Nginx rate limiting: zones, burst, 429

• limit_req_zone $binary_remote_addr zone=api:10m rate=60r/m — пул
• limit_req zone=api burst=20 nodelay — в location
• limit_req_status 429 — иначе 503 default
• limit_conn — параллельные соединения (не запросы)
• Логи: log_format includes $limit_req_status для fail2ban filter

# /etc/nginx/conf.d/rate-limits.conf
limit_req_zone  zone=api:10m rate=60r/m;
limit_req_zone  zone=login:10m rate=5r/m;
limit_req_status 429;

server {
  location /api/ {
    limit_req zone=api burst=20 nodelay;
    proxy_pass http://backend;
  }
  location /login {
    limit_req zone=login burst=3 nodelay;
    proxy_pass http://backend;
  }
}

# fail2ban filter (jail.d/nginx-rate.conf)
[Definition]
failregex = limiting requests, excess.*client: <HOST>

• Setup fail2ban
• Token Bucket