sneak c6f1943bb9 metrics: rate limit /metrics per client address before Basic Auth (closes #101) ...

/metrics is behind a password, and REPO_POLICIES.md requires rate
limiting on password logins. Each client address may now send it 30
requests a minute, counted by httprate before Basic Auth, so failed
logins use up the allowance and a request over it gets 429 without
the password being checked. The address is the one the existing
trusted-proxy logic in internal/middleware works out, with IPv6
addresses grouped by /64. A Prometheus server scraping every 15
seconds sends 4 requests a minute.

Model: opus-5-5

2026-10-01 19:37:09 +00:00

..

export_test.go

server: assert timeouts on the served http.Server, not just the constructor (closes #120)

2026-09-28 22:01:36 +02:00

routes_test.go

metrics: rate limit /metrics per client address before Basic Auth (closes #101)

2026-10-01 19:37:09 +00:00

routes.go

metrics: rate limit /metrics per client address before Basic Auth (closes #101)

2026-10-01 19:37:09 +00:00

server_test.go

server: assert timeouts on the served http.Server, not just the constructor (closes #120)

2026-09-28 22:01:36 +02:00

server.go

server: set all four http.Server socket timeouts (#118)

2026-09-09 15:17:43 +02:00