lichess-org / leroyjenkins Goto Github PK

leroyjenkins might not be the best name for a software project if one of the goals is to be inclusive. For a lot people that meme is linked with racism and minstrel shows.

Maybe named pipes instead of sockets ...

mkfifo leroy_sink
cargo run --release -- ... 0<leroy_sink

And from elsewhere:

cat ips.txt > leroy_sink

Test this with nginx.

Undo this, but fix the existence test: 76591ee

Checking whether an IP is in the ipset is one of the slower parts of the program. During a DDoS, leroy will often be faced with a large list of duplicate IPs that made a huge number of simultaneous requests, it would be good to add each banned IP to an in-memory cache that is cheap to check and we skip any lines that are in that cache. This should significantly improve performance in DDoS circumstances

Any ip that shows up gets banned immediately (no rate limiter)

The idea being that we could have a more ban-happy leroy for situations where the rate of 429s from nginx hit a certain threshold. e.g, when the 429s ramp up globally, we can be more ban happy.

https://github.com/lichess-org/leroyjenkins/blob/main/src/main.rs#L52C5-L52C19 is no longer used, remove it.