How to Configure Windows Sandbox Local Traefik TLS Dynamic Middlewares RateLimit Takahe via XML in Windows 11

Evaluating multi-domain Fediverse servers like Takahe requires benchmarking how asynchronous ActivityPub deliveries, identity staging, and Starlark plugins perform under traffic spikes. Windows Sandbox in Windows 11 offers a pristine, hardware-isolated execution sandbox ideal for deploying Traefik v3 reverse proxies without altering host system networking. By utilizing a Windows Sandbox configuration file (.wsb) with host directory mappings and automated logon scripts, administrators can launch an ephemeral testing node equipped with TLS termination and IP-based rate limiting. This tutorial explains how to author the WSB XML configuration and set up dynamic Traefik middlewares for Takahe federation testing.

Windows Sandbox Architecture and WSB Declarations

Windows Sandbox boots an isolated Hyper-V container based on the host OS image. The .wsb XML file configures sandbox capabilities upon launch:

• <MappedFolders>: Mirrors a host directory holding Traefik executables, TLS certificates, and YAML configuration files directly into the sandbox.
• <Networking>: Sets up virtual NAT networking so the sandbox can forward traffic to host loopback interfaces or local virtual machines.
• <LogonCommand>: Automatically executes an initialisation script in PowerShell when the sandbox desktop loads.

Creating the Windows Sandbox WSB Configuration

Create a directory on your host workstation at C:\\Sandbox\\TakaheGateway and save the following file as TakaheSandbox.wsb:

<Configuration>
  <VGpu>Default</VGpu>
  <Networking>Default</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\\Sandbox\\TakaheGateway</HostFolder>
      <SandboxFolder>C:\\TakaheGateway</SandboxFolder>
      <ReadOnly>false</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -File C:\\TakaheGateway\\bootstrap.ps1</Command>
  </LogonCommand>
</Configuration>

Defining Traefik Static and Dynamic Middlewares

Within C:\\Sandbox\\TakaheGateway\\config\\dynamic_conf.yml, configure dynamic middleware rules that restrict inbound federation request rates:

# Dynamic middleware rules for Takahe federation testing
http:
  routers:
    takahe-inbound:
      rule: "Host(\`takahe.local\`)"
      entryPoints:
        - "websecure"
      service: "takahe-backend"
      middlewares:
        - "takahe-ratelimit"
        - "secure-headers"
      tls: {}

  middlewares:
    takahe-ratelimit:
      rateLimit:
        average: 35
        burst: 70
        period: "1m"
        sourceCriterion:
          ipStrategy:
            depth: 1

    secure-headers:
      headers:
        sslRedirect: true
        stsSeconds: 31536000
        browserXssFilter: true
        contentTypeNosniff: true

  services:
    takahe-backend:
      loadBalancer:
        servers:
          - url: "http://10.0.2.2:8000"

Automating Sandbox Boot with PowerShell Bootstrap

Save the following script as C:\\Sandbox\\TakaheGateway\\bootstrap.ps1 to launch Traefik and open necessary firewall ports within the disposable sandbox environment:

# Bootstrap script inside Windows Sandbox
$gatewayDir = "C:\\TakaheGateway"
Set-Location $gatewayDir

# Configure Windows Defender Firewall rule
New-NetFirewallRule -DisplayName "Traefik Takahe Inbound" -Direction Inbound -LocalPort 80,443,8080 -Protocol TCP -Action Allow

# Launch Traefik with static configuration
Start-Process -FilePath "$gatewayDir\\traefik.exe" -ArgumentList "--configFile=$gatewayDir\\config\\traefik.yml" -WindowStyle Normal

Benchmarking Inbound Rate Limiting

Double-click TakaheSandbox.wsb to boot the sandbox. When the desktop appears, open PowerShell and send high-frequency synthetic ActivityPub federation requests using curl.exe:

# Benchmark rate-limiting response codes
for ($i = 1; $i -le 85; $i++) {
    $response = curl.exe -k -s -o /dev/null -w "%{http_code}" https://takahe.local/inbox
    Write-Host "Request $i: HTTP Status $response"
}

The first 70 requests return status 200 or 401, while requests 71 through 85 immediately trigger HTTP 429 Too Many Requests, demonstrating that the Traefik rate-limiting middleware successfully protects the backend service.

Troubleshooting Windows Sandbox Traefik Environments

Issue	Potential Cause	Corrective Action
Sandbox fails to launch	Host folder path does not exist	Confirm C:\\Sandbox\\TakaheGateway exists before opening WSB
HTTP 502 Bad Gateway	Host backend service unreachable	Verify Takahe is listening on host interface and accessible via 10.0.2.2
Rate limiting inactive	Missing middleware router attachment	Ensure takahe-ratelimit is declared under router middlewares

By using this Windows Sandbox configuration, development teams can safely stress-test federated API rate limits without altering system-level host configurations.