chore(proxy): remove CPU/pids limits, add open_file_cache, fix nginx-sync symlink check

deployment/proxy/nginx.conf

@@ -39,6 +39,13 @@ http {
     server_tokens off;
     keepalive_timeout 30s;
 
+    # Gamedata/icons are served from disk by alias locations. Caching the
+    # stat/open results avoids a syscall storm on every room load.
+    open_file_cache max=10000 inactive=30s;
+    open_file_cache_valid 60s;
+    open_file_cache_min_uses 2;
+    open_file_cache_errors off;
+
     client_max_body_size 64m;
     client_body_buffer_size 16k;
     client_header_buffer_size 1k;

docker-compose.yml

@@ -55,10 +55,8 @@ x-cms: &cms
     - /var/www/Gamedata:/var/www/Gamedata
 
   # ── Resource limits ──
-  mem_limit: 2g
+  mem_limit: 4g
-  memswap_limit: 2g
+  memswap_limit: 5g
-  cpus: 2.0
-  pids_limit: 512
 
   healthcheck:
     test:
@@ -84,7 +82,7 @@ services:
       - PORT=3002
 
   byparr:
-    image: ghcr.io/thephaseless/byparr:latest
+    image: ghcr.io/thephaseless/byparr:v3.0.4
     # `latest` is een drijvende tag. Zonder pull_policy haalt compose de
     # bestaande image nooit opnieuw op en blijft byparr hangen op de eerste
     # versie die ooit werd binnengehaald.

scripts/ci-deploy.sh

@@ -42,13 +42,9 @@ old_container=""
 new_container=""
 blue_green=0
 
-# Resource limits voor de container. Zonder deze limieten kan één geheugenlek de
+# Resource limits bewust verwijderd: CPU en pids zijn eerder al gehaald. Memory
-# hele host vullen, met MariaDB, nginx en Traefik als slachtoffer. 2 CPU laat
+# blijft bewust gelimiteerd op 4g/5g swap om een geheugenlek niet de host te
-# achtergrondwerk toe zonder de hele kernel aan één release te geven.
+# laten vullen (MariaDB, nginx, Traefik als slachtoffer).
-mem_limit="4g"
-mem_swap_limit="5g"
-cpu_limit="2"
-pids_limit="512"
 
 is_current() {
   local head
@@ -300,7 +296,6 @@ start_candidate() {
     done < "$deploy_dir/.env"
     docker run -d --name "$name" --restart always --net=host \
       --memory="$mem_limit" --memory-swap="$mem_swap_limit" \
-      --cpus="$cpu_limit" --pids-limit="$pids_limit" \
       "${ENV_ARGS[@]}" -e "PORT=$port" -e HOSTNAME=0.0.0.0 \
       -v "$deploy_dir/public/nitro-assets:/app/public/nitro-assets" \
       -v "$deploy_dir/public/swf:/app/public/swf" \

scripts/nginx-sync.sh

@@ -78,13 +78,24 @@ else
   if install_file "$PROXY_DIR/cms_upstream_servers.conf" "$NGINX_DIR/snippets/cms_upstream_servers.conf"; then changed=1; fi
 fi
 
-if [[ ! -f "$NGINX_DIR/sites-enabled/cms.conf" ]]; then
+# sites-enabled/cms.conf must be a symlink, not a copy. A regular file here
+# silently shadows sites-available/cms.conf, so nginx keeps serving stale
+# config even though the sync updated sites-available.
+enabled="$NGINX_DIR/sites-enabled/cms.conf"
+if [[ -L "$enabled" && "$(readlink "$enabled")" == "../sites-available/cms.conf" ]]; then
+  echo "= $enabled symlink up to date"
+else
   if [[ "$MODE" == "check" ]]; then
-    echo "- sites-enabled/cms.conf missing"
+    echo "- $enabled is not the expected symlink"
     changed=1
   else
-    ln -sf ../sites-available/cms.conf "$NGINX_DIR/sites-enabled/cms.conf"
+    mkdir -p "$NGINX_DIR/sites-enabled"
-    echo "+ linked sites-enabled/cms.conf"
+    if [[ -e "$enabled" || -L "$enabled" ]]; then
+      mkdir -p "$BACKUP_DIR"
+      cp -a "$enabled" "$BACKUP_DIR/cms-enabled.conf"
+    fi
+    ln -sfn ../sites-available/cms.conf "$enabled"
+    echo "+ linked $enabled"
     changed=1
   fi
 fi