add random timeout on deny

[Pofilo]

When I receive a lot of requests, I may want to slow down a little bit (this will delay the next request).

Note that:

• I'm not familiar with Go (I did not use any linters..)
• I don't know the consequences of this sleep (will it block other goroutines? how limited is the pool?)

[PascalMinder]

No. The implementation is fine on that front, it only delays the response for the denied request itself. Go's net/http server dispatches each request to its own goroutine, and time. Sleep parks only the calling goroutine.

But if the intent is to slow down "a lot of simultaneous requests" the server needs to hold a connection for each request. This would mean rate x delayOnDenyMs. E.g. 1,000 req/s with a 2s delay means ~2,000 goroutines/connections held open concurrently. That can exhaust:

• File descriptors (each open connection is one fd)
• Memory, if the flood is large enough or delay long enough.
• Traefik's own connection/listener limits, if configured (e.g. maxIdleConnsPerHost, transport limits)