feat: right-size production config for 10k maxconn with ECC cert support

deploy/ansible/roles/app/templates/docker-compose.yml.j2

@@ -10,10 +10,10 @@ services:
     restart: unless-stopped
     ulimits:
       nofile:
-        soft: 1048576
-        hard: 1048576
+        soft: 65536
+        hard: 65536
     sysctls:
-      net.core.somaxconn: "65535"
+      net.core.somaxconn: "16384"
       net.ipv4.tcp_tw_reuse: "1"
     networks:
       - internal
@@ -33,8 +33,8 @@ services:
     restart: unless-stopped
     ulimits:
       nofile:
-        soft: 1048576
-        hard: 1048576
+        soft: 65536
+        hard: 65536
     networks:
       - internal
 
@@ -53,8 +53,8 @@ services:
     restart: unless-stopped
     ulimits:
       nofile:
-        soft: 1048576
-        hard: 1048576
+        soft: 65536
+        hard: 65536
     networks:
       - internal
 

deploy/ansible/roles/app/templates/haproxy.cfg.j2

@@ -1,15 +1,14 @@
 global
     log stderr local0 err
-    maxconn 100000
+    maxconn 10000
     # Performance tuning for high-throughput
     tune.bufsize 16384
     tune.maxrewrite 1024
     tune.http.maxhdr 128
     tune.comp.maxlevel 1
-    tune.ssl.default-dh-param 2048
-    # TLS configuration optimized for Cloudflare-to-origin connections
-    ssl-default-bind-curves X25519:prime256v1:secp384r1
-    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
+    # TLS configuration optimized for Cloudflare Origin CA ECC certificates
+    ssl-default-bind-curves prime256v1:X25519:secp384r1
+    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384
     ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
     ssl-default-bind-options prefer-client-ciphers ssl-min-ver TLSv1.2 no-tls-tickets
 
@@ -19,7 +18,7 @@ defaults
     option  httplog
     option  dontlognormal
     option  http-keep-alive
-    maxconn 100000
+    maxconn 10000
     timeout connect 5s
     timeout client  30s
     timeout server  30s
@@ -46,7 +45,7 @@ frontend https_in
 
     # Rate limiting: tiered based on global request rate
     # Track per-IP request rate (per minute)
-    stick-table type string len 45 size 500k expire 1m store http_req_rate(1m)
+    stick-table type string len 45 size 100k expire 1m store http_req_rate(1m)
     http-request track-sc0 req.hdr(CF-Connecting-IP)
     # Track global request rate (per second)
     http-request track-sc1 str(global) table global_rate_tracking

deploy/ansible/roles/base/templates/limits.conf.j2

@@ -1,5 +1,5 @@
-# System-wide file descriptor limits for high-throughput service
-*    soft    nofile    1048576
-*    hard    nofile    1048576
-root soft    nofile    1048576
-root hard    nofile    1048576
+# System-wide file descriptor limits for web service (10k concurrent connections)
+*    soft    nofile    65536
+*    hard    nofile    65536
+root soft    nofile    65536
+root hard    nofile    65536

deploy/ansible/roles/base/templates/sysctl.conf.j2

@@ -1,19 +1,19 @@
-# Network performance tuning for high-throughput web service
+# Network performance tuning for web service (10k concurrent connections)
 
 # Socket buffer sizes
-net.core.rmem_max = 16777216
-net.core.wmem_max = 16777216
-net.core.rmem_default = 1048576
-net.core.wmem_default = 1048576
+net.core.rmem_max = 8388608
+net.core.wmem_max = 8388608
+net.core.rmem_default = 262144
+net.core.wmem_default = 262144
 
 # TCP buffer auto-tuning
-net.ipv4.tcp_rmem = 4096 87380 16777216
-net.ipv4.tcp_wmem = 4096 65536 16777216
+net.ipv4.tcp_rmem = 4096 87380 8388608
+net.ipv4.tcp_wmem = 4096 65536 8388608
 
 # Connection backlog
-net.core.somaxconn = 65535
-net.core.netdev_max_backlog = 65535
-net.ipv4.tcp_max_syn_backlog = 65535
+net.core.somaxconn = 16384
+net.core.netdev_max_backlog = 16384
+net.ipv4.tcp_max_syn_backlog = 16384
 
 # TCP connection reuse and timeout
 net.ipv4.tcp_tw_reuse = 1
@@ -44,11 +44,11 @@ net.ipv4.tcp_sack = 1
 
 # SYN flood protection
 net.ipv4.tcp_syncookies = 1
-net.ipv4.tcp_max_tw_buckets = 2000000
+net.ipv4.tcp_max_tw_buckets = 200000
 
 # File descriptor limits
-fs.file-max = 2097152
-fs.nr_open = 2097152
+fs.file-max = 131072
+fs.nr_open = 131072
 
 # VM tuning
 vm.swappiness = 10
@@ -56,4 +56,4 @@ vm.dirty_ratio = 15
 vm.dirty_background_ratio = 5
 
 # Connection tracking (for iptables/fail2ban)
-net.netfilter.nf_conntrack_max = 262144
+net.netfilter.nf_conntrack_max = 32768

deploy/ansible/roles/docker/tasks/main.yml

@@ -58,8 +58,8 @@
     dest: /etc/systemd/system/docker.service.d/override.conf
     content: |
       [Service]
-      LimitNOFILE=1048576
-      LimitNPROC=infinity
+      LimitNOFILE=65536
+      LimitNPROC=8192
       LimitCORE=infinity
     owner: root
     group: root

deploy/ansible/roles/docker/templates/daemon.json.j2

@@ -8,13 +8,13 @@
   "default-ulimits": {
     "nofile": {
       "Name": "nofile",
-      "Hard": 1048576,
-      "Soft": 1048576
+      "Hard": 65536,
+      "Soft": 65536
     },
     "nproc": {
       "Name": "nproc",
-      "Hard": 65535,
-      "Soft": 65535
+      "Hard": 8192,
+      "Soft": 8192
     }
   },
   "default-shm-size": "256M"