您的位置：首页 > 新闻中心 > 社会 > 正文

大王小王

Nginx limit_req 限流：几行配置挡住大部分CC攻击_我的网站

steam

一 |

　一键部署OpenClaw 服务器CPU莫名飙高，带宽跑满，看日志全是同一个IP一秒打来几十个请求——这不是业务火了，是被CC了。 RAVENA, N.Y. -- New York officials launched legal recreational marijuana sales by promising many of the first retail licenses to people with past drug convictions, hoping to give people harmed by the war on drugs a chance to succeed before competitors crowded in.But more than nine months after sales started, only about two dozen state-sanctioned dispensaries have opened their doors. Legal challenges over the state's permitting process have left more than 400 provisional licensees in limbo. Marijuana farmers are reeling because there are too few stores to sell their harvest.State regulators are now expanding the market amid those troubles. They recently opened up a 60-day general application window to grow, process, distribute or sell marijuana, expecting to issue more than 1,000 new licenses. New rules also will allow companies licensed to grow and sell medical marijuana in New York to get into the recreational market.The moves are expected to boost the number of legal dispensaries in a market now dominated by black-market sellers who simply opened retail stores without a license. But the prospect of competing with the medical providers worries some farmers and retailers who fear being squeezed by deeper-pocketed companies before they had a chance to establish themselves.“My concern is that they have all the money to bleed us out,” said Coss Marte, whose opening of CONBUD dispensary in Manhattan was pushed back by a lawsuit against state regulators. “They’re vertically integrated. So now what they could do is ... grow their own product at the cheapest price and basically outbid all the farmers, all our products and all our pricing.”Critics blame New York’s slow retail growth partly on bureaucratic issues, like delays in setting up a $200 million “social equity” fund to help applicants open shops. The rollout also was hobbled by lawsuits on behalf of people and businesses excluded from the first wave of retail licenses. Marte's shop was among those temporarily blocked by a judge from opening after a group sued on behalf of disabled veterans, saying they were wrongly excluded from applying for a license. Marte, who has a past drug arrest, was paying rent on a store he could not open.A judge recently ruled that Marte's store and several others could open. But the fate of many other provisional license holders, like Carson Grant of New York City, was unclear. After months of delays in opening his store in Queens, he was debating whether to reapply for a license again in this general round.“It's very difficult emotionally,” he said.Reginald Fluellen, senior consultant with the Cannabis Social Equity Coalition, blamed the state for a botched rollout.“They’ve failed miserably in providing the justice-involved individuals the kind of head start, the kind of foothold, in the market that they promised," Fluellen said.Under new regulations, medical marijuana providers could begin retail recreational sales at one of their existing dispensaries as early as Dec. 29. They could begin selling recreational pot at two more dispensaries six months after that. The entry price for those companies is steep: a $20 million licensing fee, with $5 million due upfront. But multiple companies are expected to jump in.“We expect New York to be the hub, or one of the hubs, for legal cannabis on the East Coast,” said Curaleaf CEO Matt Darin. “And so we’re very bullish and we’ve invested a lot of capital and time to be able to maximize the opportunity.”Curaleaf, which operates in multiple states, has already invested $50 million in New York, most of it on a recently expanded indoor growing facility south of Albany that now serves the medical market. Rows of plants there mature in intensely lit rooms where humidity, temperature and nutrition are tightly controlled — a scene in stark contrast to the fields and greenhouses that have defined New York’s adult-use market since growing started last year.Curaleaf will be able to double the size of the facility’s canopy to 64,000 square feet, or about 1.5 acres (0.61 hectares), if the market dictates, said Joe Holland, an executive vice president.To guard against retail monopolies, the medical providers will be limited to three retail outlets. And in a nod to farmers, their shops will initially have to devote half their shelf space to products grown and processed by independent businesses.Still, critics say the state should have allowed more time for economically and socially diverse entrepreneurs to succeed before letting in larger competitors.Joseph Calderone of Grateful Valley Farm, near the Pennsylvania border, compared it to little hardware stores competing against big box stores. Large indoor facilities, he said, can produce multiple crops a year. Meanwhile, farms having trouble selling their crops are “teetering on the edge of failure,” he said.“We were given a fair chance to grow. We were asked to do that," he said. "We kept our promise. The state did not keep their promise.” Office of Cannabis Management executive director Chris Alexander said the new regulations maintain New York’s commitment to social and economic equity, while keeping the market more competitive than in other states. That includes giving priority consideration for social and equity applicants in the current round.While acknowledging there was some “frustration” in getting retail stores open, Alexander said the state has shown a market supplied by small farmers can work. "We've got some of the top-performing dispensaries in the country right here in New York," Alexander saidAnd there’s still room to grow. Regulators have estimated New York will eventually require at least 2,000 dispensaries to meet demand. “I think there’s enough business to go around,” said Christian Chavez, CEO of Statis Cannabis Co. He said sales have been good since they opened their dispensary in the Bronx in July. “I think it’ll be quite some time until this market gets saturated in New York.”。

二 | 扛CC的第一道闸门不在代码里，在Nginx的限流模块里，配置成本几乎为零。

三 | limit_req的原理是漏桶：你设定一个速率，超速的请求直接返回503或延迟排队。先用limit_req_zone定义一个计数区，再在location里挂上limit_req，两步完事。

# nginx.conf 的 http 块里定义限流区

# 以客户端IP为key，10MB内存可存约16万个IP状态 # rate=10r/s 表示平均每秒最多放行10个请求 limit_req_zone $binary_remote_addr zone=req_per_ip:10m rate=10r/s; # server 或 location 块里应用 server { location / { limit_req zone=req_per_ip burst=20 nodelay; proxy_pass http://127.0.0.1:8080; } } burst=20是缓冲队列长度，配合nodelay表示突发20个请求立即处理、不排队，超出就直接拒。想对登录、搜索这类昂贵接口管得更严，单独再定义一个rate=2r/s的zone挂上去就行，互不影响。

# 对登录接口单独限流：每秒2个，突发5个
limit_req_zone $binary_remote_addr zone=login_limit:10m rate=2r/s;
 
location /login.php {
 limit_req zone=login_limit burst=5 nodelay;
 # 被限流的请求返回429而不是默认503
 limit_req_status 429;
 fastcgi_pass 127.0.0.1:9000;
}

验证很简单：reload之后用ab压一下，ab -n 200 -c 20 https://你的域名/，看返回里有没有429或503；同时tail -f日志确认正常用户没被误伤。限流阈值别拍脑袋定，先统计自己站点的正常峰值，设成峰值的两倍左右再逐步收紧。限流是防守，如果卡死自己人就本末倒置了。数据来源：nginx.org官方文档 ngx_http_limit_req_module 模块说明

申请创业报道，分享创业好点子。