mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
f52da1c875
The shared proxy's nginx.conf derived worker_connections from the
openresty container's pids_limit. pids_limit caps processes and threads,
worker_connections caps simultaneous sockets per worker (client and
upstream), so with pids_limit 256 and one worker the whole host's proxy
held about 256 sockets, roughly 128 proxied requests in flight across
every vhost. Raising pids_limit to buy connections would loosen the
fork-bomb guard.
svc-prx-openresty now declares services.openresty.worker_connections
(4096 per worker, the common nginx production range, enough for several
chunk-heavy apps such as OpenWebUI at ~150-170 requests per page load).
WEBSERVER_PROXY_WORKER_CONNECTIONS reads it through lookup('config'),
without a default, so a missing key fails loudly. pids_limit stays 256.
WEBSERVER_PROXY_WORKER_RLIMIT_NOFILE is derived as 2x worker_connections
(8192), one descriptor for each client and upstream socket of a proxied
request, and nginx.conf renders it as worker_rlimit_nofile. The openresty
container pins its nofile ulimit (soft and hard) to the same value:
workers call setrlimit as root without CAP_SYS_RESOURCE, so they can only
lower the hard limit, and the inherited hard limit depends on the host
daemon (Docker >= 25 defaults to 1024:524288, DiD nests whatever the
outer container has). An explicit ulimit makes the rlimit succeed on
every host instead of logging a setrlimit alert.
The unit test pins worker_connections 4096, worker_rlimit_nofile 8192 and
the container ulimit, and fails when worker_connections follows
pids_limit again.
Live proof (compose deploy of web-svc-html, both plays failed=0): the
deployed nginx.conf renders worker_rlimit_nofile 8192 and
worker_connections 4096; openresty's master, worker and cache manager
run with "Max open files 8192 8192"; the openresty log carries no
setrlimit or "worker_connections are not enough" line.
Closes #1300
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
49 lines
1.3 KiB
YAML
49 lines
1.3 KiB
YAML
---
|
|
openresty:
|
|
modes:
|
|
compose:
|
|
enabled: true
|
|
swarm:
|
|
enabled: true
|
|
# nocheck: default-placement-manager edge proxy + TLS terminator at a known IP; sys-front-inj-* Lua pipeline cannot ride the overlay yet (Future Extension: Traefik with Yaegi)
|
|
placement: manager
|
|
bond: 1
|
|
enabled: true
|
|
shared: true
|
|
name: openresty
|
|
ports:
|
|
internal:
|
|
http: 80
|
|
https: 443
|
|
public:
|
|
http: 80
|
|
https: 443
|
|
onion:
|
|
http: true
|
|
# nocheck: onion-flag the hidden service is already the transport encryption, and the onion address has no certificate a TLS listener could present
|
|
https: false
|
|
healthcheck:
|
|
test: ["CMD", "openresty", "-t", "-q"]
|
|
min_storage: 264MB
|
|
backup:
|
|
disabled: true
|
|
cpus: 0.5
|
|
mem_reservation: 1g
|
|
mem_limit: 2g
|
|
image: openresty/openresty
|
|
version: 1.31.8.1-alpine
|
|
custom: true
|
|
lifecycle: beta
|
|
pids_limit: 256
|
|
worker_connections: 4096
|
|
|
|
# nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
|
|
tor:
|
|
bond: 0.5
|
|
enabled: "{{ 'svc-net-tor' in group_names }}"
|
|
shared: true # nocheck: dynamic-flag
|
|
# nocheck: dynamic-flag - proxy state is fully re-rendered by the deploy (configs, certs via binds), the backup consumer stays permanently off
|
|
container_backup:
|
|
enabled: false
|
|
shared: true
|