p2pstream

Appearance

Limits and Shaping ​

WAF rules, rate limits, traffic shapers, cache rules, and request retry rules are global public proxy controls.

What It Is ​

These controls protect, slow, or cache public traffic around route/target selection.

LayerRunsTypical use
WAFBefore rate limitsBlock, captcha, or queue traffic by HTTP match rules.
Rate limitsBefore traffic shapingReject repeated requests with 429.
Traffic shapingBefore route/target forwardingSlow upload and download streams without rejecting the request.
CacheAfter route/target selectionServe eligible public proxy assets from proxy storage.
RetriesAfter a cache miss, during agent upstream forwardingRetry an eligible transport failure through another agent in the selected target.

When It Matters ​

Use these controls when protecting login endpoints, controlling API budgets, slowing large transfers, queuing short traffic surges, or caching public static assets.

Runtime Behavior ​

Every public request passes through these layers in order. A request stopped at an earlier layer never reaches later ones.

Evaluation order:

  1. ACME HTTP challenge bypass
  2. Reserved WAF endpoints
  3. WAF rules
  4. Rate limits
  5. Traffic shapers
  6. Route and target selection
  7. Cache rule evaluation and lookup
  8. Agent retry rule selection for an upstream cache miss
  9. Origin forwarding, bounded alternate-agent attempts, or cached response

Policy matching uses request-only CEL match_rule expressions for method, protocol, host, path, remote IP/CIDR, headers, cookies, and query parameters. See CEL Policy Matching for the shared matcher syntax, validation rules, and examples. Legacy match is removed from the public API; existing stored legacy rows are migrated automatically. If no key parts are configured, remote IP is used.

Cache route_ids and target_ids remain separate filters evaluated after route/target selection.

Traffic shaping uses byte-per-second token buckets. per_key shares a bucket for requests with the same key; per_request gives each request its own bucket.

Cache rules store eligible public GET/HEAD responses for proxy targets after route/target selection. Cache hits still pass through WAF, rate limits, and traffic shaping first.

Retry rules are first-match policies for agent-backed proxy targets. They keep the selected target fixed and exclude previously attempted agents. The safest rule covers GET/HEAD, allows one retry, and retries connection-establishment failures only. See Request Retries for replay limits and duplicate-request safety.

p2pstream Traffic Policy WAF tab showing filterable WAF rules, captcha providers, and Visitor identity and GeoIP settings
The WAF tab keeps filterable WAF rules and captcha providers above the separate Visitor identity & GeoIP configuration used by country restrictions and client identity.
p2pstream Traffic Policy Traffic Shaper tab showing a filterable compact rule table with matches, budgets, scope, priority, and state
Traffic Shaper has its own tab and filter. Cache rules and cache storage operations remain on the separate Cache tab because cache is evaluated after route and target selection.

Common Mistakes ​

  • Using remote IP as the only key when p2pstream sits behind another reverse proxy.
  • Creating broad rules with low priority numbers that catch unrelated traffic.
  • Expecting cache hits to bypass rate limits or WAF.
  • Allowing cookie-bearing cache requests on broad dynamic paths instead of precise static asset paths.
  • Retrying side-effecting methods without an upstream idempotency key.

Operations documentation for self-hosted p2pstream deployments.