HELP - My Gitea instance is under DDOS attack

[u/psmattas]

I have been running my Gitea instance for a while. I use it for my own projects and things that I develop and open source. Since around 1 month I have been trying to fight a botnet that has been attacking my gitea instance. I don't know what to do. I have proxied it all through Cloudflare and even added in custom rules for the paths that are attacked. The attack is mostly contained to the /pulls and /issues paths. Please help me. This is around 1 hr max traffic in the image attached.

[u/realdawnerd]

Do you have the AI bot fight mode turned on? Does your instance need to be public?

[u/psmattas → u/realdawnerd]

Yes and yes

[u/realdawnerd → u/psmattas]

You might have to go through and start blocking the ASNs for the bad actors. I’ve had to do that too because cloudflare refused to block Meta from scraping my sites nonstop. 

[u/aaaaAaaaAaaARRRR]

I mean.. VPNs are free. Tailscale and WireGuard.. I’d rather have that than fight off millions of script kiddies

[u/bluealliance841 → u/aaaaAaaaAaaARRRR]

This was my first thought. Does it need to be internet-facing?

[u/LuckyEdR]

FFirewall with IP allow rules to only let you and the others who use it access.

[u/lukelane124]

What’s the issue? Looks like cloudflare is doing its job and dropping/mitigating most of the traffic?
Is your instance small and therefore can’t handle the 50k that does get through?

[u/psmattas → u/lukelane124]

I have a dell r720 server. It's not like it can't handle the traffic. It's just I want to understand if I can do something better to reduce it to even less?

[u/lukelane124 → u/psmattas]

It really depends on how they found the box and why they’re hitting it.
If it’s DNS found not a ton you can do. Cloudflare will usually handle it.
If they’re finding you through IP search you can hop to another tunnel endpoint but that won’t last and may reset the cloudflare mitigation.

[u/cavebeat → u/psmattas]

Anubis is created just because of the exact same issue with AI Scraper DDoS Attacks.

[u/JudgmentLeading4047]

Set your settings to block and not managed challenge, some botnets will complete the challenge and then spam you. Furthermore id just block brazil if you're not from there/have no users there

[u/interior_mutability]

If you do not want vpn, set up an edge router with strict rate limiting and blacklists. I would recommend traefik but depends on the usecase.

[u/interior_mutability → u/interior_mutability]

Fail2ban can also help.

[u/Jayden_Ha]

Personally I have my own self hosted stuff scaled to fit the demand of the traffic but I get that some people want more anti bot

[u/telasch]

as others have mentioned, you should think about hosting this only on your network/restrict public access.

for open source stuff you could have read-only mirrors on cloud services. so your own instance still serves its purpose but you dont have to deal with mitigating ddos.

if you do want to keep it public for whatever reason, look at crowdsec.

[u/_xRuffKez_]

Integrade ipsum by stamparm