[pbs-devel] [PATCH proxmox{, -backup} v3 0/6] add user specific rate-limits

[Christian Ebner]

On 11/10/25 2:43 PM, Hannes Laimer wrote:
> When a connection is accepted we create a shared tag handle for its
> rate-limited stream. The REST layer clears that handle before every
> request. Once a request authenticates successfully, we push a
> User(...) tag with the auth ID. Failed or unauthenticated requests
> leave the tag list empty. RateLimitedStream watches that handle and
> forces an immediate limiter refresh whenever the tag set changes so
> user-specific throttles take effect right away.
> 
> Currently rules with a user specified take priority over others. So:
> user > IP only > neither, in case two rules match.
> 
> If users and networks are specified, the rule only applies if both
> match. So, Any of the specified user connect from any of the specified
> network.
> 
> And all of this ofc still only if the given timeframe matches.
> 
> I did also test this with a basic nginx reverse proxy configured with
> `keepalive 32`, I didn't run into problems using this setup.
> 
> v3, thanks @Chris!:
>   - simplify code by passing the taglist to the callback, as sugested by
>     Chris
>   - mention potential future use-case in commit message
>   - created documented type for 3-tuple and inlined var for printing
> 
> v2, thanks @Chris!:
>   - fix problem with tag staying on connection after request finishes,
>     and with when it would be set in first place
>   - use a more generic tag-list on the connection, this is more general
>   - tag is now an enum, like chris suggested, this should make it
>     somewhat easy to extend if we at some point should want to
>


- tested per-user rate limits are set
- tested rate limits are applied for all users defined in the ruleset
- tested rate limits are honored with reverse proxy (haproxy with 
`http-reuse always`)
- checked correct per-user rules are applied when connections go trough 
proxy


With all the comments addressed, please consider:

Reviewed-by: Christian Ebner <c.ebner at proxmox.com>
Tested-by: Christian Ebner <c.ebner at proxmox.com>