From 6d18eecd3fb3da6320515d3aa6a32c26bae1a76c Mon Sep 17 00:00:00 2001 From: NetworkCats Date: Thu, 5 Mar 2026 21:33:43 +0800 Subject: [PATCH] feat: right-size production config for 10k maxconn with ECC cert support --- .../roles/app/templates/docker-compose.yml.j2 | 14 +++++----- .../roles/app/templates/haproxy.cfg.j2 | 13 ++++----- .../roles/base/templates/limits.conf.j2 | 10 +++---- .../roles/base/templates/sysctl.conf.j2 | 28 +++++++++---------- deploy/ansible/roles/docker/tasks/main.yml | 4 +-- .../roles/docker/templates/daemon.json.j2 | 8 +++--- 6 files changed, 38 insertions(+), 39 deletions(-) diff --git a/deploy/ansible/roles/app/templates/docker-compose.yml.j2 b/deploy/ansible/roles/app/templates/docker-compose.yml.j2 index 95cf2e7..0ff402e 100644 --- a/deploy/ansible/roles/app/templates/docker-compose.yml.j2 +++ b/deploy/ansible/roles/app/templates/docker-compose.yml.j2 @@ -10,10 +10,10 @@ services: restart: unless-stopped ulimits: nofile: - soft: 1048576 - hard: 1048576 + soft: 65536 + hard: 65536 sysctls: - net.core.somaxconn: "65535" + net.core.somaxconn: "16384" net.ipv4.tcp_tw_reuse: "1" networks: - internal @@ -33,8 +33,8 @@ services: restart: unless-stopped ulimits: nofile: - soft: 1048576 - hard: 1048576 + soft: 65536 + hard: 65536 networks: - internal @@ -53,8 +53,8 @@ services: restart: unless-stopped ulimits: nofile: - soft: 1048576 - hard: 1048576 + soft: 65536 + hard: 65536 networks: - internal diff --git a/deploy/ansible/roles/app/templates/haproxy.cfg.j2 b/deploy/ansible/roles/app/templates/haproxy.cfg.j2 index c26569d..4ab3a20 100644 --- a/deploy/ansible/roles/app/templates/haproxy.cfg.j2 +++ b/deploy/ansible/roles/app/templates/haproxy.cfg.j2 @@ -1,15 +1,14 @@ global log stderr local0 err - maxconn 100000 + maxconn 10000 # Performance tuning for high-throughput tune.bufsize 16384 tune.maxrewrite 1024 tune.http.maxhdr 128 tune.comp.maxlevel 1 - tune.ssl.default-dh-param 2048 - # TLS configuration optimized for Cloudflare-to-origin connections - ssl-default-bind-curves X25519:prime256v1:secp384r1 - ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384 + # TLS configuration optimized for Cloudflare Origin CA ECC certificates + ssl-default-bind-curves prime256v1:X25519:secp384r1 + ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384 ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 ssl-default-bind-options prefer-client-ciphers ssl-min-ver TLSv1.2 no-tls-tickets @@ -19,7 +18,7 @@ defaults option httplog option dontlognormal option http-keep-alive - maxconn 100000 + maxconn 10000 timeout connect 5s timeout client 30s timeout server 30s @@ -46,7 +45,7 @@ frontend https_in # Rate limiting: tiered based on global request rate # Track per-IP request rate (per minute) - stick-table type string len 45 size 500k expire 1m store http_req_rate(1m) + stick-table type string len 45 size 100k expire 1m store http_req_rate(1m) http-request track-sc0 req.hdr(CF-Connecting-IP) # Track global request rate (per second) http-request track-sc1 str(global) table global_rate_tracking diff --git a/deploy/ansible/roles/base/templates/limits.conf.j2 b/deploy/ansible/roles/base/templates/limits.conf.j2 