secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-29 09:14:33 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity
89025c9313
secubox-deb/packages/secubox-mitmproxy/systemd
History
CyberMind-FR 6efac89d49 feat: Phase 6.P memory optimization — P3+P4+P5+P6 backported to sources (ref #496) 
Aggregate live result on gk2 :
  - journald disk    : 1.3 GB → 176 MB    (-86%)
  - Free memory      : 241 MB → 524 MB    (+283 MB)
  - Running LXCs     : 16 → 13 (yacy/horde/rustdesk stopped + autostart=0)
  - 13 LXCs with memory.max cap + swap.max=0 (5.5 GB total budget on 8 GB host)
  - mitm-wg + mitm   : RuntimeMaxSec=6h (clean restart drops ~50 MB/process)
  - mitm-wg launcher : --set http2=false (HTTP/2 multiplex state retention)

## Source artifacts

### P5 — journald rotation
  packages/secubox-mitmproxy/systemd/journald.conf.d/90-secubox-rotation.conf
    SystemMaxUse=200M, MaxRetentionSec=2week, ForwardToSyslog=no
  postinst : install file + 'journalctl --vacuum-size=200M' + restart journald

### P3 — mitm http2=false + RuntimeMaxSec drop-ins
  packages/secubox-toolbox/sbin/secubox-toolbox-mitm-wg-launch (modified)
    --set http2=false ajouté aux ARGS
  packages/secubox-toolbox/systemd/secubox-toolbox-mitm.service.d/10-runtime-max.conf (NEW)
  packages/secubox-toolbox/systemd/secubox-toolbox-mitm-wg.service.d/10-runtime-max.conf (NEW)
    [Service] RuntimeMaxSec=6h
  packages/secubox-mitmproxy/systemd/system/{...}/10-runtime-max.conf
    same drop-ins shipped via mitmproxy package (covers LXC-side WAF)
  debian/rules of both packages : install drop-ins

### P4 — per-LXC memory budget
  packages/secubox-mitmproxy/bin/secubox-apply-lxc-memory-budget (NEW, 755)
    Idempotent script : applies memory.max + swap.max=0 LIVE and persists
    in /var/lib/lxc/<name>/config. 16 LXCs covered with realistic budgets
    (5.5 GB total / 8 GB host, leaves 2.5 GB for host).
  postinst : runs it if installed (LXC-aware install).

### P6 — operator decision, not auto-applied
  Stop yacy/horde/rustdesk + autostart=0 was done LIVE on gk2 but is an
  operator preference, NOT a package decision. Documented in
  .claude/PHASE-6.P-MEMORY-OPTIMIZATION.md as 'optional stop unused LXCs'.

## What's NOT in this commit (kept for future sessions)

### P2 — secubox_toolbox FastAPI diet (~50 MB)
  Lazy-load Jinja2 templates, lazy-import dpi_class, tune uvicorn workers.
  Needs careful per-route testing.

### P1 — ASGI consolidation (~840 MB)
  New 'secubox-aggregator' package mounts 15 module FastAPIs as sub-apps
  under a single uvicorn. Biggest gain but architectural change ; do
  after Phase 7.C lands and the WAF stack is stable.

## Files

  Modified :
    packages/secubox-mitmproxy/debian/postinst
    packages/secubox-mitmproxy/debian/rules
    packages/secubox-toolbox/debian/rules
    packages/secubox-toolbox/sbin/secubox-toolbox-mitm-wg-launch
  Created :
    packages/secubox-mitmproxy/bin/secubox-apply-lxc-memory-budget
    packages/secubox-mitmproxy/systemd/journald.conf.d/90-secubox-rotation.conf
    packages/secubox-mitmproxy/systemd/system/secubox-toolbox-mitm.service.d/10-runtime-max.conf
    packages/secubox-mitmproxy/systemd/system/secubox-toolbox-mitm-wg.service.d/10-runtime-max.conf
    packages/secubox-toolbox/systemd/secubox-toolbox-mitm.service.d/10-runtime-max.conf
    packages/secubox-toolbox/systemd/secubox-toolbox-mitm-wg.service.d/10-runtime-max.conf
2026-06-06 07:37:21 +02:00
..
journald.conf.d feat: Phase 6.P memory optimization — P3+P4+P5+P6 backported to sources (ref #496) 2026-06-06 07:37:21 +02:00
system feat: Phase 6.P memory optimization — P3+P4+P5+P6 backported to sources (ref #496) 2026-06-06 07:37:21 +02:00