Rate limiting

.env.example

@@ -48,6 +48,14 @@ RATE_LIMIT_ENTERPRISE_PER_MINUTE=10000
 RATE_LIMIT_WINDOW_MS=60000
 RATE_LIMIT_BURST_MULTIPLIER=1.2
 
+# Distributed rate limiting (Redis-backed) — complements the per-tier limits above
+# Default strategy: "token-bucket" or "sliding-window"
+RATE_LIMIT_DEFAULT_STRATEGY=token-bucket
+# Redis key prefix for rate-limit entries
+RATE_LIMIT_REDIS_KEY_PREFIX=alian:rl:
+# When false, requests are rejected (not in-memory fallback) if Redis is down
+RATE_LIMIT_FALLBACK_TO_MEMORY=true
+
 # ── Logging ────────────────────────────────────────────────────────────────
 # Minimum log level emitted to all transports.
 # Values: verbose | debug | info | warn | error | fatal

.env.production.example

@@ -69,6 +69,11 @@ RATE_LIMIT_ENTERPRISE_PER_MINUTE=10000
 RATE_LIMIT_WINDOW_MS=60000
 RATE_LIMIT_BURST_MULTIPLIER=1.2
 
+# Distributed rate limiting (Redis-backed)
+RATE_LIMIT_DEFAULT_STRATEGY=token-bucket
+RATE_LIMIT_REDIS_KEY_PREFIX=alian:rl:
+RATE_LIMIT_FALLBACK_TO_MEMORY=false
+
 # Security Headers
 HSTS_MAX_AGE=31536000