index 4bce7c3..194f2d9 100644 --- a/deploy/ansible/roles/base/templates/limits.conf.j2 +++ b/deploy/ansible/roles/base/templates/limits.conf.j2 @@ -1,5 +1,5 @@ -# System-wide file descriptor limits for high-throughput service -* soft nofile 1048576 -* hard nofile 1048576 -root soft nofile 1048576 -root hard nofile 1048576 +# System-wide file descriptor limits for web service (10k concurrent connections) +* soft nofile 65536 +* hard nofile 65536 +root soft nofile 65536 +root hard nofile 65536 diff --git a/deploy/ansible/roles/base/templates/sysctl.conf.j2 b/deploy/ansible/roles/base/templates/sysctl.conf.j2 index 671913e..addb67b 100644 --- a/deploy/ansible/roles/base/templates/sysctl.conf.j2 +++ b/deploy/ansible/roles/base/templates/sysctl.conf.j2 @@ -1,19 +1,19 @@ -# Network performance tuning for high-throughput web service +# Network performance tuning for web service (10k concurrent connections) # Socket buffer sizes -net.core.rmem_max = 16777216 -net.core.wmem_max = 16777216 -net.core.rmem_default = 1048576 -net.core.wmem_default = 1048576 +net.core.rmem_max = 8388608 +net.core.wmem_max = 8388608 +net.core.rmem_default = 262144 +net.core.wmem_default = 262144 # TCP buffer auto-tuning -net.ipv4.tcp_rmem = 4096 87380 16777216 -net.ipv4.tcp_wmem = 4096 65536 16777216 +net.ipv4.tcp_rmem = 4096 87380 8388608 +net.ipv4.tcp_wmem = 4096 65536 8388608 # Connection backlog -net.core.somaxconn = 65535 -net.core.netdev_max_backlog = 65535 -net.ipv4.tcp_max_syn_backlog = 65535 +net.core.somaxconn = 16384 +net.core.netdev_max_backlog = 16384 +net.ipv4.tcp_max_syn_backlog = 16384 # TCP connection reuse and timeout net.ipv4.tcp_tw_reuse = 1 @@ -44,11 +44,11 @@ net.ipv4.tcp_sack = 1 # SYN flood protection net.ipv4.tcp_syncookies = 1 -net.ipv4.tcp_max_tw_buckets = 2000000 +net.ipv4.tcp_max_tw_buckets = 200000 # File descriptor limits -fs.file-max = 2097152 -fs.nr_open = 2097152 +fs.file-max = 131072 +fs.nr_open = 131072 # VM tuning vm.swappiness = 10 @@ -56,4 +56,4 @@ vm.dirty_ratio = 15 vm.dirty_background_ratio = 5 # Connection tracking (for iptables/fail2ban) -net.netfilter.nf_conntrack_max = 262144 +net.netfilter.nf_conntrack_max = 32768 diff --git a/deploy/ansible/roles/docker/tasks/main.yml b/deploy/ansible/roles/docker/tasks/main.yml index 08fccc9..5a0b0fc 100644 --- a/deploy/ansible/roles/docker/tasks/main.yml +++ b/deploy/ansible/roles/docker/tasks/main.yml @@ -58,8 +58,8 @@ dest: /etc/systemd/system/docker.service.d/override.conf content: | [Service] - LimitNOFILE=1048576 - LimitNPROC=infinity + LimitNOFILE=65536 + LimitNPROC=8192 LimitCORE=infinity owner: root group: root diff --git a/deploy/ansible/roles/docker/templates/daemon.json.j2 b/deploy/ansible/roles/docker/templates/daemon.json.j2 index 02925d3..d1abca6 100644 --- a/deploy/ansible/roles/docker/templates/daemon.json.j2 +++ b/deploy/ansible/roles/docker/templates/daemon.json.j2 @@ -8,13 +8,13 @@ "default-ulimits": { "nofile": { "Name": "nofile", - "Hard": 1048576, - "Soft": 1048576 + "Hard": 65536, + "Soft": 65536 }, "nproc": { "Name": "nproc", - "Hard": 65535, - "Soft": 65535 + "Hard": 8192, + "Soft": 8192 } }, "default-shm-size": "256M"