feat: wire rate limiting config in core

README.md

@@ -137,7 +137,7 @@ func OTELMeterProvider() otelmetric.MeterProvider
 OTELMeterProvider returns the global OTel MeterProvider. This is a convenience accessor for code that needs the interface type.
 
 <a name="SetOTELGRPCClientOptions"></a>
-## func [SetOTELGRPCClientOptions](<https://github.com/go-coldbrew/core/blob/main/core.go#L594>)
+## func [SetOTELGRPCClientOptions](<https://github.com/go-coldbrew/core/blob/main/core.go#L600>)
 
 ```go
 func SetOTELGRPCClientOptions(opts ...otelgrpc.Option)
@@ -146,7 +146,7 @@ func SetOTELGRPCClientOptions(opts ...otelgrpc.Option)
 Deprecated: Use SetOTELOptions instead. Only applies when OTEL\_USE\_LEGACY\_INSTRUMENTATION=true.
 
 <a name="SetOTELGRPCServerOptions"></a>
-## func [SetOTELGRPCServerOptions](<https://github.com/go-coldbrew/core/blob/main/core.go#L588>)
+## func [SetOTELGRPCServerOptions](<https://github.com/go-coldbrew/core/blob/main/core.go#L594>)
 
 ```go
 func SetOTELGRPCServerOptions(opts ...otelgrpc.Option)
@@ -155,7 +155,7 @@ func SetOTELGRPCServerOptions(opts ...otelgrpc.Option)
 Deprecated: Use SetOTELOptions instead. Only applies when OTEL\_USE\_LEGACY\_INSTRUMENTATION=true.
 
 <a name="SetOTELOptions"></a>
-## func [SetOTELOptions](<https://github.com/go-coldbrew/core/blob/main/core.go#L601>)
+## func [SetOTELOptions](<https://github.com/go-coldbrew/core/blob/main/core.go#L607>)
 
 ```go
 func SetOTELOptions(opts grpcotel.Options)
@@ -314,7 +314,7 @@ type CB interface {
 ```
 
 <a name="New"></a>
-### func [New](<https://github.com/go-coldbrew/core/blob/main/core.go#L914>)
+### func [New](<https://github.com/go-coldbrew/core/blob/main/core.go#L920>)
 
 ```go
 func New(c config.Config) CB

config/README.md

@@ -66,7 +66,7 @@ import "github.com/go-coldbrew/core/config"
 
 
 <a name="Config"></a>
-## type [Config](<https://github.com/go-coldbrew/core/blob/main/config/config.go#L12-L188>)
+## type [Config](<https://github.com/go-coldbrew/core/blob/main/config/config.go#L12-L198>)
 
 Config is the configuration for the Coldbrew server It is populated from environment variables and has sensible defaults for all fields so that you can just use it as is without any configuration The following environment variables are supported and can be used to override the defaults for the fields
 
@@ -182,6 +182,16 @@ type Config struct {
     // per-request debug logging. The header value should be a valid log level
     // (e.g., "debug"). Default: "x-debug-log-level".
     DebugLogHeaderName string `envconfig:"DEBUG_LOG_HEADER_NAME" default:"x-debug-log-level"`
+    // RateLimitPerSecond is the maximum number of incoming requests per second
+    // for this pod. This is a per-pod in-memory limit — with N pods, the
+    // effective cluster-wide limit is N × this value. Set to 0 to disable (default).
+    // For distributed rate limiting, use interceptors.SetRateLimiter() with a custom implementation.
+    RateLimitPerSecond float64 `envconfig:"RATE_LIMIT_PER_SECOND" default:"0"`
+    // RateLimitBurst is the maximum burst size for the token bucket rate limiter.
+    // Only takes effect when RateLimitPerSecond > 0.
+    RateLimitBurst int `envconfig:"RATE_LIMIT_BURST" default:"1"`
+    // DisableRateLimit disables the rate limiting interceptor entirely.
+    DisableRateLimit bool `envconfig:"DISABLE_RATE_LIMIT" default:"false"`
     // DisableVTProtobuf disables the use of the vtprotobuf marshaller and unmarshaller for GRPC
     // https://github.com/planetscale/vtprotobuf
     DisableVTProtobuf bool `envconfig:"DISABLE_VT_PROTOBUF" default:"false"`
@@ -246,7 +256,7 @@ type Config struct {
 ```
 
 <a name="Config.Validate"></a>
-### func \(Config\) [Validate](<https://github.com/go-coldbrew/core/blob/main/config/config.go#L193>)
+### func \(Config\) [Validate](<https://github.com/go-coldbrew/core/blob/main/config/config.go#L203>)
 
 ```go
 func (c Config) Validate() []string

config/config.go

@@ -120,6 +120,16 @@ type Config struct {
 	// per-request debug logging. The header value should be a valid log level
 	// (e.g., "debug"). Default: "x-debug-log-level".
 	DebugLogHeaderName string `envconfig:"DEBUG_LOG_HEADER_NAME" default:"x-debug-log-level"`
+	// RateLimitPerSecond is the maximum number of incoming requests per second
+	// for this pod. This is a per-pod in-memory limit — with N pods, the
+	// effective cluster-wide limit is N × this value. Set to 0 to disable (default).
+	// For distributed rate limiting, use interceptors.SetRateLimiter() with a custom implementation.
+	RateLimitPerSecond float64 `envconfig:"RATE_LIMIT_PER_SECOND" default:"0"`
+	// RateLimitBurst is the maximum burst size for the token bucket rate limiter.
+	// Only takes effect when RateLimitPerSecond > 0.
+	RateLimitBurst int `envconfig:"RATE_LIMIT_BURST" default:"1"`
+	// DisableRateLimit disables the rate limiting interceptor entirely.
+	DisableRateLimit bool `envconfig:"DISABLE_RATE_LIMIT" default:"false"`
 	// DisableVTProtobuf disables the use of the vtprotobuf marshaller and unmarshaller for GRPC
 	// https://github.com/planetscale/vtprotobuf
 	DisableVTProtobuf bool `envconfig:"DISABLE_VT_PROTOBUF" default:"false"`

core.go

@@ -148,6 +148,12 @@
 	if c.config.DebugLogHeaderName != "" {
 		interceptors.SetDebugLogHeaderName(c.config.DebugLogHeaderName)
 	}
+	if c.config.DisableRateLimit {
+		interceptors.SetDisableRateLimit(true)
+	}
+	if c.config.RateLimitPerSecond > 0 {
+		interceptors.SetDefaultRateLimit(c.config.RateLimitPerSecond, c.config.RateLimitBurst)
+	}
 	if c.config.EnablePrometheusGRPCHistogram {
 		if len(c.config.PrometheusGRPCHistogramBuckets) > 0 {
 			interceptors.SetServerMetricsOptions(