KeyCDN is the CDN in question. I tried enabling OriginShield and adding a template.yml (in the style of cloudflare.template.yml) to my app.yml, but I was still getting 429s.
Rather than keep futzing with it, I’ve switched to BunnyCDN and that seems to be working better.
I’ve put the template file below in case it helps anyone else.
keycdn.template.yml
run:
- file:
path: /tmp/add-keycdn-ips
chmod: +x
contents: |
#!/bin/bash -e
# Add list of keycdn ips
curl -s 'https://www.keycdn.com/shield-prefixes.json' | \
python3 -c "import sys, json; print('\n'.join(json.load(sys.stdin)['prefixes']))" > /tmp/keycdn-ips
# Make into nginx commands and escape for inclusion into sed append command
CONTENTS=$(</tmp/keycdn-ips sed 's/^/set_real_ip_from /' | sed 's/$/;/' | tr '\n' '\\' | sed 's/\\/\\n/g')
echo keycdn IPs:
echo $(echo | sed "/^/a $CONTENTS")
# Insert into discourse.conf
sed -i "/sendfile on;/a $CONTENTS\nreal_ip_header X-Forwarded-For;\nreal_ip_recursive on;" /etc/nginx/conf.d/discourse.conf
# Clean up
rm /tmp/keycdn-ips
- exec: "/tmp/add-keycdn-ips"
- exec: "rm /tmp/add-keycdn-ips"