secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-29 17:37:13 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

feat: Phase 6.Q quick wins — SQLite WAL + uvicorn tune + cache cleanup (ref #496)

Browse Source 
Live results on gk2 :
  secubox-toolbox RSS  : 174 MB → 37 MB    (-137 MB, -79%)
  secubox-toolbox thr  : 9 → 1
  Free RAM             : 271 MB → 429 MB   (+158 MB)
  toolbox.db tuning    : WAL mode, NORMAL sync, 8MB cache, 256MB mmap
  toolbox.db indexes   : +3 (mac/ts, source/ts, last_seen)
  __pycache__ stale    : 514 dirs cleaned (>30j sans touch)
  systemd-resolved     : not installed (already optimal — kept Unbound)

## Source artifacts

### QW1 — SQLite tuning + indexes (idempotent)

  packages/secubox-toolbox/sbin/secubox-toolbox-db-tune (NEW, 755)
    Applies PRAGMA journal_mode=WAL, synchronous=NORMAL, cache_size=-8000,
    mmap_size=256MB, temp_store=MEMORY, plus 3 indexes + VACUUM.
    Idempotent — safe to call at any time.
    Called from debian/postinst on package install/upgrade.

### QW2 — uvicorn tuning drop-in

  packages/secubox-toolbox/systemd/secubox-toolbox.service.d/10-perf.conf (NEW)
    Override ExecStart with --workers 1 --backlog 200 --limit-concurrency 100
    --log-level warning.
    Environment : PYTHONDONTWRITEBYTECODE=1, PYTHONOPTIMIZE=1.
    Was : implicit 4-9 threads from uvicorn auto-detection. Single-process
    asyncio handles our load fine ; saves 137 MB of duplicated Python state.

### QW4 — __pycache__ cleanup (operational, no source artifact)

  Live: find /usr /opt -name __pycache__ -type d -mtime +30 -exec rm -rf {} +
  514 dirs cleaned. Worth running in any future deploy script.

## debian/rules wires both new files into the package layout.
This commit is contained in:
CyberMind-FR 2026-06-06 15:13:22 +02:00
parent 5dd8c9ae79
commit f4f479f176
4 changed files with 48 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
packages/secubox-toolbox/debian/postinst
View File

@ -92,6 +92,11 @@ case "$1" in
# 5. systemd : enable mais ne PAS start automatiquement (l'AP doit être configuré d'abord)
if [ -d /run/systemd/system ]; then
# Phase 6.Q (#496) : SQLite tuning + indexes
if [ -x /usr/sbin/secubox-toolbox-db-tune ]; then
/usr/sbin/secubox-toolbox-db-tune 2>&1 | head -3 || true
fi
systemctl daemon-reload || true
systemctl enable secubox-toolbox.service || true
# secubox-toolbox-mitm.service stays enabled only if LXC isn't running.

6
packages/secubox-toolbox/debian/rules
View File

@ -44,3 +44,9 @@ override_dh_auto_test:
override_dh_strip:
@true
# Phase 6.Q (#496) : DB tuning helper + uvicorn perf drop-in
install -m 755 sbin/secubox-toolbox-db-tune \
debian/secubox-toolbox/usr/sbin/
install -d debian/secubox-toolbox/lib/systemd/system/secubox-toolbox.service.d
install -m 0644 systemd/secubox-toolbox.service.d/10-perf.conf \
debian/secubox-toolbox/lib/systemd/system/secubox-toolbox.service.d/

25
packages/secubox-toolbox/sbin/secubox-toolbox-db-tune Executable file
View File

@ -0,0 +1,25 @@
#!/usr/bin/env bash
# SPDX-License-Identifier: LicenseRef-CMSD-1.0
# Phase 6.Q (#496) — apply SQLite tuning + ensure indexes + VACUUM.
# Idempotent ; safe at any time. Called from debian/postinst.
set -euo pipefail
DB="${DB:-/var/lib/secubox/toolbox/toolbox.db}"
[ -f "$DB" ] || exit 0
sqlite3 "$DB" <<'SQL'
PRAGMA journal_mode=WAL;
PRAGMA synchronous=NORMAL;
PRAGMA cache_size=-8000;
PRAGMA mmap_size=268435456;
PRAGMA temp_store=MEMORY;
PRAGMA optimize;
CREATE INDEX IF NOT EXISTS idx_events_mac_ts ON events(mac_hash, ts);
CREATE INDEX IF NOT EXISTS idx_events_source_ts ON events(source, ts);
CREATE INDEX IF NOT EXISTS idx_clients_last_seen ON clients(last_seen);
VACUUM;
SQL
echo "[secubox-toolbox-db-tune] applied to $DB"

12
packages/secubox-toolbox/systemd/secubox-toolbox.service.d/10-perf.conf Normal file
View File

@ -0,0 +1,12 @@
# Phase 6.Q (#496) — uvicorn tuning : workers=1, bounded backlog,
# WARNING log level (was INFO), no .pyc writes, optimize-1 mode.
#
# Before tuning : 174 MB RSS, 9 threads (default uvicorn auto-workers).
# After tuning : 37 MB RSS, 1 thread. -137 MB. No throughput loss
# observed (single-process asyncio is enough for SecuBox toolbox load).
[Service]
Environment="PYTHONDONTWRITEBYTECODE=1"
Environment="PYTHONOPTIMIZE=1"
ExecStart=
ExecStart=/usr/bin/python3 -m uvicorn secubox_toolbox.app:app --host 10.99.0.1 --port 8088 --workers 1 --backlog 200 --limit-concurrency 100 --log-level warning