TLS, proxies, and limits

Configure the HTTP protocol, trusted proxy networks, and request/response limits.

HttpTransportConfig defines HTTP connection and data limits together. Invalid limits are rejected during application build.

Transport overrides#

This snippet creates the builder in your startup function:

use std::time::Duration;
use lilyrs::http_api::{AppBuilder, HttpTransportConfig};

let transport = HttpTransportConfig {
    max_in_flight_requests: 500,
    max_request_body_bytes: 2 * 1024 * 1024,
    max_multipart_part_bytes: 1024 * 1024,
    request_timeout: Duration::from_secs(30),
    trusted_proxy_cidrs: vec!["10.10.0.0/16".parse()?],
    ..Default::default()
};
let builder = AppBuilder::new("127.0.0.1:8080").transport_config(transport);

When lowering the body limit, keep the multipart part limit within it as well. Replace the CIDR with your actual proxy network. Fields such as max_request_body_bytes and trusted_proxy_cidrs are not part of the current TOML ServerConfig schema; supply them through the DTO shown here.

Protocol and TLS#

Options include HttpProtocol::Auto, Http1_1, and Http2. TLS uses ALPN. Connect RustlsConfig::from_pem_file or a prepared TLS configuration through AppBuilder::rustls_config. Explicitly choose tls_disabled() for local plaintext.

In the following async startup snippet, the certificate and key files must be your actual deployment files:

let tls = lilyrs::http_api::RustlsConfig::from_pem_file(
    "./certs/fullchain.pem",
    "./certs/private-key.pem",
).await?;
lilyrs::http_api::AppBuilder::new("0.0.0.0:8443")
    .rustls_config(tls)
    .protocol(lilyrs::http_api::HttpProtocol::Auto)
    .build().await?
    .start().await?;

TLS termination at a reverse proxy and TLS on the Lily listener are separate choices. A configuration helper with a client CA is also supported.

Proxies and client IP#

The default trusted proxy list is empty. The effective IP is resolved from a bounded X-Forwarded-For chain only when the direct peer belongs to a trusted CIDR. Do not treat a client-supplied forwarding header as verified identity directly.

The ClientIp extractor uses this transport result. Forwarded identity headers do not replace a verified Principal for authentication.

Default limits#

Control	Default
Connections / in-flight requests	10,000 / 10,000
Request body / buffered response	16 MiB / 16 MiB
Multipart part / count / metadata	8 MiB / 128 / 16 KiB
Response stream item	64 KiB
Total stream-byte limit	`None`; deadline and chunk limits still apply
Request headers / response headers	64 fields and 64 KiB each
URI	8 KiB
Request timeout	60 seconds
Connection idle / header-read/TLS-handshake	120 / 10 seconds
HTTP/2 concurrent streams	100 per connection
Trusted proxy CIDRs	Empty
Lifecycle shutdown budget	30 seconds

These are HttpTransportConfig::default and lifecycle defaults; configuration and the builder can override them. HTTP/2 window/frame/send-buffer/reset/keepalive fields are also in the transport reference.

Capacity and quotas#

Exceeding admission capacity produces 503. This is a different policy from rate limiting, which applies a per-user quota over time. The request timeout also includes body reading and lazy response production.