mirror of
https://github.com/coredns/coredns.git
synced 2026-10-08 19:45:21 -04:00
2b8c305203
Add a max_streams option to the *https* plugin to limit the number of concurrent HTTP/2 streams per DoH connection. This lets operators cap per-connection concurrency (guarding against resource exhaustion) or raise it above the Go default for high-fan-in clients that multiplex many requests over a single connection. Semantics match the existing *https3* plugin's max_streams: - omitted -> Go HTTP/2 server default is used - 0 -> use the underlying HTTP/2 transport default - positive -> advertise exactly that many concurrent streams - negative -> rejected at config parse time The limit is applied via the standard library http.Server.HTTP2 (HTTP2Config.MaxConcurrentStreams) so it is advertised in the server's SETTINGS frame. Signed-off-by: Mekias Yohannes <mmyohannes@gmail.com>
52 lines
1.3 KiB
Markdown
52 lines
1.3 KiB
Markdown
# https
|
|
|
|
## Name
|
|
|
|
*https* - configures DNS-over-HTTPS (DoH) server options.
|
|
|
|
## Description
|
|
|
|
The *https* plugin allows you to configure parameters for the DNS-over-HTTPS (DoH) server to fine-tune the security posture and performance of the server.
|
|
|
|
This plugin can only be used once per HTTPS listener block.
|
|
|
|
## Syntax
|
|
|
|
```txt
|
|
https {
|
|
max_connections NON_NEGATIVE_INTEGER
|
|
max_streams NON_NEGATIVE_INTEGER
|
|
}
|
|
```
|
|
|
|
* `max_connections` limits the number of concurrent TCP connections to the HTTPS server. The default value is 200 if not specified. Set to 0 for unbounded.
|
|
* `max_streams` limits the number of concurrent HTTP/2 streams per HTTPS connection. This helps prevent unbounded streams on a single connection, exhausting server resources. The default value is 250 if not specified. Set to 0 to use the underlying HTTP/2 transport default.
|
|
|
|
## Examples
|
|
|
|
Set custom limits for maximum connections and streams:
|
|
|
|
```
|
|
https://.:443 {
|
|
tls cert.pem key.pem
|
|
https {
|
|
max_connections 100
|
|
max_streams 100
|
|
}
|
|
whoami
|
|
}
|
|
```
|
|
|
|
Set both values to 0 to disable the CoreDNS limits (unbounded connections and the underlying HTTP/2 transport stream default), matching CoreDNS behaviour before v1.14.0:
|
|
|
|
```
|
|
https://.:443 {
|
|
tls cert.pem key.pem
|
|
https {
|
|
max_connections 0
|
|
max_streams 0
|
|
}
|
|
whoami
|
|
}
|
|
```
|