syntax = "proto3";

package envoy.extensions.filters.network.local_ratelimit.v3;

import "envoy/config/core/v3/base.proto";
import "envoy/type/v3/token_bucket.proto";

import "udpa/annotations/status.proto";
import "udpa/annotations/versioning.proto";
import "validate/validate.proto";

option java_package = "io.envoyproxy.envoy.extensions.filters.network.local_ratelimit.v3";
option java_outer_classname = "LocalRateLimitProto";
option java_multiple_files = true;
option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/local_ratelimit/v3;local_ratelimitv3";
option (udpa.annotations.file_status).package_version_status = ACTIVE;

// [#protodoc-title: Local rate limit]
// Local rate limit :ref:`configuration overview <config_network_filters_local_rate_limit>`.
// [#extension: envoy.filters.network.local_ratelimit]

message LocalRateLimit {
  option (udpa.annotations.versioning).previous_message_type =
      "envoy.config.filter.network.local_rate_limit.v2alpha.LocalRateLimit";

  // The prefix to use when emitting :ref:`statistics
  // <config_network_filters_local_rate_limit_stats>`.
  string stat_prefix = 1 [(validate.rules).string = {min_len: 1}];

  // The token bucket configuration to use for rate limiting connections that are processed by the
  // filter's filter chain. Each incoming connection processed by the filter consumes a single
  // token. If the token is available, the connection will be allowed. If no tokens are available,
  // the connection will be immediately closed.
  //
  // .. note::
  //   In the current implementation each filter and filter chain has an independent rate limit, unless
  //   a shared rate limit is configured via :ref:`share_key <envoy_v3_api_field_extensions.filters.network.local_ratelimit.v3.LocalRateLimit.share_key>`.
  //
  // .. note::
  //   In the current implementation the token bucket's :ref:`fill_interval
  //   <envoy_v3_api_field_type.v3.TokenBucket.fill_interval>` must be >= 50ms to avoid too aggressive
  //   refills.
  type.v3.TokenBucket token_bucket = 2 [(validate.rules).message = {required: true}];

  // Runtime flag that controls whether the filter is enabled or not. If not specified, defaults
  // to enabled.
  config.core.v3.RuntimeFeatureFlag runtime_enabled = 3;

  // Specifies that the token bucket used for rate limiting should be shared with other local_rate_limit filters
  // with a matching :ref:`token_bucket <envoy_v3_api_field_extensions.filters.network.local_ratelimit.v3.LocalRateLimit.token_bucket>`
  // and ``share_key`` configuration. All fields of ``token_bucket`` must match exactly for the token bucket to be shared. If this
  // field is empty, this filter will not share a token bucket with any other filter.
  string share_key = 4;
}
