Discourse overloaded real traffic or DDOS? 100% CPU usage despite of decent traffic and high specs server

The ip 172.17.0.1 is probably a docker ip. I assume that the logs you posted are from the nginx service in the discourse container. My guess is that the nginx in your host is sending the request to the nginx in discourse, and the nginx in discourse is seeing the ip from the nginx in your host.

You should be able to fix it either by setting the real ip in discourse to be the value of a header sent by the nginx in the host, or by using a socket to connect the nginx services.

For example, in the nginx in the host you do proxy_set_header X-Real-IP $remote_addr;, and in the nginx in the discourse container you would use the real ip according to this header, set_real_ip_from 0.0.0.0/0; (assuming the discourse nginx is not publicly accessed) and real_ip_header X-Real-IP;. You probably will need a template or run some sed command to include it in the nginx configuration file in discourse.

Another option is to use sockets, and include the web.socketed.template.yml according to:

But my recommendation, if affordable, is to use discourse in it’s own server, without having to use nginx as a reverse proxy in front, which would make the setup much more straightforward and easier.

3 Likes