Overview
rs-tunnel enforces quotas to prevent resource exhaustion and ensure fair usage. The primary quota is a limit on the number of active tunnels per user.Maximum Active Tunnels
Configuration
Fromapps/api/src/config/env.ts:37:
This limit can be configured via the
MAX_ACTIVE_TUNNELS environment variable.Setting the Quota
In your.env file:
Quota Enforcement
When Quotas Are Checked
Quotas are enforced when a user attempts to create a new tunnel. Fromapps/api/src/services/tunnel.service.ts:35-36:
Quota Assertion Logic
Fromapps/api/src/services/quota.ts:
What Counts as Active?
From the tunnel service implementation, a tunnel is considered active if its status is in theACTIVE_STATES set:
active or stopping count toward the quota.
Error When Quota Exceeded
When a user exceeds their quota, the API returns a 409 Conflict error:Error Response
Error Fields
| Field | Description |
|---|---|
statusCode | HTTP status code (409) |
code | Error code identifier |
message | Human-readable error message including the limit |
details.activeCount | Current number of active tunnels |
details.maxActive | Maximum allowed tunnels |
The error message dynamically includes the configured limit, so users know exactly how many tunnels are allowed.
CLI Error Handling
When the CLI receives a quota error, it should:- Display the error message to the user
- Suggest stopping an existing tunnel to free up quota
- Optionally show a list of active tunnels
Checking Current Usage
Users can check their current tunnel usage with the list command:apps/api/src/services/tunnel.service.ts:113-137, the list endpoint returns all active tunnels with their status and lease information.
Example Response
Freeing Up Quota
To free up quota, users must stop active tunnels:stopped and it no longer counts toward the quota.
Per-User vs Global Quotas
The current implementation enforces per-user quotas. Each user gets their own limit ofMAX_ACTIVE_TUNNELS.
Per-User Quota
Each user can have up to N active tunnels.Pros: Fair usage, prevents one user from exhausting resourcesCurrent implementation
Global Quota
All users share a global pool of tunnels.Pros: Simpler for small deploymentsNot currently implemented
Future Enhancements
Potential quota features for future implementation:Custom Per-User Limits
Allow different users to have different quota limits based on role or subscription tier.
Bandwidth Quotas
Limit total bandwidth usage per user per month.
Request Rate Limits
Limit requests per second through tunnels.
Quota Notifications
Notify users when they’re approaching their quota limit.
Monitoring Quota Usage
You can monitor quota usage and quota-exceeded errors through:Audit Logs
Tunnel creation attempts are logged:Database Queries
Query active tunnel counts per user:Application Metrics
Consider instrumenting the quota check with metrics:Troubleshooting
Issue: User can’t create tunnels despite seeing fewer than max
Cause: Tunnels instopping state count toward the quota.
Solution: Wait for tunnels to fully stop (lease expires, reaper cleans up) or manually verify tunnel status in the database.
Issue: Quota limit not updating after configuration change
Cause: API server needs to be restarted to load new environment variables. Solution: Restart the API server after changingMAX_ACTIVE_TUNNELS.

