Rate limiting

dygo.WithGlobalGuards(ratelimit.Guard(ratelimit.Options{Limit: 100, Window: time.Minute}))

r.Post("/login", dygo.Handle(c.Login), ratelimit.Limit(5, time.Minute))
r.Get("/status", h, ratelimit.Skip())

Each route counts separately per client IP, and requests refill evenly over the window (GCRA), so there is no burst at a window boundary. Behind a proxy, set TrustProxy: true and ProxyHops to the number of proxies you run (default 1): the client IP is read from X-Forwarded-For counting from the right, because the left part is whatever the client sent. middleware.CompressMin(n) changes the gzip threshold. Blocked requests get 429 with Retry-After. The default store is in memory; implement ratelimit.Store to share limits across instances.