LotusGuild/matrix

fix(cinny-web): per-client rate limits; own budget for decorations #36

Merged

jared merged 1 commits from fix/nginx-real-ip-decorations into main

2026-10-19 12:44:26 -04:00

Author	SHA1	Message	Date
Lotus CIandClaude Opus 5.5	a52d6a89bc	fix(cinny-web): per-client rate limits; own budget for decorations Lint / Shell (shellcheck) (pull_request) Successful in 7s Details Lint / JS (eslint) (pull_request) Successful in 7s Details Lint / No secrets in webhook configs (pull_request) Successful in 3s Details Lint / Landing page is rendered (matrix (pull_request) Successful in 3s Details Lint / Python (ruff) (pull_request) Successful in 4s Details Lint / Python deps (pip-audit) (pull_request) Successful in 49s Details Lint / Secret scan (gitleaks) (pull_request) Successful in 5s Details Lint / Shell (shellcheck) (push) Successful in 7s Details Lint / JS (eslint) (push) Successful in 6s Details Lint / No secrets in webhook configs (push) Successful in 4s Details Lint / Landing page is rendered (matrix (push) Successful in 4s Details Lint / Python (ruff) (push) Successful in 4s Details Lint / Python deps (pip-audit) (push) Successful in 30s Details Lint / Secret scan (gitleaks) (push) Successful in 4s Details Every request reaches LXC 106 from Nginx Proxy Manager (10.10.10.27), and nginx had no realip config, so chat_limit (20 r/s, burst 60, keyed by $binary_remote_addr) was ONE bucket for the whole community: a scanner burst 503ed real users. Trust X-Real-IP from the proxy only, in both server blocks. Decorations (#22) now come from this host, and the profile picker can fetch all 629 thumbnails: ~500 of them 503ed in testing. /decorations/ gets its own zone (100 r/s, burst 700) instead of chat_limit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-19 12:41:46 -04:00