Struct ShieldConfig 

#[non_exhaustive]
pub struct ShieldConfig {
    pub enabled: bool,
    pub profiles: HashMap<String, LimitProfileConfig>,
    pub rules: Vec<RateRuleConfig>,
    pub default_profile: Option<String>,
    pub jwt_limits: Option<JwtLimitConfig>,
    pub limit_service: Option<LimitServiceConfig>,
    pub sync: Option<SyncConfig>,
    pub trusted_proxies: Vec<String>,
}

Shield (rate limiting) configuration.

The proxy runs embedded on each service instance, so every limit decision is made locally with a GCRA shaper (zero blocking latency). A shared store, when configured via sync, is reconciled asynchronously off the request path to approximate a fleet-wide limit; the request path never blocks on it.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

enabled: bool

profiles: HashMap<String, LimitProfileConfig>

Named limit tiers referenced by rules and by tier-name resolution (JWT claim / limit service). Map of profile name → { rate, burst }.

rules: Vec<RateRuleConfig>

Rate-limit rules, evaluated in order; the first whose pattern matches the request path applies.

default_profile: Option<String>

Profile name applied when a matched rule resolves no other limit (JWT and service resolution absent or empty, and the rule sets no explicit profile). Must name an entry in profiles.

jwt_limits: Option<JwtLimitConfig>

Resolve a key’s limit from claims in the validated JWT. Presence enables JWT-based resolution (tier name or explicit numbers).

limit_service: Option<LimitServiceConfig>

Resolve a key’s limit from an external service. The lookup is cached and refreshed in the background; the request path never blocks on it.

sync: Option<SyncConfig>

Asynchronous cross-instance reconciliation via a shared store. When unset, each instance limits locally (fleet limit ≈ N × per-instance).

trusted_proxies: Vec<String>

CIDR ranges of trusted reverse proxies / load balancers (e.g. “10.0.0.0/8”). X-Forwarded-For / X-Real-IP are honored only when the direct peer falls in one of these ranges; otherwise the peer socket address is used as the client identity. Empty (the default) means do not trust forwarding headers; set this behind a load balancer.

Trait Implementations

impl Clone for ShieldConfig

fn clone(&self) -> ShieldConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ShieldConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ShieldConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.