Nginx rate limiting outside of container - any tips?

[Overgrow (OG)]

Can anybody please share his working configuration for rate limiting nginx outside of docker container (setup with discourse on the socket)? Thanks…

I seem to be unable to tune it properly and still limiting valid traffic.

Add an offline page to display when Discourse is rebuilding or starting up

It should be noted that running an nginx proxy in front of Discourse as described here will result in the rate limit, which is by default configured in Discourse Docker to apply for requests for all users. The rate limit template templates/web.ratelimited.template.yml should be removed from the docker config and the rate limit should then be configured in the outer nginx instance instead.

[pfaffman (Jay Pfaffman)]

@Overgrow

I seem to be unable to tune it properly and still limiting valid traffic.

Do you mean that traffic is getting limited when it shouldn’t be or that you are not limiting traffic when it should be?

[Overgrow (OG)]

@pfaffman

Do you mean that traffic is getting limited when it shouldn’t be

Exactly… for start I have used template from the inside of the container and moved it outside. I don’t know if there is some recommended config for rate limiting outer nginx.
Emojis and avatars seem to be suitable for different limits than the rest of traffic.

[Overgrow (OG)]

Bump… Really nobody is willing to share his tips for working rate limits for outer nginx? Thanks in advance!

[Stephen]

Please don’t bump topics. If someone had an answer for you I’m sure they would have volunteered it.

Assuming that you have followed the other guides here on meta, and nginx is correctly configured to pass client IPs into the container, is this actually a discourse problem?

[Overgrow (OG)]

a) AFAIK nginx outside of container is recommended
b) It should be tailor-made to what discourse requires

So, yes I see it as discourse related problem.

Is this really true and recommended practice?

The rate limit template templates/web.ratelimited.template.yml should be removed from the docker config and the rate limit should then be configured in the outer nginx instance instead.

[Stephen]

No, discourse doesn’t require nginx outside the container.

Nginx already exists inside the container and is configured automatically. It’s zero-touch providing you followed the standard install.

If you aren’t running any other services on the host you don’t need an external nginx instance at all.

[Overgrow (OG)]

Sorry, but I don’t think that 20+ minute app rebuilding without any offline page is good practice (for high traffic site).

[Stephen]

Manual rebuilds which require downtime happen once or twice a year. If you upgrade via /admin/upgrade the upgrades are seamless.

You can significantly reduce your rebuild times with a two-container install and I would recommend you look into this regardless of whether you use nginx.

[Overgrow (OG)]

Two-container install sounds good. But I can’t find any documentation on that here on forum …

[justin (Justin DiRose)]

@Overgrow

a) AFAIK nginx outside of container is recommended

No it is not. It’s possible but not a standard recommendation.

Here’s the guide.

Move from standalone container to separate web and data containers

This is an advanced setup. Don’t follow this unless you are experienced with Linux server administration and Docker. 2 Container Setup for a New Site Added by @pfaffman 2019-12-11. NOTE: If you want to create a 2 container site you can do this: ./discourse-setup --two-container It works just like normal except it’ll create separate data and web_only containers and generate a random password for the database. If you already have an app.yml you’ll need to rename it, or discourse-…

If your main concern is downtime during rebuilds, that’s going to be your best bet. If you need help setting that up, someone in marketplace will be able to help.