@threadedstack/wmd-web 0.1.13 → 0.1.15

package/relay/logfile.ts

@@ -26,14 +26,22 @@ export function createLogFile(o: LogFileOptions) {
   const retainMs = (o.retainDays ?? 14) * 24 * 3600_000
   const maxDir = o.maxLogDirBytes ?? 2 ** 30
   const warn = o.warn ?? ((m: string) => void process.stderr.write(`${m}\n`))
-  const append = o.append ?? ((p: string, t: string) => appendFileSync(p, t, { mode: 0o600 }))
-  // the directory holds connection metadata: owner only, also when it already existed with a looser mode
-  mkdirSync(o.dir, { recursive: true, mode: 0o700 })
+  // The directory holds connection metadata: never open to others. Its group bits are the operator's: on Linux they
+  // are the ACL mask, and a chmod to 0700 would switch off a reader granted with setfacl. New files are group-readable
+  // only when the directory is, so such a reader can read them too.
+  const lockDown = () => {
+    mkdirSync(o.dir, { recursive: true, mode: 0o700 })
+    const m = statSync(o.dir).mode & 0o777
+    if (m & 0o007) chmodSync(o.dir, m & 0o770)
+    return m & 0o040 ? 0o640 : 0o600
+  }
+  let fileMode: number
   try {
-    chmodSync(o.dir, 0o700)
+    fileMode = lockDown()
   } catch (e: any) {
-    throw new Error(`the log directory ${o.dir} must be owner-only (0700) and cannot be made so: ${e?.message ?? e}`)
+    throw new Error(`the log directory ${o.dir} must be closed to others and cannot be made so: ${e?.message ?? e}`)
   }
+  const append = o.append ?? ((p: string, t: string) => appendFileSync(p, t, { mode: fileMode }))
   const live = join(o.dir, LIVE)
   let size = existsSync(live) ? statSync(live).size : 0
   let born = existsSync(live) ? statSync(live).birthtimeMs || statSync(live).mtimeMs : now()
@@ -93,8 +101,7 @@ export function createLogFile(o: LogFileOptions) {
         append(live, text)
       } catch (e: any) {
         if (e?.code !== 'ENOENT') throw e
-        mkdirSync(o.dir, { recursive: true, mode: 0o700 }) // the directory was removed: make it again and try once more
-        chmodSync(o.dir, 0o700)
+        fileMode = lockDown() // the directory was removed: make it again and try once more
         size = 0
         append(live, text)
       }

package/relay/main.ts

@@ -13,7 +13,7 @@ import { randomBytes } from 'node:crypto'
 import { chmodSync, existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs'
 import { networkInterfaces } from 'node:os'
 import { dirname, join } from 'node:path'
-import { type HostedOptions } from './hosted.ts'
+import { type HostedOptions, compileSites } from './hosted.ts'
 import { type OwnerKey, newKey } from './keys.ts'
 import { ControlError, COMMANDS, ctl, startControl } from './control.ts'
 import { createLogFile } from './logfile.ts'
@@ -51,18 +51,23 @@ Flags:
   --proxy-header <name>          the header the proxy sets (X-Forwarded-For; e.g. CF-Connecting-IP)
   --allow-lan                    guests may reach private addresses (10/8, 192.168/16, ...)
   --allow-loopback-ports <list>  guests may reach this computer's loopback on these ports
-  --block-ports <list>           destination ports refused (25)
+  --block-ports <list>           destination ports refused (none)
   --allow-hosts <list>           only these names (name[:port|port], a leading . for subdomains)
-  --hosted                       the public hosted profile (docs/relay-hosted.md): per-address, network and origin
-                                 limits, byte ceilings, deny lists, a control socket, /healthz, /readyz
+  --hosted                       the public hosted profile (docs/relay-hosted.md): only listed sites, no crawling,
+                                 failed dials slowed, the month's data cap, host limits, deny lists, a control
+                                 socket, /healthz, /readyz
     --abuse-contact <text>       required: an address or URL, shown in the MOTD, /healthz and every refusal
+    --sites-file <file>          required: JSON {"sites": ["https://name", "https://*.domain", ...]}, the page
+                                 origins served; re-read on SIGHUP
+    --month-bytes <n>            bytes relayed in a UTC month (the provider's free outbound data less headers);
+                                 off pace, heavy addresses are slowed first; at it, new connections stop
+    --link-bytes-per-sec <n>     the host's link speed: when it is full, networks, then addresses, then browsers
+                                 share it evenly
     --deny-cidr <list>           dialled addresses to refuse besides the built-in ranges (the fleet's private neighbours)
     --deny-file <file>           JSON {addresses, origins, destinations}; re-read on SIGHUP, denied sessions end
-    --max-bytes-per-day <n>      stop taking new connections after this many bytes relayed in a UTC day (both ways)
-    --max-bytes-per-month <n>    the same for a UTC month
     --allow-ports <list>         only these destination ports (25, 465 and 587 are always blocked)
     --control-dir <dir>          the control socket's directory, mode 0700, never under /tmp (~/.wmd/relay/ctl)
-    --state-dir <dir>            where the byte counters are kept (~/.wmd/relay)
+    --state-dir <dir>            where the month's byte counter is kept (~/.wmd/relay)
     --start-stopped              start in stop-new until 'ctl resume' (a stop does not persist a restart otherwise)
     --log-dir <dir>              metadata log files, rotated by size and age; --log-retention-days <n> (14)
   --config <file>                JSON or TOML with any of the above, and the caps
@@ -70,11 +75,14 @@ Flags:
 `
 
