From 714712b862b2be2702ec7656fca4e4722f4a9cb6 Mon Sep 17 00:00:00 2001 From: Ruben Hensen Date: Sun, 25 Oct 2026 13:11:20 +0100 Subject: [PATCH] docs: WordPress is capped at 12 workers --- docs/roadmap.md | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/docs/roadmap.md b/docs/roadmap.md index b6fab85..2c0df6d 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -280,16 +280,22 @@ Counted 2026-10-25 over the 73 running containers: kube-system - [ ] Memory limits, once there are daytime numbers: the night ones miss immich's machine learning at work (it idles at 234Mi) -- [ ] WordPress (scoutingmbg.nl) was OOMKilled at 08:27:59 UTC on +- [x] WordPress (scoutingmbg.nl) was OOMKilled at 08:27:59 UTC on 2026-10-25, its third restart: a crawler asked for 88 pages and assets within a few seconds (normally ~6 a minute), Apache started a PHP worker - for each, and the container went past its 1Gi limit (500s first, then - the kill; back within seconds). Unrelated to the NetworkPolicies; memory - sat at ~500Mi before. Fixes, in order: cap Apache's prefork workers - (`MaxRequestWorkers` ~16, so a burst queues instead of filling memory), - a page cache plugin. Rate limiting per visitor in Envoy doesn't work - yet: node001 passes TLS through, so every request arrives from - 46.224.26.65; that needs the PROXY protocol from node001's nginx to Envoy + for each (~45-60 MB each, `MaxRequestWorkers` was the default 150), and + the container went past its 1Gi limit. Unrelated to the + NetworkPolicies. Now capped at 12 workers through the chart's + `apachePortsConfig` (ports.conf comes after mods-enabled/*.conf), checked + with `apache2ctl -t` in the same image first. Replaying the burst (90 + page requests, 40 at a time): all 200, at most 13 Apache processes and + 572Mi, no restart; the price is waiting (4.3s median, up to ~22s at the + peak) instead of a crash +- [ ] A page cache plugin for WordPress: a page takes seconds to render, + which is what makes a burst queue up +- [ ] Rate limiting per visitor in Envoy needs the client's address, which + node001 loses: it passes TLS through, so every request arrives from + 46.224.26.65. That needs the PROXY protocol from node001's nginx to Envoy (ClientTrafficPolicy `enableProxyProtocol`) - [x] Probes for gitea (`/api/healthz`), freshrss (TCP, since mod_auth_openidc answers 401 to non-browsers) and serpbear (`/login`)