Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
232 changes: 17 additions & 215 deletions engine/artifacts/config-schema.json

Large diffs are not rendered by default.

33 changes: 1 addition & 32 deletions engine/packages/config/src/config/guard.rs
Original file line number Diff line number Diff line change
Expand Up @@ -11,16 +11,6 @@ pub struct Guard {
pub port: Option<u16>,
/// Enable & configure HTTPS
pub https: Option<Https>,
/// Route cache TTL in milliseconds.
pub route_cache_ttl_ms: Option<u64>,
/// Proxy state cache TTL in milliseconds.
pub proxy_state_cache_ttl_ms: Option<u64>,
/// Time to keep TCP connection open after WebSocket close, in milliseconds.
pub websocket_close_linger_ms: Option<u64>,
/// Max incoming WebSocket message size in bytes.
pub websocket_max_message_size: Option<usize>,
/// Max outgoing WebSocket message size in bytes.
pub websocket_max_outgoing_message_size: Option<usize>,
/// Max HTTP request body size in bytes (first line of defense).
pub http_max_request_body_size: Option<usize>,
}
Expand All @@ -34,29 +24,8 @@ impl Guard {
self.port.unwrap_or(crate::defaults::ports::GUARD)
}

pub fn route_cache_ttl_ms(&self) -> u64 {
self.route_cache_ttl_ms.unwrap_or(10 * 60 * 1000) // 10 minutes
}

pub fn proxy_state_cache_ttl_ms(&self) -> u64 {
self.proxy_state_cache_ttl_ms.unwrap_or(60 * 60 * 1000) // 1 hour
}

pub fn websocket_close_linger_ms(&self) -> u64 {
self.websocket_close_linger_ms.unwrap_or(100)
}

pub fn websocket_max_message_size(&self) -> usize {
self.websocket_max_message_size.unwrap_or(32 * 1024 * 1024) // 32 MiB
}

pub fn websocket_max_outgoing_message_size(&self) -> usize {
self.websocket_max_outgoing_message_size
.unwrap_or(32 * 1024 * 1024) // 32 MiB
}

pub fn http_max_request_body_size(&self) -> usize {
self.http_max_request_body_size.unwrap_or(256 * 1024 * 1024) // 256 MiB
self.http_max_request_body_size.unwrap_or(20 * 1024 * 1024) // 20 MiB
}
}

Expand Down
166 changes: 5 additions & 161 deletions engine/packages/config/src/config/pegboard.rs
Original file line number Diff line number Diff line change
Expand Up @@ -7,73 +7,51 @@ pub struct Pegboard {
/// Time to delay an actor from rescheduling after a rescheduling failure.
///
/// Unit is in milliseconds.
///
/// **Experimental**
pub base_retry_timeout: Option<usize>,
/// How long to wait after creating and not receiving a starting state before setting actor as lost.
///
/// Unit is in milliseconds.
///
/// **Experimental**
pub actor_start_threshold: Option<i64>,
/// How long to wait after stopping and not receiving a stop state before setting actor as lost.
///
/// Unit is in milliseconds.
///
/// **Experimental**
pub actor_stop_threshold: Option<i64>,
/// How long an actor goes without retries before it's retry count is reset to 0, effectively resetting its
/// backoff to 0.
///
/// Unit is in milliseconds.
///
/// **Experimental**
pub retry_reset_duration: Option<i64>,
/// Maximum exponent for the reschedule backoff calculation.
///
/// This controls the maximum backoff duration when rescheduling actors.
///
/// **Experimental**
pub reschedule_backoff_max_exponent: Option<usize>,
/// How long after last ping before considering a runner ineligible for allocation.
///
/// Unit is in milliseconds.
///
/// **Experimental**
pub runner_eligible_threshold: Option<i64>,
/// How long to wait after last ping before forcibly removing a runner from the database
/// and deleting its workflow, evicting all actors.
///
/// Note that the runner may still be running and can reconnect.
///
/// Unit is in milliseconds.
///
/// **Experimental**
pub runner_lost_threshold: Option<i64>,
/// How long after last ping before considering a hibernating request disconnected.
///
/// Unit is in milliseconds.
///
/// **Experimental**
pub hibernating_request_eligible_threshold: Option<i64>,
/// Time to delay a serverless runner from attempting a new outbound connection after a connection failure.
///
/// Unit is in milliseconds.
///
/// **Experimental**
pub serverless_base_retry_timeout: Option<usize>,
/// How long a serverless runner goes without connection failures before it's retry count is reset to 0,
/// effectively resetting its backoff to 0.
///
/// Unit is in milliseconds.
///
/// **Experimental**
pub serverless_retry_reset_duration: Option<i64>,
/// Maximum exponent for the serverless backoff calculation.
///
/// This controls the maximum backoff duration when serverlessly connecting to runners.
///
/// **Experimental**
pub serverless_backoff_max_exponent: Option<usize>,

