My server is getting federation inbound messages. I have just myself as local user. But federation protocols have a lot of outbound HTTP fetches:

Jul 01 19:04:05 instance-20230117-wakereality0 lemmy_server[2358887]: 2023-07-01T19:04:05.496130Z  INFO HTTP request{http.method=POST http.scheme="http" http.host=bulletintree.com http.target=/inbox otel.kind="server" request_id=34622a86-e6ef-4a62-8514-f191a5289465}: activitypub_federation::fetch: Fetching remote object https://kbin.social/u/beesyrup
Jul 01 19:04:05 instance-20230117-wakereality0 lemmy_server[2358887]: 2023-07-01T19:04:05.949767Z  INFO HTTP request{http.method=POST http.scheme="http" http.host=bulletintree.com http.target=/inbox otel.kind="server" request_id=ff4a97a8-a93b-4b37-84d9-e5ab01c3ee67}:receive:verify: activitypub_federation::fetch: Fetching remote object https://lemmy.world/comment/697555
Jul 01 19:04:06 instance-20230117-wakereality0 lemmy_server[2358887]: 2023-07-01T19:04:06.029375Z  INFO HTTP request{http.method=POST http.scheme="http" http.host=bulletintree.com http.target=/inbox otel.kind="server" request_id=34622a86-e6ef-4a62-8514-f191a5289465}:from_json:from_json: activitypub_federation::fetch: Fetching remote object https://kbin.social/
Jul 01 19:04:06 instance-20230117-wakereality0 lemmy_server[2358887]: 2023-07-01T19:04:06.368602Z  INFO HTTP request{http.method=POST http.scheme="http" http.host=bulletintree.com http.target=/inbox otel.kind="server" request_id=34622a86-e6ef-4a62-8514-f191a5289465}:receive: activitypub_federation::fetch: Fetching remote object https://kbin.social/m/RedditMigration/t/122349
Jul 01 19:04:06 instance-20230117-wakereality0 lemmy_server[2358887]: 2023-07-01T19:04:06.699349Z  INFO HTTP request{http.method=POST http.scheme="http" http.host=bulletintree.com http.target=/inbox otel.kind="server" request_id=162a4d97-2951-4000-85c0-35d252c22faa}:receive:verify:verify_person_in_community: activitypub_federation::fetch: Fetching remote object https://lemmy.world/u/asuratva
Jul 01 19:04:08 instance-20230117-wakereality0 lemmy_server[2358887]: 2023-07-01T19:04:08.074109Z  INFO HTTP request{http.method=POST http.scheme="http" http.host=bulletintree.com http.target=/inbox otel.kind="server" request_id=eed763b3-83af-4d5a-8190-8563a3ebf9ed}:receive:verify:verify_person_in_community: activitypub_federation::fetch: Fetching remote object https://infosec.pub/u/techviator
Jul 01 19:04:11 instance-20230117-wakereality0 lemmy_server[2358887]: 2023-07-01T19:04:11.738901Z  INFO HTTP request{http.method=POST http.scheme="http" http.host=bulletintree.com http.target=/inbox otel.kind="server" request_id=e19f40f4-4840-457d-a8cb-3d5a37fa355c}:receive:verify:verify_person_in_community: activitypub_federation::fetch: Fetching remote object https://feddit.de/u/Quetzacoatl
Jul 01 19:04:13 instance-20230117-wakereality0 lemmy_server[2358887]: 2023-07-01T19:04:13.662622Z  INFO HTTP request{http.method=POST http.scheme="http" http.host=bulletintree.com http.target=/inbox otel.kind="server" request_id=0b674845-0c58-40e8-9da8-f0b7b90a442f}:receive: activitypub_federation::fetch: Fetching remote object https://kbin.social/m/RedditMigration/t/122349
Jul 01 19:04:14 instance-20230117-wakereality0 lemmy_server[2358887]: 2023-07-01T19:04:14.068155Z  INFO HTTP request{http.method=POST http.scheme="http" http.host=bulletintree.com http.target=/inbox otel.kind="server" request_id=b7336fc3-eebb-423d-aa8e-6636c429af84}:receive:verify: activitypub_federation::fetch: Fetching remote object https://lemmy.world/comment/694930
Jul 01 19:04:15 instance-20230117-wakereality0 lemmy_server[2358887]: 2023-07-01T19:04:15.996734Z  INFO HTTP request{http.method=POST http.scheme="http" http.host=bulletintree.com http.target=/inbox otel.kind="server" request_id=3506dcc3-f9ef-4620-ab12-1261668bcfb2}:receive:verify: activitypub_federation::fetch: Fetching remote object https://lemmy.world/comment/694973

ok, so inserting something into the Rust code at the API front door

The rate-limit logic is something to trace in the code and understand, as I assume that blocks before getting into SQL?

  /// Returns true if the request passed the rate limit, false if it failed and should be rejected.
  pub fn check(self, ip_addr: IpAddr) -> bool {
    // Does not need to be blocking because the RwLock in settings never held across await points,
    // and the operation here locks only long enough to clone
    let mut guard = self
      .rate_limit
      .lock()
      .expect("Failed to lock rate limit mutex for reading");
    let rate_limit = &guard.rate_limit_config;

    let (kind, interval) = match self.type_ {
      RateLimitType::Message => (rate_limit.message, rate_limit.message_per_second),
      RateLimitType::Post => (rate_limit.post, rate_limit.post_per_second),
      RateLimitType::Register => (rate_limit.register, rate_limit.register_per_second),
      RateLimitType::Image => (rate_limit.image, rate_limit.image_per_second),
      RateLimitType::Comment => (rate_limit.comment, rate_limit.comment_per_second),
      RateLimitType::Search => (rate_limit.search, rate_limit.search_per_second),
    };
    let limiter = &mut guard.rate_limiter;

    limiter.check_rate_limit_full(self.type_, ip_addr, kind, interval, InstantSecs::now())
  }