# Token Rate Limiting -- Per-IP Bucket Keys
#
# Honor X-Forwarded-For for the IP budget only when a trusted proxy
# sanitizes it and direct access is blocked; otherwise omit `header` to
# key on the TCP peer. Extends token-rate-limit.yaml with M5 IP
# dimensions (ai#123): each distinct client address gets its own token
# budget under the same catch-all rule. This example reads
# `X-Forwarded-For` and takes the right-most hop after `trusted_hops`
# trusted proxies (appending proxies put client-controlled values on
# the left). When the header is absent, the TCP peer address is used.
# A present but unusable header fails closed (400) rather than
# skipping hops.
#
# `trusted_hops: 0` assumes exactly one trusted appending proxy in
# front of Praxis. When clients connect directly, they control
# X-Forwarded-For and can rotate buckets; omit `header` to key on the
# TCP peer instead. `max_keys` bounds key-table memory and rejects new
# IP keys with HTTP 429 (`KeyCapacity`) after the cap is reached; it
# does not stop clients from attempting rotation. `ipv6_prefix: 64`
# keys IPv6 clients per /64 so a single subscriber cannot mint a fresh
# budget per address in its prefix.
#
# Usage:
#   cargo run -p praxis-ai-proxy --features token-rate-limit-filter -- -c examples/configs/token-rate-limit-ip-keys.yaml
#   curl -i http://localhost:8080/v1/chat/completions \
#     -H 'X-Forwarded-For: 203.0.113.10' \
#     -d '{"model":"gpt-4","messages":[{"role":"user","content":"hi"}]}'
#
# See token-rate-limit.yaml for reservation-based admission (M2),
# reconciliation, M4 token-type weights, and the `rules:` schema.
#
# Supported token_count provider values:
#   openai | anthropic | google | bedrock | azure

listeners:
  - name: default
    address: "127.0.0.1:8080"
    filter_chains:
      - main

filter_chains:
  - name: main
    filters:
      - filter: router
        routes:
          - path: "/v1/chat/completions"
            cluster: backend

      - filter: token_rate_limit
        key:
          ip:
            header: x-forwarded-for
            trusted_hops: 0
            ipv6_prefix: 64
        max_keys: 100000
        default_weights:
          input: 1.0
          output: 1.0
          cached_input: 0.1
          cache_write: 1.25
          reasoning: 0.9
        rules:
          - name: default
            algorithm: sliding_window
            window: 1h
            capacity: 100000
            reserved_tokens: 500

      - filter: token_count
        provider: openai

      - filter: access_log

      - filter: load_balancer
        clusters:
          - name: backend
            endpoints:
              - "127.0.0.1:3000"

insecure_options:
  allow_private_endpoints: true