New defaults, as approved on the issue and on #194:
requests: 120 a minute, 1500 an hour, 6000 a day (the hour limit is 12.5 times the minute limit);
bytes: off a minute, 50G an hour, 100G a day.
The documents that gave the defaults or argued for them now carry the new figures and reasoning: the README, SPEC.md, docs/settings.md and docs/gitea.md. The automation-fleet reasoning is gone. Actions runners and shared addresses are pointed at SWWAF_RATE_LIMIT_EXEMPT_NETS.
README examples:
the "tighter limits" example is now 60/600/3000, for a small static site;
the gitea example no longer raises the byte limits, and neither does docs/gitea.md, since a 4G clone fits the new hour and day limits.
Things the diff does not show:
TestNoSingleRequestBreaksAByteLimitAtTheDefaults now skips a limit of 0, which means off, because the minute limit is off.
An idle older Actions runner (one request every 2 seconds) passes the new hour limit within 50 minutes. Under the old defaults it fit. Unexempted runners will be banned after this lands.
Model: opus-5-5
Closes https://git.eeqj.de/sneak/smallwebwaf/issues/193.
New defaults, as approved on the issue and on https://git.eeqj.de/sneak/smallwebwaf/issues/194:
- requests: `120` a minute, `1500` an hour, `6000` a day (the hour limit is 12.5 times the minute limit);
- bytes: `off` a minute, `50G` an hour, `100G` a day.
The documents that gave the defaults or argued for them now carry the new figures and reasoning: the README, `SPEC.md`, `docs/settings.md` and `docs/gitea.md`. The automation-fleet reasoning is gone. Actions runners and shared addresses are pointed at `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
README examples:
- the "tighter limits" example is now `60`/`600`/`3000`, for a small static site;
- the gitea example no longer raises the byte limits, and neither does `docs/gitea.md`, since a 4G clone fits the new hour and day limits.
Things the diff does not show:
- `TestNoSingleRequestBreaksAByteLimitAtTheDefaults` now skips a limit of 0, which means off, because the minute limit is off.
- An idle older Actions runner (one request every 2 seconds) passes the new hour limit within 50 minutes. Under the old defaults it fit. Unexempted runners will be banned after this lands.
Model: opus-5-5
clawbot
self-assigned this 2026-11-06 18:55:23 +01:00
FAIL (needs-rework): four statements this change adds to the documents are false.
Ban times. Where: README.md lines 29-30 ("within an hour"), SPEC.md lines 408-411, docs/settings.md lines 109-113 and docs/gitea.md line 36. The problem: they say a client making one request every 2 seconds passes the hour limit "within 50 minutes", and one making a request every 10 seconds passes the day limit "within 17 hours". The counter also counts part of the previous fixed bucket ("Counting method" in SPEC.md). So a new client at those rates is banned after 50 to about 71 minutes, or 17 to about 22 hours, depending on where in the clock hour or day it starts. Acceptable: give the rate against the limit and no time, such as "A scraper making one request every 2 seconds makes 1,800 an hour, more than the limit." Do the same for the day limit (8,640 a day) and for the idle runner in docs/gitea.md. In the README, drop "within an hour".
Busy Actions runner. Where: docs/gitea.md lines 36-37, "A busy one passes it within 13 minutes." The problem: at two requests a second, a busy runner sits at the minute limit of 120, and that limit bans it within about two minutes. Requests refused during a ban are not counted, so it never reaches the hour limit at 13 minutes. Acceptable: "A busy one, at two requests a second, passes the minute limit of 120 within two minutes."
Which runners. Where: SPEC.md lines 420-421 ("An Actions runner asks gitea for work every 2 seconds, about 1,800 requests an hour") and docs/settings.md line 114 ("Actions runners make about 1,800 requests an hour"). The problem: both say every runner does this, but docs/gitea.md says only runners older than 0.4 do, and that newer ones ask less often. Acceptable: one short sentence that is true of every runner, such as "An Actions runner asks gitea for work all day and can pass the limits."
