# limen v0.2.1 - Table of Contents

> Native Elixir L7 bot protection: scoring, rate limiting and proof-of-work challenges

## Pages

- [Limen](readme.md)
- [Changelog](changelog.md)
- [LICENSE](license.md)

- Guides
  - [Getting started](getting-started.md)
  - [Concepts](concepts.md)
  - [Rolling out with dry-run](dry-run-rollout.md)
  - [Honeypots and the maze](honeypots-and-maze.md)
  - [JA4 behind nginx](nginx-ja4.md)
  - [Tuning](tuning.md)
  - [Testing](testing.md)

## Modules

- Gate
  - [Limen](Limen.md): Native Elixir L7 bot protection.
  - [Limen.Context](Limen.Context.md): Everything Limen knows about a request while it is being evaluated.
  - [Limen.Decision](Limen.Decision.md): The explainable record of a verdict.
  - [Limen.Decision.Match](Limen.Decision.Match.md): A rule that matched, and the values its condition observed.

  - [Limen.LiveView](Limen.LiveView.md): Gates LiveView connections, see `Limen.Socket`.
  - [Limen.Plug](Limen.Plug.md): The request gate.
  - [Limen.Socket](Limen.Socket.md): Gates WebSocket connections, which bypass `Limen.Plug`.

- Cluster
  - [Limen.Cluster](Limen.Cluster.md): Propagates an instance's bans across a cluster of nodes.

- Honeypots
  - [Limen.Maze](Limen.Maze.md): An endless maze of slow, plausible pages for clients caught misbehaving.
  - [Limen.Maze.Bundled](Limen.Maze.Bundled.md): The maze model of Limen's own corpus, built at compile time.
  - [Limen.Maze.Dice](Limen.Maze.Dice.md): Loaded dice: weighted random choices in constant time.
  - [Limen.Maze.Model](Limen.Maze.Model.md): The language model maze pages are written with.
  - [Limen.Trap](Limen.Trap.md): Honeypots: places only automated clients go, and what happens when they do.

- Instances
  - [Limen.Instance](Limen.Instance.md): A running Limen instance: its configuration and handles to its state.
  - [Limen.Owner](Limen.Owner.md): Owns an instance's tables and publishes its `Limen.Instance`.
  - [Limen.Supervisor](Limen.Supervisor.md): Supervises one Limen instance.

- Configuration
  - [Limen.Config](Limen.Config.md): Instance configuration.
  - [Limen.Config.Keys](Limen.Config.Keys.md): Keys derived from the configured secret.
  - [Limen.Lists](Limen.Lists.md): Named lists policies can test membership against, such as known-bad JA4
fingerprints or allow-listed networks.

- Challenge
  - [Limen.Challenge](Limen.Challenge.md): The proof-of-work challenge, modelled on the [Anubis] proxy.
  - [Limen.Challenge.Assets](Limen.Challenge.Assets.md): The challenge page's script, worker and stylesheet.
  - [Limen.Challenge.Page](Limen.Challenge.Page.md): The challenge interstitial, and how to make it your own.
  - [Limen.Challenge.Pass](Limen.Challenge.Pass.md): The pass cookie a client gets for solving a challenge.
  - [Limen.Challenge.Replay](Limen.Challenge.Replay.md): Makes every challenge token single-use.
  - [Limen.Challenge.Replay.Rotator](Limen.Challenge.Replay.Rotator.md): Rotates an instance's replay filter every challenge `:ttl`.

  - [Limen.Challenge.Token](Limen.Challenge.Token.md): Stateless, signed challenge tokens.

- Policies
  - [Limen.Policy](Limen.Policy.md): A compiled DSL for bot policies.
  - [Limen.Policy.Default](Limen.Policy.Default.md): The policy `Limen.Plug` uses when none is given.
  - [Limen.Policy.Runtime](Limen.Policy.Runtime.md): Functions compiled policies call on the request path.

  - [Limen.Tarpit](Limen.Tarpit.md): Holds tarpitted requests before denying them.

- State
  - [Limen.State](Limen.State.md): An instance's shared, lock-free state.
  - [Limen.State.BanList](Limen.State.BanList.md): Banned prefixes, with expiry.
  - [Limen.State.Gcra](Limen.State.Gcra.md): Lock-free [GCRA] (generic cell rate algorithm) rate limiting on ETS.
  - [Limen.State.Rotator](Limen.State.Rotator.md): Clears an instance's expired time-window slots shortly after each epoch
boundary.
  - [Limen.State.Sweeper](Limen.State.Sweeper.md): Periodically removes an instance's expired bans and idle GCRA keys.
  - [Limen.State.Window](Limen.State.Window.md): Sliding-window request counters.

