Documentation
¶
Overview ¶
Package ratelimit implements an in-memory per-IP, per-route-group token-bucket limiter that the API and Web UI mount as middleware.
Per the issue scope, the limiter is single-node by design — operators running multiple replicas should rate-limit at the load balancer instead. The map is bounded by an LRU per shard so a flood cannot blow up the server's memory.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func MaskIP ¶
MaskIP collapses an IP to its rate-limit-friendly prefix so audit entries don't explode under a sustained attack. /24 for IPv4, /64 for IPv6.
func WriteRetryAfter ¶
func WriteRetryAfter(w http.ResponseWriter, retryAfter time.Duration)
WriteRetryAfter writes the standard 429 response (Retry-After header and a tiny body) so callers don't repeat the boilerplate.
Types ¶
type Config ¶
type Config struct {
Enabled bool
TrustProxyHeader bool
Groups map[string]GroupConfig
// MaxEntriesPerShard caps the per-shard LRU. Default 65536.
MaxEntriesPerShard int
// Shards is the number of shards. Power-of-two recommended. Default 4.
Shards int
}
Config drives the limiter.
type GroupConfig ¶
GroupConfig is the per-route-group rate/burst pair.
type Limiter ¶
type Limiter struct {
// contains filtered or unexported fields
}
Limiter is the public API the middleware calls.
func New ¶
New builds a Limiter. Returns nil when cfg.Enabled is false so the middleware can short-circuit.
func (*Limiter) Allow ¶
Allow reports whether a request from ip in route-group should be served. Returns the bucket's reservation delay so callers can set Retry-After. delay == 0 means the request was admitted.
func (*Limiter) ClientIP ¶
ClientIP returns the effective IP for the request. When the limiter is configured to trust X-Forwarded-For, the rightmost address wins: that entry was appended by the reverse proxy in front of this server, while everything to its left arrived in the client's own header and is attacker-controlled. Entries left of the rightmost are never consulted — falling back leftward on a parse failure would let a client choose its own rate-limit key with "spoofed, garbage". If the rightmost entry does not parse, or trust_proxy_header is off, RemoteAddr is used.
Source Files