/// Global pool desired max.
Expand All @@ -82,8 +60,6 @@ pub struct Pegboard {
/// Default metadata poll interval for serverless runners when not specified in runner config.
///
/// Unit is in milliseconds.
///
/// **Experimental**
pub default_metadata_poll_interval: Option<u64>,

/// Minimum metadata poll interval for serverless runners.
Expand All @@ -93,20 +69,14 @@ pub struct Pegboard {
/// runner config specifies a very short interval.
///
/// Unit is in milliseconds.
///
/// **Experimental**
pub min_metadata_poll_interval: Option<u64>,

/// Number of consecutive successes required to clear an active runner pool error.
///
/// This prevents a single success from clearing an error during flapping conditions.
/// Higher values provide more stability but slower recovery from transient errors.
///
/// **Experimental**
pub runner_pool_consecutive_successes_to_clear_error: Option<u32>,
/// Amount of runners to query from the allocation queue and choose at random when allocating an actor.
///
/// **Experimental**
pub actor_allocation_candidate_sample_size: Option<usize>,

// === Gateway Settings ===
Expand All @@ -125,53 +95,11 @@ pub struct Pegboard {
/// Max pending message buffer size for hibernating WebSockets in bytes.
pub gateway_hws_max_pending_size: Option<u64>,
/// Max HTTP request body size in bytes for requests to actors.
///
/// Note: guard-core also enforces a larger limit (default 256 MiB) as a first line of defense.
/// See `Guard::http_max_request_body_size`.
pub gateway_http_max_request_body_size: Option<usize>,
/// Rate limit: number of requests allowed per period.
pub gateway_rate_limit_requests: Option<u64>,
/// Rate limit: period in seconds.
pub gateway_rate_limit_period_secs: Option<u64>,
/// Maximum concurrent in-flight requests per actor per IP.
pub gateway_max_in_flight: Option<usize>,
/// HTTP request timeout in seconds for actor traffic.
///
/// This is the outer timeout for the entire request lifecycle.
/// Should be slightly longer than `gateway_response_start_timeout_ms` to provide a grace period.
pub gateway_actor_request_timeout_secs: Option<u64>,
/// HTTP request timeout in seconds for API traffic (api-public).
pub gateway_api_request_timeout_secs: Option<u64>,
/// Maximum retry attempts for failed requests.
pub gateway_retry_max_attempts: Option<u32>,
/// Initial retry interval in milliseconds (doubles with each attempt).
pub gateway_retry_initial_interval_ms: Option<u64>,
/// WebSocket proxy task timeout in seconds.
pub gateway_ws_proxy_timeout_secs: Option<u64>,
/// WebSocket connection attempt timeout in seconds.
pub gateway_ws_connect_timeout_secs: Option<u64>,
/// WebSocket send message timeout in seconds.
pub gateway_ws_send_timeout_secs: Option<u64>,
/// WebSocket flush timeout in seconds.
pub gateway_ws_flush_timeout_secs: Option<u64>,

// === API Settings ===
/// Rate limit for API traffic: number of requests allowed per period.
pub api_rate_limit_requests: Option<u64>,
/// Rate limit for API traffic: period in seconds.
pub api_rate_limit_period_secs: Option<u64>,
/// Maximum concurrent in-flight requests for API traffic.
pub api_max_in_flight: Option<usize>,
/// Maximum retry attempts for API traffic.
pub api_retry_max_attempts: Option<u32>,
/// Initial retry interval for API traffic in milliseconds.
pub api_retry_initial_interval_ms: Option<u64>,
/// Max HTTP request body size in bytes for API traffic.
pub api_max_http_request_body_size: Option<usize>,

// === Runner Settings ===
/// Max HTTP response body size in bytes from actors.
pub runner_http_max_response_body_size: Option<usize>,
/// Max response payload size in bytes from actors.
pub runner_max_response_payload_body_size: Option<usize>,
/// Ping interval for runner updates in milliseconds.
pub runner_update_ping_interval_ms: Option<u64>,
/// GC interval for actor event demuxer in milliseconds.
Expand All @@ -185,11 +113,7 @@ pub struct Pegboard {
/// runner is sent stop commands for all of its actors. After the grace period is over (i.e. the full
/// duration is reached) the runner websocket is forcibly closed.
///
/// Default is 10 seconds.
///
/// Unit is in milliseconds.
///
/// **Experimental**
pub serverless_drain_grace_period: Option<u64>,
}

