A Django-based web forum I maintain is seeing application level DDOS attacks daily. Essentially, it's an HTTP GET flood hitting the home page, causing the server to execute a large number of internal requests and load various files to create the page. The flood peaks at ~4000 requests per minute (typical throughput being around 500 rpm), bringing down my server in the process.
My webserver is nginx serving as reverse proxy for a gunicorn application server. I know about DDoS mitigation via nginx; this question focuses on gunicorn.
Gunicorn has DDoS related security parameters such as: limit_request_line, limit_request_fields, limit_request_field_size. How do I use them to mitigate an HTTP GET flood? Illustrative examples would be great.
