Rate Limits and Connection Limits

Rate limits protect login, API, chat, WebSocket connection attempts, and streaming paths. Multi-replica deployments depend on Redis for shared rate-limit state.

connection_limits

These fields control long-lived and WebSocket-style connections.

Field	Default	Purpose
connection_limits.max_per_user	20	Maximum concurrent connections per user
connection_limits.max_per_room	2000	Maximum concurrent connections per room
connection_limits.max_total	100000	Maximum concurrent connections globally
connection_limits.idle_timeout_seconds	300	Disconnect idle connections
connection_limits.max_duration_seconds	86400	Maximum connection lifetime
connection_limits.ws_message_rate_limit_per_second	50	Per-connection WebSocket message rate

When sizing these values, consider CPU, memory, file descriptor limits, reverse proxy limits, and Kubernetes resource limits.

messaging_rate_limits

Business-layer chat limits:

messaging_rate_limits:
  chat_per_second: 10
  window_seconds: 1

Request Rate Limits

Request limits are shared across HTTP and gRPC transports:

request_rate_limits:
  auth_max_requests: 5
  auth_window_seconds: 60
  write_max_requests: 120
  write_window_seconds: 60
  read_max_requests: 600
  read_window_seconds: 60
  media_max_requests: 120
  media_window_seconds: 60
  admin_max_requests: 180
  admin_window_seconds: 60
  streaming_max_requests: 1200
  streaming_window_seconds: 60
  websocket_max_requests: 60
  websocket_window_seconds: 60

Each group uses:

• *_max_requests: maximum allowed requests in one window.
• *_window_seconds: window length in seconds.

Categories:

Category	Purpose
auth	Login, registration, refresh, and other auth endpoints
write	Create, update, delete operations
read	List, detail, and status queries
media	Add, remove, parse, and batch media operations
admin	Administrative endpoints
streaming	HLS, FLV, media proxy, and similar streaming HTTP paths
websocket	WebSocket connection attempts

Auth limits should remain strict on public deployments. Streaming limits are higher because HLS playback can generate many playlist and segment requests.

Transport Notes

HTTP and gRPC requests use the same category budgets.

Redis And Multi-Replica Behavior

Without Redis, rate limit state is stored in process memory.

For multi-replica deployments, Redis is required for meaningful global limits. Otherwise each replica counts separately. With three replicas and an auth limit of 5 per minute, a client could effectively get 15 attempts per minute if requests are distributed across all replicas.

Deployment shape	Requirement
Local testing	Redis optional
Production single-node	Configure Redis
Multi-replica	Redis required