Expand Down Expand Up @@ -257,8 +181,6 @@ impl Pegboard {
self.actor_allocation_candidate_sample_size.unwrap_or(100)
}

// === Gateway Settings ===

pub fn gateway_websocket_open_timeout_ms(&self) -> u64 {
self.gateway_websocket_open_timeout_ms.unwrap_or(15_000)
}
Expand Down Expand Up @@ -289,87 +211,9 @@ impl Pegboard {
.unwrap_or(128 * 1024 * 1024) // 128 MiB
}

pub fn gateway_http_max_request_body_size(&self) -> usize {
self.gateway_http_max_request_body_size
.unwrap_or(128 * 1024 * 1024) // 128 MiB
}

pub fn gateway_rate_limit_requests(&self) -> u64 {
self.gateway_rate_limit_requests.unwrap_or(1200)
}

pub fn gateway_rate_limit_period_secs(&self) -> u64 {
self.gateway_rate_limit_period_secs.unwrap_or(60)
}

pub fn gateway_max_in_flight(&self) -> usize {
self.gateway_max_in_flight.unwrap_or(32)
}

pub fn gateway_actor_request_timeout_secs(&self) -> u64 {
self.gateway_actor_request_timeout_secs.unwrap_or(6 * 60) // 6 minutes
}

pub fn gateway_api_request_timeout_secs(&self) -> u64 {
self.gateway_api_request_timeout_secs.unwrap_or(60) // 1 minute
}

pub fn gateway_retry_max_attempts(&self) -> u32 {
self.gateway_retry_max_attempts.unwrap_or(7)
}

pub fn gateway_retry_initial_interval_ms(&self) -> u64 {
self.gateway_retry_initial_interval_ms.unwrap_or(150)
}

pub fn gateway_ws_proxy_timeout_secs(&self) -> u64 {
self.gateway_ws_proxy_timeout_secs.unwrap_or(30)
}

pub fn gateway_ws_connect_timeout_secs(&self) -> u64 {
self.gateway_ws_connect_timeout_secs.unwrap_or(5)
}

pub fn gateway_ws_send_timeout_secs(&self) -> u64 {
self.gateway_ws_send_timeout_secs.unwrap_or(5)
}

pub fn gateway_ws_flush_timeout_secs(&self) -> u64 {
self.gateway_ws_flush_timeout_secs.unwrap_or(2)
}

// === API Settings ===

pub fn api_rate_limit_requests(&self) -> u64 {
self.api_rate_limit_requests.unwrap_or(1200)
}

pub fn api_rate_limit_period_secs(&self) -> u64 {
self.api_rate_limit_period_secs.unwrap_or(60)
}

pub fn api_max_in_flight(&self) -> usize {
self.api_max_in_flight.unwrap_or(32)
}

pub fn api_retry_max_attempts(&self) -> u32 {
self.api_retry_max_attempts.unwrap_or(3)
}

pub fn api_retry_initial_interval_ms(&self) -> u64 {
self.api_retry_initial_interval_ms.unwrap_or(100)
}

pub fn api_max_http_request_body_size(&self) -> usize {
self.api_max_http_request_body_size
.unwrap_or(256 * 1024 * 1024) // 256 MiB
}

// === Runner Settings ===

pub fn runner_http_max_response_body_size(&self) -> usize {
self.runner_http_max_response_body_size
.unwrap_or(128 * 1024 * 1024) // 128 MiB
pub fn runner_max_response_payload_body_size(&self) -> usize {
self.runner_max_response_payload_body_size
.unwrap_or(20 * 1024 * 1024) // 20 MiB
}

pub fn runner_update_ping_interval_ms(&self) -> u64 {
Expand Down
12 changes: 0 additions & 12 deletions engine/packages/guard-core/src/errors.rs
Original file line number Diff line number Diff line change
Expand Up @@ -127,15 +127,3 @@ pub struct WebSocketServiceTimeout;
"WebSocket target changed, retry not possible."
)]
pub struct WebSocketTargetChanged;

#[derive(RivetError, Serialize, Deserialize)]
#[error(
"guard",
"request_body_too_large",
"Request body too large.",
"Request body size {size} bytes exceeds maximum allowed {max_size} bytes."
)]
pub struct RequestBodyTooLarge {
pub size: usize,
pub max_size: usize,
}
Loading
Loading