bitcoinafterlife/bal-server
1
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

docs: update rate limiting docs for RealIpKeyExtractor and trusted proxy

Browse Source 
- Correct per-endpoint rate limit tables to reflect actual single global config
- Document RealIpKeyExtractor behavior (X-Real-IP / X-Forwarded-For behind proxy)
- Add BAL_SERVER_TRUSTED_PROXY env var to all relevant docs
- Update security audit and modules detail with proxy-aware rate limiting
This commit is contained in:
svatantrya
2026-08-19 02:57:57 -04:00
parent 8e5b921771
commit c957dfff6b
5 changed files with 11 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
docs/05_api_reference.md
View File

@@ -10,16 +10,11 @@
### Rate Limiting
All endpoints are rate-limited via `actix-governor` with a token-bucket algorithm. Defaults:
All endpoints are rate-limited via `actix-governor` with a token-bucket algorithm. The rate limit key is the **real client IP address**, extracted from `X-Real-IP` / `X-Forwarded-For` headers when the request comes from a trusted proxy (default `127.0.0.1`, configurable via `BAL_SERVER_TRUSTED_PROXY`). Direct connections (non-proxy) use the TCP peer IP.
| Endpoint | Rate (req/s) | Burst |
|----------|-------------|-------|
| `POST /{network}/pushtxs` | 1 | 3 |
| `POST /searchtx` | 5 | 10 |
| `GET /{network}/info` | 20 | 30 |
| All others | 50 | 100 |
Default: 1 req/s with burst of 3 (configurable via `BAL_SERVER_ACTIX_PUSHTXS_PER_SEC` / `BAL_SERVER_ACTIX_PUSHTXS_BURST`).
Rate limits are configurable via `BAL_SERVER_ACTIX_*` environment variables.
When behind Nginx, ensure `proxy_set_header X-Real-IP $remote_addr` is set so the server can identify individual clients.
### `GET /`
- **Description:** Returns a static identification string (default: "Will Executor Server").