@ahmad @alex @flappypaddle poast goes over and above to mitigate this with other measures that are a secret, yes however you can do the following:
/etc/nginx/conf.d/ratelimit.conf:
limit_req_zone $request_uri zone=register_rate:1m rate=10r/m;/etc/nginx/sites-enabled/pleroma.conf (or whatever you named it
server { [...] location = /api/v1/accounts { limit_req zone=register_rate; proxy_pass http://phoenix; } }this will limit hits to the endpoint used for registration to 3 maximum in a minute. lower rate=10r/m to rate=3r/m to restrict to one registration per minute, increase by three per registration you want (3 calls are made each registration attempt)