eblume/blumeops
1
1
Fork 0
Code Issues Pull requests Projects Releases 83 Packages Wiki Activity Actions

Fix fly.io proxy rate limit to key on real client IP
All checks were successful
Deploy Fly.io Proxy / deploy (push) Successful in 2m24s
Details

Browse source 
The general rate limit zone used $binary_remote_addr (Fly's internal
proxy IP), causing all external clients to share one bucket. Switch to
$http_fly_client_ip to match forge_auth's correct behavior.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Erich Blume 2026-04-10 19:00:33 -07:00
commit a75f28e073
2 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
docs/changelog.d/+fix-flyio-rate-limit-key.bugfix.md Normal file
View file

@ -0,0 +1 @@
Fix Fly.io proxy rate limiting to key on real client IP instead of Fly's internal proxy IP, so crawlers no longer consume the shared rate limit bucket for all clients.

2
fly/nginx.conf
View file

@ -27,7 +27,7 @@ http {
access_log /var/log/nginx/access.json.log json_log; access_log /var/log/nginx/access.json.log json_log;
# Rate limiting zones — define per-service zones as needed # Rate limiting zones — define per-service zones as needed
limit_req_zone $binary_remote_addr zone=general:10m rate=10r/s; limit_req_zone $http_fly_client_ip zone=general:10m rate=10r/s;
# Forge-specific rate limit keyed on real client IP (Fly-Client-IP header). # Forge-specific rate limit keyed on real client IP (Fly-Client-IP header).
# $binary_remote_addr is Fly's internal proxy IP — all clients share one # $binary_remote_addr is Fly's internal proxy IP — all clients share one