fix(gitea): block scraper IP and add rate limiting

74.7.243.196 was crawling valknar/home SVG icon tree at 1.8 req/s.
- Denylist the IP in fail2ban dynamic config
- Add rate-limit@file middleware to Gitea's Traefik router to throttle
  future scrapers on public repos

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

gitea/compose.yml

@@ -58,7 +58,7 @@ services:
       - "traefik.http.routers.gitea-web-secure.rule=Host(`${TRAEFIK_HOST}`)"
       - "traefik.http.routers.gitea-web-secure.tls.certresolver=resolver"
       - "traefik.http.routers.gitea-web-secure.entrypoints=web-secure"
-      - "traefik.http.routers.gitea-web-secure.middlewares=security-headers@file"
+      - "traefik.http.routers.gitea-web-secure.middlewares=security-headers@file,rate-limit@file"
       - "traefik.http.services.gitea-web-secure.loadbalancer.server.port=3000"
       - "traefik.docker.network=${NETWORK_NAME}"
     networks:

traefik/dynamic/fail2ban.yaml

@@ -5,6 +5,8 @@ http:
         fail2ban:
           allowlist:
             ip: "127.0.0.1/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,::1"
+          denylist:
+            ip: "74.7.243.196"
           rules:
             bantime: "3h"
             findtime: "10m"