Add rate limiting for security

- Add httprate dependency for rate limiting
- Apply 10 requests per minute limit on auth endpoints
- Prevent brute force attacks on login/register
- Update README with security features

README.md

@@ -8,8 +8,10 @@ Self-hosted habit tracking service with a clean, hexagonal architecture.
 - **Flexible scheduling**: Daily, Weekly, Monthly with specific days
 - **Carry-over support**: Choose if incomplete habits persist or expire
 - **Full history tracking**: Complete audit trail of all interactions
-- **Charts & Analytics**: Heatmaps, line charts, and statistics
+- **Statistics**: Track streaks, completion rates, and progress
 - **Self-hosted first**: Easy deployment with SQLite
+- **Security**: JWT authentication, rate limiting on auth endpoints
+- **API Documentation**: Interactive Swagger UI
 
 ## Quick Start
 

go.mod

@@ -7,6 +7,7 @@ toolchain go1.24.10
 require (
 	github.com/go-chi/chi/v5 v5.2.3
 	github.com/go-chi/cors v1.2.2
+	github.com/go-chi/httprate v0.7.4
 	github.com/golang-jwt/jwt/v5 v5.3.0
 	github.com/google/uuid v1.6.0
 	github.com/joho/godotenv v1.5.1

internal/infrastructure/http/router.go

@@ -2,12 +2,14 @@ package http
 
 import (
 	"net/http"
+	"time"
 
 	"apocapoc-api/internal/infrastructure/auth"
 
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
 	"github.com/go-chi/cors"
+	"github.com/go-chi/httprate"
 	httpSwagger "github.com/swaggo/http-swagger"
 
 	_ "apocapoc-api/docs"
@@ -38,6 +40,7 @@ func NewRouter(corsOrigins string, habitHandlers *HabitHandlers, authHandlers *A
 	})
 
 	r.Route("/api/v1/auth", func(r chi.Router) {
+		r.Use(httprate.LimitByIP(10, 1*time.Minute))
 		r.Post("/register", authHandlers.Register)
 		r.Post("/login", authHandlers.Login)
 	})