commit 29ac915

Updated documentation.

 1@@ -242,6 +242,12 @@ posts will not be direct ones, but proxied by
 2 This way, remote media servers will not see the user's IP, but the server one,
 3 improving privacy. Please take note that this will increase the server's incoming
 4 and outgoing traffic.
 5+.It Ic badlogin_retries
 6+If incorrect logins from a given IP address reach this count, subsequent attempts
 7+from it are rejected until the lock expires (default: 5 retries).
 8+.It Ic badlogin_expire
 9+The number of seconds a blocked IP address is ignored in login attempts
10+(default: 300 seconds).
11 .El
12 .Pp
13 You must restart the server to make effective these changes.
14@@ -546,6 +552,22 @@ heavily on how all the servers involved behave. Just cross your fingers and hope
15 Full instances can be blocked. This operation must be done from
16 the command-line tool. See
17 .Xr snac 1 .
18+.Pp
19+.Ss Bad login throttling
20+Since version 2.67, a simple logic to avoid brute force attacks against user passwords
21+has been implemented: if, from a given IP address, the number of failed logins reaches
22+a given threshold, further tries from that IP address are never successful until a timer
23+expires. The maximum number of retries can be configured in the 
24+.Pa server.json
25+file by setting the
26+.Ic badlogin_retries
27+variable, and the number of seconds the IP address unlock timer expires, in
28+.Ic badlogin_expire .
29+Please take note that, for this system to work, you must setup your web server proxy
30+to pass the remote connection address in the
31+.Ic X-Forwarded-For
32+HTTP header (unless you use the FastCGI interface; if that's the case, you don't have
33+to do anything).
34 .Sh ENVIRONMENT
35 .Bl -tag -width Ds
36 .It Ev DEBUG
37@@ -603,35 +625,42 @@ example.com server section:
38 location /fedi {
39     proxy_pass http://localhost:8001;
40     proxy_set_header Host $http_host;
41+    proxy_set_header X-Forwarded-For $remote_addr;
42 }
43 # webfinger
44 location /.well-known/webfinger {
45     proxy_pass http://localhost:8001;
46     proxy_set_header Host $http_host;
47+    proxy_set_header X-Forwarded-For $remote_addr;
48 }
49 # Mastodon API (entry points)
50 location /api/v1/ {
51     proxy_pass http://localhost:8001;
52     proxy_set_header Host $http_host;
53+    proxy_set_header X-Forwarded-For $remote_addr;
54 }
55 location /api/v2/ {
56     proxy_pass http://localhost:8001;
57     proxy_set_header Host $http_host;
58+    proxy_set_header X-Forwarded-For $remote_addr;
59 }
60 # Mastodon API (OAuth support)
61 location /oauth {
62     proxy_pass http://localhost:8001;
63     proxy_set_header Host $http_host;
64+    proxy_set_header X-Forwarded-For $remote_addr;
65 }
66 # optional
67 location /.well-known/nodeinfo {
68     proxy_pass http://localhost:8001;
69     proxy_set_header Host $http_host;
70+    proxy_set_header X-Forwarded-For $remote_addr;
71 }
72 # optional (needed by some Mastodon API clients)
73 location /.well-known/host-meta {
74     proxy_pass http://localhost:8001;
75     proxy_set_header Host $http_host;
76+    proxy_set_header X-Forwarded-For $remote_addr;
77 }
78 .Ed
79 .Pp