rwhod: put max cap on status update storage

Without a max cap, someone could potentially flood our memory by posting tons and tons of spoofed status updates.
2026-07-20 23:41:05 +09:00
parent 2b89f6c755
commit 4373eec6b5
6 changed files with 196 additions and 7 deletions
@@ -69,6 +69,16 @@ in {
              '';
            };

+            max_status_entries = lib.mkOption {
+              type = lib.types.ints.positive;
+              default = 4096;
+              description = ''
+                Maximum number of distinct hosts to keep rwhod status records for
+                at the same time. Once at capacity, the least recently updated
+                record is evicted to make room for a newly-seen host.
+              '';
+            };
+
            ignoreUsers = lib.mkOption {
              type = with lib.types; listOf (either str ints.unsigned);
              default = [ ];