ratelock

Back to Projects
ratelock banner

A per-tenant API gateway built around atomic Redis Lua token buckets, plan-aware quotas, per-route cost weights, and standard X-RateLimit response headers.

Highlights

  • Edge gateway in Go using `net/http` reverse proxy mode, terminating TLS and forwarding to upstream service meshes.
  • Atomic token-bucket implementation in Redis Lua (HSET of tokens + last-refill, EVAL'd per request) to avoid check-then-set races.
  • Plan-aware quota engine: `free`, `pro`, `enterprise` plans each carry burst capacity, refill rate, and per-route cost weights.
  • Per-route weight table so cheap routes (`GET /healthz`) cost 0 tokens while expensive routes (`POST /reports`) cost 50 tokens.
  • Standard response headers on every request: `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset`, plus `Retry-After` on 429.
  • Tenant identification via JWT claim, API key header, or `X-Tenant-Id` for service-to-service traffic, all validated against a Redis cache.
  • `GET /v1/me/limits` debug endpoint that returns current bucket state, plan tier, and refill schedule for the calling tenant.
  • Load-tested with k6 against 1k simulated tenants, including one noisy neighbor scenario to validate isolation.

Tech Stack

  • Go
  • Redis
  • Lua
  • Postgres
  • k6
  • OpenTelemetry
  • Docker