Lower the default request and byte limits (closes #193)

New defaults, as sneak approved: 120 requests a minute, 1,500 an hour and 6,000 a day; bytes off a minute, 50G an hour and 100G a day. The README, `SPEC.md`, `docs/settings.md` and `docs/gitea.md` give the new figures and reasoning, and point Actions runners and shared addresses at `SWWAF_RATE_LIMIT_EXEMPT_NETS`. The README examples now hold against the new defaults.

An Actions runner that is not exempted makes more requests an hour than the new limit and will be banned.

Model: opus-5-5

docs/gitea.md

@@ -72,11 +72,10 @@ A clone or a download is a response:
 - `SWRP_MAX_RESPONSE_TIME_MS` is `900000`, 15 minutes, half the default. A clone
   or download that takes longer is cut off.
 - `SWRP_MAX_RESPONSE_SIZE` stays at its default, 1 GiB. A repository whose clone
-  is larger needs it raised, and the byte limits with it ("Byte limits, per
-  client" in `SPEC.md`).
+  is larger needs it raised.
 
-The byte limits stay at their defaults. Two uploads of 2 GiB from one address in
-one minute pass the minute's limit of 4 GiB, and ban the address.
+The byte limits stay at their defaults: no minute limit, 50 GiB an hour and 100
+GiB a day.
 
 ## The checks
 
@@ -86,9 +85,9 @@ gitea searches and file names. The section "What the Core Rule Set refuses in
 `block` mode" below lists them. Each such refusal counts toward the error burst,
 so 31 in one minute ban the address.
 
-Every other check stays at its default. A client may make 500 requests a minute,
-20,000 an hour and 300,000 a day. Archive downloads and blame and history pages
-are what scrapers hammer, and these limits do most of the work there.
+Every other check stays at its default. A client may make 120 requests a minute,
+1,500 an hour and 6,000 a day. Archive downloads and blame and history pages are
+what scrapers hammer, and these limits do most of the work there.
 
 ## The shared network
 
@@ -108,7 +107,7 @@ Containers on the shared network skip `servewaf`'s checks:
 - A container on the shared network that asks for the site at the host's public
   address arrives from the gateway. It is checked like any visitor.
 - A fleet on another host can have its address added to `SWWAF_ALLOW_NETS`.
-  Without that, the default request limits are sized for such a fleet.
+  Without that, it is counted like any client.
 - traefik replaces the `X-Forwarded-For` a visitor sends, by default. Keep it
   so: otherwise a visitor could name an address on the shared network, and skip
   the checks.
@@ -145,20 +144,14 @@ in the query string, as `?token=`, is then in the log. Send it in the
 
 A runner on the shared network skips the checks. One on another host is counted
 like any client. A runner older than version 0.4 (April 2026) asks for work
-every 2 seconds, 43,200 requests a day. While it runs a job, it reports the
-job's log and state every second instead, two requests a second. So one runner
-busy all day sends 120 requests a minute and 172,800 a day, under the request
-limits.
+every 2 seconds, 1,800 requests an hour. While it runs a job, it reports the
+job's log and state every second instead, two requests a second.
 
-Several runners on one address can pass them:
-
-- Two busy all day make 345,600 requests, and pass the day limit of 300,000.
-- Three busy at once make 21,600 an hour, and pass the hour limit of 20,000.
-- Five busy at once make 600 a minute, and pass the minute limit of 500.
-
-Their address is then banned, their running jobs fail, and each repeat within a
-day makes the ban longer. Newer runners ask for work less often. Put the
-runners' addresses in `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
+So one idle runner makes 1,800 requests an hour, more than the hour limit of
+1,500. A busy one, at two requests a second, passes the minute limit of 120
+within two minutes. Its address is then banned, its running jobs fail, and each
+repeat within a day makes the ban longer. Newer runners ask for work less often.
+Put the runners' addresses in `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
 
 ## What the Core Rule Set refuses in `block` mode
 

docs/settings.md

@@ -99,19 +99,22 @@ chooses between the two (see "The image's command" below).
 
 ## Request rate limits, per client
 
-- `SWWAF_RATE_LIMIT_PER_MINUTE` (default `500`, about 8 a second): the most
-  requests a client may make in a minute. A count or `off`. The default catches,
-  within seconds, a client firing requests as fast as it can. It leaves room for
-  a fleet of about 20 agents at its busiest, about 120 requests a minute. It
-  also leaves room for a few quick first visits to gitea with an empty cache,
-  about 40 files each.
-- `SWWAF_RATE_LIMIT_PER_HOUR` (default `20000`, about 5.5 a second): the most
-  requests a client may make in an hour. A count or `off`. The default leaves
-  room for an automation fleet at work. It catches a client that keeps up more
-  than about 5.5 a second for an hour.
-- `SWWAF_RATE_LIMIT_PER_DAY` (default `300000`, about 3.5 a second): the most
-  requests a client may make in a day. A count or `off`. The default catches a
-  scraper that keeps up 4 a second around the clock.
+- `SWWAF_RATE_LIMIT_PER_MINUTE` (default `120`, 2 a second): the most requests a
+  client may make in a minute. A count or `off`. The default leaves room for a
+  person opening two gitea pages at once with an empty cache, up to 60 files
+  each.
+- `SWWAF_RATE_LIMIT_PER_HOUR` (default `1500`): the most requests a client may
+  make in an hour. A count or `off`. It is the main limit against scrapers. A
+  person reading code in gitea for an hour, a page every 20 seconds, makes
+  about 900. A scraper making one request every 2 seconds makes 1,800 an hour,
+  more than the limit.
+- `SWWAF_RATE_LIMIT_PER_DAY` (default `6000`): the most requests a client may
+  make in a day. A count or `off`. The default is four hours at the hour limit.
+  A scraper making one request every 10 seconds makes 8,640 a day, more than the
+  limit.
+- An Actions runner asks gitea for work all day and can pass the limits. Put the
+  runners' addresses in `SWWAF_RATE_LIMIT_EXEMPT_NETS`. Do the same for a
+  network where many people share one address, such as an office.
 - Counting cannot catch a client that stays under all three limits (see "Request
   rate limits, per client" in [`SPEC.md`](../SPEC.md)).
 - `SWWAF_RATE_LIMIT_EXEMPT_PATHS` (default empty): path prefixes exempt from
@@ -119,8 +122,8 @@ chooses between the two (see "The image's command" below).
 
 ## Byte limits, per client
 
-- `SWWAF_BYTES_LIMIT_PER_MINUTE` (default `4G`), `SWWAF_BYTES_LIMIT_PER_HOUR`
-  (default `20G`) and `SWWAF_BYTES_LIMIT_PER_DAY` (default `200G`): the most
+- `SWWAF_BYTES_LIMIT_PER_MINUTE` (default `off`), `SWWAF_BYTES_LIMIT_PER_HOUR`
+  (default `50G`) and `SWWAF_BYTES_LIMIT_PER_DAY` (default `100G`): the most
   bytes counted for a client in each window. A size or `off`.
 - `SWWAF_BYTES_COUNT` (default `both`): which body bytes the byte limits count:
   `response`, `request` or `both`.