me, so nginx wins by force of inertia.
- jakearmitage 4y agoSame for me. If it's not on core, means devs don't want to support it, which means it is buggy, therefore not ready for production.
- mholt 4y agoNo; if it's not in the core, that means we don't want to bloat the code base. Caddy is extensible for very good reasons!
- mholt 4y agoHappy to finish it if a company would like to sponsor that work. It works well enough for what it was originally commissioned for. It actually will probably work pretty well for you as-is. Try it!
- Alacart 4y agoAs a counter point, I've been running 100k+ domains through caddy clusters with about 1tb of traffic per month (so not a ton, but not nothing). I built and manage that solo with very little maintenance or support, which I think is a testament to how reliable and performant caddy is.
- mholt 4y agoHoly cow, 100k? Who are you? (Seriously) That might be the largest deployments I know about in terms of domain names. I keep telling people "tens of thousands" when I probably should be saying "hundreds of thousands"...
- Alacart 4y agoYou already know me, just not under this username! I try not to put my name directly out on forums like this, but I run https://approximated.app https://approximated.app and those 100k+ domains aren't all in one cluster, though some clusters are growing quickly and might be there in a few months. Customers paying for the clusters are generally SAAS or hosting related so they can bring a lot of user domains when they come on board and tend to grow steadily.
- mholt 4y agoAh, that's you! Thanks so much for sponsoring. Hit me up if you ever need something or would like something more/special from your sponsorship.
- POPOSYS 4y agoBut how do you know that it is really reliable and performant? How do you know how many requests are silently lost? I would like to read more about how reliability is actually measured on high-traffic sites.