# Caddy rate limiting for `/book/*`, `/manage/*` and `/api/booking/*` (#17, #18)

Like every other homelab Caddy change (see `deploy/clients/new-client.sh`), there's no
Caddyfile tracked in this repo -- apply this by hand at `/etc/caddy/Caddyfile` on the host
and reload with `docker exec caddy caddy reload --config /etc/caddy/Caddyfile`.

Add, on the site block that proxies to `smb-crm` (e.g. `onboard.mivanchenko.de`, or wherever
`/book/`, `/manage/` and `/api/booking/` are routed):

```
handle /book/* {
    rate_limit {
        zone book_public {
            key {remote_host}
            events 20
            window 1m
        }
    }
    reverse_proxy smb-crm:8080
}
handle /manage/* {
    rate_limit {
        zone book_public {
            key {remote_host}
            events 20
            window 1m
        }
    }
    reverse_proxy smb-crm:8080
}
handle /api/booking/* {
    rate_limit {
        zone book_api {
            key {remote_host}
            events 30
            window 1m
        }
    }
    reverse_proxy smb-crm:8080
}
```

Requires Caddy built with the `caddy-ratelimit` plugin, as used for other per-IP
protections on this homelab.