mirror of
https://github.com/GrapheneOS/infrastructure.git
synced 2025-02-24 08:49:58 -05:00
b38736ca74
Now that the usage of synproxy is gated behind a SYN packet rate limit, we can expand this to all our TCP services to have always enabled DDoS protection instead of needing to deploy a stricter set of rules when the servers are under attack. This is far better because there isn't always a system administrator available to handle an ongoing attack. We already used per-IP connection limits in nginx across the board but those limits are applied far too late after a TLS connection has been established and headers are sent rather than before. Using IPv6 /64 blocks means this is much more aggressive for IPv6, but many clients will fall back to IPv4 due to the happy eyeballs approach. The nginx limits are still useful due to HTTP/2 multiplexing and we'll need to think over how to address IPv6 there.
Information about GrapheneOS servers is available in the GrapheneOS servers article on grapheneos.org.