Rate Limiting

Throttling, concurrency limits, and abuse prevention

DeltaGlider Proxy has several layers of protection against overload, abuse, and resource exhaustion. All limits have sensible defaults and are configurable via environment variables.

Auth Rate Limiter

Per-IP brute force protection for SigV4 authentication and admin login endpoints.

After a lockout expires, the failure counter resets and the IP can authenticate again.

Progressive delay

Failed auth attempts add an artificial delay to responses, making brute force expensive even before the lockout threshold:

IP extraction

Rate limiting requires a client IP. The proxy extracts it from X-Forwarded-For or X-Real-IP headers only when DGP_TRUST_PROXY_HEADERS=true. The default is false (secure-by-default: direct-to-internet deployments are protected against IP spoofing out of the box).

Set DGP_TRUST_PROXY_HEADERS=true when the proxy sits behind a trusted reverse proxy (nginx, Caddy, Coolify, ALB) that injects these headers.

For direct-to-internet deployments (no reverse proxy), the rate limiter falls through with no IP — rate limiting is effectively a no-op for those requests, though SigV4 signature verification and the SigV4 replay cache still apply. The admission chain's source_ip_list predicates use axum ConnectInfo (wired at startup) so they still work in the direct-to-internet case, but the rate limiter doesn't yet consume ConnectInfo.

Codec Semaphore

Limits the number of concurrent xdelta3 encode/decode subprocesses. Delta reconstruction (decode) is CPU-fast but I/O-bound (fetching reference + delta from storage), so the default is generous.

Behavior differs by operation:

• GET (decode): Waits up to 60 seconds for a codec slot. If no slot becomes available, returns 503 SlowDown.
• PUT (encode): Fails immediately with 503 SlowDown if no slot is available. This prevents queuing uploads that hold large request bodies in memory while waiting.

HTTP Concurrency Limit

Caps the total number of in-flight HTTP requests across the entire server. Requests beyond the limit queue until a slot opens or the request timeout fires.

Request Timeout

Per-request deadline applied to all S3 API requests. Returns HTTP 504 Gateway Timeout when exceeded. Set this high enough to accommodate large delta reconstructions over slow storage links.

Multipart Upload Limit

Caps concurrent in-progress multipart uploads. Each upload holds part data in memory until completion, so this limit prevents memory exhaustion from abandoned or excessive uploads.

Returns 503 SlowDown when exceeded.

Replay Detection Cache

Prevents replay attacks by caching SigV4 signatures and rejecting duplicates within the clock skew window.

When the cache exceeds 500K entries, expired signatures are evicted first. Duplicate signatures within the window are rejected with 403.

S3 Backend HEAD Concurrency

During LIST operations that require per-object metadata, the proxy issues HEAD requests to the upstream S3 backend. These are rate-limited to avoid triggering S3's own SlowDown throttling.

Summary of all env vars