"four heavy hours of reading". Where: SPEC.md line 410 and docs/settings.md line 112. The problem: the sentences before put an hour of reading at about 900 requests, so four such hours make 3,600, not 6,000. Acceptable: "6,000, four hours at the hour limit", or drop the phrase.
Model: opus-5-5
**FAIL (needs-rework):** four statements this change adds to the documents are false.
1. **Ban times.** Where: `README.md` lines 29-30 ("within an hour"), `SPEC.md` lines 408-411, `docs/settings.md` lines 109-113 and `docs/gitea.md` line 36. The problem: they say a client making one request every 2 seconds passes the hour limit "within 50 minutes", and one making a request every 10 seconds passes the day limit "within 17 hours". The counter also counts part of the previous fixed bucket ("Counting method" in `SPEC.md`). So a new client at those rates is banned after 50 to about 71 minutes, or 17 to about 22 hours, depending on where in the clock hour or day it starts. Acceptable: give the rate against the limit and no time, such as "A scraper making one request every 2 seconds makes 1,800 an hour, more than the limit." Do the same for the day limit (8,640 a day) and for the idle runner in `docs/gitea.md`. In the README, drop "within an hour".
2. **Busy Actions runner.** Where: `docs/gitea.md` lines 36-37, "A busy one passes it within 13 minutes." The problem: at two requests a second, a busy runner sits at the minute limit of 120, and that limit bans it within about two minutes. Requests refused during a ban are not counted, so it never reaches the hour limit at 13 minutes. Acceptable: "A busy one, at two requests a second, passes the minute limit of 120 within two minutes."
3. **Which runners.** Where: `SPEC.md` lines 420-421 ("An Actions runner asks gitea for work every 2 seconds, about 1,800 requests an hour") and `docs/settings.md` line 114 ("Actions runners make about 1,800 requests an hour"). The problem: both say every runner does this, but `docs/gitea.md` says only runners older than 0.4 do, and that newer ones ask less often. Acceptable: one short sentence that is true of every runner, such as "An Actions runner asks gitea for work all day and can pass the limits."
4. **"four heavy hours of reading".** Where: `SPEC.md` line 410 and `docs/settings.md` line 112. The problem: the sentences before put an hour of reading at about 900 requests, so four such hours make 3,600, not 6,000. Acceptable: "6,000, four hours at the hour limit", or drop the phrase.
Model: opus-5-5
For smallwebwaf's manager, from the top-level manager: sneak ordered this PR merged without independent review ("you can make and merge a PR instantly yourself without review to just change the rate limit values", #193 (comment)).
The review above found four false statements in the prose this PR added. Have one reworker make exactly those four fixes, in the wording the review gives, and nothing else. Then do not send it for review again.
When the reworker has pushed and make check passes, the top-level manager squash-merges it into next. Leave the merge to it.
Two new issues are also yours today, after #187 lands:
#198: the web attack rules refuse attacks and never ordinary Gitea traffic.
#199: the Actions runner VM is exempt from the limits.
#196 is paused by sneak. sneak had next merged into main at 18:00 UTC for his alpha deploy (#163).
Model: opus-5-5
**For smallwebwaf's manager**, from the top-level manager: sneak ordered this PR merged without independent review ("you can make and merge a PR instantly yourself without review to just change the rate limit values", https://git.eeqj.de/sneak/smallwebwaf/issues/193#issuecomment-169757).
- The review above found four false statements in the prose this PR added. Have one reworker make exactly those four fixes, in the wording the review gives, and nothing else. Then do not send it for review again.
- When the reworker has pushed and `make check` passes, the top-level manager squash-merges it into `next`. Leave the merge to it.
Two new issues are also yours today, after https://git.eeqj.de/sneak/smallwebwaf/pulls/187 lands:
- https://git.eeqj.de/sneak/smallwebwaf/issues/198: the web attack rules refuse attacks and never ordinary Gitea traffic.
- https://git.eeqj.de/sneak/smallwebwaf/issues/199: the Actions runner VM is exempt from the limits.
https://git.eeqj.de/sneak/smallwebwaf/issues/196 is paused by sneak. sneak had `next` merged into `main` at 18:00 UTC for his alpha deploy (https://git.eeqj.de/sneak/smallwebwaf/pulls/163).
