#
# CyberLux onion ingress budgets.
# Installed into /etc/nginx/conf.d/ so these zones exist in nginx `http { }`.
#
# Tor hidden services connect to nginx over 127.0.0.1, so per-IP limits are not
# useful here. `$server_port` keys the CyberLux onion ingress bucket.
#
# Keyed by server_port — not remote_addr, because all Tor clients arrive from loopback.
# rate=60r/s is generous for onion traffic; static assets are excluded from this zone
# (see nginx.example.conf /_next/static/ location block).
limit_req_zone $server_port zone=cyberlux_onion_req:10m rate=60r/s;
limit_conn_zone $server_port zone=cyberlux_onion_conn:10m;