waf: period 10 (plan-allowed) — 20 req/10s = 120/min ceiling

15c6ec1625d75495f879c052ac8836eb9223c0c5 · 2026-08-12 09:28:22 -0700 · Steve Abrams

Files touched

M scripts/apply-ratelimit.sh

Diff

commit 15c6ec1625d75495f879c052ac8836eb9223c0c5
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Wed Aug 12 09:28:22 2026 -0700

    waf: period 10 (plan-allowed) — 20 req/10s = 120/min ceiling
---
 scripts/apply-ratelimit.sh | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/scripts/apply-ratelimit.sh b/scripts/apply-ratelimit.sh
index 1724baa..ec53629 100755
--- a/scripts/apply-ratelimit.sh
+++ b/scripts/apply-ratelimit.sh
@@ -14,9 +14,11 @@ ZONE="0121a01d603b55dd23cb23d78987e16e"   # agentabrams.com
 API="https://api.cloudflare.com/client/v4"
 DESC="buildingpermits API rate limit"
 
-# The rule: block an IP that exceeds 120 req/60s to /api/ on the public host,
-# for 60s. cf.colo.id is required by the ratelimit schema; ip.src is the counter.
-RULE='{"action":"block","description":"'"$DESC"'","expression":"(http.host eq \"buildingpermits.agentabrams.com\" and starts_with(http.request.uri.path, \"/api/\"))","ratelimit":{"characteristics":["ip.src","cf.colo.id"],"period":60,"requests_per_period":120,"mitigation_timeout":60}}'
+# The rule: block an IP that exceeds 20 req/10s to /api/ on the public host,
+# for 10s. (period must be 10 on this CF plan; 20/10s = 120/min, same effective
+# ceiling as the original 120/60s.) cf.colo.id is required by the ratelimit
+# schema; ip.src is the counter.
+RULE='{"action":"block","description":"'"$DESC"'","expression":"(http.host eq \"buildingpermits.agentabrams.com\" and starts_with(http.request.uri.path, \"/api/\"))","ratelimit":{"characteristics":["ip.src","cf.colo.id"],"period":10,"requests_per_period":20,"mitigation_timeout":10}}'
 
 # DRY_RUN — print exactly what WOULD be sent, touch nothing, need no token.
 if [ "${DRY_RUN:-0}" = "1" ]; then

← b8b0d82 Add transition-only canary alert wrapper (CNCP card + George · back to La Socrata Ingester · contacts: $0 own-site miner for linkedin/email/phone (NANP-v 90cf00f →