Unless you run a community that has a history of DDOS attacks for some particular reason and you expect more, I’d not use any more of your brain on it. It would take me an hour or three to figure it out and document it. I have been setting up Discourse for people for a long time and have never worked with someone for whom DDOS was an actual problem.