feat(node): per-IP write-surface rate brake + purge-spam admin tool

.env.example

@@ -13,9 +13,19 @@ GITLAWB_PUBLIC_URL=https://your-node.example.com
 # ── Server ────────────────────────────────────────────────────────────────
 GITLAWB_HOST=0.0.0.0
 GITLAWB_PORT=7545
+# Optional address to bind a Prometheus /metrics exposition endpoint on (e.g.
+# 127.0.0.1:9091). Leave empty (default) to disable. Bind to localhost or a
+# private interface — the metrics endpoint is unauthenticated.
+GITLAWB_METRICS_ADDR=
+# Max seconds to wait for in-flight requests to drain on shutdown before the
+# server returns 503 to anything still in flight and exits. Default: 30.
+GITLAWB_SHUTDOWN_GRACE_SECS=30
 
 # ── Storage ───────────────────────────────────────────────────────────────
 GITLAWB_REPOS_DIR=/data/repos
+# Tigris (S3-compatible) bucket for repo storage. Leave empty (default) to
+# disable Tigris and use local-only storage.
+GITLAWB_TIGRIS_BUCKET=
 
 # PostgreSQL connection URL. Required.
 # When using the bundled docker-compose, this is wired automatically.
@@ -39,6 +49,9 @@ GITLAWB_DB_RETRY_INITIAL_SECS=5
 GITLAWB_DB_RETRY_MAX_SECS=60
 
 # ── IPFS pinning (Pinata) ─────────────────────────────────────────────────
+# URL of a local IPFS/Kubo node HTTP API (e.g. http://127.0.0.1:5001). Leave
+# empty (default) to disable local IPFS.
+GITLAWB_IPFS_API=
 # Get a JWT at https://app.pinata.cloud/developers/api-keys
 GITLAWB_PINATA_JWT=
 GITLAWB_PINATA_UPLOAD_URL=https://uploads.pinata.cloud/v3/files
@@ -127,6 +140,20 @@ GITLAWB_PUSH_RATE_LIMIT=600
 # the client IP. 0 disables. Default 120.
 GITLAWB_CREATE_RATE_LIMIT=120
 
+# ── Write rate limiting (non-creation authenticated writes) ───────────────
+# Max non-creation write requests per client IP per hour: issue/PR comments,
+# labels, stars, merges, protect/unprotect, replicas, visibility, tasks,
+# bounties, profile, and all GraphQL HTTP requests. The brake wraps the whole
+# /graphql route, so queries and the playground GET consume this bucket too, not
+# only mutations (GraphQL WebSocket subscriptions are excluded). Its own bucket,
+# separate from the creation and push brakes. Uses GITLAWB_TRUSTED_PROXY to
+# resolve the client IP.
+# NOTE: this is a per-IP aggregate across ALL those write actions, so behind a
+# shared NAT/egress IP (or with GITLAWB_TRUSTED_PROXY unset) many users collapse
+# onto one bucket — raise this for automation-heavy or multi-user single-IP
+# deployments. 0 disables. Default 600.
+GITLAWB_WRITE_RATE_LIMIT=600
+
 # ── Peer-sync rate limiting (per client IP, uses GITLAWB_TRUSTED_PROXY below) ─
 # /api/v1/peers/announce and /api/v1/sync/notify accept unsigned requests from
 # known peers and run at higher frequency, so a generous bucket. Separate from

crates/gitlawb-node/Cargo.toml

@@ -12,6 +12,7 @@ path = "src/main.rs"
 
 [dependencies]
 gitlawb-core = { path = "../gitlawb-core" }
+async-trait = "0.1"
 ed25519-dalek = { workspace = true }
 base64 = { workspace = true }
 tokio = { workspace = true }