CyberMind-FR 6efac89d49 feat: Phase 6.P memory optimization — P3+P4+P5+P6 backported to sources (ref #496) ... Aggregate live result on gk2 : - journald disk : 1.3 GB → 176 MB (-86%) - Free memory : 241 MB → 524 MB (+283 MB) - Running LXCs : 16 → 13 (yacy/horde/rustdesk stopped + autostart=0) - 13 LXCs with memory.max cap + swap.max=0 (5.5 GB total budget on 8 GB host) - mitm-wg + mitm : RuntimeMaxSec=6h (clean restart drops ~50 MB/process) - mitm-wg launcher : --set http2=false (HTTP/2 multiplex state retention) ## Source artifacts ### P5 — journald rotation packages/secubox-mitmproxy/systemd/journald.conf.d/90-secubox-rotation.conf SystemMaxUse=200M, MaxRetentionSec=2week, ForwardToSyslog=no postinst : install file + 'journalctl --vacuum-size=200M' + restart journald ### P3 — mitm http2=false + RuntimeMaxSec drop-ins packages/secubox-toolbox/sbin/secubox-toolbox-mitm-wg-launch (modified) --set http2=false ajouté aux ARGS packages/secubox-toolbox/systemd/secubox-toolbox-mitm.service.d/10-runtime-max.conf (NEW) packages/secubox-toolbox/systemd/secubox-toolbox-mitm-wg.service.d/10-runtime-max.conf (NEW) [Service] RuntimeMaxSec=6h packages/secubox-mitmproxy/systemd/system/{...}/10-runtime-max.conf same drop-ins shipped via mitmproxy package (covers LXC-side WAF) debian/rules of both packages : install drop-ins ### P4 — per-LXC memory budget packages/secubox-mitmproxy/bin/secubox-apply-lxc-memory-budget (NEW, 755) Idempotent script : applies memory.max + swap.max=0 LIVE and persists in /var/lib/lxc/<name>/config. 16 LXCs covered with realistic budgets (5.5 GB total / 8 GB host, leaves 2.5 GB for host). postinst : runs it if installed (LXC-aware install). ### P6 — operator decision, not auto-applied Stop yacy/horde/rustdesk + autostart=0 was done LIVE on gk2 but is an operator preference, NOT a package decision. Documented in .claude/PHASE-6.P-MEMORY-OPTIMIZATION.md as 'optional stop unused LXCs'. ## What's NOT in this commit (kept for future sessions) ### P2 — secubox_toolbox FastAPI diet (~50 MB) Lazy-load Jinja2 templates, lazy-import dpi_class, tune uvicorn workers. Needs careful per-route testing. ### P1 — ASGI consolidation (~840 MB) New 'secubox-aggregator' package mounts 15 module FastAPIs as sub-apps under a single uvicorn. Biggest gain but architectural change ; do after Phase 7.C lands and the WAF stack is stable. ## Files Modified : packages/secubox-mitmproxy/debian/postinst packages/secubox-mitmproxy/debian/rules packages/secubox-toolbox/debian/rules packages/secubox-toolbox/sbin/secubox-toolbox-mitm-wg-launch Created : packages/secubox-mitmproxy/bin/secubox-apply-lxc-memory-budget packages/secubox-mitmproxy/systemd/journald.conf.d/90-secubox-rotation.conf packages/secubox-mitmproxy/systemd/system/secubox-toolbox-mitm.service.d/10-runtime-max.conf packages/secubox-mitmproxy/systemd/system/secubox-toolbox-mitm-wg.service.d/10-runtime-max.conf packages/secubox-toolbox/systemd/secubox-toolbox-mitm.service.d/10-runtime-max.conf packages/secubox-toolbox/systemd/secubox-toolbox-mitm-wg.service.d/10-runtime-max.conf		2026-06-06 07:37:21 +02:00
..
journald.conf.d	feat: Phase 6.P memory optimization — P3+P4+P5+P6 backported to sources (ref #496)	2026-06-06 07:37:21 +02:00
system	feat: Phase 6.P memory optimization — P3+P4+P5+P6 backported to sources (ref #496)	2026-06-06 07:37:21 +02:00