 // config keys: flags (camelCase) plus the relay's caps
-const FLAG_KEYS = ['host', 'port', 'origins', 'keys', 'tlsCert', 'tlsKey', 'localTls', 'behindTls', 'trustProxy', 'proxyHeader', 'allowLan', 'allowLoopbackPorts', 'blockPorts', 'allowHosts', 'log', 'hosted', 'abuseContact', 'denyCidr', 'denyFile', 'maxBytesPerDay', 'maxBytesPerMonth', 'allowPorts', 'controlDir', 'stateDir', 'startStopped', 'logDir', 'logRetentionDays', 'logMaxBytes', 'logDirMaxBytes'] as const
+const FLAG_KEYS = ['host', 'port', 'origins', 'keys', 'tlsCert', 'tlsKey', 'localTls', 'behindTls', 'trustProxy', 'proxyHeader', 'allowLan', 'allowLoopbackPorts', 'blockPorts', 'allowHosts', 'log', 'hosted', 'abuseContact', 'sitesFile', 'monthBytes', 'linkBytesPerSec', 'denyCidr', 'denyFile', 'allowPorts', 'controlDir', 'stateDir', 'startStopped', 'logDir', 'logRetentionDays', 'logMaxBytes', 'logDirMaxBytes'] as const
 const CAP_KEYS = ['maxConns', 'maxSessions', 'maxSessionsPerGroup', 'opensPerMin', 'connectsPerMin', 'dnsPerMin', 'rateDown', 'rateUp', 'maxBytes', 'selfAddrs', 'dnsServers', 'connectTimeoutMs', 'dnsTimeoutMs'] as const
 const WISP_KEYS = ['path', 'buffer', 'maxPayload', 'maxHeldBytes', 'maxSessionHeldBytes', 'maxHeldTotal', 'maxGroupHeldBytes', 'instancesPerHour', 'maxPrincipals', 'preAuthPerAddr', 'handshakeMs', 'streamIdleMs', 'prefixKeys'] as const
-// the limits of the hosted profile, under "hosted" in a config file (hosted.ts HostedOptions; all whole numbers)
-const HOSTED_KEYS = ['groupStreams', 'groupConnectsPerMin', 'groupBytesPerHour', 'groupDnsPerMin', 'coarseSessions', 'coarseInstancesPerHour', 'coarseRateDown', 'coarseRateUp', 'originTable', 'originSessions', 'otherOriginSessions', 'noOriginSessions', 'originsPerAddrPerHour', 'originRateDown', 'originRateUp', 'maxStreams', 'maxRateDown', 'maxRateUp', 'destConnectsPerMin', 'destStreams', 'distinctDests', 'failedConnects', 'failedWindowMs', 'failedCoolMs'] as const
+// the numbers of the hosted rules, under "hosted" in a config file (hosted.ts HostedOptions; all whole numbers)
+const HOSTED_KEYS = ['sitesPerAddrPerHour', 'sitesPerNetPerHour'] as const
+// keys of the limits plan §16 removed: a config that still has them starts, with one line saying they do nothing
+const LEGACY_KEYS = new Set(['maxBytesPerDay', 'maxBytesPerMonth'])
+const LEGACY_HOSTED_KEYS = new Set(['groupStreams', 'groupConnectsPerMin', 'groupBytesPerHour', 'groupDnsPerMin', 'coarseSessions', 'coarseInstancesPerHour', 'coarseRateDown', 'coarseRateUp', 'originTable', 'originSessions', 'originShare', 'otherOriginSessions', 'noOriginSessions', 'originsPerAddrPerHour', 'originRateDown', 'originRateUp', 'maxStreams', 'maxRateDown', 'maxRateUp', 'destConnectsPerMin', 'destStreams', 'distinctDests', 'failedConnects', 'failedWindowMs', 'failedCoolMs'])
 const BOOL_FLAGS = new Set(['localTls', 'behindTls', 'allowLan', 'log', 'hosted', 'startStopped'])
 const LIST_FLAGS = new Set(['origins', 'allowLoopbackPorts', 'blockPorts', 'allowHosts', 'denyCidr', 'allowPorts'])
 
