From e84da6a8dfa9e660b660e44675f9bab359637f67 Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Mon, 3 Aug 2026 14:07:57 -0400
Subject: [PATCH] Add rate limits to sensitve pages

---
 .../private/lib/traefik/getTraefikConfig.ts   | 21 ++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/server/private/lib/traefik/getTraefikConfig.ts b/server/private/lib/traefik/getTraefikConfig.ts
index d47352e04..03b7bfa73 100644
--- a/server/private/lib/traefik/getTraefikConfig.ts
+++ b/server/private/lib/traefik/getTraefikConfig.ts
@@ -58,6 +58,8 @@ import { build } from "@server/build";
 const redirectHttpsMiddlewareName = "redirect-to-https";
 const redirectToRootMiddlewareName = "redirect-to-root";
 const badgerMiddlewareName = "badger";
+const landingRateLimitMiddlewareName = "landing-ratelimit";
+const bgRateLimitMiddlewareName = "bg-ratelimit";
 
 // Define extended target type with site information
 type TargetWithSite = Target & {
@@ -432,6 +434,18 @@ export async function getTraefikConfig(
                         replacement: "${1}://${2}/auth/org",
                         permanent: false
                     }
+                },
+                [landingRateLimitMiddlewareName]: {
+                    rateLimit: {
+                        average: 3,
+                        burst: 6
+                    }
+                },
+                [bgRateLimitMiddlewareName]: {
+                    rateLimit: {
+                        average: 3,
+                        burst: 6
+                    }
                 }
             }
         }
@@ -1055,6 +1069,7 @@ export async function getTraefikConfig(
                 config.getRawConfig().traefik.additional_middlewares || [];
             const routerMiddlewares = [
                 badgerMiddlewareName,
+                bgRateLimitMiddlewareName,
                 ...additionalMiddlewares
             ];
 
@@ -1539,6 +1554,7 @@ export async function getTraefikConfig(
                     entryPoints: [
                         config.getRawConfig().traefik.https_entrypoint
                     ],
+                    middlewares: [landingRateLimitMiddlewareName],
                     service: "landing-service",
                     rule: `Host(\`${fullDomain}\`) && (PathRegexp(\`^/auth/resource/[^/]+$\`) || PathRegexp(\`^/auth/idp/[0-9]+/oidc/callback\`) || PathPrefix(\`/_next\`) || Path(\`/auth/org\`) || PathRegexp(\`^/__nextjs*\`) || Path(\`/favicon.ico\`))`,
                     priority: 203,
@@ -1557,7 +1573,10 @@ export async function getTraefikConfig(
                     entryPoints: [
                         config.getRawConfig().traefik.https_entrypoint
                     ],
-                    middlewares: [redirectToRootMiddlewareName],
+                    middlewares: [
+                        landingRateLimitMiddlewareName,
+                        redirectToRootMiddlewareName
+                    ],
                     service: "landing-service",
                     rule: `Host(\`${fullDomain}\`)`,
                     priority: 202,