From f9a6aba1bbdcd27a9634d6d518458df538afba15 Mon Sep 17 00:00:00 2001 From: Grant Slater Date: Thu, 24 Sep 2026 11:45:38 +0100 Subject: [PATCH] Drop keepalive on apache 429 responses --- cookbooks/dev/templates/default/apache.user.erb | 4 ++-- cookbooks/git/templates/default/apache.erb | 2 +- cookbooks/mediawiki/templates/default/apache.erb | 8 ++++---- cookbooks/web/templates/default/apache.frontend.erb | 4 ++-- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/cookbooks/dev/templates/default/apache.user.erb b/cookbooks/dev/templates/default/apache.user.erb index caf46774e..86cc090b4 100644 --- a/cookbooks/dev/templates/default/apache.user.erb +++ b/cookbooks/dev/templates/default/apache.user.erb @@ -35,12 +35,12 @@ WSGIDaemonProcess <%= @user %>.dev.openstreetmap.org user=<%= @user %> processes RewriteCond %{SERVER_PROTOCOL} =HTTP/1.1 RewriteCond %{HTTP_REFERER} ^-?$ RewriteCond %{HTTP_USER_AGENT} ((CriOS|Chrome)/[1-9][0-9]?\.0\.|Chrome/1[0-4][0-9]\.0\.|(Firefox|FxiOS)/[1-6]?[0-9]\.|MSIE\ [5-9]\.0|Opera/[8-9]\.|Windows\ NT\ [3-5]\.|Version/[3-5]\.[0-1]) [NC] - RewriteRule ^ - [R=429,L] + RewriteRule ^ - [R=429,E=nokeepalive:1,L] # Prevent abuse by an anonymous AI bot RewriteCond %{REQUEST_METHOD} ^(GET|HEAD)$ RewriteCond %{HTTP_REFERER} =https://<%= @user %>.dev.openstreetmap.org - RewriteRule ^ - [R=429,L] + RewriteRule ^ - [R=429,E=nokeepalive:1,L] RewriteCond <%= @directory %>%{REQUEST_FILENAME} -f RewriteRule ^/cgi-bin/(.*)$ /~<%= @user %>/cgi-bin/$1 [PT,L] diff --git a/cookbooks/git/templates/default/apache.erb b/cookbooks/git/templates/default/apache.erb index 5793b914e..5b35b934a 100644 --- a/cookbooks/git/templates/default/apache.erb +++ b/cookbooks/git/templates/default/apache.erb @@ -79,7 +79,7 @@ RewriteCond %{REQUEST_URI} ^/[^/]+\.git/tree RewriteCond %{HTTP_REFERER} ^-?$ RewriteCond %{HTTP_USER_AGENT} ((CriOS|Chrome)/[1-9][0-9]?\.0\.|Chrome/[1-9][0-9]*\.0\.|Chrome/122\.0\.0\.0|(Firefox|FxiOS)/[1-6]?[0-9]\.|MSIE\ [5-9]\.0|Opera/[8-9]\.|Windows\ NT\ [3-5]\.|Version/[3-5]\.[0-1]) [NC] - RewriteRule ^ - [R=429,L] + RewriteRule ^ - [R=429,E=nokeepalive:1,L] ScriptAlias /public /usr/lib/git-core/git-http-backend/public ScriptAlias /private /usr/lib/git-core/git-http-backend/private diff --git a/cookbooks/mediawiki/templates/default/apache.erb b/cookbooks/mediawiki/templates/default/apache.erb index 3631da8fa..cabcd40d3 100644 --- a/cookbooks/mediawiki/templates/default/apache.erb +++ b/cookbooks/mediawiki/templates/default/apache.erb @@ -15,7 +15,7 @@ RewriteCond %{HTTPS} !