- Sketches
  - [Limen.Sketch](Limen.Sketch.md): Fixed-memory probabilistic structures for high-cardinality state.
  - [Limen.Sketch.Bloom](Limen.Sketch.Bloom.md): A lock-free [Bloom filter] on `:atomics`.
  - [Limen.Sketch.CountMin](Limen.Sketch.CountMin.md): A lock-free [Count-Min Sketch] on `:atomics`.
  - [Limen.Sketch.HyperLogLog](Limen.Sketch.HyperLogLog.md): A lock-free [HyperLogLog] on `:atomics`.
  - [Limen.Sketch.RotatingBloom](Limen.Sketch.RotatingBloom.md): "Seen recently" as two Bloom filter generations.

- Signals
  - [Limen.Signal](Limen.Signal.md): A source of facts about a request.
  - [Limen.Signal.Asn](Limen.Signal.Asn.md): Maps the client address to its autonomous system (ASN).
  - [Limen.Signal.Asn.Download](Limen.Signal.Asn.Download.md): Fetches IP-to-ASN data over HTTP(S) into a file, only when it changed.
  - [Limen.Signal.Asn.Loader](Limen.Signal.Asn.Loader.md): Loads IP-to-ASN data for `Limen.Signal.Asn` and keeps it current, off the
request path.
  - [Limen.Signal.Asn.Schedule](Limen.Signal.Asn.Schedule.md): When the ASN loader checks for new data, as pure functions of the time.
  - [Limen.Signal.Asn.Source](Limen.Signal.Asn.Source.md): Where `Limen.Signal.Asn` looks client addresses up.
  - [Limen.Signal.Asn.Table](Limen.Signal.Asn.Table.md): IP-to-ASN data packed into a handful of binaries, for one
`:persistent_term` entry.
  - [Limen.Signal.Behaviour](Limen.Signal.Behaviour.md): What each client prefix has been doing over the last minute.
  - [Limen.Signal.ClientIP](Limen.Signal.ClientIP.md): Resolves the client address and prefix.
  - [Limen.Signal.Fcrdns](Limen.Signal.Fcrdns.md): Verifies that a request claiming to come from a search engine crawler
really does, with forward-confirmed reverse DNS (FCrDNS): the check search
engines document themselves, as [Google does for Googlebot][FCrDNS].
  - [Limen.Signal.Fcrdns.DNS](Limen.Signal.Fcrdns.DNS.md): DNS lookups used to verify crawlers, as a behaviour so they can be replaced
(in tests, or with a caching resolver).
  - [Limen.Signal.Fcrdns.InetRes](Limen.Signal.Fcrdns.InetRes.md): `Limen.Signal.Fcrdns.DNS` on top of OTP's `:inet_res` resolver.
  - [Limen.Signal.Fcrdns.Resolver](Limen.Signal.Fcrdns.Resolver.md): Verifies an instance's queued crawler addresses in the background.
  - [Limen.Signal.HttpShape](Limen.Signal.HttpShape.md): Checks whether a request looks like what its user agent claims to be.
  - [Limen.Signal.JA4](Limen.Signal.JA4.md): Reads the [JA4] TLS client fingerprint set by the TLS terminator.
  - [Limen.Signal.UserAgent](Limen.Signal.UserAgent.md): A deliberately small user agent classifier.

- Observability
  - [Limen.Dashboard](Limen.Dashboard.md): A Phoenix LiveDashboard page for a Limen instance.
  - [Limen.Dashboard.Data](Limen.Dashboard.Data.md): Node-local figures of an instance for dashboards: counters, the busiest
clients, bans and recent decisions.
  - [Limen.DecisionLog](Limen.DecisionLog.md): A sampled, structured decision log.
  - [Limen.DecisionLog.Flusher](Limen.DecisionLog.Flusher.md): Drains an instance's decision log buffer to its sink periodically, see
`Limen.DecisionLog.Sink`.

  - [Limen.DecisionLog.Logger](Limen.DecisionLog.Logger.md): The default `Limen.DecisionLog.Sink`: logs every sampled decision as a
structured `Logger` report (see `Limen.DecisionLog.report/1`).
  - [Limen.DecisionLog.Sink](Limen.DecisionLog.Sink.md): Where `Limen.DecisionLog.Flusher` writes sampled decisions.
  - [Limen.Stats](Limen.Stats.md): Lock-free, node-local counters for dashboards and health checks.
  - [Limen.Telemetry](Limen.Telemetry.md): Telemetry events emitted by Limen.

- Utilities
  - [Limen.IP](Limen.IP.md): IP address helpers: parsing, prefix aggregation and CIDR matching.
  - [Limen.Test](Limen.Test.md): Helpers for testing an application that uses Limen.

