feat: granularize the rate limit configs

Author: JacobCoffee

pillar/base/haproxy.sls

@@ -17,6 +17,7 @@ haproxy:
         - docs.python.org
         - doc.python.org
       check: "HEAD /_check HTTP/1.1\\r\\nHost:\\ docs.python.org"
+      rate_limit: 100
 
     downloads:
       domains:
@@ -75,6 +76,7 @@ haproxy:
         - {{ config.server_name }}
       verify_host: bugs.psf.io
       check: "HEAD / HTTP/1.1\\r\\nHost:\\ {{ config.server_name }}"
+      rate_limit: {{ config.get('rate_limit', 10) }}
     {% endfor %}
 
     moin:

salt/haproxy/config/haproxy.cfg.jinja

@@ -52,6 +52,12 @@ global
     # Lower the amount of space we reserve for header rewriting
     tune.maxrewrite 1024
 
+    # rate limits only if there is a rate_limit in haproxy.sls
+    {% for service, config in haproxy.services.items() %}
+    {% if config.get('rate_limit') %}
+    stick-table type ip size 100k expire 30s store http_req_rate(1s) name {{ service }}_ratelimit
+    {% endif %}
+    {% endfor %}
 
 defaults
     log     global
@@ -117,11 +123,14 @@ frontend main
     bind :::80
     bind 127.0.0.1:19001  # This is our TLS socket.
 
-    # Client rate limiting
-    # See: https://www.haproxy.com/blog/four-examples-of-haproxy-rate-limiting
-    stick-table type ip size 100k expire 15s store http_req_rate(10s)
-    http-request track-sc0 src
-    http-request deny deny_status 429 if { sc_http_req_rate(0) gt 20 }
+    # Apply rate limits per srvice
+    {% for service, config in haproxy.services.items() %}
+    {% if config.get('rate_limit') %}
+    acl is_{{ service }} hdr(host) -i {% for domain in config.domains %}{{ domain }} {% endfor %}
+    http-request track-sc{{ loop.index }} src table {{ service }}_ratelimit if is_{{ service }}
+    http-request deny deny_status 429 if is_{{ service }} { sc{{ loop.index }}_http_req_rate() gt {{ config.rate_limit }} }
+    {% endif %}
+    {% endfor %}
 
     # Custom logging format, this is the same as the normal "httplog" in
     # HAProxy except information about the TLS connection is included.