@@ -118,17 +126,27 @@ export function parseFlags(argv: string[]): Conf {
   return c
 }
 
-/** A config file (JSON, or TOML by extension). Unknown keys are refused, so a typo is not a silent default. */
-export function readConfig(file: string): Conf {
+/** A config file (JSON, or TOML by extension). Unknown keys are refused, so a typo is not a silent default. Keys of
+    removed limits are dropped with one line to `warn` each. */
+export function readConfig(file: string, warn: (line: string) => void = l => void process.stderr.write(`${l}\n`)): Conf {
   const text = readFileSync(file, 'utf8')
   const c: Conf = /\.toml$/i.test(file) ? (Bun.TOML.parse(text) as Conf) : JSON.parse(text)
   if (!c || typeof c !== 'object' || Array.isArray(c)) throw new UsageError(`${file}: expected an object`)
+  const gone = (k: string) => warn(`wmd-relay: ${file}: '${k}' is a limit this version no longer has (docs/relay-hosted.md); it is ignored`)
   for (const k of Object.keys(c)) {
-    if (k === 'wisp') {
+    if (LEGACY_KEYS.has(k)) {
+      gone(k)
+      delete c[k]
+    } else if (k === 'wisp') {
       for (const w of Object.keys(c.wisp ?? {})) if (!(WISP_KEYS as readonly string[]).includes(w)) throw new UsageError(`${file}: unknown key wisp.${w}`)
     } else if (k === 'hosted' && c.hosted && typeof c.hosted === 'object') {
-      // "hosted": true turns the profile on; "hosted": {limits} turns it on with those limits
-      for (const w of Object.keys(c.hosted)) if (!(HOSTED_KEYS as readonly string[]).includes(w)) throw new UsageError(`${file}: unknown key hosted.${w}`)
+      // "hosted": true turns the profile on; "hosted": {numbers} turns it on with those numbers
+      for (const w of Object.keys(c.hosted)) {
+        if (LEGACY_HOSTED_KEYS.has(w)) {
+          gone(`hosted.${w}`)
+          delete c.hosted[w]
+        } else if (!(HOSTED_KEYS as readonly string[]).includes(w)) throw new UsageError(`${file}: unknown key hosted.${w}`)
+      }
     } else if (k === 'origin') throw new UsageError(`${file}: the key is 'origins' (a list)`)
     else if (!(FLAG_KEYS as readonly string[]).includes(k) && !(CAP_KEYS as readonly string[]).includes(k)) throw new UsageError(`${file}: unknown key '${k}'`)
   }
@@ -159,7 +177,7 @@ function checkTypes(c: Conf) {
     if (k === 'hosted' && c.hosted && typeof c.hosted === 'object' && !Array.isArray(c.hosted)) continue
     if (c[k] !== undefined && typeof c[k] !== 'boolean') throw new UsageError(`${k} must be true or false (got ${JSON.stringify(c[k])})`)
   }
-  for (const k of ['host', 'keys', 'tlsCert', 'tlsKey', 'proxyHeader', 'abuseContact', 'denyFile', 'controlDir', 'stateDir', 'logDir'] as const) {
+  for (const k of ['host', 'keys', 'tlsCert', 'tlsKey', 'proxyHeader', 'abuseContact', 'sitesFile', 'denyFile', 'controlDir', 'stateDir', 'logDir'] as const) {
     if (c[k] !== undefined && c[k] !== null && (typeof c[k] !== 'string' || !c[k])) throw new UsageError(`${k} must be a non-empty string (got ${JSON.stringify(c[k])})`)
   }
   if (c.host === null) delete c.host
@@ -171,7 +189,7 @@ function checkTypes(c: Conf) {
       if (cidr.bits < (cidr.v === 4 ? 8 : 16)) throw new UsageError(`--trust-proxy ${x} trusts too much of the internet: a prefix shorter than /8 (IPv4) or /16 (IPv6) is refused in every mode, because ranges like 0.0.0.0/1,128.0.0.0/1 together cover every address and any sender could pick the client address the limits use; list your proxy's address or network`)
     }
   }
-  for (const k of ['maxBytesPerDay', 'maxBytesPerMonth', 'logRetentionDays', 'logMaxBytes', 'logDirMaxBytes'] as const) if (c[k] !== undefined) c[k] = num(c[k], k, k === 'logRetentionDays' || k === 'logMaxBytes' || k === 'logDirMaxBytes' ? 1 : 0)
+  for (const k of ['monthBytes', 'linkBytesPerSec', 'logRetentionDays', 'logMaxBytes', 'logDirMaxBytes'] as const) if (c[k] !== undefined) c[k] = num(c[k], k, k === 'logRetentionDays' || k === 'logMaxBytes' || k === 'logDirMaxBytes' ? 1 : 0)
   if (c.hosted && typeof c.hosted === 'object') {
     if (Array.isArray(c.hosted)) throw new UsageError('hosted must be true or a table of limits')
     for (const k of HOSTED_KEYS) if (c.hosted[k] !== undefined) c.hosted[k] = num(c.hosted[k], `hosted.${k}`, 0)
@@ -264,16 +282,14 @@ async function withLock<T>(file: string, fn: () => Promise<T>): Promise<T> {
 
