Skip to content

1.94.0

Latest

Choose a tag to compare

@avandeputte avandeputte released this 10 Sep 04:16
· 3 commits to main since this release

A rate limit per client, on any published service (#1).

The Publish wizard and the Backend Pools editor gain Requests per client and a Rate window in seconds (10 unless changed). A client address that asks more than that many times in the window is refused until it slows down: an HTTP service answers 429, a TCP service drops the connection. Empty means no limit, which is what every existing pool has.

  • What it renders: the counter lives in the pool's stick table, so 100 per 10 s on an HTTP pool comes out as http-request track-sc0 src, http-request deny deny_status 429 if { sc_http_req_rate(0) gt 100 } and stick-table type ipv6 size 30k expire 30s store http_req_rate(10s). TCP pools count conn_rate and tcp-request content reject.
  • With source persistence: HAProxy allows one stick table per proxy, so the limit shares the persistence table rather than adding a second one — the table keeps its type, size and expiry and gains the rate counter.
  • Order: the limit is checked after the allow-list, so a refused network fills no table, and before any basic-auth or single sign-on, so a flood is turned away without a login round trip.
  • The list says so: a limited service shows at most 100 requests per 10 s per client under its address, and editing it brings both numbers back.
  • Refused at the form, not ignored: a limit that is not a whole number, or a window outside 1..3600 s, is rejected on both the wizard and the pool editor.

Also in this release: the translation checker had stopped extracting the API's fixed messages and now also covers messages raised as ValueError; the ten dictionaries gain the strings it found, along with the new fields.

Upgrading from 1.93.x: nothing to do. A pool with no limit renders exactly as before.

Packages are attached below; the container image is at ghcr.io/avandeputte/haproxy-manager:1.94.0.