sneak c6f1943bb9 metrics: rate limit /metrics per client address before Basic Auth (closes #101) ...

/metrics is behind a password, and REPO_POLICIES.md requires rate
limiting on password logins. Each client address may now send it 30
requests a minute, counted by httprate before Basic Auth, so failed
logins use up the allowance and a request over it gets 429 without
the password being checked. The address is the one the existing
trusted-proxy logic in internal/middleware works out, with IPv6
addresses grouped by /64. A Prometheus server scraping every 15
seconds sends 4 requests a minute.

Model: opus-5-5

2026-10-01 19:37:09 +00:00

..

export_test.go

metrics: rate limit /metrics per client address before Basic Auth (closes #101)

2026-10-01 19:37:09 +00:00

middleware_test.go

metrics: rate limit /metrics per client address before Basic Auth (closes #101)

2026-10-01 19:37:09 +00:00

middleware.go

metrics: rate limit /metrics per client address before Basic Auth (closes #101)

2026-10-01 19:37:09 +00:00