 /** The relay options for a config (flags merged over the file). */
 /** What `serve` needs besides the relay's options when --hosted is on. */
-export type HostedRun = { controlDir: string; stateDir: string; denyFile?: string; logDir?: string; logMaxBytes?: number; logDirMaxBytes?: number; logRetentionDays?: number; tlsCert?: string; tlsKey?: string }
+export type HostedRun = { controlDir: string; stateDir: string; sitesFile: string; denyFile?: string; logDir?: string; logMaxBytes?: number; logDirMaxBytes?: number; logRetentionDays?: number; tlsCert?: string; tlsKey?: string }
 
-/**
- * Defaults of the hosted profile (docs/relay-hosted.md, section "Measured on this machine"): the per-guest and per-address
- * numbers one instance carried in the loopback load test, with headroom. Each is a flag, a config key or a `hosted` table key.
- */
-export const HOSTED_DEFAULTS = {
-  caps: { maxSessions: 4000, maxSessionsPerGroup: 8, maxConns: 32, opensPerMin: 20, connectsPerMin: 120, dnsPerMin: 300, rateDown: 4 << 20, rateUp: 1 << 20, maxBytes: 2 ** 30 },
-  wisp: { instancesPerHour: 30 },
-  hosted: {} as Partial<HostedOptions>,
+/** A sites file: {"sites": [origin patterns]} (hosted.ts compileSites checks each). */
+export function readSites(file: string): string[] {
+  const j = JSON.parse(readFileSync(file, 'utf8'))
+  if (!Array.isArray(j?.sites) || j.sites.some((x: any) => typeof x !== 'string')) throw new UsageError(`${file}: expected {"sites": ["https://name", ...]}`)
+  compileSites(j.sites)
+  return j.sites
 }
 
