I'm waiting for Cloudflare to open source their web server as promised. But failing that I'm likely to implement a web proxy that utilizes the wirefilter libra

I'm waiting for Cloudflare to open source their web server as promised. But failing that I'm likely to implement a web proxy that utilizes the wirefilter library that is already open sourced by Cloudflare (but no longer updated). The tools to stop these attacks are reasonably trivial. Most of the art of stopping them is observability. When you can see every dimension of a TCP/UDP connection, the TLS handshake, the HTTP communication... Then the dimension by which an attack is being conducted is glaringly obvious. Once you have the very obvious correlation, then you only need a blunt instrument of a tool that can block/deny/nullroute the attack. What's hard isn't the block rules, What's hard is instrumenting enough observability to see the obvious correlation of an attack. Even on my personal nginx a single request logs about 20 things. But there are literally hundreds of properties one can log if you have access to the entirety of the stack, and if you have access to log on it, then you have the ability to carry that context to a point in the code where you can block it. Also, 10k qps really isn't a lot. So this should be treated as a warning sign, this attack was low volume even for amateur booter services.