Important to note that it only helps against DDoS that originates within layer7 e.g. recursively downloading specific page URLs, especially many dynamic ones that are easy to slow down the entire webserver with, such as with git platforms.

Someone (or their botnet) sending a "real" DDoS of a few terabits/sec of layer3 traffic your way cannot be stopped by software running at a higher layer at all. Your only recourse there is playing a cat-and-mouse game of who can change IP addresses fast enough.