 export function relayOptions(c: Conf, env: Record<string, string | undefined> = process.env): { opts: RelayOptions; notes: string[]; url: string; localTls: boolean; hosted?: HostedRun } {
@@ -310,6 +326,7 @@ export function relayOptions(c: Conf, env: Record<string, string | undefined> =
     if (c.behindTls && !isPrivateBind(host)) throw new UsageError(`--hosted --behind-tls binds only to loopback or a private address (the proxy\'s side), not ${host}: a public bind would let anyone skip the proxy and its TLS`)
     if (!tls && !c.behindTls && !isPrivateBind(host)) throw new UsageError(`--hosted refuses plain ws:// on the public address ${host}: give --tls-cert and --tls-key, or put a TLS proxy in front with --behind-tls (bound to loopback)`)
     if (c.localTls) throw new UsageError('--local-tls is for a person\'s own computer, not --hosted')
+    if (!c.sitesFile) throw new UsageError('--hosted needs --sites-file <file>: the page origins it serves (JSON {"sites": [...]}); a hosted relay serves only listed sites')
   }
   const w = c.wisp ?? {}
   const secret = env.WMD_RELAY_SECRET || randomBytes(32).toString('base64url') // tokens (wmn's issuer) only when the secret is shared
@@ -325,7 +342,6 @@ export function relayOptions(c: Conf, env: Record<string, string | undefined> =
     allowLoopbackPorts: ports(c.allowLoopbackPorts, '--allow-loopback-ports'),
     blockedPorts: ports(c.blockPorts, '--block-ports'),
     allowHosts: c.allowHosts,
-    ...(isHosted ? HOSTED_DEFAULTS.caps : {}),
     ...Object.fromEntries(CAP_KEYS.filter(k => c[k] !== undefined).map(k => [k, c[k]])),
     ...(Array.isArray(c.trustProxy) ? { trustProxy: c.trustProxy } : {}),
     ...(c.proxyHeader ? { proxyHeader: c.proxyHeader } : {}),
@@ -333,14 +349,14 @@ export function relayOptions(c: Conf, env: Record<string, string | undefined> =
     ...(isHosted
       ? {
           hosted: {
-            ...HOSTED_DEFAULTS.hosted,
             ...(typeof c.hosted === 'object' ? c.hosted : {}),
             abuseContact: String(c.abuseContact).trim(),
             version: VERSION,
             startStopped: !!c.startStopped,
             usageFile: join(c.stateDir ?? relayDir(), 'usage.json'),
-            maxBytesPerDay: c.maxBytesPerDay,
-            maxBytesPerMonth: c.maxBytesPerMonth,
+            sites: readSites(c.sitesFile),
+            ...(c.monthBytes ? { monthBytes: c.monthBytes } : {}),
+            ...(c.linkBytesPerSec ? { linkBytesPerSec: c.linkBytesPerSec } : {}),
             denyCidrs: c.denyCidr,
           } as HostedOptions,
         }
@@ -355,7 +371,6 @@ export function relayOptions(c: Conf, env: Record<string, string | undefined> =
       checkHost: loopback && !isHosted, // a hosted relay answers to its own name
       trustProxy: c.trustProxy === true, // a list is the relay's `trustProxy` option (only those peers are believed)
       version: VERSION,
-      ...(isHosted ? HOSTED_DEFAULTS.wisp : {}),
       ...Object.fromEntries(WISP_KEYS.filter(k => w[k] !== undefined).map(k => [k, w[k]])),
     },
   }
@@ -371,7 +386,7 @@ export function relayOptions(c: Conf, env: Record<string, string | undefined> =
   const shown = host === '0.0.0.0' || host === '::' ? 'HOST' : host.includes(':') ? `[${host.replace(/%/g, '%25')}]` : host // a zone id is %25 in a URL
   const url = `${tls ? 'wss' : 'ws'}://${shown}:${port}${w.path ?? '/wisp/'}`
   const hostedRun: HostedRun | undefined = isHosted
-    ? { controlDir: c.controlDir ?? join(relayDir(), 'ctl'), stateDir: c.stateDir ?? relayDir(), denyFile: c.denyFile, logDir: c.logDir, logMaxBytes: c.logMaxBytes, logDirMaxBytes: c.logDirMaxBytes, logRetentionDays: c.logRetentionDays, tlsCert: c.tlsCert, tlsKey: c.tlsKey }
+    ? { controlDir: c.controlDir ?? join(relayDir(), 'ctl'), stateDir: c.stateDir ?? relayDir(), sitesFile: c.sitesFile, denyFile: c.denyFile, logDir: c.logDir, logMaxBytes: c.logMaxBytes, logDirMaxBytes: c.logDirMaxBytes, logRetentionDays: c.logRetentionDays, tlsCert: c.tlsCert, tlsKey: c.tlsKey }
     : undefined
   return { opts, notes, url, localTls: !!c.localTls, hosted: hostedRun }
 }
@@ -382,6 +397,13 @@ function ownAddress(host: string): boolean {
   return Object.values(networkInterfaces()).some(l => (l || []).some(i => i.address.split('%')[0].toLowerCase() === h))
 }
 