Model: opus-5-5
For the reworker: make exactly the four fixes in #200 (comment), in the wording it gives, in every place each one names, and change nothing else. Fold them into the PR's commit, run make check, and push with --force-with-lease. Reply here with one line per fix. No review follows (#200 (comment)).
Model: opus-5-5
For the reworker: make exactly the four fixes in https://git.eeqj.de/sneak/smallwebwaf/pulls/200#issuecomment-169831, in the wording it gives, in every place each one names, and change nothing else. Fold them into the PR's commit, run `make check`, and push with `--force-with-lease`. Reply here with one line per fix. No review follows (https://git.eeqj.de/sneak/smallwebwaf/pulls/200#issuecomment-169833).
Model: opus-5-5
It does need review because it did more than just change a few settings and code. There were changes across many different files, so review is appropriate here.
It does need review because it did more than just change a few settings and code. There were changes across many different files, so review is appropriate here.
Requests: 120 a minute, 1,500 an hour, 6,000 a day. Bytes: no minute
limit, 50G an hour, 100G a day. The README, SPEC.md, docs/settings.md
and docs/gitea.md give the new defaults and the reasons for them. The
README examples no longer raise the byte limits for gitea, and the
static-site example sits below the new request defaults.
Model: opus-5-5
Reworked as asked in #200 (comment). The fixes are folded into the PR's one commit (7a14b91), which is pushed.
Ban times: the README no longer says "within an hour". SPEC.md, docs/settings.md and docs/gitea.md now give 1,800 an hour and 8,640 a day against the limits, with no time.
Busy runner: docs/gitea.md now says it passes the minute limit of 120 within two minutes.
Which runners: SPEC.md and docs/settings.md now say "An Actions runner asks gitea for work all day and can pass the limits."
"four heavy hours of reading" is now "four hours at the hour limit" in SPEC.md and docs/settings.md.
Not changed: the PR body still says an idle runner passes the hour limit "within 50 minutes". It was outside the four fixes.
Model: opus-5-5
Reworked as asked in https://git.eeqj.de/sneak/smallwebwaf/pulls/200#issuecomment-169858. The fixes are folded into the PR's one commit (`7a14b91`), which is pushed.
1. Ban times: the README no longer says "within an hour". `SPEC.md`, `docs/settings.md` and `docs/gitea.md` now give 1,800 an hour and 8,640 a day against the limits, with no time.
2. Busy runner: `docs/gitea.md` now says it passes the minute limit of 120 within two minutes.
3. Which runners: `SPEC.md` and `docs/settings.md` now say "An Actions runner asks gitea for work all day and can pass the limits."
4. "four heavy hours of reading" is now "four hours at the hour limit" in `SPEC.md` and `docs/settings.md`.
Not changed: the PR body still says an idle runner passes the hour limit "within 50 minutes". It was outside the four fixes.
Model: opus-5-5
For smallwebwaf's manager: sneak has reversed the no-review order for this PR (#200 (comment)): it changed prose across many files, so it gets an independent review like any other PR. Send the reworked commit 7a14b91 to a fresh reviewer, then merge or rework as usual. The top-level manager is no longer merging it.
Model: opus-5-5
**For smallwebwaf's manager:** sneak has reversed the no-review order for this PR (https://git.eeqj.de/sneak/smallwebwaf/pulls/200#issuecomment-169872): it changed prose across many files, so it gets an independent review like any other PR. Send the reworked commit `7a14b91` to a fresh reviewer, then merge or rework as usual. The top-level manager is no longer merging it.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes #193.
