feat(multiplayer): wire control-plane request limits

server/cmd/control-plane/main.go

@@ -30,6 +30,9 @@ func main() {
 	redisTTL := flag.Duration("redis-ttl", 60*time.Second, "TTL for transient candidate projection entries")
 	workloadSecret := flag.String("workload-secret", os.Getenv("COSMIC_CLASH_WORKLOAD_SECRET"), "HMAC secret for control-plane-issued workload tokens (see workload/signed_token.go); server registration/result submission return 503 until this is set")
 	degraded := flag.Bool("degraded", false, "start with new login, queue, and proposal mutations rejected; SIGUSR1 enables and SIGUSR2 disables this mode")
+	rateLimit := flag.Int("rate-limit", 120, "maximum requests per per-credential/IP fixed window")
+	rateWindow := flag.Duration("rate-limit-window", time.Minute, "fixed window for the per-replica request limiter")
+	rateMaxKeys := flag.Int("rate-limit-max-keys", 10000, "maximum credential/IP keys retained by the per-replica request limiter")
 	flag.Parse()
 	if *role != "api" {
 		fatalf("unsupported role %q (only api is implemented)", *role)
@@ -40,6 +43,10 @@ func main() {
 	if *redisTTL <= 0 {
 		fatalf("--redis-ttl must be positive")
 	}
+	rateLimiter, err := api.NewRateLimiter(*rateLimit, *rateWindow, *rateMaxKeys)
+	if err != nil {
+		fatalf("invalid request limiter configuration: %v", err)
+	}
 	db, err := sql.Open("pgx", *dsn)
 	if err != nil {
 		fatalf("open PostgreSQL: %v", err)
@@ -64,6 +71,7 @@ func main() {
 		fmt.Fprintln(os.Stderr, "control-plane: warning: --workload-secret / COSMIC_CLASH_WORKLOAD_SECRET is unset; server registration and result submission will return 503")
 	}
 	service := newAPIService(db, *workloadSecret, candidateIndex)
+	service.RateLimiter = rateLimiter
 	admission := api.NewAdmissionGate(*degraded)
 	service.Admission = admission
 	server := &http.Server{Addr: *listen, Handler: service.Handler(), ReadHeaderTimeout: 5 * time.Second}