The logs show a distributed automated flood against /digitization-resource/: roughly 103,000 IPs generated 169,000 captured requests, nearly all with forged-looking self-referrers and a small set of repeated browser user-agent strings. Each request carries many search filters—about 10 parameters on average—which overwhelms CKAN/uWSGI. That caused upstream connection failures, exhausted Nginx worker connections, created multi-gigabyte error logs, and filled the root disk.
The immediate mitigation is active: /digitization-resource/ returns 403 at Nginx before reaching CKAN, and diagnostic logging is sampled at 0.01% with bounded rotation. The durable fix is to proxy the domain through Cloudflare or AWS CloudFront with AWS WAF, enforce bot/DDoS controls and path-specific rate limits upstream, then optimize/cache the resource-search queries before safely re-enabling the route.
Solutions to try:
Use Cloudflare Free as the first durable defense. Proxy digitizationknowledge.org through Cloudflare, enable its DDoS/WAF protections, and keep the Nginx block in place while confirming the server stays stable.
Then add Nginx rate/concurrency limits and optimize the expensive CKAN resource-search queries. Once protected, cautiously remove the temporary /digitization-resource/ 403 block and monitor the sampled diagnostic log and disk usage. If abusive traffic still overwhelms the site, upgrade Cloudflare to Pro ($25/month) for stronger bot mitigation.
The logs show a distributed automated flood against
/digitization-resource/: roughly 103,000 IPs generated 169,000 captured requests, nearly all with forged-looking self-referrers and a small set of repeated browser user-agent strings. Each request carries many search filters—about 10 parameters on average—which overwhelms CKAN/uWSGI. That caused upstream connection failures, exhausted Nginx worker connections, created multi-gigabyte error logs, and filled the root disk.The immediate mitigation is active:
/digitization-resource/returns403at Nginx before reaching CKAN, and diagnostic logging is sampled at 0.01% with bounded rotation. The durable fix is to proxy the domain through Cloudflare or AWS CloudFront with AWS WAF, enforce bot/DDoS controls and path-specific rate limits upstream, then optimize/cache the resource-search queries before safely re-enabling the route.Solutions to try:
Use Cloudflare Free as the first durable defense. Proxy
digitizationknowledge.orgthrough Cloudflare, enable its DDoS/WAF protections, and keep the Nginx block in place while confirming the server stays stable.Then add Nginx rate/concurrency limits and optimize the expensive CKAN resource-search queries. Once protected, cautiously remove the temporary
/digitization-resource/403block and monitor the sampled diagnostic log and disk usage. If abusive traffic still overwhelms the site, upgrade Cloudflare to Pro ($25/month) for stronger bot mitigation.