sneak 5f39597eae Rate limit password attempts on /metrics (closes #104) ...

Each client address may make 60 requests to /metrics a minute,
through the same httprate middleware and TRUSTED_PROXIES
resolution the report route uses, with an allowance of its own.
The limit runs before the basic auth, so past it the answer is 429
and the password is not checked. backend/README.md says so; a test
uses up one client's allowance on wrong passwords, gets 429 with
the right one, and checks that another client behind the same
nginx still gets in.

Model: opus-5-5

2026-10-04 04:01:37 +00:00

..

export_test.go

Rate limit password attempts on /metrics (closes #104)

2026-10-04 04:01:37 +00:00

http_test.go

build: one image, nginx in front of the backend on loopback (closes #52)

2026-09-29 02:59:33 +02:00

http.go

Remove Buildarch: read the architecture at run time (closes #83)

2026-10-02 01:05:09 +02:00

routes_test.go

Rate limit password attempts on /metrics (closes #104)

2026-10-04 04:01:37 +00:00

routes.go

Rate limit password attempts on /metrics (closes #104)

2026-10-04 04:01:37 +00:00

server.go

Report handler panics to Sentry when SENTRY_DSN is set (closes #95)

2026-10-04 05:57:02 +02:00