[Question]: Running Librechat bebind GCP Loadbalancer - how does ip based ratelimit work?

[xueshanf]

What is your question?

We are running Librechat behind GCP loadbalancer. I have a few questions:

• how to get real client request IP show up in logs
• for IP based ratelimit, does it use the Loadbalancer's IP or real client IP? If GCP's LB, then would the service get ratelimited rather quickly when there are lots of users using it?

More Details

The reason I am asking is because I spotted some log entries like this:

ERROR 2024-09-01T00:00:19.635833161Z [resource.labels.containerName: librechat] [Login] [Login failed] [Username: [email protected]] [Request-IP: 35.x.x.x].

The IP is loadbalancer IP. I don't see any other client IP requests. Maybe there is a flag to show real client IP?

What is the main subject of your question?

No response

Screenshots

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[danny-avila]

The IP is loadbalancer IP. I don't see any other client IP requests. Maybe there is a flag to show real client IP?

There is not. The IP in the log is simply what is available to the API via express native property of the req object, i.e. req.ip.

If you are using a load balancer in front of it, you should maybe disable the API's IP rate limits and simply use the user ones instead.

Notes on configuring the API's limiters: https://www.librechat.ai/docs/configuration/mod_system

[xueshanf]

@danny-avila I am looking in api/server/index.js, L56, It does seem to set to "trust proxy"... Does it mean Librechat actually do know real client IP and use it for ip based ratelimit?

[xueshanf]

@@danny-avila It seems no configuration to disable login attempts per IP. Our users are getting {"message":"Too many login attempts, please try again after 5 minutes."} , as soon as there are other users tried and failed. It looks like the LB's IP is used for ratelimits that that's shared by all users through that IP. Is there a way to workaround or even quick code changes? Basically a few failed login attempts can bring the whole service down....