rate-limit /save_event

relay/go.mod

@@ -12,5 +12,6 @@ require (
 	github.com/mattn/go-sqlite3 v1.14.4
 	github.com/rs/cors v1.7.0
 	github.com/rs/zerolog v1.20.0
+	golang.org/x/time v0.0.0-20201208040808-7e3f01d25324
 	gopkg.in/antage/eventsource.v1 v1.0.0-20150318155416-803f4c5af225
 )

relay/go.sum

@@ -64,6 +64,8 @@ golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5h
 golang.org/x/sys v0.0.0-20190109145017-48ac38b7c8cb/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/time v0.0.0-20201208040808-7e3f01d25324 h1:Hir2P/De0WpUhtrKGGjvSb2YxUgyZ7EFOSLIcSSpiwE=
+golang.org/x/time v0.0.0-20201208040808-7e3f01d25324/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20190828213141-aed303cbaa74/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gopkg.in/antage/eventsource.v1 v1.0.0-20150318155416-803f4c5af225 h1:xy+AV3uSExoRQc2qWXeZdbhFGwBFK/AmGlrBZEjbvuQ=

relay/handlers.go

@@ -9,13 +9,23 @@ import (
 	"fmt"
 	"net/http"
 	"strings"
+	"time"
+
+	"golang.org/x/time/rate"
 )
 
+var ratelimiter = rate.NewLimiter(rate.Every(time.Second*40), 2)
+
 type ErrorResponse struct {
 	Error error `json:"error"`
 }
 
 func saveEvent(w http.ResponseWriter, r *http.Request) {
+	if !ratelimiter.Allow() {
+		w.WriteHeader(503)
+		return
+	}
+
 	w.Header().Set("content-type", "application/json")
 
 	var evt Event

relay/main.go

@@ -23,8 +23,8 @@ type Settings struct {
 var s Settings
 var err error
 var db *sqlx.DB
-var router = mux.NewRouter()
 var log = zerolog.New(os.Stderr).Output(zerolog.ConsoleWriter{Out: os.Stderr})
+var router = mux.NewRouter()
 
 func main() {
 	err = envconfig.Process("", &s)