metrics: rate limit /metrics per client address before Basic Auth (closes #101)

/metrics is behind a password, and REPO_POLICIES.md requires rate limiting on password logins. Each client address may now send it 30 requests a minute, counted by httprate before Basic Auth, so failed logins use up the allowance and a request over it gets 429 without the password being checked. The address is the one the existing trusted-proxy logic in internal/middleware works out, with IPv6 addresses grouped by /64. A Prometheus server scraping every 15 seconds sends 4 requests a minute. Model: opus-5-5
2026-10-01 19:30:53 +00:00
parent 3390d7065e
commit b38d33f817
9 changed files with 265 additions and 2 deletions
@@ -19,6 +19,8 @@ Rationale, Design, TODO, License, Author) if any are still missing.

 # Completed Steps

+- 2026-10-01: `/metrics` allows each client address 30 requests a minute,
+  counted before Basic Auth, and answers 429 beyond that (closes #101).
 - 2026-10-01: wildcard CORS now applies only to the public routes, not to
  `/metrics`, and allows only the methods they serve (closes #100).
 - 2026-10-01: `internal/state` and `internal/watcher` no longer export test-only