Rate limits, PKGBUILD checks, and limits

The repository file docs/security.md is the review note. This page is the operator's version. Neither one is a certification.

Rate limit

TAUR_RPC_RATE_LIMIT=400
TAUR_RPC_RATE_WINDOW=60

Each TCP peer may make that many RPC calls per window. The 429 body is JSON with "error":"Rate limit reached". Forwarded headers are ignored, so a proxy in front must limit too if you need per-client limits.

PKGBUILD

Pushes compare simple assignments only. To also run makepkg --printsrcinfo you must set TAUR_PKGBUILD_ISOLATION=bwrap and install bubblewrap. The server will not fall back to running makepkg on the host. That sandbox is not a virtual machine.

TLS

Terminate TLS in front of TAUR_BIND. gRPC is plaintext HTTP/2 on TAUR_GRPC_BIND. A Caddy snippet for this documentation site is site/Caddyfile. It does not start by itself.