From 1eff40ea8968c73066ecde405ee4fa6405d81290 Mon Sep 17 00:00:00 2001
From: Daniel Dourvaris <daniel@rhodecode.com>
Date: Thu, 15 Jun 2017 23:32:01 +0200
Subject: [PATCH] docs: added example how to secure login page from brute force
 attacks.

---
 docs/admin/nginx-config-example.rst | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/docs/admin/nginx-config-example.rst b/docs/admin/nginx-config-example.rst
index c76a7205..7f55d38f 100644
--- a/docs/admin/nginx-config-example.rst
+++ b/docs/admin/nginx-config-example.rst
@@ -5,7 +5,10 @@ Use the following example to configure Nginx as a your web server.
 
 
 .. code-block:: nginx
+    ## rate limiter for certain pages to prevent brute force attacks
+    limit_req_zone  $binary_remote_addr  zone=dl_limit:10m   rate=1r/s;
 
+    ## custom log format
     log_format log_custom '$remote_addr - $remote_user [$time_local] '
                           '"$request" $status $body_bytes_sent '
                           '"$http_referer" "$http_user_agent" '
@@ -109,6 +112,12 @@ Use the following example to configure Nginx as a your web server.
             proxy_set_header Connection  "upgrade";
         }
 
+        location /_admin/login {
+            ## rate limit this endpoint
+            limit_req  zone=dl_limit  burst=10  nodelay;
+            try_files $uri @rhode;
+        }
+
         location / {
             try_files $uri @rhode;
         }