c4be87753f
When we added Apache as a filtering proxy on our Gitea backends in order to more easily mitigate resource starvation, we did not set any tuning to tell it when to recycle worker processes. As a result, backends may continue serving requests with workers which pre-date certificate rotation. This problem has also become more broadly prevalent throughout our services with the introduction of Let's Encrypt's 3-month certificate expirations as compared to our previous 2-year certificates. Add the same MaxConnectionsPerChild tuning to our Gitea backend proxies as we use for our static sites and mirror servers. Change-Id: I77d89385178a30f7dc5d04bedd0ab3772865c09f
36 lines
661 B
YAML
36 lines
661 B
YAML
- name: Install apache2
|
|
apt:
|
|
name:
|
|
- apache2
|
|
- apache2-utils
|
|
state: present
|
|
|
|
- name: Apache modules
|
|
apache2_module:
|
|
state: present
|
|
name: "{{ item }}"
|
|
loop:
|
|
- rewrite
|
|
- proxy
|
|
- proxy_http
|
|
- ssl
|
|
- headers
|
|
|
|
- name: Copy apache config
|
|
template:
|
|
src: gitea.vhost.j2
|
|
dest: /etc/apache2/sites-enabled/000-default.conf
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
notify: gitea Reload apache2
|
|
|
|
- name: Copy apache tuning
|
|
copy:
|
|
src: apache-connection-tuning
|
|
dest: /etc/apache2/conf-enabled/connection-tuning.conf
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
notify: gitea Restart apache2
|