Public edge limits

​

Recommended baseline

• /c/:public_id only needs a short public ID and an optional short src query parameter. A 2 KB URI ceiling is generous.
• Mantis does not need request bodies on /c/*; POST is accepted only for clients that can only signal by POST.
• If you intentionally embed long attribution in query strings, raise the URL limit for /c/* and keep the app’s storage caps in sync.
• Node’s default HTTP request-header limit is 16 KiB. Railway’s public proxy allows 32 KB combined headers. The app stores request fields with caps above the Node default so normal accepted traffic is preserved.
• Mantis also enforces app-level body caps where it parses request bodies: management JSON bodies are capped at 64 KiB, Apple Wallet log bodies at 32 KiB, and the dev inbox capture at 1 MiB. Oversized parsed bodies return 413 payload_too_large.
• Stored hit headers are allowlisted and capped. Credential-shaped names such as authorization, cookies, session tokens, CSRF tokens, and API-key-looking headers are dropped before storage; x-mantis-* installer headers are kept.

​

Cloudflare Tunnel or Cloudflare in front of any host

​

Custom rule: reject oversized public URLs

1. Cloudflare dashboard -> your zone -> Security -> WAF -> Custom rules.
2. Create a rule named mantis public URL limits.
3. Expression:

(
  starts_with(http.request.uri.path, "/c/")
  and len(http.request.uri) > 2048
)
or
(
  starts_with(http.request.uri.path, "/status/")
  and len(http.request.uri) > 1024
)
or
(
  starts_with(http.request.uri.path, "/api/wallet/")
  and len(http.request.uri) > 4096
)
or
(
  starts_with(http.request.uri.path, "/inbox")
  or starts_with(http.request.uri.path, "/api/inbox")
)

4. Action: Block.
5. Deploy.

​

Rate limiting rules

1. Security -> WAF -> Rate limiting rules.
2. Create one rule for /c/*:
   • Expression: starts_with(http.request.uri.path, "/c/")
   • Characteristics: IP address
   • Period: 60 seconds
   • Requests: 120
   • Mitigation timeout: 60 seconds
   • Action: Block or Managed Challenge
3. Create one rule for /status/*:
   • Expression: starts_with(http.request.uri.path, "/status/")
   • Characteristics: IP address
   • Period: 60 seconds
   • Requests: 240
   • Mitigation timeout: 60 seconds
   • Action: Block
4. If Apple Wallet is enabled, create one rule for /api/wallet/*:
   • Expression: starts_with(http.request.uri.path, "/api/wallet/")
   • Characteristics: IP address
   • Period: 60 seconds
   • Requests: 120
   • Mitigation timeout: 60 seconds
   • Action: Block

• Rules language functions
• Rate limiting rules
• Request body size field

​

Railway

1. Deploy Mantis on Railway as usual.
2. Add a custom domain in Railway.
3. Put that hostname in Cloudflare DNS with the orange cloud enabled.
4. Add the Cloudflare custom and rate limiting rules above.
5. Set TRUST_PROXY_HEADERS=1 only when Cloudflare is the public entry point.

• Public networking specs and limits
• Pricing
• Redis service

​

Railway Redis/Valkey for shared rate limiting

• RAM is billed at $10/GB-month.
• CPU is billed at $20/vCPU-month by actual usage.
• Volume storage is $0.15/GB-month.
• Hobby has a $5/month minimum that counts toward usage.

​

Fly.io

1. Keep type = "requests" with a hard limit your VM can actually handle.
2. Use a Cloudflare-proxied custom domain for the public hostname if the Mantis URL will be exposed broadly.
3. Add the Cloudflare rules above.

• Concurrency settings

​

Render

• DDoS protection

​

Tailscale Funnel

1. Prefer Cloudflare Tunnel if you own a domain and want edge rules.
2. Or put nginx/Caddy between the Funnel sidecar and Mantis, then point Tailscale Serve/Funnel at that local proxy instead of mantis:3000.

client_max_body_size 16k;
large_client_header_buffers 4 8k;

location /c/ {
  limit_except GET HEAD POST { deny all; }
  limit_req zone=mantis_trigger burst=20 nodelay;
  proxy_pass http://mantis:3000;
}

location /status/ {
  limit_except GET HEAD { deny all; }
  limit_req zone=mantis_status burst=20 nodelay;
  proxy_pass http://mantis:3000;
}

​

Local Docker