- Reject envelopes for addresses without a device (404) instead of
queueing them for 30 days; random addresses were the cheapest way
to fill the relay's disk.
- Per-sender hourly quota on stored envelopes (count and bytes, 429)
and a count cap on each recipient's queue next to the byte cap.
- Per-account attachment quota: bytes per day and bytes stored within
the TTL, kept in memory only (no account-to-blob link is stored).
- Disk watermarks: below a configurable share of free space the relay
refuses new attachments, then new offline envelopes (507), before
Postgres runs out of space.
- WebSocket buffers 4 KiB read / unbuffered write: ~16.6 KiB per
connection instead of ~137 KiB (10 500 connections measured at
~180 MiB including the DB pool).
- reqwest with HTTP/2: APNs only accepts HTTP/2, so no iOS wake-up
could ever be delivered. APNs registration with only a VoIP token
is stored instead of deleted.
- All limits configurable via environment (limits.rs). Defaults keep
previous behaviour except registration per IP (50 + 1/10 s, for
carrier-grade NAT) guarded by a global cap (40/s), separate Tor
buckets (SEPOT_TOR_PEERS) and a rate limit on opening WebSockets.
SEPOT_REGISTRATION_PAUSED=1 pauses new registrations (503).
- Envelopes whose encoding exceeds the queue column limit are 400
before they count against the sender quota.
Rate limiting moves from tower_governor to governor directly, so Tor
and clearnet can use different quotas on the same route.
Julius Joska
5222c301ff