[feature] Make rate limit requests amount configurable (#966)

* update rate limit documentation

* regenerate landingpage config helpers

* make rate limit rate configurable

2 files changed, 27 insertions, 11 deletions

diff --git a/docs/api/ratelimiting.md b/docs/api/ratelimiting.md
new file mode 100644
index 000000000..88e6ce56c
--- /dev/null
+++ b/docs/api/ratelimiting.md
@@ -0,0 +1,27 @@
+# Rate Limit
+
+To mitigate abuse + scraping of your instance, an IP-based HTTP rate limit is in place.
+
+This rate limit applies not just to the API, but to all requests (web, federation, etc).
+
+By default, a maximum of 1000 requests in a 5 minute time window are allowed.
+
+Every response will include the current status of the rate limit with the following headers:
+
+- `X-Ratelimit-Limit`: maximum number of requests allowed per time period.
+- `X-Ratelimit-Remaining`: number of remaining requests that can still be performed within.
+- `X-Ratelimit-Reset`: unix timestamp indicating when the rate limit will reset.
+
+In case the rate limit is exceeded, an [HTTP 429 Too Many Requests](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/429) error is returned to the caller.
+
+## Rate Limiting FAQs
+
+### My rate limit keeps being exceeded! Why?
+
+If you find that your rate limit is regularly being exceeded (both for yourself and other callers) during normal use of your instance, it's possible that your `trusted-proxies` setting is not configured correctly. This can result in your instance seeing all incoming IP addresses as the same address: namely, the IP address of your reverse proxy. This means that all incoming requests are *sharing the same rate limit*, rather than being split correctly per IP.
+
+You can investigate this by viewing the logs of your instance. If (almost) all logged IP addresses appear to be the same IP address (something like `172.x.x.x`), then it's likely that your `trusted-proxies` is not correctly configured. If this is the case, try adding the IP address of your reverse proxy to the list of `trusted-proxies`, and restarting your instance.
+
+### Can I configure the rate limit? Can I just turn it off?
+
+Yes! See the config setting `advanced-rate-limit-requests`.
diff --git a/docs/api/swagger.md b/docs/api/swagger.md
index fac2ba009..50191f18d 100644
--- a/docs/api/swagger.md
+++ b/docs/api/swagger.md
@@ -1,16 +1,5 @@
 # API Documentation
 
-## Rate limit
-
-To prevent abuse of the API an IP-based HTTP rate limit is in place, a maximum of 1000 requests in a 5 minutes time window are allowed, every response will include the current status of the rate limit with the following headers:
-
-- `x-ratelimit-limit` maximum number of requests allowed per time period (fixed)
-- `x-ratelimit-remaining` number of remaining requests that can still be performed
-- `x-ratelimit-reset` unix timestamp when the rate limit will reset
-
-In case the rate limit is exceeded an HTTP 429 error is returned to the caller.
-
-
 GoToSocial uses [go-swagger](https://github.com/go-swagger/go-swagger) to generate a V2 [OpenAPI specification](https://swagger.io/specification/v2/) document from code annotations.
 
 The resulting API documentation is rendered below, for quick reference.