docs: define the nginx rate limit key per client

The limit_req_zone keyed on $pw_limit, but that variable was never
defined, so its value was empty and every client shared a single rate
limit bucket. A single busy client could then exhaust the shared
budget and throttle everyone.

Define $pw_limit from the client address so the limit applies per
client, and document setting it empty to exempt trusted hosts.

Signed-off-by: Robin Jarry <robin@jarry.cc>

Author: rjarry

docs/deployment/nginx.conf

@@ -1,3 +1,11 @@
+# Rate limiting key: the client address. Set to an empty string to
+# exempt a client from limiting (for example a trusted internal host).
+# Without this the zone key would be empty and every client would share
+# a single bucket instead of being limited individually.
+map $binary_remote_addr $pw_limit {
+	default $binary_remote_addr;
+}
+
 # Rate limiting zone: allow 20 requests/second per client.
 limit_req_zone $pw_limit zone=pw:10m rate=20r/s;