seems ->haproxy->filter-relay=>actual-relay --- a lot rate limits can moved onto reverse proxy level.quotingWell, I've done a few experiments a while back throttling, but the problem usually is that regular old nostr clients always use more bandwidth than the clients I was attempting to block (because they're just sending events and nostr users are doing tons of REQs). However, haproxy could totally throttle upgrades and etc. Here's a massive paste of some of my experiments that show bandwidth throttle and other types. It may give you some ideas of what to search for (HUGE PASTE INCOMING)
nevent1q…r03a
```
acl throttled_url path_beg -i /
# IPs excluded from temporary deny feature
acl throttle_exclude req.hdr_ip(X-Forwarded-For) -f /etc/haproxy/lists/throttle_exclude.lst
# Identify unique clients based on temporary header
http-request set-header X-SB-Track %[req.fhdr(Host)]_%[req.fhdr(X-Forwarded-For)]_%[req.fhdr(User-Agent)]
# base64 encode temporary tracking header
http-request set-header X-Concat %[req.fhdr(X-SB-Track),base64]
# Remove temporary tracking header
http-request del-header X-SB-Track
# stick-table for tracking HTTP request rate and the number of concurrently open connections
# We track request rate within 10-second sliding window
stick-table type binary len 64 size 100k store gpc0_rate(10s),conn_cur expire 4m
# clients that were "seen" by HAProxy
acl mark_seen sc0_inc_gpc0 gt 0
# clients that have exceeded HTTP request rate threshold
acl fast_refresher sc0_gpc0_rate gt 10
# clients that have more than 20 concurrently open connections
acl conn_limit sc0_conn_cur gt 20
ip_is_bad increments gpc0 counter every time it's evaluated
acl ip_is_bad sc1_inc_gpc0(bk_stick_blocked) gt 0
# Track X-Concat header each time throttled_url is requested
http-request track-sc0 hdr(X-Concat) if throttled_url
# Track all requests for the throttled_url in a separate stick-table (bk_stick_blocked)
http-request track-sc1 hdr_ip(X-Forwarded-For) table bk_stick_blocked if throttled_url
# Increment the counter and therefore block the IP that was detected as a fast_refresher
# IP is stored in stick-table bk_stick_blocked
http-request track-sc1 hdr_ip(X-Forwarded-For) table bk_stick_blocked if fast_refresher ip_is_bad !throttle_exclude
http-request track-sc1 hdr_ip(X-Forwarded-For) table bk_stick_blocked if fast_refresher ip_is_bad
# Check if the client's IP is blocked
acl ip_was_bad sc1_get_gpc0(bk_stick_blocked) gt 0
acl is-blocked-ip src -f /etc/haproxy/blocklisted.ips
http-request deny if is-blocked-ip
# Deny access to blocked IP
http-request deny if ip_was_bad !throttle_exclude
http-request deny if ip_was_bad
filter bwlim-in myuploadlimit default-limit 5000 default-period 5m
http-request set-bandwidth-limit myuploadlimit
filter bwlim-in myuploadlimit limit 62500 key src table bk_stick_rate
http-request set-bandwidth-limit myuploadlimit
http-request deny if ip_was_bad
# if the client has too many open connections, return 429 error
use_backend bk_429 if mark_seen conn_limit
# if the trusted client exceeded HTTP request rate, return 429 error
use_backend bk_429 if mark_seen fast_refresher
```