mc/mc-proxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add per-listener connection limits

Browse Source 
Configurable maximum concurrent connections per listener. When the
limit is reached, new connections are closed immediately after accept.
0 means unlimited (default, preserving existing behavior).

Config: Listener gains max_connections field, validated non-negative.

DB: Migration 3 adds listeners.max_connections column.
UpdateListenerMaxConns method for runtime changes via gRPC.
CreateListener updated to persist max_connections on seed.

Server: ListenerState/ListenerData gain MaxConnections. Limit checked
in serve() after Accept but before handleConn — if ActiveConnections
>= MaxConnections, connection is closed and the accept loop continues.
SetMaxConnections method for runtime updates.

Proto: SetListenerMaxConnections RPC added. ListenerStatus gains
max_connections field. Generated code regenerated.

gRPC server: SetListenerMaxConnections implements write-through
(DB first, then in-memory update). GetStatus includes max_connections.

Client: SetListenerMaxConnections method, MaxConnections in
ListenerStatus.

Tests: DB CRUD and UpdateListenerMaxConns, server connection limit
enforcement (accept 2, reject 3rd, close one, accept again), gRPC
SetListenerMaxConnections round-trip with DB persistence, not-found
error handling.

Also updates PROJECT_PLAN.md with phases 6-8 and PROGRESS.md with
tracking for the new features.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Kyle Isom
2026-03-25 16:42:53 -07:00
parent 5bc8f4fc8e
commit 564e0a9c67
16 changed files with 595 additions and 102 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
PROGRESS.md
View File

@@ -49,19 +49,42 @@ proceeds. Each item is marked:
- [x] 5.4 Web UI through L7 validation (HTTP/1.1 fallback, HTTP/2)
- [x] 5.5 Documentation (verified ARCHITECTURE.md, CLAUDE.md, Makefile)
## Phase 6: Per-Listener Connection Limits
- [x] 6.1 Config: `MaxConnections` on Listener, validation
- [x] 6.2 DB: migration 3, CRUD updates, `UpdateListenerMaxConns`
- [x] 6.3 Server: limit enforcement in `serve()`, `SetMaxConnections` method
- [x] 6.4 Proto/gRPC: `SetListenerMaxConnections` RPC, `max_connections` in status
- [x] 6.5 Client: `SetListenerMaxConnections` method, `MaxConnections` in status
- [x] 6.6 Tests: DB CRUD, server limit enforcement, gRPC round-trip
## Phase 7: L7 Policies
- [ ] 7.1 Config: `L7Policy` struct, `L7Policies` on Route, validation
- [ ] 7.2 DB: migration 4, `l7_policies` table, CRUD in `l7policies.go`
- [ ] 7.3 L7 middleware: `PolicyMiddleware` in `internal/l7/policy.go`
- [ ] 7.4 Server/L7 integration: thread policies from RouteInfo to RouteConfig
- [ ] 7.5 Proto/gRPC: `L7Policy` message, policy management RPCs
- [ ] 7.6 Client/CLI: policy methods, `mcproxyctl policies` subcommand
- [ ] 7.7 Startup: load L7 policies per route in `loadListenersFromDB`
- [ ] 7.8 Tests: middleware unit, DB CRUD + cascade, gRPC round-trip, e2e
## Phase 8: Prometheus Metrics
- [ ] 8.1 Dependency: add `prometheus/client_golang`
- [ ] 8.2 Config: `Metrics` section (`addr`, `path`)
- [ ] 8.3 Package: `internal/metrics/` definitions and HTTP server
- [ ] 8.4 Instrumentation: connections, firewall, dial latency, bytes, HTTP status, policy blocks
- [ ] 8.5 Firewall: `BlockedWithReason()` method
- [ ] 8.6 L7: status recording on ResponseWriter
- [ ] 8.7 Startup: conditionally start metrics server
- [ ] 8.8 Tests: metric sanity, server endpoint, `BlockedWithReason`
---
## Current State
All five phases are complete. The codebase implements the full dual-mode
(L4/L7) architecture with PROXY protocol support:
- L4 passthrough: SNI extraction, raw TCP relay (original behavior)
- L7 terminating: TLS termination, HTTP/2 reverse proxy with h2c backends
- PROXY protocol: v1/v2 receive on listeners, v2 send on routes
- Per-route mode selection: L4 and L7 routes coexist on the same listener
- gRPC admin API: full CRUD for routes with L7 fields, PROXY protocol flags
- CLI tools: `mcproxyctl routes add` with `--mode`, `--tls-cert`, etc.
- Multi-hop deployment tested: edge→origin with real client IP preservation
Phases 1-6 complete. Per-listener connection limits are implemented and
tested. L7 policies and Prometheus metrics are next.
`go vet` and `go test` pass across all 13 packages.