Merge pull request 'fix(cinny-nginx): own rate budget for content-hashed app files' (#40) from fix/asset-rate-limit into main

.gitea/workflows/lint.yml

@@ -94,8 +94,16 @@ jobs:
 
       - name: Audit matrixbot dependencies
         # --local scans the env without spawning a venv (required for standalone Python)
-        # CVE-2026-3219 is in pip itself, not our code — ignore it explicitly
-        run: /opt/python/bin/pip-audit --local --ignore-vuln CVE-2026-3219
+        # CVE-2026-3219 is in pip itself, not our code — ignore it explicitly.
+        # The filelock CVEs (fixed in 4.2.1) are in pip-audit's own dependency
+        # (CacheControl[filecache]); the bot doesn't use filelock, and 4.2+
+        # needs Python 3.11, which this 3.10 audit env can't install.
+        run: >-
+          /opt/python/bin/pip-audit --local
+          --ignore-vuln CVE-2026-3219
+          --ignore-vuln CVE-2026-112906 --ignore-vuln CVE-2026-112907
+          --ignore-vuln CVE-2026-112913 --ignore-vuln CVE-2026-112914
+          --ignore-vuln CVE-2026-112937 --ignore-vuln CVE-2026-112940
 
   secret-scan:
     name: Secret scan (gitleaks)

cinny/nginx.conf

@@ -17,6 +17,14 @@ map $uri $lotus_shell_cache_control {
 # decoration picker can fetch hundreds of thumbnails, which would otherwise use
 # up chat_limit and 503 the app's own files.
 limit_req_zone $binary_remote_addr zone=decorations_limit:10m rate=100r/s;
+#
+# [cinny #201 follow-up] Content-hashed app files (js/css/fonts/images/wasm)
+# likewise: a cold page load fires ~75 requests within a second, and the
+# service worker precaches all ~126 build files at once (every deploy renames
+# them), both past chat_limit's burst of 60, so chunks 503ed and pages
+# rendered blank / the precache install failed. Immutable files, cheap to
+# serve; pages and the webhook keep chat_limit.
+limit_req_zone $binary_remote_addr zone=assets_limit:10m rate=100r/s;
 
 server {
     listen 80;
@@ -85,6 +93,8 @@ server {
         }
         location ~* \.(?:js|css|woff2?|png|svg|ico|webp|wasm)$ {
             include snippets/cinny-security-headers-framed.conf;
+            # Own budget (replaces the server-level chat_limit; see assets_limit).
+            limit_req zone=assets_limit burst=400 nodelay;
             expires 1y;
             add_header Cache-Control "public, immutable" always;
         }
@@ -93,6 +103,8 @@ server {
     # Cache content-addressed static assets aggressively
     location ~* \.(?:js|css|woff2?|png|svg|ico|webp)$ {
         include snippets/cinny-security-headers.conf;
+        # Own budget (replaces the server-level chat_limit; see assets_limit).
+        limit_req zone=assets_limit burst=400 nodelay;
         expires 1y;
         add_header Cache-Control "public, immutable" always;
     }
@@ -189,6 +201,8 @@ server {
         }
         location ~* \.(?:js|css|woff2?|png|svg|ico|webp|wasm)$ {
             include snippets/cinny-security-headers-call.conf;
+            # Own budget (replaces the server-level chat_limit; see assets_limit).
+            limit_req zone=assets_limit burst=400 nodelay;
             expires 1y;
             add_header Cache-Control "public, immutable" always;
         }