iroh_http_core/http/server/
options.rs

1//! `ServeOptions` and the default tunables consumed by
2//! [`crate::http::server::serve_with_events`].
3//!
4//! Split out of `mod.rs` per Slice C.7 of #182 so the accept loop in
5//! `mod.rs` stays close to the axum reference shape (≤ 200 LoC).
6
7/// Options for the HTTP serve loop.
8///
9/// Passed directly to [`crate::http::server::serve`] or
10/// [`crate::http::server::serve_with_events`]. These govern
11/// per-request middleware (Tower layers), inbound connection caps, and
12/// serve-loop lifecycle — they do **not** affect outgoing fetch calls.
13#[derive(Debug, Clone, Default)]
14pub struct ServeOptions {
15    /// Maximum simultaneous in-flight requests.  Default: 1024.
16    pub max_concurrency: Option<usize>,
17    /// Per-request timeout in milliseconds.  Default: 60 000.
18    pub request_timeout_ms: Option<u64>,
19    /// Maximum connections from a single peer.  Default: 8.
20    pub max_connections_per_peer: Option<usize>,
21    /// Reject request bodies larger than this many **wire** bytes (compressed).
22    /// Default: 16 MiB.
23    pub max_request_body_wire_bytes: Option<usize>,
24    /// Reject request bodies larger than this many **decoded** bytes (after
25    /// decompression). This is the primary compression-bomb guard.
26    /// Default: 16 MiB.
27    pub max_request_body_decoded_bytes: Option<usize>,
28    /// Graceful shutdown drain window in milliseconds.  Default: 30 000.
29    pub drain_timeout_ms: Option<u64>,
30    /// Maximum total QUIC connections the server will accept.  Default: unlimited.
31    pub max_total_connections: Option<usize>,
32    /// When `true` (the default), reject new requests immediately with `503
33    /// Service Unavailable` when `max_concurrency` is already reached rather
34    /// than queuing them.  Prevents thundering-herd on recovery.
35    pub load_shed: Option<bool>,
36    /// When `true` (the default), automatically decompress compressed request
37    /// bodies before handing them to the handler.  Set to `false` to receive
38    /// the raw wire bytes (e.g. for relay/proxy use-cases that forward the
39    /// body downstream without inspecting it).
40    pub decompression: Option<bool>,
41}
42
43pub(crate) const DEFAULT_CONCURRENCY: usize = 1024;
44pub(crate) const DEFAULT_REQUEST_TIMEOUT_MS: u64 = 60_000;
45pub(crate) const DEFAULT_MAX_CONNECTIONS_PER_PEER: usize = 8;
46pub(crate) const DEFAULT_DRAIN_TIMEOUT_MS: u64 = 30_000;
47/// 16 MiB — applied when `max_request_body_wire_bytes` or
48/// `max_request_body_decoded_bytes` is not explicitly set.
49/// Prevents memory exhaustion from unbounded request bodies.
50pub(crate) const DEFAULT_MAX_REQUEST_BODY_BYTES: usize = 16 * 1024 * 1024;
51/// 256 MiB — applied when `max_response_body_bytes` is not explicitly set.
52/// Prevents memory exhaustion from a malicious server sending a compressed
53/// response that expands to an unbounded size (compression bomb).
54pub(crate) const DEFAULT_MAX_RESPONSE_BODY_BYTES: usize = 256 * 1024 * 1024;
iroh_http_core/http/server/options.rs

iroh_http_core/http/server/
options.rs
