From 424a3cf07654a9a323cf8591c2ebf9ee177a3fdd Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Sun, 26 Jul 2026 00:35:39 +0300 Subject: git-server: cut cgit render time by enabling its response cache cgit ran with cache-size=0 against scan-path over ~80 repos on NFS, so every request reopened all of them to resolve the index age column. Measured 376ms per index render, of which only ~50ms was CPU -- the rest was NFS wait. With the cache enabled the same render takes ~19-29ms. cache-root points at the existing node-local cgit-runtime emptyDir rather than the NFS-backed /repos; caching onto NFS is what the old "permission issues" comment was actually about. The startup script creates the directory since cgit does not. fcgiwrap ran as a single worker, so the 26 ArgoCD apps polling conf.git through git-http-backend serialized against web UI renders; 4 concurrent requests managed only ~1.5x the throughput of one. Preforking 4 workers separates them. The cgit container also idled at 105m against a 250m limit and had accumulated ~2.9h of throttled time (nr_throttled 96979), so raise the ceiling and set the request from measured idle usage. Co-Authored-By: Claude Opus 5 --- .../helm-chart/templates/configmap-cgit.yaml | 19 ++++++++++++++-- .../helm-chart/templates/deployment.yaml | 26 +++++++++++++++++----- 2 files changed, 38 insertions(+), 7 deletions(-) (limited to 'f3s/git-server/helm-chart/templates') diff --git a/f3s/git-server/helm-chart/templates/configmap-cgit.yaml b/f3s/git-server/helm-chart/templates/configmap-cgit.yaml index 519ab26..7dda693 100644 --- a/f3s/git-server/helm-chart/templates/configmap-cgit.yaml +++ b/f3s/git-server/helm-chart/templates/configmap-cgit.yaml @@ -15,8 +15,23 @@ data: # Set the virtual root for correct URL generation virtual-root=/ - # Disable caching to avoid permission issues - cache-size=0 + # Response cache. With scan-path over ~80 repos on NFS, an uncached render + # reopens every repo to resolve its age column: measured 376ms per index + # page, 87% of it NFS wait rather than CPU. Caching drops that to ~19-29ms. + # cache-root must be node-local and writable by UID 33 -- it points at the + # cgit-runtime emptyDir mounted on /tmp, NOT at the NFS-backed /repos + # (caching on NFS is what originally caused the permission trouble here). + # The startup script in deployment.yaml creates the directory. + cache-root=/tmp/cgit-cache + cache-size=1000 + + # TTLs in minutes; these are cgit's defaults, stated explicitly so the + # staleness window after a push is visible rather than implied. + # Static pages are keyed by commit SHA, so they never need to expire. + cache-root-ttl=5 + cache-repo-ttl=5 + cache-dynamic-ttl=5 + cache-static-ttl=-1 # Enable git-config for per-repo settings enable-git-config=1 diff --git a/f3s/git-server/helm-chart/templates/deployment.yaml b/f3s/git-server/helm-chart/templates/deployment.yaml index 28733c5..4206cd8 100644 --- a/f3s/git-server/helm-chart/templates/deployment.yaml +++ b/f3s/git-server/helm-chart/templates/deployment.yaml @@ -204,8 +204,19 @@ spec: }\ ' /tmp/conf.d/default.conf - # Start fcgiwrap with socket in /tmp - spawn-fcgi -s /tmp/fcgiwrap.sock -n -- /usr/bin/fcgiwrap & + # cgit's response cache lives here (see cache-root in the cgit-config + # ConfigMap). It must exist before cgit runs -- cgit does not create it. + # /tmp is the cgit-runtime emptyDir: node-local, so cache writes never + # go back over NFS. The cache is intentionally per-pod and cold after + # a restart. + mkdir -p /tmp/cgit-cache + + # Start fcgiwrap with socket in /tmp. + # -c 4 preforks 4 workers. With a single worker the 26 ArgoCD apps + # polling conf.git through git-http-backend serialize against web UI + # renders on the same CGI process; measured 4 concurrent requests at + # only ~1.5x the throughput of one. + spawn-fcgi -s /tmp/fcgiwrap.sock -n -- /usr/bin/fcgiwrap -c 4 & sleep 1 chmod 666 /tmp/fcgiwrap.sock exec nginx -c /tmp/nginx.conf -g 'daemon off;' @@ -239,13 +250,18 @@ spec: allowPrivilegeEscalation: false capabilities: drop: ["ALL"] + # cgit idled at 105m against the previous 250m limit -- 42% of its own + # ceiling at rest -- and the cgroup had accumulated ~2.9h of throttled + # time (nr_throttled 96979). Renders are bursty, so the quota was being + # hit on ordinary page loads. Headroom raised for the 4 fcgiwrap + # workers; the request tracks measured idle usage. resources: requests: - cpu: 50m + cpu: 100m memory: 128Mi limits: - cpu: 250m - memory: 256Mi + cpu: 1000m + memory: 512Mi volumes: - name: repos -- cgit v1.2.3