From 2e66e0ad27a5f452f4125c4473314e76c645cd07 Mon Sep 17 00:00:00 2001
From: Duncan Overbruck <mail@duncano.de>
Date: Thu, 29 Oct 2026 01:10:48 +0100
Subject: [PATCH 1/3] services/nomad/infrastructure/nginx-mirror: rate limit
 non xbps UAs

---
 .../nomad/infrastructure/nginx-sites/10-mirror.conf    | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/services/nomad/infrastructure/nginx-sites/10-mirror.conf b/services/nomad/infrastructure/nginx-sites/10-mirror.conf
index 99da396..8424389 100644
--- a/services/nomad/infrastructure/nginx-sites/10-mirror.conf
+++ b/services/nomad/infrastructure/nginx-sites/10-mirror.conf
@@ -1,3 +1,10 @@
+map $http_user_agent $non_xbps {
+    xbps/2.0  "";
+    default   $binary_remote_addr;
+}
+
+limit_req_zone $non_xbps zone=per_ip:10m rate=5r/s;
+
 server {
     include /etc/nginx/fragments/ssl.conf;
     listen 443 ssl http2;
@@ -10,6 +17,9 @@ server {
                 "~^repo-[a-z]{2}\.voidlinux\.org$";
     root /srv/www/mirror;
 
+    limit_req zone=per_ip burst=10 nodelay;
+    limit_req_status 429;
+
     location / {
         autoindex on;
     }

From 682f6fc5d7a3a7ff2fc2dd622623c1c0144e8c10 Mon Sep 17 00:00:00 2001
From: Duncan Overbruck <mail@duncano.de>
Date: Sun, 1 Nov 2026 03:04:25 +0100
Subject: [PATCH 2/3] services/pkg/nginx: memory limit

---
 services/nomad/infrastructure/nginx-mirror.nomad | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/nomad/infrastructure/nginx-mirror.nomad b/services/nomad/infrastructure/nginx-mirror.nomad
index b3ab1dd..340f50b 100644
--- a/services/nomad/infrastructure/nginx-mirror.nomad
+++ b/services/nomad/infrastructure/nginx-mirror.nomad
@@ -28,8 +28,8 @@ job "nginx" {
       }
 
       resources {
-        memory = 2000
-        memory_max = -1
+        memory     = 2000
+        memory_max = 16384
       }
 
       dynamic "volume_mount" {

From 4855d053bda6caf68416efcd1d819dfd77afb2ae Mon Sep 17 00:00:00 2001
From: Duncan Overbruck <mail@duncano.de>
Date: Sun, 1 Nov 2026 03:04:53 +0100
Subject: [PATCH 3/3] services/nomad/mirror/sync: do not delete repodata &
 memory limits

---
 services/nomad/mirror/sync.nomad | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/services/nomad/mirror/sync.nomad b/services/nomad/mirror/sync.nomad
index 9e03f1b..66b184a 100644
--- a/services/nomad/mirror/sync.nomad
+++ b/services/nomad/mirror/sync.nomad
@@ -45,6 +45,7 @@ job "sync" {
             "--delete-after",
             "--delay-updates",
             "--links",
+            "--filter=P *-repodata",
             "rsync://${env["RSYNC_ADDR"]}/${group.value}/",
             "/${group.value}/",
           ]
@@ -62,7 +63,7 @@ EOF
         }
 
         resources {
-          memory = 1000
+          memory = 3000
         }
 
         volume_mount {