# Rules

> How moat rules run: top to bottom, first verdict wins, what add and limit do to evaluation, how moat fmt formats rules, and what a rule counter counts.

Source: https://moatfw.dev/docs/rules

```moat
rule NAME { when CONDITION then ACTIONS }
```

Rules run top to bottom:

- `pass` and `drop` end evaluation.
- `add` does not: evaluation continues with the next rule unless a
  verdict follows it in the same rule.
- `limit` lets the packet continue to the next rule while it is under the
  rate. Above the rate it runs its `on exceed` actions, or drops the
  packet when there are none.

## Formatting

`moat fmt` prints the canonical form: one declaration per line, single
blank lines kept where the source had any, rules on one line when they
fit in 80 columns and otherwise split into `when` and `then` lines
indented by four spaces. Comments are kept; a comment written inside a
rule moves to the line above it.

```sh
$ moat fmt rules.moat
$ moat fmt --write *.moat
$ moat fmt --check *.moat
```

`--write` (or `-w`) rewrites the files in place. `--check` changes
nothing: like `gofmt -l`, it prints the path of every file that is not in
canonical form, one per line, and exits with 1 if there are any and 0 if
all are clean, so in CI it fails when a file is not formatted. `--check`
and `--write` together are a usage error, exit 2.

## Counters

A rule's counter counts the packets its actions applied to: for a
`limit` rule, the packets above the rate. A rule with only `add` actions
counts every packet it matched and lets it continue.