chore: add mention about plugin rate limit to changeset

Signed-off-by: Hellgren Heikki <heikki.hellgren@op.fi>

.changeset/famous-terms-rescue.md

@@ -13,3 +13,15 @@ backend:
     window: 6s
     incomingRequestLimit: 100
 ```
+
+Plugin specific rate limiting can be configured by adding the following configuration to `app-config.yaml`:
+
+```yaml
+backend:
+  rateLimit:
+    global: false # This will disable the global rate limiting
+    plugin:
+      catalog:
+        window: 6s
+        incomingRequestLimit: 100
+```

.changeset/sour-comics-attend.md

@@ -1,5 +0,0 @@
----
-'@backstage/backend-defaults': patch
----
-
-Add configuration variable for `express` trust proxy setting

docs/backend-system/core-services/http-router.md

@@ -68,6 +68,50 @@ For those routes you will also have to specify `allowLimitedAccess: true` when
 using the [`auth`](./auth.md) and [`httpAuth`](./http-auth.md) services to
 access the incoming credentials.
 
+## Rate limiting
+
+Rate limiting allows you to limit the amount of requests users can send to you backend.
+This is useful for blocking various network attacks, such as DDOS, if your instance does not
+have additional firewall configured to handle this.
+
+To configure the default rate limiting, add the following to your config:
+
+```yaml
+backend:
+  rateLimit: true
+```
+
+You can additionally configure the rate limiting parameters also by plugin:
+
+```yaml
+backend:
+  rateLimit:
+    global: true # Enables or disables rate limit for all plugins
+    window: 6s # Time window for rate limiting for single client
+    incomingRequestLimit: 100 # Number of requests to accept from one client during time window
+    ipAllowList: ['127.0.0.1'] # IPs to bypass rate limiting
+    skipSuccesfulRequests: false # Rate limit successful requests
+    skipFailedRequests: false # Rate limit failed requests
+    plugin:
+      # Plugin specific rate limiting
+      catalog:
+        window: 3s
+        incomingRequestLimit: 50
+```
+
+By default, the rate limiting is per instance and the request counts are stored into memory.
+If you want to share this information across all your backstage instances, you have to configure
+the rate limiting store:
+
+```yaml
+backend:
+  rateLimit:
+    global: true
+    store:
+      type: redis
+      connection: redis://127.0.0.1:16379
+```
+
 ## Configuring the service
 
 For more advanced customization, there are several APIs from the `@backstage/backend-defaults/httpRouter` package that allow you to customize the implementation of the config service. The default implementation uses all of the middleware exported from `@backstage/backend-defaults/httpRouter`, including `createLifecycleMiddleware`, `createAuthIntegrationRouter`, `createCredentialsBarrier` and `createCookieAuthRefreshMiddleware`. You can use these to create your own `httpRouter` service implementation, for example - here's how you would add a custom health check route to all plugins:

packages/backend-defaults/src/entrypoints/httpRouter/http/createRateLimitMiddleware.ts

@@ -23,7 +23,7 @@ export const createRateLimitMiddleware = (options: {
   config: Config;
 }) => {
   const { pluginId, config } = options;
-  const configKey = `backend.rateLimit.${pluginId}`;
+  const configKey = `backend.rateLimit.plugin.${pluginId}`;
   const enabled = config.has(configKey);
   if (!enabled) {
     return (_req: Request, _res: Response, next: NextFunction) => {