traffic_guard

Administrator-only traffic guard rules and current rate-limited IPs.

GET lists returns database and global entries with IP, kind, note, expiry (Unix seconds, zero means forever), and source. GET throttled returns node-local active rate-limit decisions, including observe-mode decisions, without visited URLs. POST entry accepts kind (allow/block), ips (whitespace/comma separated), note and validity (hour/day/week/month/forever or YYYY-MM-DDTHH:MM in UTC). Re-adding an IP of the same kind updates its note and expiry. POST block accepts ip and validity, and generates a note from current throttling evidence. DELETE entry/id removes a database entry. All mutations reject read-only credentials.

At most 256 database entries per kind are allowed. Notes are required, at most 1000 characters. Global traffic_guard_allow and traffic_guard_block lists in zotonic.config are merged on every configuration load and cannot be edited here. Allow takes precedence. Expired rules stop matching immediately and are deleted by hourly maintenance. No migration from the former JSON setting is performed.