11. Nginx Rate Limiting (limit_req), DDoS Mitigation & Security Headers Injection • DevOps, Docker & Cloud VPS Deployment Mastery • Rishabh Ki Kaksha

DevOps, Docker & Cloud VPS Deployment Mastery › 11. Nginx Rate Limiting (limit_req), DDoS Mitigation & Security Headers Injection

40 mins

← Prev Next →

Course Syllabus

Module 1: Linux System Administration & Kernel Performance Tuning

01. Linux OS Architecture: Kernel vs User Space, System Calls & Process Management (ps, top, htop) 02. Linux File Permissions (chmod, chown, SUID/SGID) & Sticky Bits Security 03. Networking & Diagnostics: netstat, ss, lsof, tcpdump, curl, dig & DNS Resolution

Part 1: Linux & Docker Containerization

Module 2: Containerization with Docker & Multi-Stage Builds

04. Docker Architecture: Namespaces, Cgroups, UnionFS & Docker Engine Internals 05. Dockerfile Optimization: Layer Caching, Non-Root Users & Ultra-Light Alpine Multi-Stage Builds 06. Docker Compose: Multi-Container Networking, Persistent Volumes & Environment Config 07. Docker Production Security: Read-Only Root FS, Capabilities Drop & Container Scanning

Part 2: Nginx, SSL, PM2 & Automated CI/CD

Module 3: Nginx Reverse Proxy, SSL Automation & Security Hardening

08. Nginx Masterclass: Event-Driven Non-Blocking Architecture vs Apache Multi-Threaded 09. Nginx as Reverse Proxy, Load Balancer (upstream) & Gzip/Brotli Compression Config 10. SSL/TLS Automation with Certbot Let's Encrypt, HTTP/2 & Strict-Transport-Security (HSTS) 11. Nginx Rate Limiting (limit_req), DDoS Mitigation & Security Headers Injection

Module 4: Process Management with PM2 & Systemd Services

12. Systemd Services: Creating Custom System Daemons with Automatic Restart & Logging 13. PM2 Enterprise Process Manager: Cluster Mode, Ecosystem Config & Graceful Reloads 14. Log Management & Rotation: logrotate, journalctl & Centralized Syslog Streaming

Module 5: CI/CD Automation with GitHub Actions & Zero-Downtime Deployments

15. CI/CD Foundations: Building Automated Test & Build Pipelines with GitHub Actions 16. Automated SSH Deployments: Self-Hosted Runners, Deploy Keys & Zero-Downtime Atomic Symlinks 17. Blue-Green & Canary Deployment Strategies on Cloud VPS Infrastructure

Module 6: Cloud VPS Production Hardening, Firewall (UFW) & Backups

18. Cloud VPS Hardening: Non-Root Sudo Users, SSH Key-Only Auth, Fail2ban & UFW Firewall Rules 19. Automated Database & Media Backups to Cloud Storage (AWS S3 / Cloudflare R2 / MinIO) 20. Server Health Monitoring & Alerting: Uptime Kuma, Netdata, Prometheus & Telegram Bot Webhooks

Interactive Lesson Studio

# 11. Nginx Rate Limiting (limit_req), DDoS Mitigation & Security Headers Injection

> DevOps & Cloud VPS Notes by Rishabh - Topic 11

---

### 1. Nginx `limit_req_zone` (Token Bucket on Edge 🛡️)

```nginx
# Define shared memory zone tracking Client IP ($binary_remote_addr):
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;

server {
    location /api/ {
        # Burst of 20 requests with nodelay processing:
        limit_req zone=api_limit burst=20 nodelay;
        limit_req_status 429;

proxy_pass http://127.0.0.1:3000;
    }
}
```

---

### 2. A+ Grade Security Headers Injection

```nginx
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
```

---

### 3. Master Comparison Matrix

---

### 4. Interview Ke 3 Sawal Is Topic Se

1. **`$binary_remote_addr` `$remote_addr` se memory-efficient kyu hai?** -> `$remote_addr` string format me 7-15 bytes leta hai jabki `$binary_remote_addr` binary format me sirf 4 bytes (IPv4) leta hai.
2. **`X-Frame-Options: DENY` kis attack ko block karta hai?** -> Clickjacking attacks (attacker aapki site ko invisible iframe me embed nahi kar sakta).
3. **Nginx connection limiting (`limit_conn_zone`) rate limiting se kaise alag hai?** -> `limit_conn` simultaneous active open TCP connections restrict karta hai; `limit_req` request arrival rate restrict karta hai.

---
**Next Topic:** 12. Systemd Services: Creating Custom System Daemons with Automatic Restart & Logging

Loading lesson content...

Python 3.12

Full IDE

Live Execution Terminal

Click "Execute Live" to run code.
                

Lesson Mastery AI Quiz

AI Doubt Solver

CERTIFICATE OF COMPLETION

Rishabh Gehlot

PHP 8+ & Laravel 11 Master Track