Configuration at the webserver level will be highly dependent on the software used (nginx, apache, caddy etc)
You also need to address questions like how to separate users, how many requests is too much, what to do if they reach that limit, etc.
What I have for caddy is this, with the ratelimit module installed and differentiating on their flarum_session cookie for all requests to /login. It limits to 2 requests a second and generates a 429 Too many requests error otherwise.
domain.tld {
header /assets {
+Cache-Control max-age=25000
+Cache-Control public, must-revalidate, proxy-revalidate Pragma public
}
reverse_proxy internalip
route /login {
rate_limit {cookie.flarum_session} 2r/s
}
}
