Redis Rate Limit

rate-limit-redis uses a Redis Lua script to atomically update token bucket state across A3S Gateway replicas.

Behavior

The key is scoped by router:

a3s:ratelimit:<router>

Over-limit requests return 429 with Retry-After: 1 and:

{"error":"Rate limit exceeded (distributed)"}

Redis connections are lazy. If Redis is unreachable or the script fails, this middleware fails open: it logs a warning and allows the request.

middlewares "rate-limit-distributed" {
  type      = "rate-limit-redis"
  rate      = 200
  burst     = 100
  redis_url = "redis://127.0.0.1:6379"
}

Key	Type	Default	Notes
`type`	string	required	Must be `rate-limit-redis`.
`redis_url`	string	required	Redis URL.
`rate`	u64	required	Tokens per second.
`burst`	u64	`rate`	Bucket capacity.

The gateway binary must be built with the redis cargo feature. Without it, this type returns a configuration error.

The limit is per router, even when the same middleware name is used by multiple routers.
Redis failures allow traffic rather than deny it.
Keep Redis close to the gateway; Redis latency is request-path latency.

middlewares = ["auth-jwt", "rate-limit-redis", "body-limit"]