Relay limits and quotas

This page states the relay’s limits in the Developer Preview as trueseal-relay ADR-0012 decides them, with the size limit of trueseal-sync ADR-0025 and the TTL ceiling of ADR-0034. The client’s response to each refusal is on Delivery issues.

Keying

Push Sessions carry no sender identity, so no limit is keyed on a sender.
Every limit is keyed on the recipient Inbox, the Device key, or a global count.
No limit reads, stores or is keyed on an IP address. Per-IP limiting belongs at the Operator’s firewall or reverse proxy.

Defaults

Limit	Default	When exceeded	Kind
Blobs per Inbox	10,000 Blobs	`inbox full`	Temporary
Bytes per Inbox	268,435,456 bytes (256 MiB)	`inbox full`	Temporary
Push rate per recipient	Token bucket, 20 pushes per second sustained, bursts of 500	`rate limited`	Temporary
Concurrent connections per listener	1,000 connections	Connection closed
Concurrent Receive Sessions per Device key	4 Receive Sessions	New session refused
Envelope size	Derived from the Protocol Size Limit, 61,440 bytes (60 KiB) of `Sync` body	`too large`	Permanent
TTL	30 days	Blob reaped

Refusal codes carry no content.
On a temporary refusal the client keeps the outbox entry and retries with backoff. No delivery issue is raised.
On too large the client removes the outbox entry and raises sendFailed(messageId, tooLarge).

Deadlines and liveness

Item	Value
Noise handshake deadline, both listeners	10 seconds
Push Session deadline, accept to close	30 seconds
Client heartbeat on a Receive Session	Every 25 seconds; the relay echoes it
Receive Session idle close	75 seconds with no frame received

The client starts heartbeats. The relay does not.

Retention

A Blob stays in its Inbox until the recipient sends DeliverAck, which the client sends after its handler finishes (trueseal-sync ADR-0026), or until the TTL.
The reaper deletes expired Blobs every hour by default.
A reaped Blob is reported to neither device.

Changing limits

The Operator can change every value.
The envelope size limit (the Relay Size Limit) and the TTL can only be lowered.
The relay refuses to start with a size limit above the Protocol Size Limit.
The relay refuses to start with a TTL above 30 days: the Replay Window (60 days) minus the client Outbox expiry (30 days), so a message pushed on its last outbox day still arrives inside the Replay Window.
An app using a relay with a lower Relay Size Limit passes a matching lower maxPayloadBytes to open(). maxPayloadBytes counts the body; the Relay Size Limit counts the sealed envelope.

Setting	Variable	Format
TTL	`TRUESEAL_RELAY_TTL`	Go duration, e.g. `720h`
Reap interval	`TRUESEAL_RELAY_REAP_INTERVAL`	Go duration, e.g. `1h`
Connections per listener	`TRUESEAL_RELAY_MAX_CONNECTIONS`	Integer
Relay Size Limit	`TRUESEAL_RELAY_MAX_ENVELOPE_BYTES`	Integer bytes of the protobuf Envelope

Accepted attack

Anyone who knows a Device’s public key can use up that Device’s quota and delay its delivery. This is a targeted availability attack. The relay does not prevent it. Confidentiality and integrity of the queued Blobs are unaffected.