Discourse overloaded real traffic or DDOS? 100% CPU usage despite of decent traffic and high specs server

Product Support Self-hosting
14

@RGJ thanks for your advice.

We are now getting real IPs of the users in our discourse user profile pages from Admin GUI.

image
image1652×344 15.2 KB

We did that by uncommenting below line in our outer NGIXN,

proxy_ssl_server_name       on;
        proxy_ssl_protocols         TLSv1 TLSv1.1 TLSv1.2;
        proxy_pass       http://localhost:2045;
        proxy_redirect  http://localhost:2045/ https://howtodiscuss.com;
       # proxy_set_header X-Real-IP $remote_addr;
       # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       # proxy_set_header Host $http_host;
       # proxy_set_header X-NginX-Proxy true;

        proxy_redirect off;

        # Socket.IO Support
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

However, netstat still shows cloudlfare IPs.

Our original problem is why our CPU usage is still 100% even though our real time online traffic is approx 150 users average on google analytics.. and most of the unicorn workers are taking CPU usage, and i have already shared my app.yaml configs + and server specs in my first post. you can see above,

image
image1114×624 70.5 KB

Should we resize our server with more CPUs, or what changes/settings/optimization we can do in app.yaml, discourse or serverside to speed up our site and lower our CPU usage?

Should we uncomment the ratelimit template in our app.yaml now? Last time when we uncommented it, our normal users were facing the 429 too many requests because all users were likely showing as CF IPs in our server. but now we think real users IPs are coming and it will be safe to uncomment the ratelimit template in app.yml?

how do we confirm that discourse and our server is infact getting real IPs of the users, since netstats is still showing CF IPs. ?

Is someone doing DDOS attack to down our discourse forum, if yes, how to stop that?

If the 100% cpu usage is genuinely because of real genuine traffic increase, what server specs should we resize to now?

are there any multi-threading or parallel CPU usage optimizations settings we can do on linux/discourse level to fix our 100% CPU usage problem and load our site faster to users? We have disabled most of the plugins which we are not using.