shutter-api/docker-compose.rate_limit.yaml at main · shutter-network/shutter-api · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
### docker compose overrides for rate limiting
#
# Usage:
#   add the override via `-f docker-compose.rate_limit.yaml`, e.g.:
#   ```
#   docker compose -f docker-compose.yml -f docker-compose.rate_limit.yaml up -d
#   ```
#
# Use together with redirects if the deployment needs them — leaving the redirect
# override out silently drops the old-endpoint redirects:
#   ```
#   docker compose -f docker-compose.yml -f docker-compose.redirect.yaml -f docker-compose.rate_limit.yaml up -d
#   ```
#
# Note: the custom caddy container needs to be build before use:
#
#   ```
#   docker compose -f docker-compose.yml -f docker-compose.rate_limit.yaml build caddy
#   ```
#
# Management of API keys for premium access via the `apikeys` script in `./apikeys/apikeys.py`.
# See script header for documentation!

services:
  compiler:
    image: ghcr.io/astral-sh/uv:python3.13-alpine
    volumes:
      - ./apikeys/apikeys.py:/apikeys.py
      - ./apikeys/limits.yaml:/limits.yaml
      - ${DATA_DIR:-./data}:/data
    environment:
      - KEYS_FILE=/data/keys.csv
      - LIMITS_FILE=/limits.yaml
      - CADDY_SNIPPET=/data/apikeys.caddy
    command: uv run --script /apikeys.py --compile
  shutter-api:
    labels:
      # /check_authentication endpoint
      caddy.@checkauth.path_0: "/check_authentication"
      caddy.@checkauth.path_1: "/api/check_authentication"
      caddy.handle: "@checkauth"
      caddy.handle.handle_0: "@withApiKey"
      caddy.handle.handle_0.respond: "`{\"result\": \"authenticated\"}`"
      caddy.handle.handle_1: "@noApiKey"
      caddy.handle.handle_1.respond: "`{\"result\": \"unauthenticated\"}`"

      ## Rate limiting:
      # Make sure to mount compiled 'apikeys' file to this path in caddy container:
      caddy.import: /etc/caddy/apikeys
      caddy.handle_errors: 429
      caddy.handle_errors.respond: "`{\"error\": \"Request is rate limited. See documentation! https://github.com/shutter-network/shutter-api?tab=readme-ov-file#rate-limits--authorization\", \"retry_after_seconds\": {http.response.header.Retry-After}, \"status\": {err.status_code}}`"
      caddy.handle_errors.header.Content-type: "application/json"

      # Rate limit zones are no longer configured here — they are compiled into
      # the imported snippet above from apikeys/limits.yaml, which holds every
      # tier's limit for every endpoint in one table. Edit that file, not this one.

  caddy:
    build:
      context: .
      dockerfile: caddy/Dockerfile
    image: caddy-docker-proxy-rate-limit
    volumes:
      - ${DATA_DIR:-./data}/apikeys.caddy:/etc/caddy/apikeys
    entrypoint: /usr/bin/caddy
    command: docker-proxy run
    depends_on:
      compiler:
        condition: service_completed_successfully