Conclusion: Bot Mitigation (timeout) etc

[Sven Göthel]

I have concluded my DoS Bot Mitigation and added a cgit section here
<https://jausoft.com/cgit/jaunotes.git/about/config/server/xx-attack/DoS-Mitigation.md#cgit---web-frontend-for-git-repositories>

See the Haskell/Lightpanda incident for example
<https://jausoft.com/cgit/jaunotes.git/about/config/server/xx-attack/DoS-Mitigation.md#haskelllightpanda-incident>.
Notable: Most of these bots go straight to the cgit pages, millions of bots!
W/o mitigation, I could have just ended my few server.

It reflects my last cgit commits using SIGALRM to counter the lack of signal
propagation from Apache2 to cgit under suEXEC.
To block a bot-attack, I set Apache2 Timeout=10 and cgit timeout=8 (or roughly around these).
- my branch <https://jausoft.com/cgit/cgit.git/log/>
- backup <https://github.com/sgothel/cgit/commits/master>

The SIGALRM AS-Safe log messages exposes either high git processing time
under heavy bot-load or a 'slow-attack' bot/client (doubt anybody uses a dial-up modem today).

I have further added an early out for max-blob-size,
before reading the git data to save I/O load.

The previous added mitigations/patches regarding lock-failure, io-idle-timeout,
io-min-rate and the 64-bit RNV-1a hash (+ using cgit-reaper) also helps against (slow-)attacks.

Find cgit-reaper here
 - repo <https://jausoft.com/cgit/cgit-reaper.git/about/>
 - backup <https://github.com/sgothel/cgit-reaper>

Main objective for this file reaper is to allow cgit to use the full range of 64-bit FNV-1a value
to reduce collisions but limiting the maximum number of cache files to a considerably lower number.

This works w/ my cgit patches using the 64-bit FNV-1a value and a bit more
- my branch <https://jausoft.com/cgit/cgit.git/log/>
- backup <https://github.com/sgothel/cgit/commits/master>

Cheers,

~Sven