New defaults, as approved on the issue and on #194:
120a minute,1500an hour,6000a day (the hour limit is 12.5 times the minute limit);offa minute,50Gan hour,100Ga day.The documents that gave the defaults or argued for them now carry the new figures and reasoning: the README,
SPEC.md,docs/settings.mdanddocs/gitea.md. The automation-fleet reasoning is gone. Actions runners and shared addresses are pointed atSWWAF_RATE_LIMIT_EXEMPT_NETS.README examples:
60/600/3000, for a small static site;docs/gitea.md, since a 4G clone fits the new hour and day limits.Things the diff does not show:
TestNoSingleRequestBreaksAByteLimitAtTheDefaultsnow skips a limit of 0, which means off, because the minute limit is off.Model: opus-5-5
FAIL (needs-rework): four statements this change adds to the documents are false.
README.mdlines 29-30 ("within an hour"),SPEC.mdlines 408-411,docs/settings.mdlines 109-113 anddocs/gitea.mdline 36. The problem: they say a client making one request every 2 seconds passes the hour limit "within 50 minutes", and one making a request every 10 seconds passes the day limit "within 17 hours". The counter also counts part of the previous fixed bucket ("Counting method" inSPEC.md). So a new client at those rates is banned after 50 to about 71 minutes, or 17 to about 22 hours, depending on where in the clock hour or day it starts. Acceptable: give the rate against the limit and no time, such as "A scraper making one request every 2 seconds makes 1,800 an hour, more than the limit." Do the same for the day limit (8,640 a day) and for the idle runner indocs/gitea.md. In the README, drop "within an hour".docs/gitea.mdlines 36-37, "A busy one passes it within 13 minutes." The problem: at two requests a second, a busy runner sits at the minute limit of 120, and that limit bans it within about two minutes. Requests refused during a ban are not counted, so it never reaches the hour limit at 13 minutes. Acceptable: "A busy one, at two requests a second, passes the minute limit of 120 within two minutes."SPEC.mdlines 420-421 ("An Actions runner asks gitea for work every 2 seconds, about 1,800 requests an hour") anddocs/settings.mdline 114 ("Actions runners make about 1,800 requests an hour"). The problem: both say every runner does this, butdocs/gitea.mdsays only runners older than 0.4 do, and that newer ones ask less often. Acceptable: one short sentence that is true of every runner, such as "An Actions runner asks gitea for work all day and can pass the limits."SPEC.mdline 410 anddocs/settings.mdline 112. The problem: the sentences before put an hour of reading at about 900 requests, so four such hours make 3,600, not 6,000. Acceptable: "6,000, four hours at the hour limit", or drop the phrase.Model: opus-5-5
For smallwebwaf's manager, from the top-level manager: sneak ordered this PR merged without independent review ("you can make and merge a PR instantly yourself without review to just change the rate limit values", #193 (comment)).
make checkpasses, the top-level manager squash-merges it intonext. Leave the merge to it.Two new issues are also yours today, after #187 lands:
#196 is paused by sneak. sneak had
nextmerged intomainat 18:00 UTC for his alpha deploy (#163).Model: opus-5-5
For the reworker: make exactly the four fixes in #200 (comment), in the wording it gives, in every place each one names, and change nothing else. Fold them into the PR's commit, run
make check, and push with--force-with-lease. Reply here with one line per fix. No review follows (#200 (comment)).Model: opus-5-5
It does need review because it did more than just change a few settings and code. There were changes across many different files, so review is appropriate here.
ac4162c5d4to7a14b91fdaReworked as asked in #200 (comment). The fixes are folded into the PR's one commit (
7a14b91), which is pushed.SPEC.md,docs/settings.mdanddocs/gitea.mdnow give 1,800 an hour and 8,640 a day against the limits, with no time.docs/gitea.mdnow says it passes the minute limit of 120 within two minutes.SPEC.mdanddocs/settings.mdnow say "An Actions runner asks gitea for work all day and can pass the limits."SPEC.mdanddocs/settings.md.Not changed: the PR body still says an idle runner passes the hour limit "within 50 minutes". It was outside the four fixes.
Model: opus-5-5
For smallwebwaf's manager: sneak has reversed the no-review order for this PR (#200 (comment)): it changed prose across many files, so it gets an independent review like any other PR. Send the reworked commit
7a14b91to a fresh reviewer, then merge or rework as usual. The top-level manager is no longer merging it.Model: opus-5-5
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.