openvibers/openvibe.host Commits

Host: a rate limit answers 429, not 503, on every site (one http-level default for the 19 vhosts that lacked it) (#92)

OP OpenVibers committed 30 days ago · 57457db977 · 2 files, +24 −0

Found by an all-sites link sweep: Reviews' entity pages answered **503** to a short crawl. That was nginx's `limit_req` refusing at 10 r/s, and nginx answers 503 for a refused request by default, which reads as "the site is down" to browsers, crawlers and uptime checks.

19 of the 39 vhosts that rate-limit had no `limit_req_status 429`: Host, OpenRestream, Trade, Website, Events, Deals, Reviews, News, Coupons, Live, Billing, Search, and Tools with six of its subdomains.

`deploy/nginx/openvibe-ratelimit-status.conf` sets `limit_req_status 429;` and `limit_conn_status 429;` as the http-level default. It is installed with `ov-vhost-install` as an enabled sites file: `sites-enabled/*` is included inside the http block, so every server inherits it, and a vhost that sets its own status keeps it.

`test/nginx-ratelimit-status.test.js` pins exactly those two directives and no block.

Changes

ddiff --git a/deploy/nginx/openvibe-ratelimit-status.conf b/deploy/nginx/openvibe-ratelimit-status.conf
nnew file mode 100644
iindex 0000000..42cf135
---- /dev/null
++++ b/deploy/nginx/openvibe-ratelimit-status.conf
@@@ -0,0 +1,9 @@
++# OpenVibe host: what a rate limit answers. nginx answers 503 by default when limit_req or limit_conn refuses a request,
++# which tells a browser, a crawler and the uptime checks that the site is down. A limit is not an outage: answer 429.
++#
++# Installed as /etc/nginx/sites-available/openvibe-ratelimit-status.conf (enabled) with ov-vhost-install. sites-enabled/*
++# is included inside nginx.conf's http block, so these are the http-level defaults every server block inherits; a vhost
++# that sets its own status keeps it. Found 2026-10-14: 19 of the 39 vhosts that rate-limit answered 503 (Reviews' entity
++# pages under a crawl, among them).
++limit_req_status 429;
++limit_conn_status 429;
ddiff --git a/test/nginx-ratelimit-status.test.js b/test/nginx-ratelimit-status.test.js
nnew file mode 100644
iindex 0000000..6707b68
---- /dev/null
++++ b/test/nginx-ratelimit-status.test.js
@@@ -0,0 +1,15 @@
++'use strict';
++/**
++ * deploy/nginx/openvibe-ratelimit-status.conf: the host-wide answer of a rate limit. It is included inside nginx's http
++ * block (sites-enabled/*), so it must hold http-level directives only — never a server or location block, which would
++ * change what some site serves — and both limit kinds answer 429, not nginx's default 503.
++ */
++const assert = require('assert');
++const fs = require('fs');
++const path = require('path');
++
++const conf = fs.readFileSync(path.join(__dirname, '..', 'deploy', 'nginx', 'openvibe-ratelimit-status.conf'), 'utf8');
++const directives = conf.split('\n').map((l) => l.replace(/#.*/, '').trim()).filter(Boolean);
++assert.deepStrictEqual(directives, ['limit_req_status 429;', 'limit_conn_status 429;'], 'exactly the two status directives');
++assert.ok(!/[{}]/.test(directives.join('')), 'no block of any kind');
++console.log('nginx rate limit status: all checks passed');