Struct ConnectionLimits 

#[non_exhaustive]
pub struct ConnectionLimits {
    pub header_read_timeout: Option<Duration>,
    pub max_connection_duration: Option<Duration>,
    pub max_connections: usize,
    pub max_concurrent_streams: Option<u32>,
    pub max_connections_per_ip: Option<usize>,
}

Connection-level limits enforced by serve_with_limits, independent of (and in addition to) the request-level tower layers applied by this crate’s router constructors.

Constructed via ConnectionLimits::default and overridden per field; #[non_exhaustive] so new limits can be added without a breaking change.

Examples

use std::time::Duration;
use pjson_rs::infrastructure::http::ConnectionLimits;

// Long-lived WebSocket listeners disable the connection-duration ceiling
// (see that field's docs) while keeping the other defaults.
let mut limits = ConnectionLimits::default();
limits.max_connection_duration = None;
assert_eq!(limits.header_read_timeout, Some(Duration::from_secs(10)));

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

header_read_timeout: Option<Duration>

Deadline for a client to finish sending request headers after the connection is accepted, None to disable.

Defaults to 10s. Hyper’s own default is 30s and nginx uses 60s; this crate picks 10s to cut the cost of a slowloris-style header-trickle attack roughly 6x relative to hyper’s default while remaining far above the time any real client needs to send headers.

Also gates serve_with_limits’s preface-read wait (see that function’s implementation) — setting this to None together with max_connection_duration: None lets a connection that never sends a byte hold its max_connections slot (and, if assigned one, its max_connections_per_ip slot) indefinitely; at least one of the two should normally stay Some.

max_connection_duration: Option<Duration>

Hard ceiling on a single connection’s total lifetime, None to disable.

Defaults to 300s (5 minutes). Response payload size is bounded by MAX_FRAMES_PER_REQUEST (see domain::config::limits) together with the 10MB DefaultBodyLimit applied in apply_common_layers, which implies a real client only ever needs to sustain roughly 33 KB/s to finish reading within this window — far under any real client’s throughput and far over what a stalling client can fake.

WebSocket caveat: this is a hard deadline on the whole connection, including any upgraded protocol — it will terminate a legitimate long-lived WebSocket session just as readily as a stalling one. A listener that serves WebSocket upgrade routes should set this to None and rely on WS-level idle/ping timeouts instead; crates/pjs-demo/src/servers/websocket_streaming.rs does exactly that. In particular, if serving a router that mounts this crate’s own /pjs/ws/{session_id} upgrade route (see infrastructure::websocket), set this to None — the default 300s ceiling will otherwise kill every WebSocket session it outlives.

max_connections: usize

Maximum number of concurrently open connections.

Defaults to 1024: conservative, overridable, and comfortably under the file-descriptor soft limit on typical deployment targets. This bounds accept-loop backpressure (how many connections are being served at once), not per-request concurrency, which is a separate concern already covered by MAX_CONCURRENT_REQUESTS in apply_common_layers.

max_concurrent_streams: Option<u32>

Hard cap on concurrently open HTTP/2 streams per connection, None to leave hyper’s own default in place.

Defaults to Some(128). Hyper’s own default is Some(200) and is documented as explicitly unstable (“not part of the stability of hyper… encouraged to set your own limit”) — 128 sits strictly below that default while remaining far above what any legitimate browser or client needs. Combined with max_connections, this bounds the worst case at max_connections * max_concurrent_streams in-flight streams before MAX_CONCURRENT_REQUESTS (see apply_common_layers) parks the rest.

max_connections_per_ip: Option<usize>

Hard cap on concurrently open connections from a single accept-level source IP, None to disable.

Defaults to Some(64) — 1/16th of the default max_connections pool, so at least 16 distinct source IPs are needed to fully exhaust it. All three pjs-demo servers bind 127.0.0.1, so every local connection (including load/CI test loops) shares this one budget; 64 concurrent connections from a single source is still far above realistic demo or local-test load, so this is not special-cased.

Enforced by a private WebSocketRateLimiter instance owned by serve_with_limits, independent of (and never sharing state with) any RateLimitMiddleware the router itself may apply. None disables the cap entirely — no limiter instance is constructed, no cleanup task is spawned, and no per-connection map entry is made, so a reverse-proxy deployment that sets this to None (see below) pays no cost for it.

Reverse-proxy caveat: like max_connection_duration, this is enforced at the accept level, before any HTTP request is parsed — no headers exist yet, so X-Forwarded-For/trusted-proxy configuration cannot apply here. Every connection arriving through a connection-pooling reverse proxy (nginx, a load balancer, etc.) shares that proxy’s single source IP, so this cap would apply to all of them combined rather than to each real client individually. A deployment behind such a proxy must set this to None and rely on the proxy’s own per-client limiting instead.

Trait Implementations

impl Clone for ConnectionLimits

fn clone(&self) -> ConnectionLimits

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ConnectionLimits

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ConnectionLimits

fn default() -> Self

Returns the “default value” for a type.