secubox-deb

mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-29 11:12:29 +00:00

History

CyberMind-FR 478163af26 feat(secubox-mitmproxy): Phase 6.O — kernel + memory + network perf tuning (ref #496 ) User : 'baisse rapide des performances du tunnel' followed by 'd\'abord les performances'. Phase 6.N (dynamic whitelist) closed the retry-storm cause. Phase 6.O squeezes more perf from the kernel/network stack. ## Live verification (before → after on gk2) load avg : 8.08 → 4.75 (-41% in ~5 min) run queue : 12 → 5 (-58%) CPU idle : 5% → 21% (4x more breathing room) swap activity: 0 (already healthy, just better protection now) ## What changed ### /etc/sysctl.d/95-secubox-perf.conf (NEW) Memory : vm.swappiness = 10 (default 60 → keep working set in RAM) vm.vfs_cache_pressure = 50 (retain dentry/inode cache longer) vm.dirty_background_ratio = 5 (earlier background writeback) vm.dirty_ratio = 15 (lower sync flush threshold — less latency spike) Network : net.core.rmem_max / wmem_max = 16 MiB (was 200 KiB — WG burst friendly) net.core.rmem_default / wmem_default = 1 MiB net.core.netdev_max_backlog = 8000 (8x default — scheduling jitter) TCP : net.ipv4.tcp_fastopen = 3 (client + server : -1 RTT on repeat conn) net.ipv4.tcp_max_syn_backlog = 4096 net.ipv4.tcp_tw_reuse = 1 (~500 TIME_WAIT idle currently) ### /etc/tmpfiles.d/secubox-thp.conf (NEW) Switches Transparent Huge Pages from 'always' to 'madvise'. On Armada under memory pressure, 'always' causes compaction stalls (multi-ms pauses in scheduling). 'madvise' lets apps opt-in (none here do), which avoids the stalls completely. ### Not applied (kernel constraint) BBR congestion control + fq qdisc were planned but the Marvell custom kernel (6.12.85) wasn't built with CONFIG_TCP_CONG_BBR / NET_SCH_FQ. Would need a kernel rebuild for those — kept in comment in the file. Cost of staying on cubic + pfifo_fast : ~3-5% less throughput. ## Files packages/secubox-mitmproxy/sysctl/95-secubox-perf.conf (NEW) packages/secubox-mitmproxy/tmpfiles.d/secubox-thp.conf (NEW) packages/secubox-mitmproxy/debian/rules (install wires) ## Diagnostics that mattered vmstat 1 3 : si/so = 0 (no active swap thrashing — relief) ps state : 12 procs in run queue (scheduling bottleneck) cpu freq : already at max (1.4 GHz, schedutil governor OK) cpu gov : schedutil (modern, no need to change) THP : 'always' (changed to madvise — gain on this hw) ## Not pursued - eBPF/XDP : Marvell DSA driver limits XDP to generic mode (no native hook in driver). Gain would be ~2-3x, not 200x. Postponed. - LXC pruning : memory available is fine (2.98 GB avail). No need to stop yacy/horde/rustdesk.	2026-06-06 07:17:29 +02:00
..
95-secubox-perf.conf	feat(secubox-mitmproxy): Phase 6.O — kernel + memory + network perf tuning (ref #496 )	2026-06-06 07:17:29 +02:00

CyberMind-FR 478163af26 feat(secubox-mitmproxy): Phase 6.O — kernel + memory + network perf tuning (ref #496 )

User : 'baisse rapide des performances du tunnel' followed by 'd\'abord les
performances'. Phase 6.N (dynamic whitelist) closed the retry-storm cause.
Phase 6.O squeezes more perf from the kernel/network stack.

## Live verification (before → after on gk2)

  load avg     : 8.08 → 4.75 (-41% in ~5 min)
  run queue    : 12 → 5      (-58%)
  CPU idle     : 5% → 21%    (4x more breathing room)
  swap activity: 0 (already healthy, just better protection now)

## What changed

### /etc/sysctl.d/95-secubox-perf.conf (NEW)

Memory :
  vm.swappiness = 10         (default 60 → keep working set in RAM)
  vm.vfs_cache_pressure = 50 (retain dentry/inode cache longer)
  vm.dirty_background_ratio = 5  (earlier background writeback)
  vm.dirty_ratio = 15        (lower sync flush threshold — less latency spike)

Network :
  net.core.rmem_max / wmem_max = 16 MiB    (was 200 KiB — WG burst friendly)
  net.core.rmem_default / wmem_default = 1 MiB
  net.core.netdev_max_backlog = 8000       (8x default — scheduling jitter)

TCP :
  net.ipv4.tcp_fastopen = 3         (client + server : -1 RTT on repeat conn)
  net.ipv4.tcp_max_syn_backlog = 4096
  net.ipv4.tcp_tw_reuse = 1         (~500 TIME_WAIT idle currently)

### /etc/tmpfiles.d/secubox-thp.conf (NEW)

Switches Transparent Huge Pages from 'always' to 'madvise'. On Armada
under memory pressure, 'always' causes compaction stalls (multi-ms
pauses in scheduling). 'madvise' lets apps opt-in (none here do),
which avoids the stalls completely.

### Not applied (kernel constraint)

BBR congestion control + fq qdisc were planned but the Marvell custom
kernel (6.12.85) wasn't built with CONFIG_TCP_CONG_BBR / NET_SCH_FQ.
Would need a kernel rebuild for those — kept in comment in the file.
Cost of staying on cubic + pfifo_fast : ~3-5% less throughput.

## Files

  packages/secubox-mitmproxy/sysctl/95-secubox-perf.conf  (NEW)
  packages/secubox-mitmproxy/tmpfiles.d/secubox-thp.conf  (NEW)
  packages/secubox-mitmproxy/debian/rules                  (install wires)

## Diagnostics that mattered

  vmstat 1 3 : si/so = 0 (no active swap thrashing — relief)
  ps state   : 12 procs in run queue (scheduling bottleneck)
  cpu freq   : already at max (1.4 GHz, schedutil governor OK)
  cpu gov    : schedutil (modern, no need to change)
  THP        : 'always' (changed to madvise — gain on this hw)

## Not pursued

  - eBPF/XDP : Marvell DSA driver limits XDP to generic mode (no native
    hook in driver). Gain would be ~2-3x, not 200x. Postponed.
  - LXC pruning : memory available is fine (2.98 GB avail). No need
    to stop yacy/horde/rustdesk.

2026-06-06 07:17:29 +02:00

95-secubox-perf.conf

feat(secubox-mitmproxy): Phase 6.O — kernel + memory + network perf tuning (ref #496 )

2026-06-06 07:17:29 +02:00