Work out ulimit file descriptors instantly with clear inputs, formula shown and shareable results.
Each connection consumes at least one descriptor, and a proxy needs two — one client-side and one upstream. Dividing by worker count gives the per-process requirement, and a 50 percent margin covers bursts and lingering sockets in TIME_WAIT. For systemd services the limit must be set with LimitNOFILE in the unit file; the default of 1024 is the classic cause of accept failures under load.
Descriptor budget
per worker = connections x descriptors per connection / workers + other files; recommended = per worker x 1.5; fs.file-max = recommended x workers x 1.2
Because ulimit in a login shell does not affect systemd-managed services. Set LimitNOFILE in the unit or a drop-in override and reload the daemon.
The limit itself is cheap; each actually-open descriptor costs kernel memory. Setting a high ceiling is safe, but monitor actual usage.