mirror of
https://github.com/Growstuff/growstuff.git
synced 2026-10-29 18:28:28 -04:00
Brenda Wallace
a0b24381ac
- Renamed all instances of 'Activity' to 'Job' in views, controllers, and models. - Updated routes to reflect the change from activities to jobs. - Modified database schema to rename the activities table to jobs and adjusted related columns. - Updated locale files to change activity-related translations to jobs. - Adjusted tests to ensure they reference jobs instead of activities. - Removed the category field from jobs as they are now a plain list. - Updated seed data and sample data generation to create jobs instead of activities.
70 lines
2.7 KiB
Ruby
70 lines
2.7 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
class Rack::Attack
|
|
### Cache Config ###
|
|
|
|
# Count requests in this process's memory, not in Rails.cache (memcached).
|
|
# When memcached times out, the counters silently stop working and
|
|
# crawlers are never throttled or banned.
|
|
# Each Puma worker keeps its own counters, so the effective limits are
|
|
# per worker.
|
|
cache.store = ActiveSupport::Cache::MemoryStore.new(size: 8.megabytes)
|
|
|
|
### Throttle Config ###
|
|
|
|
if Rails.env.production?
|
|
# Throttle requests for members' data to 15 per minute per IP, on both the
|
|
# HTML routes and their /api/v1 equivalents.
|
|
restricted_routes = %r{^(/api/v1)?/(jobs|plantings|harvests|members)(/|$)}
|
|
|
|
throttle('req/ip/restricted_routes', limit: 15, period: 1.minute) do |req|
|
|
req.ip if req.path.match?(restricted_routes)
|
|
end
|
|
|
|
### Fail2Ban Config ###
|
|
|
|
# Block IPs that make too many requests to suspicious paths
|
|
# After 5 "bad" requests in 10 minutes, block the IP for 1 hour
|
|
blocklist('fail2ban/pentesters') do |req|
|
|
Fail2Ban.filter("pentesters-#{req.ip}", maxretry: 5, findtime: 10.minutes, bantime: 1.hour) do
|
|
# The count for the IP is incremented if the return value is truthy.
|
|
req.path.include?('wp-admin') ||
|
|
req.path.include?('wp-login') ||
|
|
req.path.include?('cgi-bin') ||
|
|
req.path.end_with?('.php', '.asp', '.aspx', '.jsp', '.exe', '.env', '.git')
|
|
end
|
|
end
|
|
end
|
|
|
|
# Abusive services
|
|
blocklist('block Semrush crawler') do |request|
|
|
request.user_agent.to_s.downcase.include?('semrush')
|
|
end
|
|
|
|
# Block IPs listed in the BLOCKED_IPS environment variable (comma separated).
|
|
# This lets us stop a crawler that is overloading the site without
|
|
# committing its IP address to the repository.
|
|
blocklist('block configured IPs') do |request|
|
|
ENV.fetch('BLOCKED_IPS', '').split(',').map(&:strip).include?(request.ip)
|
|
end
|
|
|
|
# Honeypot: block IPs that request disallowed route /dont-crawl-me for 7 days (1 week)
|
|
blocklist('fail2ban/honeypot') do |req|
|
|
Fail2Ban.filter("honeypot-#{req.ip}", maxretry: 1, findtime: 1.day, bantime: 7.days) do
|
|
req.path == '/dont-crawl-me' || req.path == '/dont-crawl-me/'
|
|
end
|
|
end
|
|
|
|
# Ban crawlers that request more than 500 pages in a day for 1 week (7 days)
|
|
blocklist('allow2ban/excessive_crawling') do |req|
|
|
Allow2Ban.filter("excessive-crawling-#{req.ip}", maxretry: 500, findtime: 1.day, bantime: 1.week) do
|
|
req.get? && !req.path.match?(%r{\.(css|js|png|jpg|jpeg|gif|ico|svg|woff2?|eot|ttf|otf)$})
|
|
end
|
|
end
|
|
|
|
### Custom Response Headers ###
|
|
|
|
# Add Retry-After header to throttled responses
|
|
self.throttled_response_retry_after_header = true
|
|
end
|