mirror of
https://relay.ngit.dev/npub15qydau2hjma6ngxkl2cyar74wzyjshvl65za5k5rl69264ar2exs5cyejr/ngit-grasp.git
synced 2026-10-06 07:28:23 +00:00
DanConwayDev
a6b5e3a9f6
rust-nostr 0.45 added a connection-wide 300-frame-per-minute bucket and closes a WebSocket when it is exhausted. Production recorded 5,020 such disconnects before this change; Caddy correlation showed both a rapid source sending more than 300 frames in roughly 1.5 seconds and legitimate gitworkshop.dev, gittr.space, armada.buzz, and localhost browser sessions crossing the same ceiling. This predates and is independent of the subscription-budget ledger. Select a fixed 6,000-message-per-minute allowance for ngit-grasp. An initial 1,200/minute production candidate reduced closures to one in 29 minutes, but that remaining localhost development client legitimately sustained about 44-45 frames/second. A 100-frame-per-second token rate gives that observed traffic useful headroom while retaining a finite catch-all for malformed and non-operation traffic. The tighter independent limits for EVENT writes, queries, and authentication events remain unchanged, so this does not expand those operation budgets. No new configuration option is added because clients cannot discover or adapt to a non-standard frame quota. Add scenario coverage proving a 1,201-frame burst remains connected and completes a subsequent REQ/EOSE exchange, while a rapid 6,001-frame burst is still closed. Update the changelog and relay hardening/scaling references in the same commit. Per-IP admission fairness and upstream rust-nostr policy remain deliberately out of scope. Validation: - nix develop -c cargo test --test relay_message_rate (46 passed) - nix develop -c cargo test --lib (643 passed on the initial candidate) - nix build .#ngit-grasp (initial candidate; final package rebuilt by deploy)
50 lines
2.6 KiB
Markdown
50 lines
2.6 KiB
Markdown
# Embedded relay limits
|
|
|
|
ngit-grasp embeds rust-nostr `LocalRelay` 0.45.0. The application selects every
|
|
effective limit explicitly so future dependency defaults cannot silently alter
|
|
production admission policy.
|
|
|
|
## Effective limits
|
|
|
|
| Limit | ngit-grasp default | Operator configuration | NIP-11 |
|
|
| --- | ---: | --- | --- |
|
|
| Total inbound connections | Unbounded | `NGIT_MAX_CONNECTIONS` | No standard field |
|
|
| Active REQs per connection | 500 | `NGIT_RELAY_MAX_SUBSCRIPTIONS` | `max_subscriptions` |
|
|
| Results per filter | 500 | `NGIT_RELAY_FILTER_LIMIT` | `max_limit`, `default_limit` |
|
|
| Serialized event size | 192 KiB | `NGIT_RELAY_MAX_EVENT_SIZE_BYTES` | No equivalent field |
|
|
| Event writes per minute | 60 | Fixed | No standard field |
|
|
| Queries per minute | 120 | Fixed | No standard field |
|
|
| Authentication events per minute | 30 | Fixed | No standard field |
|
|
| WebSocket messages per minute | 6,000 | Fixed | No standard field |
|
|
| WebSocket message size | 5 MiB | Fixed | `max_message_length` |
|
|
| Handshake deadline | 10 seconds | Fixed | No standard field |
|
|
| Subscription-ID length | 250 bytes | Fixed | `max_subid_length` |
|
|
| Filters per REQ | 20 | Fixed | No standard field |
|
|
| Subscription state per connection | 1 MiB | Fixed | No standard field |
|
|
| Active negentropy sessions per connection | 10 | Fixed | No standard field |
|
|
| Negentropy items per connection | 50,000 | Fixed | No standard field |
|
|
| Negentropy frame | 60,000 bytes | Fixed upstream | No standard field |
|
|
|
|
The filter setting is applied consistently to rust-nostr's explicit filter
|
|
cap, per-query result cap, and omitted-limit default. Limits are per filter;
|
|
results from multiple filters in one REQ are merged without an aggregate
|
|
truncation.
|
|
|
|
The 192 KiB event default is three times rust-nostr's new 64 KiB default.
|
|
Production history contains a valid NIP-34 patch event of about 149 KiB, so
|
|
64 KiB is incompatible with ngit-grasp's purpose. The raised limit remains
|
|
bounded and below the 5 MiB WebSocket message ceiling.
|
|
|
|
## Client adaptation
|
|
|
|
ngit-grasp refetches NIP-11 per connection session. Its outbound sync ledger
|
|
uses `max_subscriptions`, falling back conservatively when absent. Adaptive
|
|
historic pagination uses `default_limit` with a verification page and learns
|
|
from raw delivered page sizes. `max_limit` describes explicit filter limits;
|
|
historic sync currently omits `limit`, so it does not treat `max_limit` as an
|
|
omitted-filter page-size promise.
|
|
|
|
NIP-11 has no standard `max_filters` field in the current schema. Filter-count
|
|
and serialized-message budgets therefore remain conservative client-side
|
|
constants rather than falsely negotiated capabilities.
|