Configuration / Capacity

Workers & limits

Control process count, connection memory, shutdown, upstream deadlines, and resolution.

Processes

worker_count = 4

The default is the logical CPU count. Each process owns its event loop and connection state; the kernel distributes new connections through SO_REUSEPORT. Use one while debugging, then tune production counts with measurements.

Per-worker limits

[worker]
max_connections = 1024
max_read_buffer_size = 65536
max_write_buffer_size = 8388608
idle_timeout_ms = 30000
drain_timeout_ms = 10000

Key	Purpose
`max_connections`	Concurrent clients tracked by each worker.
`max_read_buffer_size`	Maximum accumulated request bytes per connection.
`max_write_buffer_size`	Maximum queued response bytes per connection; bounds slow-reader memory.
`idle_timeout_ms`	Close inactive connections after this interval.
`drain_timeout_ms`	Allow active work this long during graceful shutdown.

All values must exceed zero. The approximate total connection ceiling is worker_count × max_connections.

Proxy deadlines

[proxy]
connect_timeout_ms = 3000
write_timeout_ms = 30000
read_timeout_ms = 30000

These independently bound connecting to an upstream, forwarding the request, and receiving its response. All are milliseconds and must exceed zero.

DNS

[dns]
resolver_threads = 2
timeout_ms = 3000

Resolution runs outside the socket loop. The thread count and lookup deadline must exceed zero. Multiple DNS addresses are connection fallbacks, not a balancing policy.

Deployment and operations

The master process reads the configuration and supervises workers. Each worker creates its own listeners and owns its clients; SO_REUSEPORT lets the kernel distribute incoming connections between them.

On Linux, worker CPU affinity is attempted. On macOS and BSD it is logged as unavailable and does not prevent startup. Startup logs record the selected runtime and any automatic fallback.

Send SIGINT or SIGTERM to begin graceful shutdown: workers stop accepting new work and drain active connections until drain_timeout_ms. A crashed worker is restarted with bounded backoff, capped at 10 seconds and reset after stable operation. Structured logs and each worker's final metrics report provide the current operational visibility; thwip_ctl is planned for richer control.