[Rspamd-Users] What's the deal with multiple buckets at the rate limit?

[Daniel, Sebastian]

Hello,

It is about the Ratelimit module:
how may I understand the use of multiple buckets?

As an example:

rates {
   user = {
     bucket = [
     {
       burst = 100;
       rate = "10 / 1min"
     },
     {
       burst = 10;
       rate = "100 / 1min";
     }]
   }
}

Would this mean that the buckets are symbolically parallel or one above the other in the row as listed?

If in row:
Would that mean the first one holds 100 and lets 10 more through every minute into the second one, which can only hold 10, but lets them through much faster (100 per minute)?

If Parallel:
Would that mean that the second one defunds the first one a bit when it is full?
That is, if the first is "full" and blocks, then the second can mitigate this a little, because it has a much higher rate?

And what is the purpose of the expiry of a bucket?
What I can see in the redis, the key of a bucket is never reset (p), but only the burst value (b).
Can someone explain these two values (p and b), that is, how they affect each other?

As I understand it, the bucket in the redis remains full (p) (pending messages) and only the leak rate in connection with the elapsed time determines what it lets through (b).
So that at some point the bucket is completely "empty" again, it must be regenerated (expiry).
But why is the b-value reduced? and sometimes not?

Or have I completely misunderstood the behavior?