Current state with latest updates

deploy/nginx/search-rate-limit.conf

@@ -0,0 +1,43 @@
+# -----------------------------------------------------------------------
+# Rate limiting for /search and the AI vector-search endpoints
+#
+# Laravel already throttles these routes at the application layer
+# (see App\Providers\AppServiceProvider::configureSearchRateLimiter /
+# configureVectorSearchRateLimiter), but that still costs one PHP-FPM
+# worker per request just to run the rate limiter and reject the
+# request. This nginx-level limiter rejects floods with a 503 before
+# they ever reach FPM, which is what actually protects worker capacity
+# during a scripted flood or bot storm.
+#
+# Setup:
+#   1. Add the `limit_req_zone` and `limit_req_status` lines to the
+#      `http {}` block (nginx.conf or conf.d/00-rate-limit-zones.conf) —
+#      zones MUST be declared at http level, not inside server {}.
+#   2. Include the `location` blocks below inside the relevant
+#      `server {}` block, ABOVE the general `location ~ \.php$` /
+#      PHP-FPM passthrough.
+# -----------------------------------------------------------------------
+
+# --- Add to the http {} block ---------------------------------------------
+# limit_req_zone $binary_remote_addr zone=search_zone:10m   rate=20r/m;
+# limit_req_zone $binary_remote_addr zone=ai_search_zone:10m rate=10r/m;
+# limit_req_status 429;
+# limit_req_log_level warn;
+# ---------------------------------------------------------------------------
+
+# Human search traffic: /search page + /api/search/* (Meilisearch-backed,
+# cheap once app-level caching is warm — burst allowance covers pagination
+# clicks / autocomplete without tripping on normal use).
+location ~ ^/(search|api/search) {
+    limit_req zone=search_zone burst=15 nodelay;
+    try_files $uri $uri/ /index.php?$query_string;
+}
+
+# AI similarity / image-search endpoints: each request can trigger an
+# outbound HTTP call to the vision vector gateway (see
+# App\Services\Vision\VectorGatewayClient), so keep the burst tight —
+# a flood here is the "consuming FPM workers" scenario from the slow log.
+location ~ ^/api/(art/[0-9]+/similar-ai|search/image) {
+    limit_req zone=ai_search_zone burst=5 nodelay;
+    try_files $uri $uri/ /index.php?$query_string;
+}