A rate limit per client, on any published service (#1).
The Publish wizard and the Backend Pools editor gain Requests per client and a Rate window in seconds (10 unless changed). A client address that asks more than that many times in the window is refused until it slows down: an HTTP service answers 429, a TCP service drops the connection. Empty means no limit, which is what every existing pool has.
- What it renders: the counter lives in the pool's stick table, so 100 per 10 s on an HTTP pool comes out as
http-request track-sc0 src,http-request deny deny_status 429 if { sc_http_req_rate(0) gt 100 }andstick-table type ipv6 size 30k expire 30s store http_req_rate(10s). TCP pools countconn_rateandtcp-request content reject. - With source persistence: HAProxy allows one stick table per proxy, so the limit shares the persistence table rather than adding a second one — the table keeps its type, size and expiry and gains the rate counter.
- Order: the limit is checked after the allow-list, so a refused network fills no table, and before any basic-auth or single sign-on, so a flood is turned away without a login round trip.
- The list says so: a limited service shows at most 100 requests per 10 s per client under its address, and editing it brings both numbers back.
- Refused at the form, not ignored: a limit that is not a whole number, or a window outside 1..3600 s, is rejected on both the wizard and the pool editor.
Also in this release: the translation checker had stopped extracting the API's fixed messages and now also covers messages raised as ValueError; the ten dictionaries gain the strings it found, along with the new fields.
Upgrading from 1.93.x: nothing to do. A pool with no limit renders exactly as before.
Packages are attached below; the container image is at ghcr.io/avandeputte/haproxy-manager:1.94.0.