feat(dashmate): plumb Tenderdash consensus DoS rate-limit knobs

[shumkov]

What

Plumbs three Tenderdash [consensus] rate-limit knobs through the dashmate ansible role so a network can override them via the generated dashmate.json:

ansible var	dashmate key	default
dashmate_platform_drive_tenderdash_consensus_verification_rate_limit	verificationRateLimit	300
dashmate_platform_drive_tenderdash_consensus_peer_vote_rate_limit	peerVoteRateLimit	600
dashmate_platform_drive_tenderdash_consensus_peer_data_rate_limit	peerDataRateLimit	500

Changes (2 files)

1. ansible/roles/dashmate/defaults/main.yml — three vars with the Tenderdash defaults, next to the existing ..._consensus_peer_* vars.
2. ansible/roles/dashmate/templates/dashmate.json.j2 — inject the three vars (as JSON numbers) into the consensus object, after the peer block and before unsafeOverride.

This repo drives dashmate by writing dashmate.json from the Jinja template (not via dashmate config set), so the values land in dashmate's config directly.

⛔ BLOCKED-ON a dashmate release that carries the new schema keys

The dashmate.json this template writes is validated by the installed dashmate against its JSON schema, and consensus is additionalProperties: false. Emitting these keys against a dashmate build that does not know them is a validation error.

• Depends on dashpay/platform PR #4274 (adds the keys to dashmate's template, defaults, schema, and a backfill migration).
• Once that lands and ships in a dashmate release, the network's dashmate_version must be bumped to that release, in lockstep with this PR.
• dashmate_version is intentionally not bumped here — a dashmate build containing the keys does not exist yet. Do not merge until it does.

Nothing here is on the critical path for a first devnet: with the keys omitted, a Tenderdash node falls back to its compiled-in defaults (300 / 600 / 500).

Per-network override example (dash-network-configs)

Per-network files in dash-network-configs are flat ansible-var overrides. Config sets live on devnet-* branches, so rather than a separate PR here is the block to drop into a network's YAML (e.g. a devnet-* branch, alongside the other dashmate_platform_drive_tenderdash_* keys) to point at a custom image and override the limits:

# custom DoS-hardened Tenderdash for this devnet
tendermint_image: dashpay/tenderdash:1.6.1-dos-devnet1

# pin dashmate to a release that carries the new consensus schema keys
# (from dashpay/platform#4274); the exact version is TBD until that ships
dashmate_version: <release-carrying-the-keys>

# consensus DoS knobs (override the 300/600/500 defaults)
dashmate_platform_drive_tenderdash_consensus_verification_rate_limit: 0     # 0 = disabled, else >= 33
dashmate_platform_drive_tenderdash_consensus_peer_vote_rate_limit: 1200
dashmate_platform_drive_tenderdash_consensus_peer_data_rate_limit: 1000

Note: verification_rate_limit must be 0 (disabled) or >= 33; Tenderdash rejects 1..32 at node start. Overriding only in the network YAML without this PR + the dashmate release does nothing (the Jinja var would be undefined).

Dependency order

dashpay/platform#4274 → dashmate release with the keys → this PR (bump dashmate_version) → per-network dash-network-configs override.

Verification

• git diff reviewed; both edits are pure adds mirroring existing consensus vars / JSON structure.
• YAML parse of defaults/main.yml — pass; the three vars parse as integers.
• Rendered the injected Jinja lines with the default vars and json.loads'd the result — valid JSON, values are numbers (not strings) matching the dashmate schema — pass.

---

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 4011885b-b4a1-4a6a-bbde-b5408d41294c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}