feat(blog): rate limiting a Node.js API across many instances

A recipe for @imqueue/http-protect behind several gateway instances
sharing one Redis: the shared counter, what its TTL-based count really
measures, resolving the client address safely behind a proxy (the default
trusts X-Forwarded-For from anyone, which lets a client dodge the limit,
claim a safe network or get a customer banned), the ::ffff: form that
defeats safeNetworks, lifting a permanent ban, Retry-After, and failing
fast when Redis is down. Measured on http-protect 3.0.3, Express 5 and
Redis 8. The security hub description now names it.

The search index's tier-2 budget goes from 400 to 440 KB, in both the
generator and the check, as its own comment prescribes when it fires: the
site was at 398.2 KB before this post and 404.7 KB with it, with tier 1 at
96.2 of 120 KB.

Author: Mikhus

images/blog/rate-limiting-nodejs-api-redis.png

@@ -49,7 +49,7 @@ const OUT = path.join(ROOT, EDITION_DIR);
 // generator's copy fails the BUILD, this one fails `npm test` against whatever is
 // in _site-org, including a build somebody produced before changing the budget.
 const BUDGET_GZ: Record<string, number> =
-  { 'search-index.json': 120 * 1024, 'search-text.json': 400 * 1024 };
+  { 'search-index.json': 120 * 1024, 'search-text.json': 440 * 1024 };
 
 /** One tier-1 record, in the wire shape the ranker reads. See lib/search-corpus.ts. */
 interface Record1 {

scripts/check-search-index.ts

@@ -50,14 +50,16 @@ const RANGES = "search-sections.json";
 //
 // Tier 2 was raised 320 -> 360 KB on 2026-08-28, when a 3.3k-word post took the
 // measured size from 313.9 to 321.6 KB, and 360 -> 400 KB on 2026-09-15, when a
-// 3.5k-word post took it from 360.9 to 368.3 KB with tier 1 at 89.9 of 120 KB.
+// 3.5k-word post took it from 360.9 to 368.3 KB with tier 1 at 89.9 of 120 KB,
+// and 400 -> 440 KB on 2026-10-16, when a 2.6k-word post took it from 398.2 to
+// 404.7 KB with tier 1 at 96.2 of 120 KB.
 // It is not a UX number: the dialog fetches tier 2 only once a query is longer
 // than one character and never awaits it, so tier-1 results paint first and the
 // list re-ranks when the prose corpus lands.
 // The ceiling exists to make growth visible, so keep it close — a budget with
 // years of slack in it stops reporting anything. Raise it again when it fires,
 // after checking that tier 1 still has room.
-const BUDGET_GZ: Record<string, number> = { [TIER1]: 120 * 1024, [TIER2]: 400 * 1024, [RANGES]: 40 * 1024 };
+const BUDGET_GZ: Record<string, number> = { [TIER1]: 120 * 1024, [TIER2]: 440 * 1024, [RANGES]: 40 * 1024 };
 
 function gzipSize(text: string): number {
   return zlib.gzipSync(Buffer.from(text), { level: 9 }).length;

scripts/gen-search-index.ts

@@ -109,6 +109,6 @@
   "security": {
     "label": "Security",
     "title": "Securing Node.js services and their broker",
-    "description": "Security articles for Node.js service fleets: encrypting the Redis broker connection with TLS, least-privilege Redis ACL users for a message queue, keeping each tenant's rows out of other tenants' queries, and checking a caller's IP against thousands of allowed networks."
+    "description": "Security articles for Node.js service fleets: encrypting the Redis broker connection with TLS, least-privilege Redis ACL users for a message queue, keeping each tenant's rows out of other tenants' queries, rate limiting an API that runs on many instances, and checking a caller's IP against thousands of allowed networks."
   }
 }