+/** Flags over the file. `--hosted` alone turns the profile on and keeps the file's `"hosted": {...}` settings. */
+export function mergeConfig(file: Conf, flags: Conf): Conf {
+  const c = { ...file, ...flags }
+  if (flags.hosted === true && file.hosted && typeof file.hosted === 'object') c.hosted = file.hosted
+  return c
+}
+
 async function serve(argv: string[]) {
   let c = parseFlags(argv)
   let fromFile: [string, string][] = [] // [flag text, key in the file] for the settings the file gave and no flag overrode
@@ -391,7 +413,7 @@ async function serve(argv: string[]) {
     delete c.config
     const f = readConfig(file)
     fromFile = Object.keys(f).filter(k => !(k in c)).map(k => [`--${(k === 'origins' ? 'origin' : k).replace(/[A-Z]/g, m => '-' + m.toLowerCase())}`, k])
-    c = { ...f, ...c }
+    c = mergeConfig(f, c)
   }
   let made: ReturnType<typeof relayOptions>
   try {
@@ -463,6 +485,12 @@ async function serve(argv: string[]) {
           say(`certificate NOT reloaded (the old one stays): ${e?.message || e}`)
         }
       }
+      try {
+        r.hosted!.setSites(readSites(hostedRun.sitesFile))
+        say('sites reloaded')
+      } catch (e: any) {
+        say(`sites NOT reloaded (the old list stays): ${e?.message || e}`)
+      }
       if (hostedRun.denyFile) {
         try {
           const x = r.reloadDeny(readDeny())

package/relay/relay.ts

@@ -15,16 +15,16 @@
 //   WMD_RELAY_SELF           extra addresses that are this host (a public IP behind NAT); every
 //                            interface address is included anyway
 //   WMD_RELAY_DNS            resolvers to ask (ip or ip:port, comma list; default: the system's)
-//   Caps are per guest identity (the token's uid: one guest machine of one page; the token's
-//   sid when it has none) and survive reconnects for as long as that identity holds a token:
-//   WMD_RELAY_MAX_CONNS (64) connections at once; WMD_RELAY_CONNECTS_PER_MIN (600),
-//   WMD_RELAY_DNS_PER_MIN (1200), WMD_RELAY_OPENS_PER_MIN (30) WebSocket opens;
-//   WMD_RELAY_RATE_DOWN (16777216), WMD_RELAY_RATE_UP (4194304) bytes/s, every byte (a new
-//   stream's first window too); WMD_RELAY_MAX_BYTES (4294967296) bytes, both ways.
-//   One live WebSocket per identity (a newer one replaces it). WMD_RELAY_MAX_SESSIONS (100) in
-//   all, WMD_RELAY_MAX_SESSIONS_PER_GROUP (8) per token group (grp: the client the issuer saw,
-//   e.g. its address or user). The relay's state is in memory: a relay restart resets it.
-//   WMD_RELAY_BLOCK_PORTS (25)        destination ports refused
+//   Caps, none by default (plan §16: the owner sets what they want), are per guest identity (the
+//   token's uid: one guest machine of one page; the token's sid when it has none) and survive
+//   reconnects for as long as that identity holds a token:
+//   WMD_RELAY_MAX_CONNS connections at once; WMD_RELAY_CONNECTS_PER_MIN, WMD_RELAY_DNS_PER_MIN,
+//   WMD_RELAY_OPENS_PER_MIN WebSocket opens; WMD_RELAY_RATE_DOWN, WMD_RELAY_RATE_UP bytes/s,
+//   every byte (a new stream's first window too); WMD_RELAY_MAX_BYTES bytes, both ways.
+//   One live WebSocket per identity (a newer one replaces it). WMD_RELAY_MAX_SESSIONS in all,
+//   WMD_RELAY_MAX_SESSIONS_PER_GROUP per token group (grp: the client the issuer saw, e.g. its
+//   address or user). The relay's state is in memory: a relay restart resets it.
+//   WMD_RELAY_BLOCK_PORTS             destination ports refused (none)
 //   WMD_RELAY_LOG=0                   no JSON log lines on stdout
 //   WMD_RELAY_WISP=0                  do not serve Wisp at /wisp/ (W59, on by default since D-444; token
 //                                     clients only here: the standalone wmd-relay, relay/main.ts, is the keyless one)
@@ -36,12 +36,12 @@
 // own resolution (policy.ts): private, loopback, link-local, metadata, reserved and
 // multicast ranges and this host's own addresses are refused, so a name that resolves (or
 // rebinds) to one of them cannot reach it. A session needs a token (token.ts); connections,
-// connect and DNS rates, bandwidth and total bytes are capped per session.
+// connect and DNS rates, bandwidth and total bytes are capped per session when set.
 
