nginx

I tore out my self-built GoAccess stack for 3proxy's built-in admin counters, then realized counters can't answer which URLs eat the bandwidth.

TL;DR: The author deleted a self-built GoAccess dashboard for 3proxy, replacing it with the built-in admin directive and secure-mode counters. That answered how much traffic, but not which URLs or hosts consumed it. GoAccess returned properly: stripped fractional timestamps, filtered ADMIN lines, and nginx proxying WebSocket with explicit upgrade headers and longer read timeouts.

An hourly wave of 504s looked like an attack. The logs pointed at a dormant rate limit and a PHP-FPM pool out of workers.

TL;DR: Hourly 504 waves looked like a DDoS but were actually PHP-FPM worker exhaustion, worsened by request_terminate_timeout killing slow requests. Nginx rate limiting never fired because Cloudflare hid real client IPs, collapsing everyone into one $binary_remote_addr bucket. Fixes: enable Cloudflare caching, tune PHP-FPM pool settings, and rotate container logs with copytruncate.