4 ms·
We do precisely this ... and we're still dealing with the load issues. Currently I have fail2ban doing a 10 day block on any IP addr that hits our read only htt
by PaulDavisThe1st 2y ago
We do precisely this ... and we're still dealing with the load issues. Currently I have fail2ban doing a 10 day block on any IP addr that hits our read only http-git endpoint twice in 30 mins. The problem with this is that the default implementation of iptables doesn't scale well to 100k blocked addresses.
- diggan 2y agoFair enough, thanks for explaining to an outsider. I hope you manage to work out a good solution in the end!
- pabs3 2y agoDoes that not cause your devs, or people doing contributions, or browsing commits via the web, to get blocked?
- PaulDavisThe1st 2y agoYes, it does mean that anyone using the web-based interface to git gets blocked. We mirror to github for public access; our developers all use git itself, not the web interface, for interacting with the repo. How/what github et al. are doing to deal with this, I do not know.
- pabs3 2y agoIn that situation, why bother to have a local web interface at all? Edit: nevermind, I see you are using Gitea rather than cgit/etc. I guess Gitea can't disable the problematic commit/etc views.