From 8d50163c721a20f7729fa8e84ae70be73a8ab323 Mon Sep 17 00:00:00 2001 From: Suriya Date: Thu, 30 Jul 2026 16:52:56 +0530 Subject: [PATCH] raise queue.workolik.com edge rate limit for legitimate bulk orders queue-api-proxy's Traefik rate limit was average=150/burst=50, live on the container since before this repo existed (created 2026-05-30) but never captured in docker-compose.yml - the container just kept running with labels set at creation, invisible in git. Root-caused via a real bulk-order test: 200 orders fired without client-side pacing hit 79 429s, all before reaching NATS. The gateway's per-request cost is cheap (validate + publish to JetStream), and the worker pool absorbs bursts asynchronously once a message is queued - the edge limit doesn't need to shape traffic, NATS already does that downstream. It only needs to catch actual flood-scale abuse. Raised to average=300/burst=400 so realistic bulk-order volume clears it comfortably. Documented the labels in git for the first time so this isn't invisible config drift going forward. --- docker-compose.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/docker-compose.yml b/docker-compose.yml index 988f5a4..bd05eec 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -21,6 +21,16 @@ services: - "traefik.http.routers.queue-api.tls.certresolver=letsencrypt" - "traefik.http.routers.queue-api.priority=100" - "traefik.http.services.queue-api.loadbalancer.server.port=8201" + # Edge rate limit (per source IP, Traefik default). Predates this repo - + # the running container (created 2026-05-30) had average=150/burst=50 + # baked in at creation time, undocumented here since labels aren't + # re-read on an existing container. Raised to fit real bulk-order + # traffic: NATS + the worker pool absorb bursts fine once a request + # reaches the gateway, so this only needs to block actual flood-scale + # abuse, not legitimate customers batching orders (2026-07-30). + - "traefik.http.middlewares.queue-rl.ratelimit.average=300" + - "traefik.http.middlewares.queue-rl.ratelimit.burst=400" + - "traefik.http.routers.queue-api.middlewares=queue-rl" # Kubernetes dashboard proxy (kube.workolik.com ? K8s dashboard) k8s-dashboard-proxy: