diff options
Diffstat (limited to 'f3s/git-server/helm-chart/templates')
| -rw-r--r-- | f3s/git-server/helm-chart/templates/configmap-cgit.yaml | 19 | ||||
| -rw-r--r-- | f3s/git-server/helm-chart/templates/deployment.yaml | 26 |
2 files changed, 38 insertions, 7 deletions
diff --git a/f3s/git-server/helm-chart/templates/configmap-cgit.yaml b/f3s/git-server/helm-chart/templates/configmap-cgit.yaml index 519ab26..7dda693 100644 --- a/f3s/git-server/helm-chart/templates/configmap-cgit.yaml +++ b/f3s/git-server/helm-chart/templates/configmap-cgit.yaml @@ -15,8 +15,23 @@ data: # Set the virtual root for correct URL generation virtual-root=/ - # Disable caching to avoid permission issues - cache-size=0 + # Response cache. With scan-path over ~80 repos on NFS, an uncached render + # reopens every repo to resolve its age column: measured 376ms per index + # page, 87% of it NFS wait rather than CPU. Caching drops that to ~19-29ms. + # cache-root must be node-local and writable by UID 33 -- it points at the + # cgit-runtime emptyDir mounted on /tmp, NOT at the NFS-backed /repos + # (caching on NFS is what originally caused the permission trouble here). + # The startup script in deployment.yaml creates the directory. + cache-root=/tmp/cgit-cache + cache-size=1000 + + # TTLs in minutes; these are cgit's defaults, stated explicitly so the + # staleness window after a push is visible rather than implied. + # Static pages are keyed by commit SHA, so they never need to expire. + cache-root-ttl=5 + cache-repo-ttl=5 + cache-dynamic-ttl=5 + cache-static-ttl=-1 # Enable git-config for per-repo settings enable-git-config=1 diff --git a/f3s/git-server/helm-chart/templates/deployment.yaml b/f3s/git-server/helm-chart/templates/deployment.yaml index 28733c5..4206cd8 100644 --- a/f3s/git-server/helm-chart/templates/deployment.yaml +++ b/f3s/git-server/helm-chart/templates/deployment.yaml @@ -204,8 +204,19 @@ spec: }\ ' /tmp/conf.d/default.conf - # Start fcgiwrap with socket in /tmp - spawn-fcgi -s /tmp/fcgiwrap.sock -n -- /usr/bin/fcgiwrap & + # cgit's response cache lives here (see cache-root in the cgit-config + # ConfigMap). It must exist before cgit runs -- cgit does not create it. + # /tmp is the cgit-runtime emptyDir: node-local, so cache writes never + # go back over NFS. The cache is intentionally per-pod and cold after + # a restart. + mkdir -p /tmp/cgit-cache + + # Start fcgiwrap with socket in /tmp. + # -c 4 preforks 4 workers. With a single worker the 26 ArgoCD apps + # polling conf.git through git-http-backend serialize against web UI + # renders on the same CGI process; measured 4 concurrent requests at + # only ~1.5x the throughput of one. + spawn-fcgi -s /tmp/fcgiwrap.sock -n -- /usr/bin/fcgiwrap -c 4 & sleep 1 chmod 666 /tmp/fcgiwrap.sock exec nginx -c /tmp/nginx.conf -g 'daemon off;' @@ -239,13 +250,18 @@ spec: allowPrivilegeEscalation: false capabilities: drop: ["ALL"] + # cgit idled at 105m against the previous 250m limit -- 42% of its own + # ceiling at rest -- and the cgroup had accumulated ~2.9h of throttled + # time (nr_throttled 96979). Renders are bursty, so the quota was being + # hit on ordinary page loads. Headroom raised for the 4 fcgiwrap + # workers; the request tracks measured idle usage. resources: requests: - cpu: 50m + cpu: 100m memory: 128Mi limits: - cpu: 250m - memory: 256Mi + cpu: 1000m + memory: 512Mi volumes: - name: repos |