=on RewriteCond %{REQUEST_METHOD} =GET RewriteCond %{REQUEST_URI} ^/w/ - RewriteRule ^ - [R=429,L] + RewriteRule ^ - [R=429,E=nokeepalive:1,L] RedirectPermanent /.well-known/acme-challenge/ http://acme.openstreetmap.org/.well-known/acme-challenge/ RedirectPermanent / https://<%= @name %>/ @@ -53,12 +53,12 @@ RewriteCond %{HTTP_USER_AGENT} "((CriOS|Chrome)/[1-9][0-9]?\.0\.|Chrome/100\.0\.|Chrome/122\.0\.0\.0|(Firefox|FxiOS)/[1-6]?[0-9]\.|MSIE\ [5-9]\.0|Opera/[8-9]\.|Windows\ NT\ [3-5]\.|Version/[3-5]\.[0-1])" [NC,OR] RewriteCond %{HTTP_USER_AGENT} "^Mozilla/5\.0 \(Windows NT 10\.0; Win64; x64\) AppleWebKit/537\.36 \(KHTML, like Gecko\) Chrome/(76\.0\.2474\.42|103\.0\.0\.0|104\.0\.5112\.81|106\.0\.5249\.119|107\.0\.0\.0|108\.0\.0\.0|109\.0\.0\.0|110\.0\.0\.0|111\.0\.0\.0|112\.0\.0\.0|113\.0\.0\.0|116\.0\.0\.0|117\.0\.0\.0|118\.0\.0\.0|120\.0\.0\.0|123\.0\.0\.0|124\.0\.0\.0|131\.0\.0\.0|133\.0\.0\.0) Safari/537\.36$" [NC,OR] RewriteCond %{HTTP_USER_AGENT} "^Mozilla/5\.0 \(Windows NT 10\.0; Win64; x64\) AppleWebKit/537\.36 \(KHTML, like Gecko\) Chrome/105\.0\.0\.0 Safari/537\.3$" [NC] - RewriteRule ^ - [R=429,L] + RewriteRule ^ - [R=429,E=nokeepalive:1,L] # Prevent abuse by an anonymous AI bot RewriteCond %{REQUEST_METHOD} ^(GET|HEAD)$ RewriteCond %{HTTP_REFERER} =https://<%= @name %> - RewriteRule ^ - [R=429,L] + RewriteRule ^ - [R=429,E=nokeepalive:1,L] # Temporary measure to prevent abuse by an anonymous AI bot RewriteCond %{HTTP_USER_AGENT} "Chrome/1[0-4][0-9]\." @@ -66,7 +66,7 @@ RewriteCond %{QUERY_STRING} "(^|&)returnto=Special(?::|%3A|%253A)RecentChanges(&|$)" [NC,OR] RewriteCond %{QUERY_STRING} "feedrecentchanges" [NC] RewriteCond %{REQUEST_URI} ^/w/ - RewriteRule ^ - [R=429,L] + RewriteRule ^ - [R=429,E=nokeepalive:1,L] # Historical Compatibility Links RedirectMatch 301 ^/index\.php$ /w/index.php diff --git a/cookbooks/web/templates/default/apache.frontend.erb b/cookbooks/web/templates/default/apache.frontend.erb index f105236e5..5c6386ce7 100644 --- a/cookbooks/web/templates/default/apache.frontend.erb +++ b/cookbooks/web/templates/default/apache.frontend.erb @@ -107,14 +107,14 @@ ErrorLog /var/log/apache2/error.log # https://gist.github.com/Firefishy/86ed5b86991b225179b54bbafbcd769e # RewriteCond "%{QUERY_STRING}" "^q=abcde&t=20" - RewriteRule "^/api/0\.6/notes/search$" - [R=429,L] + RewriteRule "^/api/0\.6/notes/search$" - [R=429,E=nokeepalive:1,L] # # Ignore GoogleAssociationService request storm # https://en.osm.town/@osm_tech/114205363076771822 # RewriteCond %{HTTP_USER_AGENT} "GoogleAssociationService" - RewriteRule "^/\.well-known/assetlinks\.json$" - [R=429,L] + RewriteRule "^/\.well-known/assetlinks\.json$" - [R=429,E=nokeepalive:1,L] # # Drop faulty Cloudflare POST /cdn-cgi/rum submissions reaching us -- 2.47.3