[Feature request] global request-rate threshold to enable challenges only under load

Is your feature request related to a problem? Please describe.

Currently Anubis evaluates every request independently — a client is challenged based on its own UA / IP / weight, regardless of how much traffic the site is receiving overall. For sites that mostly care about uptime rather than blocking every crawler, it would be useful to run Anubis in a "passive" mode by default and only start challenging when total request rate crosses a threshold (similar to Cloudflare's "I'm Under Attack" mode, but automatic).

Proposed behaviour

• Anubis keeps a sliding-window counter of incoming requests (e.g. last 60s), in-process by default, optionally backed by the existing Valkey store for multi-replica setups.
• The current rate is exposed to CEL as a variable (e.g. global.rps), so operators can write rules like:

  - name: under-attack
    expression: "global.rps > 500"
    action: WEIGH
    weight:
      adjust: 20

to push all non-ALLOW traffic into a CHALLENGE threshold. This keeps the mechanism configurable rather than hardcoded.

• ALLOW rules (search engines, etc.) are unaffected, so indexing is never impacted.

Related

• #102 — per-client rate-based challenge reissuance
• #1313 — distributed botnets where per-IP limits don't help
• #1225 — conditional (time-based) rule activation

Solution you would like.

1

Describe alternatives you have considered.

No response

Additional context

No response