 import { E, MAX_DATA, PROTOCOL } from '../src/net/proto.js'
 import { type DialFn, type EngineOptions, type ResolveFn, createEngine } from './engine.ts'
 import { createV1 } from './v1.ts'
-import { type Governor, type HostedOptions, type DenySpec, createGovernor } from './hosted.ts'
+import { type Governor, type HostedOptions, type DenySpec, coarseKey, createGovernor, pickVictim } from './hosted.ts'
 import { type Cidr, parseCidr } from './policy.ts'
 import { DRAIN_WORDS, type WispOptions, createWisp } from './wisp.ts'
 
@@ -57,7 +57,7 @@ export type RelayOptions = EngineOptions & {
   tls?: { cert: string; key: string }
   /** A TLS proxy or tunnel is in front: secrets on a reachable plain-ws bind are acceptable. */
   behindTls?: boolean
-  /** The hosted profile (plan §15, hosted.ts): limits, lists, ceilings, /healthz and /readyz. */
+  /** The hosted profile (plan §16, hosted.ts): the rules, lists, /healthz and /readyz. */
   hosted?: HostedOptions
   /** Proxy addresses or CIDRs: only these peers are believed about the client address, which is the first entry from the right of `proxyHeader` that is not one of them. No "trust any". */
   trustProxy?: string[]
@@ -76,11 +76,8 @@ export function createRelay(o: RelayOptions) {
     throw new Error(`keys on plain ws:// at ${host} would cross the network in clear text; give a TLS certificate or say a TLS proxy is in front (behindTls)`)
   }
   let port = 0
-  // the grace after a byte ceiling is over: every open stream ends (CLOSE 0x49); the sessions stay for the next day
-  const endStreams = (words: string) => {
-    for (const s of [...engine.sessions.values()]) for (const st of [...s.streams.values()]) engine.fail(s, st, E.LIMIT, words)
-  }
-  const gov: Governor | null = o.hosted ? createGovernor({ onCeilingGrace: w => endStreams(w), ...o.hosted }) : null
+  const dialLimitMs = o.connectTimeoutMs ?? 10_000
+  const gov: Governor | null = o.hosted ? createGovernor({ dialLimitMs, ...(o.dnsServers?.length ? { dnsServers: o.dnsServers.length } : {}), ...o.hosted }) : null
   // hosted: mail ports are always refused, whatever the operator adds
   const blockedPorts = gov ? [...new Set([...MAIL_PORTS, ...(o.blockedPorts ?? [])])] : o.blockedPorts
   const trusted: Cidr[] = (o.trustProxy ?? []).map(x => {
@@ -94,6 +91,21 @@ export function createRelay(o: RelayOptions) {
   const v1 = createV1(engine, o)
   const wisp = wispOn ? createWisp(engine, { ...o, blockedPorts, port: () => port, wisp: { ...o.wisp, origins: o.wisp?.origins ?? o.origins, enabled: true, ...(gov ? { hosted: gov } : {}), ...(proxy ? { proxy } : {}) } }) : null
 
