How to Configure Windows Sandbox Local Traefik TLS Dynamic Middlewares RateLimit Calckey via XML in Windows 11

Testing ActivityPub and Fediverse software like Calckey (now Firefish) requires evaluating how inbound federation relays and burst synchronisation requests behave under strict rate limits. Windows Sandbox in Windows 11 offers an isolated, disposable Hyper-V execution environment ideal for staging reverse proxies without polluting the host operating system. By combining Traefik v3, dynamic TLS middleware configurations, and a Windows Sandbox configuration file (.wsb), developers can orchestrate an automated sandbox environment that mounts local scripts and provisions Traefik with IP rate-limiting rules upon boot. This guide details how to construct the XML configuration and configure local Traefik dynamic middlewares for Calckey federation testing.

Windows Sandbox Architecture and WSB Directives

Windows Sandbox provides clean-room containerisation that resets completely upon closure. The .wsb configuration format enables host folder redirection, virtual networking selection, vGPU acceleration, and logon command automation:

• <MappedFolders>: Maps a host directory containing Traefik binaries, configuration files, and self-signed TLS certificates directly into the sandbox file system.
• <Networking>: Configures virtual NAT network connectivity so the sandbox can interact with local dev servers or external federated relays.
• <LogonCommand>: Automates PowerShell execution upon sandbox initialisation to start the Traefik daemon with dynamic configuration reloading.

Authoring the Windows Sandbox WSB Configuration

Create a directory on your host workstation at C:\Sandbox\CalckeyGateway and save the following file as CalckeySandbox.wsb:

<Configuration>
  <VGpu>Default</VGpu>
  <Networking>Default</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\Sandbox\CalckeyGateway</HostFolder>
      <SandboxFolder>C:\CalckeyGateway</SandboxFolder>
      <ReadOnly>false</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -File C:\CalckeyGateway\bootstrap.ps1</Command>
  </LogonCommand>
</Configuration>

Defining Traefik Static and Dynamic Middlewares

Within C:\Sandbox\CalckeyGateway\config\dynamic_conf.yml, author the dynamic middleware and routing rules that impose rate limits on Calckey’s inbound federation endpoints:

# Dynamic middleware rules for Calckey federation testing
http:
  routers:
    calckey-inbound:
      rule: "Host(`calckey.local`)"
      entryPoints:
        - "websecure"
      service: "calckey-backend"
      middlewares:
        - "federation-ratelimit"
        - "secure-headers"
      tls: {}

  middlewares:
    federation-ratelimit:
      rateLimit:
        average: 30
        burst: 60
        period: "1m"
        sourceCriterion:
          ipStrategy:
            depth: 1

    secure-headers:
      headers:
        sslRedirect: true
        stsSeconds: 31536000
        browserXssFilter: true
        contentTypeNosniff: true

  services:
    calckey-backend:
      loadBalancer:
        servers:
          - url: "http://10.0.2.2:3000"

Automating Startup with PowerShell Bootstrap

Author C:\Sandbox\CalckeyGateway\bootstrap.ps1 to launch Traefik and configure firewall exemptions automatically within the disposable sandbox environment:

# Bootstrap script inside Windows Sandbox
$gatewayDir = "C:\CalckeyGateway"
Set-Location $gatewayDir

# Add local Windows Defender Firewall rule
New-NetFirewallRule -DisplayName "Traefik Inbound" -Direction Inbound -LocalPort 80,443,8080 -Protocol TCP -Action Allow

# Launch Traefik with static configuration
Start-Process -FilePath "$gatewayDir\traefik.exe" -ArgumentList "--configFile=$gatewayDir\config\traefik.yml" -WindowStyle Normal

Testing and Validating Rate Limiting

Launch the sandbox by double-clicking CalckeySandbox.wsb. Once the desktop initialises, open PowerShell inside the sandbox and issue rapid synthetic federation requests using curl.exe:

# Test rate limiting thresholds
for ($i = 1; $i -le 70; $i++) {
    $response = curl.exe -k -s -o /dev/null -w "%{http_code}" https://calckey.local/inbox
    Write-Host "Request $i: HTTP Status $response"
}

The first 60 requests return status 200 or 401, while requests 61 through 70 immediately trigger HTTP 429 Too Many Requests, verifying that Traefik’s dynamic rate-limiting middleware operates as designed.

Troubleshooting Windows Sandbox Traefik Environments

Issue	Underlying Cause	Remediation
Sandbox fails to boot WSB file	Mapped host path does not exist	Ensure C:\Sandbox\CalckeyGateway directory exists prior to launch
HTTP 404 Not Found returned	Dynamic config file path error	Verify Traefik static configuration points to C:\CalckeyGateway\config
Rate limit applies globally	Missing sourceCriterion IP strategy	Ensure ipStrategy.depth is configured in dynamic_conf.yml

This automated sandbox workflow establishes a reproducible, clean-room staging architecture for benchmarking federated web applications on Windows 11.