···1515 port = port;
1616 };
17171818+ # One address may hold a household's worth of tabs and join at a human
1919+ # pace. Without this a single host opened ~2500 sockets at once and churned
2020+ # thousands more, and the thread-per-socket server ran out of tasks for
2121+ # everyone else.
2222+ services.nginx.appendHttpConfig = ''
2323+ limit_conn_zone $binary_remote_addr zone=mazegame_conns:10m;
2424+ limit_req_zone $binary_remote_addr zone=mazegame_joins:10m rate=2r/s;
2525+ '';
2626+1827 services.nginx.virtualHosts.${domain} = {
1928 enableACME = true;
2029 forceSSL = true;
···5059 extraConfig = ''
5160 proxy_read_timeout 1h;
5261 proxy_send_timeout 1h;
6262+ limit_conn mazegame_conns 32;
6363+ limit_req zone=mazegame_joins burst=30 nodelay;
6464+ limit_conn_status 429;
6565+ limit_req_status 429;
5366 '';
5467 };
5568 locations."/api/" = {