+  // rule G: free one socket for a newcomer: the oldest unfinished handshake, else the longest-idle stream of whoever holds the most
+  gov?.setReclaim(() => {
+    const hs = (wisp?.handshakes() ?? []).map(ws => ({ kind: 'handshake' as const, at: ws.data.at as number, ws }))
+    const sts: { kind: 'stream'; net: string; addr: string; sid: string; last: number; s: any; st: any }[] = []
+    for (const s of engine.sessions.values()) {
+      const grp = s.hx?.grp ?? s.p.grp
+      for (const st of s.streams.values()) if (st.connected) sts.push({ kind: 'stream', net: coarseKey(grp), addr: grp, sid: s.sid, last: st.w?.last ?? st.openedAt, s, st })
+    }
+    const v = pickVictim(hs, sts, performance.now(), dialLimitMs)
+    if (!v) return false
+    if (v.kind === 'handshake') wisp!.closeHandshake(v.ws)
+    else engine.fail(v.s, v.st, E.LIMIT, 'the relay is full: this idle connection was closed to free a socket', 'busy')
+    return true
+  })
+
   const streams = () => {
     let n = 0
     for (const s of engine.sessions.values()) n += s.streams.size
@@ -102,11 +114,10 @@ export function createRelay(o: RelayOptions) {
   // /healthz and /readyz hold counts and the abuse contact, nothing about any client, origin, destination or key
   function health(path: string): Response {
     const why = gov!.notAccepting()
-    const ceiling = gov!.ceiling()
-    if (path === '/readyz') return new Response(why ? `not ready: ${why}\n${gov!.contactLine}` : 'ready\n', { status: why ? 503 : 200 })
+    if (path === '/readyz') return new Response(why ? `not ready: ${why.words}\n${gov!.contactLine}` : 'ready\n', { status: why ? 503 : 200 })
     return Response.json({
-      version: gov!.version ?? null, sessions: engine.sessions.size, streams: streams(), accepting: !why,
-      state: gov!.isDraining() ? 'draining' : gov!.isStopped() ? 'stopped' : 'running', ceiling, abuseContact: gov!.contact,
+      version: gov!.version ?? null, sessions: engine.sessions.size, streams: streams(), accepting: !why, rule: why?.rule ?? null,
+      state: gov!.isDraining() ? 'draining' : gov!.isStopped() ? 'stopped' : 'running', ...gov!.state(), abuseContact: gov!.contact,
     })
   }
 
@@ -178,7 +189,7 @@ export function createRelay(o: RelayOptions) {
     status() {
       return {
         accepting: gov ? gov.accepting() : true, state: gov?.isDraining() ? 'draining' : gov?.isStopped() ? 'stopped' : 'running',
-        ceiling: gov?.ceiling() ?? null, sessions: engine.sessions.size, streams: streams(), usage: gov?.usage() ?? null, origins: gov?.originStats() ?? null,
+        rule: gov?.notAccepting()?.rule ?? null, sessions: engine.sessions.size, streams: streams(), ...(gov ? gov.state() : {}),
       }
     },
     /** Hosted: replace the deny lists; sessions and streams they now deny end. Returns how many sessions and streams. */
@@ -188,9 +199,10 @@ export function createRelay(o: RelayOptions) {
       for (const s of [...engine.sessions.values()]) {
         for (const st of [...s.streams.values()]) {
           const i = st.to.lastIndexOf(':')
-          if (gov!.isDeniedDest(st.to.slice(0, i), Number(st.to.slice(i + 1)))) {
+          const port = Number(st.to.slice(i + 1))
+          if (gov!.isDeniedDest(st.to.slice(0, i), port) || (st.site && gov!.isDeniedDest(st.site, port))) {
             n++
-            engine.fail(s, st, E.BLOCKED, 'this destination is blocked by the operator')
+            engine.fail(s, st, E.BLOCKED, 'this destination is blocked by the operator', 'denied-destination')
           }
         }
       }