configurable http ratelimit

server/src/cli.rs

@@ -39,7 +39,7 @@ pub struct Cli {
     #[arg(name = "rpp", long)]
     pub rpp_path: Option<PathBuf>,
 
-    /// Maximum number of maps in both --maps and --data folders. Default: 1000.
+    /// Maximum number of maps in both --maps and --data folders.
     #[arg(long, default_value_t = 1000)]
     pub max_maps: usize,
 
@@ -48,7 +48,15 @@ pub struct Cli {
     #[arg(long, default_value_t = 10 * 1024)]
     pub max_map_size: usize,
 
-    /// Maximum number of simultaneous websocket connections. Default: 100.
+    /// Maximum number of simultaneous websocket connections.
     #[arg(long, default_value_t = 100)]
     pub max_connections: usize,
+
+    /// Maximum number of HTTP requests an IP can do at once before being rate-limited.
+    #[arg(long, default_value_t = 100)]
+    pub max_http_bursts: u32,
+
+    /// Once an IP is rate-limited, delay after which 1 request quota is replenished. In milliseconds.
+    #[arg(long, default_value_t = 500)]
+    pub http_ratelimit_delay: u64,
 }

server/src/router.rs

@@ -16,6 +16,7 @@ use tower_http::{
     cors,
     services::{ServeDir, ServeFile},
 };
+use vek::num_traits::clamp;
 
 use crate::{base64::Base64, protocol::*};
 use crate::{Cli, Server};
@@ -104,9 +105,17 @@ impl Router {
         let mut router = router
             // rate-limits
             .layer(GovernorLayer {
-                config: Arc::new(GovernorConfigBuilder::default().finish().unwrap()),
+                config: Arc::new(
+                    GovernorConfigBuilder::default()
+                        .const_burst_size(args.max_http_bursts)
+                        .const_per_millisecond(args.http_ratelimit_delay)
+                        .finish()
+                        .unwrap(),
+                ),
             })
-            .layer(DefaultBodyLimit::max(2 * 1024 * 1024)) // 2 MiB
+            .layer(DefaultBodyLimit::max(
+                clamp(args.max_map_size, 1 * 1024, 50 * 1024) * 1024,
+            )) // allows uploading maps between 1MiB-50MiB
             .layer(cors)
             .with_state(server);