Skip to main content
This guide covers implementing rate limits on Qovery services through NGINX customization. Rate limiting helps protect services from abuse. While third-party solutions like Cloudflare are recommended for filtering traffic before it reaches workloads, this tutorial demonstrates cluster-level implementation.
Changing NGINX snippets configuration is an advanced feature and can lead to misconfiguration. Please be careful when changing these settings as it might break the whole NGINX configuration.

​
Prerequisites

  • Application running on a Qovery managed cluster
  • Basic understanding of NGINX rate limiting

​
Understanding NGINX Rate Limiting

NGINX rate limiting protects your services by controlling the rate of requests. For detailed information, see NGINX’s official documentation on rate limiting.

​
Initial Setup

​
Configure Test Service

We’ll use jmalloc/echo-server Docker image for testing:
  • Image: jmalloc/echo-server
  • Port: 80

​
Configure NGINX Replicas

Rate limits apply per NGINX instance. For demonstration, set replicas to 1 (not recommended for production):
  1. Go to Cluster Settings → Advanced Settings
  2. Find nginx.controller.replicas
  3. Set value to 1
Without rate limits: 100 req/sec × 500 requests = 100% success rate (all HTTP 200 responses)

​
Global Rate Limit Implementation

​
Declare at Cluster Level

Configure nginx.controller.http_snippet:
Components:
  • $server_name: Rate limit key (can use $http_x_forwarded_for for IP-based limits)
  • zone=global:10m: Zone name with 10MB memory allocation
  • rate=10r/s: 10 requests per second threshold

​
Apply Rate Limit

Configure nginx.controller.server_snippet:

​
Deploy Changes

​
Enhancement with Burst

Adding burst=20 nodelay; permits 20-request bursts without delays:

​
Test Results

Load test: 100 req/sec for 500 total requests Result:
  • 452 HTTP 503 rejections
  • 48 HTTP 200 acceptances (~9.6 req/sec)

​
Service-Level Rate Limit

Configure rate limiting at the service level using advanced settings: Configuration Settings:
  • network.ingress.nginx_limit_rps: Rate in requests/second
  • network.ingress.nginx_limit_rpm: Rate in requests/minute
  • network.ingress.nginx_limit_burst_multiplier: Burst multiplier (default: 5)

​
Example: 10 Requests/Minute with 2× Burst

When both RPM and RPS are set, both rate limits will be enforced simultaneously. Traffic will be restricted based on whichever limit is hit first.

​
Deploy Service

​
Test Results

  • 479 HTTP 503 rejections
  • 21 HTTP 200 acceptances

​
Custom Header-Based Rate Limiting

Implement rate limiting based on custom HTTP headers.

​
Cluster Configuration

Configure nginx.controller.http_snippet:
Details: Maps HTTP header values to rate limit keys; missing headers default to “anonymous” designation.

​
Service Configuration

Configure network.ingress.nginx_controller_configuration_snippet:
Burst Parameter Explanation:
  • burst=2: Permits 2 extra requests beyond rate limit during short bursts
  • nodelay: Disables request queuing; excess requests rejected immediately

​
Deploy and Test

Test Command:
Result:
  • 473 HTTP 503 rejections
  • 27 HTTP 200 acceptances (~5.4 req/sec with burst)

​
Additional Configuration

​
Custom HTTP Status Code

Configure nginx.controller.limit_request_status_code:
  • Default: HTTP 503
  • Alternative: HTTP 429 (commonly used for rate limiting)
Test results show HTTP 429 responses:

​
Connection Limits

Configure network.ingress.nginx_limit_connections at service level to limit concurrent connections from single IP addresses.

​
Summary

Applied at cluster level, affects all services. Best for protecting the entire cluster from abuse.
Applied per service using nginx_limit_rps or nginx_limit_rpm. Best for protecting individual services.
Applied based on custom HTTP headers. Best for API key-based rate limiting and multi-tenant applications.
Limits concurrent connections per IP. Best for preventing connection exhaustion attacks.

Advanced Settings

Configure service advanced settings

NGINX Configuration

Learn about NGINX ingress

Cluster Configuration

Configure cluster settings

Security Best Practices

Implement security measures