NGINX Rate Limit Generator

nginx rate limiting works in two parts that live in different places in the file, and that is exactly where the configuration tends to fail. The directive defining the shared zone goes in the http block; the one applying the limit goes in server or location. Defining the zone and forgetting to apply it results in no limit at all — with no error whatsoever.

Fill in the zone name, the memory size, the rate and the burst and the page assembles both lines, each marked with where it belongs. The zone size is shared memory holding per-key state: one megabyte holds on the order of sixteen thousand addresses, so ten megabytes comfortably cover most sites.

The part that confuses most is the burst and nodelay pair. nginx uses a leaky bucket: the rate is constant and the burst is how much excess may queue. Without nodelay, excess requests are delayed until they fit the rate — the client waits. With nodelay, they pass immediately, as long as they fit within the burst. For human browsing, nodelay is usually right, because one page fires several requests at once and delaying them makes the site slow for no reason.