Add per-IP rate limiting and Unix socket support for gRPC admin API

Rate limiting: per-source-IP connection rate limiter in the firewall layer
with configurable limit and sliding window. Blocklisted IPs are rejected
before rate limit evaluation to avoid wasting quota. Unix socket: the gRPC
admin API can now listen on a Unix domain socket (no TLS required), secured
by file permissions (0600), as a simpler alternative for local-only access.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/server/server.go

@@ -24,6 +24,8 @@ type ListenerState struct {
 	routes            map[string]string // lowercase hostname → backend addr
 	mu                sync.RWMutex
 	ActiveConnections atomic.Int64
+	activeConns       map[net.Conn]struct{} // tracked for forced shutdown
+	connMu            sync.Mutex
 }
 
 // Routes returns a snapshot of the listener's route table.
@@ -100,9 +102,10 @@ func New(cfg *config.Config, fw *firewall.Firewall, listenerData []ListenerData,
 	var listeners []*ListenerState
 	for _, ld := range listenerData {
 		listeners = append(listeners, &ListenerState{
-			ID:     ld.ID,
-			Addr:   ld.Addr,
-			routes: ld.Routes,
+			ID:          ld.ID,
+			Addr:        ld.Addr,
+			routes:      ld.Routes,
+			activeConns: make(map[net.Conn]struct{}),
 		})
 	}
 
@@ -186,6 +189,9 @@ func (s *Server) Run(ctx context.Context) error {
 		s.logger.Info("all connections drained")
 	case <-time.After(s.cfg.Proxy.ShutdownTimeout.Duration):
 		s.logger.Warn("shutdown timeout exceeded, forcing close")
+		// Force-close all listener connections to unblock relay goroutines.
+		s.forceCloseAll()
+		<-done
 	}
 
 	s.fw.Close()
@@ -214,11 +220,31 @@ func (s *Server) serve(ctx context.Context, ln net.Listener, ls *ListenerState)
 	}
 }
 
+// forceCloseAll closes all tracked connections across all listeners.
+func (s *Server) forceCloseAll() {
+	for _, ls := range s.listeners {
+		ls.connMu.Lock()
+		for conn := range ls.activeConns {
+			conn.Close()
+		}
+		ls.connMu.Unlock()
+	}
+}
+
 func (s *Server) handleConn(ctx context.Context, conn net.Conn, ls *ListenerState) {
 	defer s.wg.Done()
 	defer ls.ActiveConnections.Add(-1)
 	defer conn.Close()
 
+	ls.connMu.Lock()
+	ls.activeConns[conn] = struct{}{}
+	ls.connMu.Unlock()
+	defer func() {
+		ls.connMu.Lock()
+		delete(ls.activeConns, conn)
+		ls.connMu.Unlock()
+	}()
+
 	remoteAddr := conn.RemoteAddr().String()
 	addrPort, err := netip.ParseAddrPort(remoteAddr)
 	if err != nil {

internal/server/server_test.go

@@ -28,7 +28,7 @@ func echoServer(t *testing.T, ln net.Listener) {
 // newTestServer creates a Server with the given listener data and no firewall rules.
 func newTestServer(t *testing.T, listeners []ListenerData) *Server {
 	t.Helper()
-	fw, err := firewall.New("", nil, nil, nil)
+	fw, err := firewall.New("", nil, nil, nil, 0, 0)
 	if err != nil {
 		t.Fatalf("creating firewall: %v", err)
 	}
@@ -195,7 +195,7 @@ func TestFirewallBlocks(t *testing.T) {
 	proxyLn.Close()
 
 	// Create a firewall that blocks 127.0.0.1 (the test client).
-	fw, err := firewall.New("", []string{"127.0.0.1"}, nil, nil)
+	fw, err := firewall.New("", []string{"127.0.0.1"}, nil, nil, 0, 0)
 	if err != nil {
 		t.Fatalf("creating firewall: %v", err)
 	}
@@ -599,7 +599,7 @@ func TestGracefulShutdown(t *testing.T) {
 	proxyAddr := proxyLn.Addr().String()
 	proxyLn.Close()
 
-	fw, err := firewall.New("", nil, nil, nil)
+	fw, err := firewall.New("", nil, nil, nil, 0, 0)
 	if err != nil {
 		t.Fatalf("creating firewall: %v", err)
 	}