Codeberg-Infrastructure/scripted-configuration
Watch
12
21
Fork
You've already forked scripted-configuration
 17
Code Issues 5 Pull requests 2 Activity

Rate limiting for Guix’s build server #96

New issue
Closed
opened 2026-05-04 17:59:57 +02:00 by dpk · 5 comments
dpk commented 2026-05-04 17:59:57 +02:00
Contributor
Copy link

On 4 May 2025 we had slowtime because of aggressive Git pulling by the build servers of @guix. After conversation with @civodul we agreed that Guix would build in a rate limiter to their Git usage, but as a temporary measure in the meanwhile until that is deployed on their end, it is okay to install an IP address rate limit (141.80.181.40, 141.80.181.41) for their use on our end.

Summary of discussions of this matter so far:

@civodul would like to know: What will be rate limited? IP connections?

@gusted would like to know: What requests/minute limit would be okay for Guix’s purposes?

@civodul says it’s okay that this would mean the IP addresses being recorded publically.

On 4 May 2025 we had slowtime because of aggressive Git pulling by the build servers of @guix. After conversation with @civodul we agreed that Guix would build in a rate limiter to their Git usage, but as a temporary measure in the meanwhile until that is deployed on their end, it is okay to install an IP address rate limit (141.80.181.40, 141.80.181.41) for their use on our end. Summary of discussions of this matter so far: @civodul would like to know: What will be rate limited? IP connections? @gusted would like to know: What requests/minute limit would be okay for Guix’s purposes? @civodul says it’s okay that this would mean the IP addresses being recorded publically.
civodul commented 2026-05-04 18:10:05 +02:00
Copy link

Hi @dpk,

First of all, apologies for the disruption caused by our systems. The culprit (the IP in .41) is https://pulls.ci.guix.gnu.org, a continuous integration system that monitors pull requests and would unnecessarily poll their repos. We are working on a fix for this though it will probably be a couple of weeks before we can deploy it.

In the meantime, it is okay to rate-limit .41 by IP; would one request per minute work for you?

The IP in .40 corresponds to ci.guix.gnu.org, which builds several branches of Guix and a few other packages (Guile, Shepherd). This one should be less intensive, but please let me know if you notice excessive activity as well. It's also a bit more critical so it's best if we can avoid rate-limiting it.

Thanks!

Hi @dpk, First of all, apologies for the disruption caused by our systems. The culprit (the IP in .41) is https://pulls.ci.guix.gnu.org, a continuous integration system that monitors pull requests and would unnecessarily poll their repos. We are working on a fix for this though it will probably be a couple of weeks before we can deploy it. In the meantime, it is okay to rate-limit .41 by IP; would one request per minute work for you? The IP in .40 corresponds to ci.guix.gnu.org, which builds several branches of Guix and a few other packages (Guile, Shepherd). This one should be less intensive, but please let me know if you notice excessive activity as well. It's also a bit more critical so it's best if we can avoid rate-limiting it. Thanks!
Gusted commented 2026-05-05 10:39:33 +02:00
Owner
Copy link

@civodul wrote in #96 (comment):

would one request per minute work for you?

Yes.

Unsolicited advice, as I'm not aware of why it's polling the forked repositories. In case it's trying to get the commits from the head branch for pull requests, they are available on https://codeberg.org/guix/guix and can be fetched via git fetch origin refs/pull/$ID/head:pr-$ID.

@civodul wrote in https://codeberg.org/Codeberg-Infrastructure/scripted-configuration/issues/96#issuecomment-14287334: > would one request per minute work for you? Yes. Unsolicited advice, as I'm not aware of why it's polling the forked repositories. In case it's trying to get the commits from the head branch for pull requests, they are available on https://codeberg.org/guix/guix and can be fetched via `git fetch origin refs/pull/$ID/head:pr-$ID`.
civodul commented 2026-05-05 17:12:28 +02:00
Copy link

@Gusted Right, thanks. Actually we figured it doesn't need to poll pull requests here (it gets a POST request when something changes anyway) so we're looking to disable polling by default.

@Gusted Right, thanks. Actually we figured it doesn't need to poll pull requests here (it gets a POST request when something changes anyway) so we're looking to disable polling by default.
civodul commented 2026-06-01 15:55:08 +02:00
Copy link

@dpk @Gusted I’ve just restarted the offending CI server at https://pulls.ci.guix.gnu.org.

I believe you should now be able to lift the rate limit on 141.80.181.41.

Of course please let us know if you still observe excessive clones or anything coming from these systems.

Thanks again for reaching out and for your patience!

@dpk @Gusted I’ve just restarted the offending CI server at https://pulls.ci.guix.gnu.org. I believe you should now be able to lift the rate limit on 141.80.181.41. Of course please let us know if you still observe excessive clones or anything coming from these systems. Thanks again for reaching out and for your patience!
Gusted commented 2026-06-02 14:44:31 +02:00
Owner
Copy link

Done, thanks!

Done, thanks!
❤️ 1
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
machines-bird-ospf3
bird-ebgp-vip
crapstone-nitrokey
kampenwand-mail
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
Codeberg-Infrastructure/scripted-configuration#96
No description provided.