GM.Gateway 1.0.0

GM.Gateway

A YARP-based API gateway for the GM.* ecosystem with distributed rate limiting enforced at the edge. One call wires a YARP reverse proxy from configuration together with GM.RateLimiting; each route opts into a policy via route metadata, and requests are limited before they are proxied — centrally, across every gateway instance.

Install

dotnet add package GM.Gateway

Wire it up

var builder = WebApplication.CreateBuilder(args);

// Counter store + concurrency (in-memory here; use the Redis variants for cross-instance limits).
builder.Services.AddGMCaching();
builder.Services.AddGMDistributedLock();
// For production: AddGMRedisCaching(...) + AddGMRedisRateLimitStore(...) — lock-free, atomic.

// YARP reverse proxy + GM rate limiting, both from configuration.
builder.Services.AddGMGateway(builder.Configuration);

var app = builder.Build();
app.UseRouting();
app.MapGMGateway();     // reverse proxy with the per-route rate-limit step in its pipeline
app.Run();

Configure routes (and their limits) in appsettings

A route opts into rate limiting purely through its YARP Metadata:

{
  "ReverseProxy": {
    "Routes": {
      "orders": {
        "ClusterId": "orders",
        "Match": { "Path": "/orders/{**catch-all}" },
        "Metadata": { "RateLimitPolicy": "api", "RateLimitPartition": "Ip,Endpoint" }
      }
    },
    "Clusters": {
      "orders": { "Destinations": { "d1": { "Address": "http://orders-service/" } } }
    }
  },
  "RateLimiting": {
    "Policies": {
      "api": { "Algorithm": "SlidingWindow", "PermitLimit": 100, "Window": "00:01:00" }
    }
  }
}

• RateLimitPolicy — a named policy from RateLimiting:Policies (fixed window / sliding window / token bucket; see GM.RateLimiting).
• RateLimitPartition — one or more of User, ApiKey, Ip, Endpoint (combine with , or |). Omitted → the middleware's default partition. Routes with no RateLimitPolicy proxy unlimited.

When a route's limit is exceeded the gateway returns 429 Too Many Requests with Retry-After, X-RateLimit-* headers, and a ProblemDetails body — the backend is never called. Because the gateway reuses GM.RateLimiting.Http's IRateLimitEnforcer, these responses are identical to in-app limiting.

Why at the edge

ASP.NET Core's built-in limiter is per-process; behind a scaled-out gateway that means each replica counts separately. GM.Gateway counts in a shared store (GM.Caching, made atomic by GM.DistributedLock or the lock-free GM.RateLimiting.Redis Lua store), so a limit is a limit no matter how many gateway instances are running.

API

• IServiceCollection.AddGMGateway(configuration, reverseProxySection = "ReverseProxy", rateLimitingSection = "RateLimiting", configureHttp?) → IReverseProxyBuilder (chain YARP config).
• IEndpointRouteBuilder.MapGMGateway() — maps the proxy with rate limiting in its pipeline.
• IReverseProxyApplicationBuilder.UseGMGatewayRateLimiting() — the pipeline step, for custom proxy pipelines.
• GatewayRouteMetadata.RateLimitPolicy / .RateLimitPartition — the metadata keys.

Samples

GM.Gateway.Samples — a runnable gateway + backend.

License

MIT — see LICENSE.