feat(proxy-route): allow -1 to disable rate limits

internal/apps/openflare/proxy_route/errs.go

@@ -27,7 +27,7 @@ const (
 	errProxyRouteCertDomainLength    = "domain_cert_ids must match domains length"
 	errProxyRouteRedirectHTTP        = "redirect_http requires enable_https"
 	errProxyRouteBasicAuth           = "basic_auth_username and basic_auth_password cannot be empty when basic auth is enabled"
-	errProxyRouteLimitRate           = "limit_rate must be a number or use the 512k / 1m format"
+	errProxyRouteLimitRate           = "limit_rate must be a number or use the 512k / 1m format, or -1 to disable"
 	errProxyRouteCachePolicy         = "cache policy is not supported"
 	errProxyRouteCacheSuffix         = "cache suffix format is invalid"
 	errProxyRouteCachePath           = "cache path rule format is invalid"

internal/apps/openflare/proxy_route/helpers.go

@@ -326,8 +326,8 @@ func validateProxyRouteZoneDomainCertificates(ctx context.Context, domains []mod
 }
 
 func normalizeProxyRouteLimitConnValue(value int, field string) (int, error) {
-	if value < 0 {
+	if value < -1 {
-		return 0, fmt.Errorf("%s must be greater than or equal to 0", field)
+		return 0, fmt.Errorf("%s must be greater than or equal to -1", field)
 	}
 	return value, nil
 }
@@ -337,6 +337,9 @@ func normalizeProxyRouteLimitRate(raw string) (string, error) {
 	if normalized == "" || normalized == "0" {
 		return "", nil
 	}
+	if normalized == "-1" {
+		return "-1", nil
+	}
 	if !proxyRouteLimitRatePattern.MatchString(normalized) {
 		return "", errors.New(errProxyRouteLimitRate)
 	}

internal/apps/openflare/proxy_route/helpers_limit_test.go

@@ -0,0 +1,29 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package proxy_route
+
+import "testing"
+
+func TestNormalizeProxyRouteLimitConnValue(t *testing.T) {
+	t.Parallel()
+	got, err := normalizeProxyRouteLimitConnValue(-1, "limit_conn_per_server")
+	if err != nil || got != -1 {
+		t.Fatalf("want -1, got %d err %v", got, err)
+	}
+	if _, err := normalizeProxyRouteLimitConnValue(-2, "limit_conn_per_server"); err == nil {
+		t.Fatal("expected error for -2")
+	}
+}
+
+func TestNormalizeProxyRouteLimitRate(t *testing.T) {
+	t.Parallel()
+	got, err := normalizeProxyRouteLimitRate("-1")
+	if err != nil || got != "-1" {
+		t.Fatalf("want -1, got %q err %v", got, err)
+	}
+	got, err = normalizeProxyRouteLimitRate("0")
+	if err != nil || got != "" {
+		t.Fatalf("want empty inherit, got %q err %v", got, err)
+	}
+}