web: canonical aggregate windows, rx_time predicates, bounded keys (#1038)

deploy/nginx.example.conf

@@ -38,6 +38,22 @@ types_hash_max_size 2048;
 # limit_req_zone $potatomesh_peer zone=potatomesh_peers:1m rate=30r/m;
 # limit_req_status 429;
 
+# Optional: rate-limit reads per client address: API requests the response
+# cache does not answer (any `since` or `before`, or a collection `limit` other
+# than 10, 200 or 1000) and /api/telemetry/aggregated. An open dashboard sends
+# up to 8 of these a second on a busy mesh, and visitors behind one NAT (camps,
+# venues) share one address: set `rate` to 8r/s per such visitor. To enable,
+# uncomment the map and the limit_req_zone lines here, the limit_req_status
+# line above (once, for either limit or both) and the second limit_req line in
+# `location /`.
+# map "$uri?$args" $potatomesh_read {
+#     default                         "";
+#     ~^/api/telemetry/aggregated[?]  $binary_remote_addr;
+#     "~*^/api/.*[?&]((s|%73)(i|%69)(n|%6e)(c|%63)(e|%65)|(b|%62)(e|%65)(f|%66)(o|%6f)(r|%72)(e|%65))="  $binary_remote_addr;
+#     "~*^/api/(nodes|positions|telemetry|neighbors|traces|ingestors|waypoints|messages)/?[?](.*&)?(l|%6c)(i|%69)(m|%6d)(i|%69)(t|%74)=(?!(10|200|1000)(&|$))"  $binary_remote_addr;
+# }
+# limit_req_zone $potatomesh_read zone=potatomesh_reads:10m rate=40r/s;
+
 # ---------------------------------------------------------------------------
 # server { } context
 # ---------------------------------------------------------------------------
@@ -96,6 +112,8 @@ server {
     location / {
         # Optional peer rate limit, see the map near the top of this file.
         # limit_req zone=potatomesh_peers burst=20 nodelay;
+        # Optional read rate limit, see the second map near the top of this file.
+        # limit_req zone=potatomesh_reads burst=2400 nodelay;
 
         proxy_pass         http://potatomesh;
         proxy_http_version 1.1;           # required for upstream keepalive