sneak 3b9afd5ec4 Default request limits per minute, hour and day, sized for API use (closes #176) ...

The default request limits now suit programmatic use of an API, such
as an automation fleet on another host, and still catch abusive bots:

- per minute: 300, passed within seconds by a client firing as fast
  as it can;
- per hour: 30000;
- per day: 300000, passed by a crawler that keeps up 4 a second.

At the default minute limit no client reaches the hour limit: 300 a
minute is at most 18,000 an hour.

The byte limits and ban lengths are unchanged. SPEC.md, README.md and
docs/settings.md give the reasons; docs/gitea.md redoes the Actions
runner sums.

Judgement call: the docs/alerts.md ban example shows the minute limit.

Model: opus-5-5

2026-11-04 20:16:50 +00:00

..

config_test.go

Default request limits per minute, hour and day, sized for API use (closes #176)

2026-11-04 20:16:50 +00:00

config.go

Default request limits per minute, hour and day, sized for API use (closes #176)

2026-11-04 20:16:50 +00:00