Document GitLab.com's rate limits

Follow up https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/18040#note_73885694:

We do not document GitLab.com's rate limits anywhere, which has caused confusion for some users. Plus, there is more than one potential source of rate-limits:

GitLab.com does not currently use the Application Setting throttles.

HAProxy config enforces this:

  • API rate-limit: 600 req/min

Also GitLab.com uses the "git_basic_auth" setting:

*** PRODUCTION *** production> Settings.rack_attack
=> {"git_basic_auth"=>{"enabled"=>true, "ip_whitelist"=>["127.0.0.1"], "maxretry"=>30, "findtime"=>180, "bantime"=>3600}}

These are the omnibus-gitlab defaults (which it doesn't look like we diverge from):

So if I'm reading this correctly, we throttle all authentication endpoints to:

  • 10 req/min
  • And ban for 1 hour upon hitting 30 req/3 mins.

Is this correct?

Edited by Michael Kozono