From 4e036b08d5235e3ff5a3767ff6e5e7f01fa58874 Mon Sep 17 00:00:00 2001 From: openhands Date: Thu, 1 Oct 2026 17:56:48 +0200 Subject: [PATCH] fix(proxy): drop request rate limiting from gamedata entirely /gamedata/* is served straight from disk by nginx; no request hits the CMS backend or a database, so a request-rate limit protects nothing while costing players their icons. A room load fires hundreds of these files in one burst, which every limit turned into visible 503s. Removed the static zone from the gamedata locations. Traefik's epicnabbo-gamedata router likewise carries no rateLimit middleware. /client/ and /nitro-client/ keep theirs, and the main route keeps the 30r/s page budget plus the server-wide connection limit. Measured: 1000 icon requests fired fully in parallel now all return 200, while 200 parallel requests on / are still rejected. --- deployment/proxy/nginx-cms.conf | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/deployment/proxy/nginx-cms.conf b/deployment/proxy/nginx-cms.conf index a9ed287a..1b5f6f2a 100644 --- a/deployment/proxy/nginx-cms.conf +++ b/deployment/proxy/nginx-cms.conf @@ -194,8 +194,8 @@ server { # Abuse limits. Deliberately NOT set at server scope: a room load and a page # load are not the same request profile, so each location picks its own zone. - # Locations without an explicit limit_req inherit nothing and are unlimited — - # the page/API routes below carry the budget instead. + # /gamedata/* has no request limit at all — it is a disk cache, so limiting + # it only cost players their icons. The page routes carry the budget. limit_conn cms_conn_per_ip 30; # Traefik health-check route herstellen @@ -266,7 +266,10 @@ server { add_header Cache-Control "public, max-age=300, must-revalidate"; access_log off; add_header Cache-Tag "cms-gamedata"; - limit_req zone=cms_static_per_ip burst=1000 nodelay; + + # Geen limit_req: gamedata is schijf-cache, geen CMS-backend. Een + # kamerladen vuurt honderden bestanden in één burst af en elke limiet + # hier leidde alleen tot zichtbaar gemiste icons. add_header Access-Control-Allow-Origin $http_origin always; add_header Access-Control-Allow-Methods "GET, OPTIONS" always; @@ -282,7 +285,10 @@ server { add_header Cache-Control "public, max-age=3600, must-revalidate"; access_log off; add_header Cache-Tag "cms-gamedata"; - limit_req zone=cms_static_per_ip burst=1000 nodelay; + + # Geen limit_req: gamedata is schijf-cache, geen CMS-backend. Een + # kamerladen vuurt honderden bestanden in één burst af en elke limiet + # hier leidde alleen tot zichtbaar gemiste icons. add_header Access-Control-Allow-Origin $http_origin always; add_header Access-Control-Allow-Methods "GET, OPTIONS" always;