v0.26.1 per-client connection caps

internal/config/config.go

@@ -375,13 +375,15 @@ type AuthOptions struct {
 
 // ACLOptions is a listener's address rules, entries being addresses or CIDRs:
 // deny wins, then a set allow list admits only its entries. proxy_from lists
-// the L4 proxies whose PROXY header names the client the rules then see.
-// Validation is in internal/netacl.
+// the L4 proxies whose PROXY header names the client the rules then see; the
+// per-client limits count that client. Validation is in internal/netacl.
 type ACLOptions struct {
-	Allow         []string `toml:"allow"`
-	Deny          []string `toml:"deny"`
-	ProxyProtocol string   `toml:"proxy_protocol"` // off, optional or required
-	ProxyFrom     []string `toml:"proxy_from"`
+	Allow                      []string `toml:"allow"`
+	Deny                       []string `toml:"deny"`
+	ProxyProtocol              string   `toml:"proxy_protocol"` // off, optional or required
+	ProxyFrom                  []string `toml:"proxy_from"`
+	MaxConnectionsPerClient    int64    `toml:"max_connections_per_client"`     // 0 = unlimited
+	RequestsPerSecondPerClient float64  `toml:"requests_per_second_per_client"` // HTTP listeners; 0 = unlimited
 }
 
 // --- TLS Options ---

internal/config/preset.go

@@ -41,7 +41,7 @@ var (
 		{Name: "hosts", List: true, Help: "names and addresses, beyond this host's, of a self or issuer certificate; ',' between them"},
 	}
 	aclParams = []PresetParam{
-		{Name: "allow", List: true, Help: "addresses or CIDRs that may connect, of listen's family; default: all; ',' between them"},
+		{Name: "allow", List: true, Help: "addresses or CIDRs that may connect, of listen's family (either behind proxy=); default: all; ',' between them"},
 		{Name: "deny", List: true, Help: "addresses or CIDRs refused, allow or not; ',' between them"},
 	}
 	transportParam = PresetParam{Name: "transport", Default: "tcp", Help: "tcp|http: tcp_chain or http_chain"}