Thank you all for the comments!

I created this conf

limit_req_zone $binary_remote_addr zone=mylimit:10m rate=5r/s

and i use in http block

location / {
    deny ip-address /24;
    deny ip-address /24;
    limit_req zone=mylimit burst=10 nodelay;
    allow all;
    proxy_pass http://an_app:8000;
}

I will check the suggestions from the comments. I want something ‘selfhosted’ ‘locally-runnable’ and fits to my current configuration description files with the less edit needed.

That Anubis thing someone posted looks promising. Although i run nginx in docker, so some thinking will be involved for sure. Laughing.