[duckduckgrayduck]

• Returns a 429 instead of a 503 which nginx does by default for rate limited clients.

• Rejects requests > 25MB in size site-wide. Github webhooks payloads are 25MB capped, Add-On events we shouldn't allow for much more than that either. Documents go to S3. Mailgun attachments are fetched by URL. This is set by NGINX_MAX_BODY_MB so we can bump it later if we need to.

• Add CORS headers to the nginx 429 response and add Retry-After that the front-end and python-squarelet can key off of.

• Bumps keepalive_timeout to 95s, to be >90s which is Heroku router's idle limit so we stop seeing H18. Issue

Follow-ups

• python-squarelet: retry 429s for all methods and respect Retry-After, then bump the pin in python-documentcloud
• Frontend: handle 429 responses and back off

Testing

• nginx -t passes on the rendered config (Done)
• Staging: rate-limited requests return 429 with Retry-After and CORS headers; normal responses don't get Retry-After
• Staging: request bodies > 25MB return 413

[mitchelljkotler]

Why are we only limiting addon_events to the max body size? We should probably have one site wide limit.

Also, as a note, when we change to using 429 status correctly we should also update the frontend (which will require adding CORS headers to the 429) and the python library to respond to them appropriately.

We can also set a retry-after header which should make the python client respect it automatically:

# only nginx's own 429s; DRF throttles set their own Retry-After
map "$upstream_status:$status" $retry_after {
    default "";
    ":429" 1;
}

server {
    ...
    add_header Retry-After $retry_after always;

[duckduckgrayduck]

Why are we only limiting addon_events to the max body size? We should probably have one site wide limit.

Also, as a note, when we change to using 429 status correctly we should also update the frontend (which will require adding CORS headers to the 429) and the python library to respond to them appropriately.

We can also set a retry-after header which should make the python client respect it automatically:

# only nginx's own 429s; DRF throttles set their own Retry-After
map "$upstream_status:$status" $retry_after {
    default "";
    ":429" 1;
}

server {
    ...
    add_header Retry-After $retry_after always;

I think this is ready for another look. I'll have to test the last two bulletpoints when it merges into staging.