feat(rpc): add stream and keepalive limits to indexer gRPC server (#10980)

Author: mergify[bot]

zebra-rpc/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- The indexer gRPC server now bounds concurrent HTTP/2 streams per connection (20)
+  and closes dead connections via HTTP/2 keepalive pings (30s interval, 10s timeout)
+  ([#10980](https://github.com/ZcashFoundation/zebra/pull/10980)).
+
 ### Fixed
 
 - Clarified the error message returned by `getrawtransaction` for transactions

zebra-rpc/src/indexer/server.rs

@@ -1,6 +1,6 @@
 //! A tonic RPC server for Zebra's indexer API.
 
-use std::net::SocketAddr;
+use std::{net::SocketAddr, time::Duration};
 
 use tokio::task::JoinHandle;
 use tonic::transport::{server::TcpIncoming, Server};
@@ -11,6 +11,19 @@ use zebra_state::ReadState;
 
 use crate::{indexer::indexer_server::IndexerServer, server::OPENED_RPC_ENDPOINT_MSG};
 
+/// Maximum concurrent HTTP/2 streams per connection.
+///
+/// The primary clients (Zaino and Zallet) each open 1-2 streams via
+/// `init_read_state_with_syncer`. 20 provides generous headroom while
+/// bounding resource usage from untrusted clients.
+const MAX_CONCURRENT_STREAMS: u32 = 20;
+
+/// Interval between HTTP/2 keepalive pings sent to detect dead connections.
+const HTTP2_KEEPALIVE_INTERVAL: Duration = Duration::from_secs(30);
+
+/// Timeout for HTTP/2 keepalive pings before the connection is closed.
+const HTTP2_KEEPALIVE_TIMEOUT: Duration = Duration::from_secs(10);
+
 type ServerTask = JoinHandle<Result<(), BoxError>>;
 
 /// Indexer RPC service.
@@ -56,6 +69,9 @@ where
 
     let server_task: JoinHandle<Result<(), BoxError>> = tokio::spawn(async move {
         Server::builder()
+            .max_concurrent_streams(Some(MAX_CONCURRENT_STREAMS))
+            .http2_keepalive_interval(Some(HTTP2_KEEPALIVE_INTERVAL))
+            .http2_keepalive_timeout(Some(HTTP2_KEEPALIVE_TIMEOUT))
             .add_service(reflection_service)
             .add_service(IndexerServer::new(indexer_service))
             .serve_with_incoming(TcpIncoming::from(tcp_listener))