From a4bc25b6d6780ee2f09abe46a515df7c9a084e3e Mon Sep 17 00:00:00 2001
From: openhands <openhands@all-hands.dev>
Date: Fri, 23 Oct 2026 14:05:31 +0200
Subject: [PATCH] chore(proxy): remove CPU/pids limits, add open_file_cache,
 fix nginx-sync symlink check

---
 deployment/proxy/nginx.conf |  7 +++++++
 docker-compose.yml          |  8 +++-----
 scripts/ci-deploy.sh        | 11 +++--------
 scripts/nginx-sync.sh       | 19 +++++++++++++++----
 4 files changed, 28 insertions(+), 17 deletions(-)

diff --git a/deployment/proxy/nginx.conf b/deployment/proxy/nginx.conf
index 0aba6433..eac414f6 100644
--- a/deployment/proxy/nginx.conf
+++ b/deployment/proxy/nginx.conf
@@ -39,6 +39,13 @@ http {
     server_tokens off;
     keepalive_timeout 30s;
 
+    # Gamedata/icons are served from disk by alias locations. Caching the
+    # stat/open results avoids a syscall storm on every room load.
+    open_file_cache max=10000 inactive=30s;
+    open_file_cache_valid 60s;
+    open_file_cache_min_uses 2;
+    open_file_cache_errors off;
+
     client_max_body_size 64m;
     client_body_buffer_size 16k;
     client_header_buffer_size 1k;
diff --git a/docker-compose.yml b/docker-compose.yml
index 9aa8748f..ddf9f6c0 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -55,10 +55,8 @@ x-cms: &cms
     - /var/www/Gamedata:/var/www/Gamedata
 
   # ── Resource limits ──
-  mem_limit: 2g
-  memswap_limit: 2g
-  cpus: 2.0
-  pids_limit: 512
+  mem_limit: 4g
+  memswap_limit: 5g
 
   healthcheck:
     test:
@@ -84,7 +82,7 @@ services:
       - PORT=3002
 
   byparr:
-    image: ghcr.io/thephaseless/byparr:latest
+    image: ghcr.io/thephaseless/byparr:v3.0.4
     # `latest` is een drijvende tag. Zonder pull_policy haalt compose de
     # bestaande image nooit opnieuw op en blijft byparr hangen op de eerste
     # versie die ooit werd binnengehaald.
diff --git a/scripts/ci-deploy.sh b/scripts/ci-deploy.sh
index dd0bb174..a061d194 100644
--- a/scripts/ci-deploy.sh
+++ b/scripts/ci-deploy.sh
@@ -42,13 +42,9 @@ old_container=""
 new_container=""
 blue_green=0
 
-# Resource limits voor de container. Zonder deze limieten kan één geheugenlek de
-# hele host vullen, met MariaDB, nginx en Traefik als slachtoffer. 2 CPU laat
-# achtergrondwerk toe zonder de hele kernel aan één release te geven.
-mem_limit="4g"
-mem_swap_limit="5g"
-cpu_limit="2"
-pids_limit="512"
+# Resource limits bewust verwijderd: CPU en pids zijn eerder al gehaald. Memory
+# blijft bewust gelimiteerd op 4g/5g swap om een geheugenlek niet de host te
+# laten vullen (MariaDB, nginx, Traefik als slachtoffer).
 
 is_current() {
   local head
@@ -300,7 +296,6 @@ start_candidate() {
     done < "$deploy_dir/.env"
     docker run -d --name "$name" --restart always --net=host \
       --memory="$mem_limit" --memory-swap="$mem_swap_limit" \
-      --cpus="$cpu_limit" --pids-limit="$pids_limit" \
       "${ENV_ARGS[@]}" -e "PORT=$port" -e HOSTNAME=0.0.0.0 \
       -v "$deploy_dir/public/nitro-assets:/app/public/nitro-assets" \
       -v "$deploy_dir/public/swf:/app/public/swf" \
diff --git a/scripts/nginx-sync.sh b/scripts/nginx-sync.sh
index 75cfaa66..713ac35a 100755
--- a/scripts/nginx-sync.sh
+++ b/scripts/nginx-sync.sh
@@ -78,13 +78,24 @@ else
   if install_file "$PROXY_DIR/cms_upstream_servers.conf" "$NGINX_DIR/snippets/cms_upstream_servers.conf"; then changed=1; fi
 fi
 
-if [[ ! -f "$NGINX_DIR/sites-enabled/cms.conf" ]]; then
+# sites-enabled/cms.conf must be a symlink, not a copy. A regular file here
+# silently shadows sites-available/cms.conf, so nginx keeps serving stale
+# config even though the sync updated sites-available.
+enabled="$NGINX_DIR/sites-enabled/cms.conf"
+if [[ -L "$enabled" && "$(readlink "$enabled")" == "../sites-available/cms.conf" ]]; then
+  echo "= $enabled symlink up to date"
+else
   if [[ "$MODE" == "check" ]]; then
-    echo "- sites-enabled/cms.conf missing"
+    echo "- $enabled is not the expected symlink"
     changed=1
   else
-    ln -sf ../sites-available/cms.conf "$NGINX_DIR/sites-enabled/cms.conf"
-    echo "+ linked sites-enabled/cms.conf"
+    mkdir -p "$NGINX_DIR/sites-enabled"
+    if [[ -e "$enabled" || -L "$enabled" ]]; then
+      mkdir -p "$BACKUP_DIR"
+      cp -a "$enabled" "$BACKUP_DIR/cms-enabled.conf"
+    fi
+    ln -sfn ../sites-available/cms.conf "$enabled"
+    echo "+ linked $enabled"
     changed=1
   fi
 fi