Module http_limits

Expand description

Resolution of the HTTP admission and execution knobs.

The values are configurable through the standard precedence chain used elsewhere in the boot path:

flag > red_config > env > built-in default

Built-in defaults preserve the existing request envelope and add a CPU-sized synchronous execution bound:

max_handlers = (2 * num_cpus).clamp(8, 256)
execution_workers = num_cpus, clamped to max_handlers
handler_timeout = 30_000 ms
retry_after_secs = 5
max_inflight_per_principal = min(64, max_handlers - 1) (issue #934; 0 disables; one slot is reserved when possible)

Each knob is validated at parse time and at resolution time so a stale red_config value cannot corrupt the running server.

Structs§

HttpLimitsCliInput: CLI-layer input. Each pair holds the already-validated value coming from a flag and from an env var, respectively. The resolver applies the flag > red_config > env > default precedence using these inputs plus a config-store lookup.
HttpLimitsResolved: Resolved values after applying the full precedence chain. Stamped into both the RedDBServer and the startup log line.

DEFAULT_HANDLER_TIMEOUT_MS
DEFAULT_MAX_INFLIGHT_PER_PRINCIPAL: Built-in default for max_inflight_per_principal (issue #934). Bounds any single principal’s concurrent in-flight requests at the async edge so one caller can’t drain the whole global handler cap and starve the rest. 0 disables the per-principal cap entirely; a single-tenant deployment can set it there to pay nothing. The effective default is clamped below the global handler envelope when possible so even a one-CPU server keeps one request slot available for another principal.
DEFAULT_RETRY_AFTER_SECS
MAX_RETRY_AFTER_SECS
MIN_HANDLER_TIMEOUT_MS: Lower bound for handler_timeout_ms. Anything below this is so short the deadline trips on healthy requests; we reject the value.
MIN_RETRY_AFTER_SECS: Inclusive bounds for retry_after_secs. Below 1s means clients hammer the server; above 30s means a transient overload looks like a permanent outage to load balancers.

default_execution_workers: Synchronous engine calls are CPU/storage work, not connection work. Keep their default parallelism tied to the CPU budget while the larger max_handlers allowance becomes the bounded wait envelope.
default_max_handlers: Built-in default for max_handlers. Matches HttpConnectionLimiter::with_default_cap.
resolve_http_limits: Apply the flag > red_config > env > default chain.
validate_execution_workers
validate_handler_timeout_ms
validate_max_handlers: Validate a max_handlers candidate from any source. Returns the value unchanged on success.
validate_max_inflight_per_principal: Validate a max_inflight_per_principal candidate (issue #934). Every usize is acceptable: a positive value caps each principal’s concurrent in-flight requests, and 0 disables the per-principal cap. Present for symmetry with the other knobs so the CLI parser can run all four through the same validated-parse helper.
validate_retry_after_secs