There was downtime over the past 24 hours. You might not have noticed if you use an app, since the API stayed up the whole time.
We were getting swamped by a botnet. Tens of thousands of different IP addresses, each making only a couple of requests, crawling deep into old posts. That makes normal rate limiting useless. Anubis was challenging them, but at the difficulty we had it set to, the bots were solving those challenges cheap enough that it didn't slow them down.
So Anubis now raises its difficulty automatically when the server is struggling. That still wasn't quite enough on its own, so there's one more layer now. If load spikes badly, the site temporarily goes private, meaning only logged-in users can read it. Bots get nothing to scrape, and it switches itself back off once things calm down. If you're logged out when that happens you'll get sent to the login page.
Fair warning that the private mode part hasn't faced a real attack yet. It works in testing, but the real test comes next time we get hit. Considering we've been attacked almost daily, we will probably see soon enough. Here's to hoping it holds.
Edit: Got attacked for a few hours again at ~18:30 UTC and it worked. Site went private on its own, stayed up, switched back when it calmed down. Federation unaffected. Hopefully this will hold any and all future attacks.
