i think its finished

app/__init__.py

@@ -1,6 +1,6 @@
 from flask import Flask
 from app.config import Config
-from app.extensions import db, mail
+from app.extensions import db, mail, limiter
 
 def create_app(config_class=Config):
     app = Flask(__name__)
@@ -9,6 +9,7 @@ def create_app(config_class=Config):
     # Initialize extensions
     db.init_app(app)
     mail.init_app(app)
+    limiter.init_app(app)
 
     # Register Blueprints
     from app.routes import bp as main_bp

app/config.py

@@ -15,5 +15,5 @@ class Config:
     MAIL_DEFAULT_SENDER = os.environ.get('EMAIL_USER')
 
     MAX_SPOTS = 84
-    TUM_DOMAIN = "tum.de"
+    TUM_DOMAINS = ["@tum.de", "@mytum.de"]
     DISCORD_LINK = os.environ.get('DISCORD_LINK')

app/extensions.py

@@ -1,5 +1,13 @@
 from flask_sqlalchemy import SQLAlchemy
 from flask_mail import Mail
+from flask_limiter import Limiter
+from flask_limiter.util import get_remote_address
 
 db = SQLAlchemy()
 mail = Mail()
+limiter = Limiter(
+    get_remote_address,
+    storage_uri="redis://cache:6379",
+    storage_options={"socket_connect_timeout": 30},
+    strategy="fixed-window",
+)

app/requirements.txt

@@ -8,15 +8,20 @@ click==8.3.1
     # via flask
 colorama==0.4.6 ; sys_platform == 'win32'
     # via click
+deprecated==1.3.1
+    # via limits
 dnspython==2.8.0
     # via email-validator
 email-validator==2.3.0
     # via register-website
 flask==3.1.2
     # via
+    #   flask-limiter
     #   flask-mail
     #   flask-sqlalchemy
     #   register-website
+flask-limiter==4.1.1
+    # via register-website
 flask-mail==0.10.0
     # via register-website
 flask-sqlalchemy==3.1.1
@@ -31,18 +36,31 @@ itsdangerous==2.2.0
     # via flask
 jinja2==3.1.6
     # via flask
+limits==5.6.0
+    # via flask-limiter
 markupsafe==3.0.3
     # via
     #   flask
     #   jinja2
     #   werkzeug
+ordered-set==4.1.0
+    # via flask-limiter
 packaging==25.0
-    # via gunicorn
+    # via
+    #   gunicorn
+    #   limits
 psycopg2-binary==2.9.11
     # via register-website
+redis==7.1.0
+    # via register-website
 sqlalchemy==2.0.45
     # via flask-sqlalchemy
 typing-extensions==4.15.0
-    # via sqlalchemy
+    # via
+    #   flask-limiter
+    #   limits
+    #   sqlalchemy
 werkzeug==3.1.4
     # via flask
+wrapt==2.0.1
+    # via deprecated

app/routes.py

@@ -1,7 +1,7 @@
 from flask import Blueprint, render_template, request, flash, redirect, url_for, current_app
 from flask_mail import Message
 from itsdangerous import URLSafeTimedSerializer, SignatureExpired, BadSignature
-from app.extensions import db, mail
+from app.extensions import db, mail, limiter
 from app.models import Participant
 
 bp = Blueprint('main', __name__)
@@ -37,6 +37,7 @@ def send_waitlist_email(user):
     mail.send(msg)
 
 @bp.route('/', methods=['GET', 'POST'])
+@limiter.limit("5 per hour", methods=["POST"])
 def index():
     confirmed_count = get_confirmed_count()
     max_spots = current_app.config['MAX_SPOTS']
@@ -47,11 +48,11 @@ def index():
         email = request.form['email'].lower().strip()
         looking_for_team = True if request.form.get('looking_for_team') else False
         
-        tum_domain = current_app.config['TUM_DOMAIN']
-        if not email.endswith(f"@{tum_domain}"):
-            flash(f"Error: You must use a @{tum_domain} email address.", "error")
+        tum_domains = current_app.config['TUM_DOMAINS']
+        if not email.endswith(tum_domains):
+            domains_str = ", ".join(tum_domains)
+            flash(f"Error: You must use one of these email addresses: {domains_str}", "error")
             return redirect(url_for('main.index'))
-
         existing_user = Participant.query.filter_by(email=email).first()
 
         if existing_user:
@@ -81,7 +82,9 @@ def index():
 
     return render_template('index.html', spots_left=spots_left, max_spots=max_spots)
 
+
 @bp.route('/verify/<token>')
+@limiter.limit("50 per hour")
 def verify_email(token):
     s = URLSafeTimedSerializer(current_app.config['SECRET_KEY'])
     try:
@@ -108,13 +111,16 @@ def verify_email(token):
     return render_template('success.html', message=msg, discord_link=discord_link, discord_token=discord_token)
 
 @bp.route('/dsgvo')
+@limiter.exempt
 def dsgvo():
     return render_template('dsgvo.html')
 
 @bp.route('/impressum')
+@limiter.exempt
 def impressum():
     return render_template('impressum.html')
 
 @bp.route('/rules')
+@limiter.exempt
 def rules():
     return render_template('rules.html')