Module http_limits 

Resolution of the HTTP admission and execution knobs.

The values are configurable through the standard precedence chain used elsewhere in the boot path:

flag > red_config > env > built-in default

Built-in defaults preserve the existing request envelope and add a CPU-sized synchronous execution bound:

• max_handlers = (2 * num_cpus).clamp(8, 256)
• execution_workers = num_cpus, clamped to max_handlers
• handler_timeout = 30_000 ms
• retry_after_secs = 5
• max_inflight_per_principal = 64 (issue #934; 0 disables)

Each knob is validated at parse time and at resolution time so a stale red_config value cannot corrupt the running server.

Structs

HttpLimitsCliInput

CLI-layer input. Each pair holds the already-validated value coming from a flag and from an env var, respectively. The resolver applies the flag > red_config > env > default precedence using these inputs plus a config-store lookup.

HttpLimitsResolved

Resolved values after applying the full precedence chain. Stamped into both the RedDBServer and the startup log line.

Constants

DEFAULT_HANDLER_TIMEOUT_MS

DEFAULT_MAX_INFLIGHT_PER_PRINCIPAL

Built-in default for max_inflight_per_principal (issue #934). Bounds any single principal’s concurrent in-flight requests at the async edge so one caller can’t drain the whole global handler cap and starve the rest. 0 disables the per-principal cap entirely; a single-tenant deployment can set it there to pay nothing. Chosen below the typical multi-core global cap (256) so it provides real fairness headroom, while sitting above the global cap on tiny boxes (where there is no abuse pressure) so it never trips spuriously.

DEFAULT_RETRY_AFTER_SECS

MAX_RETRY_AFTER_SECS

MIN_HANDLER_TIMEOUT_MS

Lower bound for handler_timeout_ms. Anything below this is so short the deadline trips on healthy requests; we reject the value.

MIN_RETRY_AFTER_SECS

Inclusive bounds for retry_after_secs. Below 1s means clients hammer the server; above 30s means a transient overload looks like a permanent outage to load balancers.

Functions

default_execution_workers

Synchronous engine calls are CPU/storage work, not connection work. Keep their default parallelism tied to the CPU budget while the larger max_handlers allowance becomes the bounded wait envelope.

default_max_handlers

Built-in default for max_handlers. Matches HttpConnectionLimiter::with_default_cap.

resolve_http_limits

Apply the flag > red_config > env > default chain.

validate_execution_workers

validate_handler_timeout_ms

validate_max_handlers

Validate a max_handlers candidate from any source. Returns the value unchanged on success.

validate_max_inflight_per_principal

Validate a max_inflight_per_principal candidate (issue #934). Every usize is acceptable: a positive value caps each principal’s concurrent in-flight requests, and 0 disables the per-principal cap. Present for symmetry with the other knobs so the CLI parser can run all four through the same validated-parse helper.

validate_retry_after_secs