This helped a lot on ours:
https://gitea.kosmos.org/kosmos/chef/pulls/626/files
I think the only real solution is PoW for unknown clients, which I'm setting up next via https://anubis.techaro.lol/ — but our Gitea has been usable for a couple months now, after the simple quick fix above.
