Module probe_rate_limit 

Three-layer token-bucket rate limiter for cdn/probe/v1 inbound traffic (ADR 005 §Probe rate limiting).

A thin probe-flavoured wrapper over the shared crate::rate_limit::ThreeLayerRateLimiter engine: it pins the probe-specific operator-visible metric names (via a private metrics sink) and re-exports the config/reject types under probe names. The layering and cheapest-first ordering (global → per-IP → per-peer) live in the shared engine — see its module docs.

Relationship to crate::dispatch::ConnectionLimiter

The probe handler runs both limiters: it still acquires a ConnectionLimiter permit (the global concurrency semaphore + the shared per-source IP bucket that gates every ALPN) and then calls ProbeRateLimiter::check for the ADR 005 three-layer token buckets. The per-source IP layer and this limiter’s per-IP layer therefore both charge a token per probe — a benign overlap: the ADR 005 probe per-IP default (50/s) is stricter than the security.per_source_* default (100/s), so the probe layer dominates, and the per-peer (NodeId) layer ADR 005 mandates exists only here. cdn/probe/v1 is one connection / one stream / one probe, so a single check per accepted connection is the whole budget.

Structs

ProbeRateLimiter

Three-layer rate limiter for inbound cdn/probe/v1 requests. Newtype over the shared ThreeLayerRateLimiter that injects the probe metrics sink.

Type Aliases

ProbeRateLimitConfig

Resolved probe rate-limit configuration. See ADR 005 §Probe rate limiting. The ADR 005 defaults (per-peer 5/5, per-IP 50/200, global 1000/2000) are supplied by the config resolver, not by Default (which returns the DHT values shared across the engine).

ProbeRejectLayer

Layer that triggered a cdn/probe/v1 rejection. Alias of the shared RejectLayer; the per_peer/per_ip/global label strings are stable.