Struct RetryConfig 

pub struct RetryConfig {
    pub attempts: u32,
    pub retry_post: bool,
    pub backoff_base_ms: u64,
    pub backoff_cap_ms: u64,
    pub retry_statuses: Vec<u16>,
    pub retry_transport: bool,
    pub budget_percent: u32,
    pub buffer_max_bytes: u64,
    pub hedge: Option<HedgeConfig>,
    pub total_deadline_ms: Option<u64>,
    pub buffer_first_frame_bytes: u64,
}

Upstream retry knobs (DW-014). All fields default; a retries: block with no keys is equivalent to retries off (attempts defaults to 0).

Frozen semantics (see upstream/proxy/retries module docs):

• attempts is the maximum number of RETRIES beyond the first attempt (0 = off). Validation caps it at 10.
• Only requests whose body was fully buffered within buffer_max_bytes may be retried; an over-cap body streams without retry. Buffering is opt-in: the default (0) buffers only empty bodies, so the default proxy path stays unbuffered.
• Retries happen strictly BEFORE response headers arrive on the final attempt; a response body that dies mid-stream is never retried (its failure is reported to passive health instead).
• Every retried attempt is charged against the upstream’s rolling-window retry budget (budget_percent).
• total_deadline_ms (REL-01) caps the wall-clock time from the first attempt to the last, INCLUDING backoff delays between attempts. Absent leaves the cross-attempt budget unbounded (the v1 default, kept for backwards compatibility). When set, a retry whose backoff would cross the deadline is aborted and the last response/error is returned to the client; the per-attempt read_ms timeout still bounds each individual attempt. Standard in Envoy and NGINX.

Fields

attempts: u32

Maximum retries beyond the first attempt (default 0 = off).

retry_post: bool

Retry non-idempotent POST requests. Default false: POST is never retried unless an operator explicitly opts in here (a retried POST may replay a body the upstream already partially processed).

backoff_base_ms: u64

Exponential backoff base in milliseconds (default 25): the nominal delay before retry n is min(base * 2^(n-1), backoff_cap_ms).

backoff_cap_ms: u64

Exponential backoff ceiling in milliseconds (default 250). Must be

= backoff_base_ms.

retry_statuses: Vec<u16>

Response statuses that trigger a retry when received as the upstream response status (default [502, 503, 504]). Each entry must be a valid 4xx/5xx status. An empty list disables status-based retries.

retry_transport: bool

Retry on transport errors (connect timeout/refusal/reset/framing) and per-attempt read timeouts (default true).

budget_percent: u32

Retry budget: the maximum percentage of requests to this upstream, in a rolling window, that may be retries (default 10). Must be in (0, 100]. When the budget is exhausted, failing requests fail through to the client instead of retrying.

buffer_max_bytes: u64

Request-body buffering cap in bytes (default 0 = no buffering). A request body is buffered (and becomes replayable) only while it fits within this cap; larger bodies stream and are never retried.

hedge: Option<HedgeConfig>

Request hedging (DW-063): after hedge_after_ms milliseconds without a response, a speculative duplicate request is sent to a different endpoint; the first response wins and the loser is cancelled. Requires buffer_max_bytes > 0 (the body must be replayable to send a hedge copy) and idempotent methods (GET, HEAD, OPTIONS, TRACE, PUT) — POST is hedged only when retry_post is also true. Absent (or hedge_after_ms = 0) disables hedging. At most hedge_max speculative copies are sent per request (default 1).

total_deadline_ms: Option<u64>

Cross-attempt total retry deadline in milliseconds (REL-01): caps the wall-clock time from the first attempt to the last, INCLUDING backoff delays between attempts. Absent leaves the cross-attempt budget unbounded (the v1 default, kept for backwards compatibility). When set, a retry whose backoff would cross the deadline is aborted and the last response/error is returned to the client; the per-attempt read_ms timeout still bounds each individual attempt. Must be in (0, MAX_RETRY_TOTAL_DEADLINE_MS]; 0 is rejected (omit the field for unbounded).

buffer_first_frame_bytes: u64

Streaming failover first-frame buffer cap in bytes (REL-05, #216). When > 0, the proxy buffers up to this many bytes of the upstream response body BEFORE forwarding any bytes to the client. If the upstream fails (connection reset, read timeout, framing error) before the buffer fills or the body completes, the proxy can still retry the request to a different endpoint — the client has not yet received any bytes, so the response is not committed. Once the buffer fills (or the body completes), the buffered prefix is flushed to the client and the rest of the body streams frame-by-frame (the stream is then committed; a later mid-body failure is terminal, as in v1). Default 0 = no first-frame buffering (v1 behavior: the response is committed as soon as headers resolve). Requires attempts > 0 and buffer_max_bytes > 0 (the request body must be replayable).

Trait Implementations

impl Clone for RetryConfig

fn clone(&self) -> RetryConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RetryConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for RetryConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for RetryConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for RetryConfig

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl PartialEq for RetryConfig

fn eq(&self, other: &RetryConfig) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for RetryConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for RetryConfig