fix(api): bound http server limits and shed on overload (#2170)

packages/config/src/ConfigLoader.ts

@@ -91,6 +91,7 @@ function defaultConfig(): MasterConfig {
 		services: {
 			api: {
 				port: 8080,
+				max_inflight_requests: 512,
 				ip_ban_exempt_ips: [],
 				desktop_github_redirect_countries: [],
 				presigned_attachment_uploads_enabled: false,
@@ -408,6 +409,7 @@ function normalizeConfig(config: MasterConfig): MasterConfig {
 	);
 	validatePostgresConfig(config);
 	validateApiWorkerConfig(config);
+	assertIntegerInRange(config.services.api.max_inflight_requests, 'FLUXER_API_MAX_INFLIGHT_REQUESTS', 1, 100_000);
 	requireString(config.domain.base_domain, 'FLUXER_BASE_DOMAIN');
 	requireString(config.auth.sudo_mode_secret, 'FLUXER_SUDO_MODE_SECRET');
 	requireString(config.auth.connection_initiation_secret, 'FLUXER_CONNECTION_INITIATION_SECRET');

packages/config/src/MasterConfig.ts

@@ -90,6 +90,7 @@ export interface MasterConfig {
 	services: {
 		api: {
 			port: number;
+			max_inflight_requests: number;
 			ip_ban_exempt_ips: Array<string>;
 			desktop_github_redirect_countries: Array<string>;
 			presigned_attachment_uploads_enabled: boolean;

packages/config/src/config_loader/EnvironmentOverrides.ts

@@ -76,6 +76,7 @@ const NAMED_FLUXER_ENV_OVERRIDES: Record<string, NamedEnvOverride> = {
 	FLUXER_NATS_JETSTREAM_URL: {path: ['services', 'nats', 'jetstream_url']},
 	FLUXER_NATS_AUTH_TOKEN: {path: ['services', 'nats', 'auth_token']},
 	FLUXER_API_PORT: {path: ['services', 'api', 'port'], parse: parseEnvValue},
+	FLUXER_API_MAX_INFLIGHT_REQUESTS: {path: ['services', 'api', 'max_inflight_requests'], parse: parseEnvValue},
 	FLUXER_API_IP_BAN_EXEMPT_IPS: {path: ['services', 'api', 'ip_ban_exempt_ips'], parse: parseCsv},
 	FLUXER_API_DESKTOP_GITHUB_REDIRECT_COUNTRIES: {
 		path: ['services', 'api', 'desktop_github_redirect_countries'],