That's rate limiting locally i.e single instance. It is a fairly trivial thing and isn't the topic here.

While that is true, at that point you should be rate limiting at the reverse proxy or load balancer.

- Nginx https://blog.nginx.org/blog/rate-limiting-nginx

- Caddy https://github.com/mholt/caddy-ratelimit

- Treafik https://doc.traefik.io/traefik/middlewares/http/ratelimit/