I have the following config, that works OK for rate limiting connections. If an abuser is authenticated and he also accesses the defined regex location more than 30 times per minute, rate limiting is initiated and he is forwarded to the rate_limiting backend where he receives an error message:
frontend http_in bind xx.xx.xx.xx:80 mode http default_backend backend_nodes tcp-request inspect-delay 5s acl location_request path_reg ^/(.*)/(.*)/ acl too_many_requests sc0_gpc0_rate(context) ge 30 acl mark_seen sc0_inc_gpc0 gt 0 stick-table type string size 100k store gpc0_rate(60s) tcp-request content track-sc0 cookie(authValidation) if location_request use_backend rate_limiting if mark_seen too_many_requests backend backend_nodes mode http balance roundrobin option http-server-close server srv1 192.168.0.1:80 weight 5 server srv2 192.168.0.2:80 weight 5 backend rate_limiting mode http timeout tarpit 2s errorfile 500 /etc/haproxy/errorfiles/429.http http-request tarpit
This configuration ensures that the abuser can't make more than 30 requests per minute, however, it does not block him completely for more than a minute. Now, what I'd like to achieve next is completely blocking the abuser for 1 hour after he gets rate-limited, but as far as I my research showed me, I don't even know if this additional step is even possible.