Rate limiting and tarpitting

[Avleen Vig]

Hi everyone :)

I've been looking to implement the limit_req_zone stuff but it doesn't
do *quite* what I want.

Ideally what I want to do is check to see if someone is making a large
number of requests in a short time, and only start to limit them if
they cross a threshold.

Eg, if someone is making 100 req/min, they're ok, but if they go over
200 req/min, I want them to start getting slower responses so that our
normal backends don't get overwhelmed.
I thought about trying to find a way to change the proxy_pass target,
but I can't find a way to just check the current query rate based an
arbitrary key (like a cookie value).

Any thoughts?