diff --git a/files/mpm_prefork.conf b/files/mpm_prefork.conf new file mode 100644 index 0000000..b06fdf1 --- /dev/null +++ b/files/mpm_prefork.conf @@ -0,0 +1,10 @@ +# prefork MPM + + + StartServers 10 + MinSpareServers 10 + MaxSpareServers 20 + MaxRequestWorkers 128 + MaxConnectionsPerChild 2000 + + diff --git a/files/www.conf.gotmpl b/files/www.conf.gotmpl new file mode 100644 index 0000000..20ea48a --- /dev/null +++ b/files/www.conf.gotmpl @@ -0,0 +1,24 @@ +{%- raw -%} +[www] +user = www-data +group = www-data + +listen = {{ env.Getenv "PHP_FPM_LISTEN" "/tmp/php-fpm.sock" }} +listen.owner = www-data +listen.group = www-data +listen.mode = 0660 + +pm = dynamic +pm.max_children = {{ env.Getenv "PHP_FPM_MAX_CHILDREN" "5" }} +pm.start_servers = {{ env.Getenv "PHP_FPM_START_SERVERS" "2" }} +pm.min_spare_servers = {{ env.Getenv "PHP_FPM_MIN_SPARE_SERVERS" "1" }} +pm.max_spare_servers = {{ env.Getenv "PHP_FPM_MAX_SPARE_SERVERS" "3" }} + +pm.status_path = /healthcheck +pm.status_listen = 127.0.0.1:8091 + +clear_env = no + +php_admin_value[display_errors] = {{ env.Getenv "PHP_FPM_DISPLAY_ERRORS" "off" }} +php_admin_value[memory_limit] = {{ env.Getenv "PHP_FPM_MEMORY_LIMIT" "32m" }} +{% endraw %} \ No newline at end of file diff --git a/tasks/hydra-saml.yml b/tasks/hydra-saml.yml index ed6a378..a8e94af 100644 --- a/tasks/hydra-saml.yml +++ b/tasks/hydra-saml.yml @@ -27,8 +27,13 @@ - name: Configure cadoles-pod-hydra-remote-user-v1 (2) ansible.builtin.copy: - src: hydra-remote-user-v1-apache.conf - dest: /etc/hydra-remote-user/apache.conf + src: "{{ item.src }}" + dest: "{{ item.dest }}" + with_items: + - src: hydra-remote-user-v1-apache.conf + dest: /etc/hydra-remote-user/apache.conf + - src: mpm_prefork.conf + dest: /etc/hydra-remote-user/mpm_prefork.conf notify: - Restart cadoles-pod-hydra-remote-user-v1 become: true diff --git a/tasks/main.yml b/tasks/main.yml index d735c47..4ec0d82 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -85,6 +85,17 @@ - Restart cadoles-pod-hydra-dispatcher-v1 become: true +- name: Configure cadoles-pod-hydra-dispatcher-v1 (2) + ansible.builtin.copy: + src: "{{ item.src }}" + dest: "{{ item.dest }}" + with_items: + - src: www.conf.gotmpl + dest: /etc/hydra-dispatcher/www.conf.gotmpl + notify: + - Restart cadoles-pod-hydra-dispatcher-v1 + become: true + - name: Configure passwordless authentification if enabled ansible.builtin.include_tasks: hydra-passwordless.yml when: enable_hydra_passwordless diff --git a/tasks/update-hydra-dispatcher.yml b/tasks/update-hydra-dispatcher.yml index fbfe5b6..838612a 100644 --- a/tasks/update-hydra-dispatcher.yml +++ b/tasks/update-hydra-dispatcher.yml @@ -23,3 +23,14 @@ notify: - Restart cadoles-pod-hydra-dispatcher-v1 become: true + +- name: Configure cadoles-pod-hydra-dispatcher-v1 (2) + ansible.builtin.copy: + src: "{{ item.src }}" + dest: "{{ item.dest }}" + with_items: + - src: www.conf.gotmpl + dest: /etc/hydra-dispatcher/www.conf.gotmpl + notify: + - Restart cadoles-pod-hydra-dispatcher-v1 + become: true diff --git a/tasks/update-hydra-remote-user.yml b/tasks/update-hydra-remote-user.yml index 6959dd4..2c7e77c 100644 --- a/tasks/update-hydra-remote-user.yml +++ b/tasks/update-hydra-remote-user.yml @@ -26,8 +26,13 @@ - name: Configure cadoles-pod-hydra-remote-user-v1 (2) ansible.builtin.copy: - src: hydra-remote-user-v1-apache.conf - dest: /etc/hydra-remote-user/apache.conf + src: "{{ item.src }}" + dest: "{{ item.dest }}" + with_items: + - src: hydra-remote-user-v1-apache.conf + dest: /etc/hydra-remote-user/apache.conf + - src: mpm_prefork.conf + dest: /etc/hydra-remote-user/mpm_prefork.conf notify: - Restart cadoles-pod-hydra-remote-user-v1 become: true diff --git a/templates/cadoles-pod-hydra-dispatcher-v1.conf.j2 b/templates/cadoles-pod-hydra-dispatcher-v1.conf.j2 index c24e781..35eb445 100644 --- a/templates/cadoles-pod-hydra-dispatcher-v1.conf.j2 +++ b/templates/cadoles-pod-hydra-dispatcher-v1.conf.j2 @@ -21,8 +21,14 @@ PODMAN_ARGS="\ -e 'SENTRY_DSN={{ hydra_dispatcher_sentry_dsn }}' \ -e 'SENTRY_ENVIRONMENT={{ hydra_dispatcher_sentry_environment }}' \ -e 'REDIS_DSN={{ hydra_dispatcher_redis_dsn }}' \ + --mount type=tmpfs,tmpfs-size=512M,destination=/app/var/cache \ -e 'DISABLE_APP_AUTO_SELECT={{ hydra_dispatcher_disable_app_auto_select }}' \ -e 'PHP_FPM_MEMORY_LIMIT=128m' \ + -e 'PHP_FPM_MAX_CHILDREN=128' \ + -e 'PHP_FPM_START_SERVERS=42' \ + -e 'PHP_FPM_MIN_SPARE_SERVERS=24' \ + -e 'PHP_FPM_MAX_SPARE_SERVERS=64' \ + -v /etc/hydra-dispatcher/www.conf.gotmpl:/etc/php81/php-fpm.d/www.conf.gotmpl \ -v /etc/hydra-dispatcher/conf.d:/app/config/hydra \ {% for item in hydra_dispatcher_mounts %} -v {{ item.host }}:{{ item.container }} \ diff --git a/templates/cadoles-pod-hydra-remote-user-v1.conf.j2 b/templates/cadoles-pod-hydra-remote-user-v1.conf.j2 index df2c83c..25d0632 100644 --- a/templates/cadoles-pod-hydra-remote-user-v1.conf.j2 +++ b/templates/cadoles-pod-hydra-remote-user-v1.conf.j2 @@ -6,6 +6,7 @@ PODMAN_ARGS="\ --tz=local \ -v /etc/hydra-remote-user/conf.d:/var/www/config/remote_user \ -v /etc/hydra-remote-user/apache.conf:/etc/apache2/sites-available/000-default.conf \ + -v /etc/hydra-remote-user/mpm_prefork.conf:/etc/apache2/mods-available/mpm_prefork.conf \ -v /etc/hosts:/etc/hosts:ro \ -e APP_ENV=prod \ -e 'APP_DEBUG={{ hydra_saml_debug }}' \ @@ -14,4 +15,4 @@ PODMAN_ARGS="\ -e HYDRA_ADMIN_BASE_URL=http://10.0.2.2:3000 \ -e 'TRUSTED_PROXIES=127.0.0.1,10.0.2.0/24' \ -e 'LOGOUT_REDIRECT_URL_PATTERN={{ haproxy_public_base_url }}{{ haproxy_hydra_saml_base_path }}/Shibboleth.sso/Logout?return=%s' \ -" \ No newline at end of file +"