Tighten timeouts and log request timeouts

[chef.git] / cookbooks / mediawiki / recipes / default.rb

diff --git a/cookbooks/mediawiki/recipes/default.rb b/cookbooks/mediawiki/recipes/default.rb
index 30bd612d1ccc515b24e8b16abe9cd030bd876327..215fbf1b98378e68b074535131250ff9a43de267 100644 (file)
--- a/cookbooks/mediawiki/recipes/default.rb
+++ b/cookbooks/mediawiki/recipes/default.rb
@@ -85,8 +85,9 @@ systemd_service "mediawiki-sitemap@" do
   exec_start "/usr/bin/php -d memory_limit=2048M -d error_reporting=22517 /srv/%i/w/maintenance/generateSitemap.php --server=https://%i --urlpath=https://%i/ --fspath=/srv/%i --quiet --skip-redirects"
   user node[:mediawiki][:user]
   nice 10
   exec_start "/usr/bin/php -d memory_limit=2048M -d error_reporting=22517 /srv/%i/w/maintenance/generateSitemap.php --server=https://%i --urlpath=https://%i/ --fspath=/srv/%i --quiet --skip-redirects"
   user node[:mediawiki][:user]
   nice 10

-  sandbox true
+  sandbox :enable_network => true

   memory_deny_write_execute false
   memory_deny_write_execute false

+  restrict_address_families "AF_UNIX"

   read_write_paths "/srv/%i"
 end
 
   read_write_paths "/srv/%i"
 end
 


@@ -97,11 +98,13 @@ end
 
 systemd_service "mediawiki-jobs@" do
   description "Run mediawiki jobs for %i"
 
 systemd_service "mediawiki-jobs@" do
   description "Run mediawiki jobs for %i"

-  exec_start "/usr/bin/php -d memory_limit=2048M -d error_reporting=22517 /srv/%i/w/maintenance/runJobs.php --server=https://%i --maxtime=175 --memory-limit=2048M --procs=8 --nothrottle --quiet"
+  exec_start "/usr/bin/php -d memory_limit=2048M -d error_reporting=22517 /srv/%i/w/maintenance/runJobs.php --server=https://%i --maxtime=175 --memory-limit=2048M --procs=8"

   user node[:mediawiki][:user]
   nice 10
   user node[:mediawiki][:user]
   nice 10

-  sandbox true
+  runtime_max_sec 3600
+  sandbox :enable_network => true

   memory_deny_write_execute false
   memory_deny_write_execute false

+  restrict_address_families "AF_UNIX"

   read_write_paths "/srv/%i"
 end
 
   read_write_paths "/srv/%i"
 end
 


@@ -113,11 +116,14 @@ end
 
 systemd_service "mediawiki-email-jobs@" do
   description "Run mediawiki email jobs for %i"
 
 systemd_service "mediawiki-email-jobs@" do
   description "Run mediawiki email jobs for %i"

-  exec_start "/usr/bin/php -d memory_limit=2048M -d error_reporting=22517 /srv/%i/w/maintenance/runJobs.php --server=https://%i --maxtime=55 --type=enotifNotify --memory-limit=2048M --procs=4 --nothrottle --quiet"
+  exec_start "/usr/bin/php -d memory_limit=2048M -d error_reporting=22517 /srv/%i/w/maintenance/runJobs.php --server=https://%i --maxtime=55 --type=enotifNotify --memory-limit=2048M --procs=4"

   user node[:mediawiki][:user]
   nice 10
   user node[:mediawiki][:user]
   nice 10

+  runtime_max_sec 3600

   sandbox :enable_network => true
   memory_deny_write_execute false
   sandbox :enable_network => true
   memory_deny_write_execute false

+  restrict_address_families "AF_UNIX"
+  read_write_paths "/srv/%i"

 end
 
 systemd_timer "mediawiki-email-jobs@" do
 end
 
 systemd_timer "mediawiki-email-jobs@" do


@@ -128,11 +134,14 @@ end
 
 systemd_service "mediawiki-refresh-links@" do
   description "Refresh mediawiki links for %i"
 
 systemd_service "mediawiki-refresh-links@" do
   description "Refresh mediawiki links for %i"

-  exec_start "/usr/bin/php -d memory_limit=2048M -d error_reporting=22517 /srv/%i/w/maintenance/refreshLinks.php --server=https://%i --memory-limit=2048M --quiet"
+  exec_start "/usr/bin/php -d memory_limit=16G -d error_reporting=22517 /srv/%i/w/maintenance/refreshLinks.php --server=https://%i --memory-limit=16G"

   user node[:mediawiki][:user]
   nice 10
   user node[:mediawiki][:user]
   nice 10

+  runtime_max_sec 259200

   sandbox :enable_network => true
   memory_deny_write_execute false
   sandbox :enable_network => true
   memory_deny_write_execute false

+  restrict_address_families "AF_UNIX"
+  read_write_paths "/srv/%i"

 end
 
 systemd_timer "mediawiki-refresh-links@" do
 end
 
 systemd_timer "mediawiki-refresh-links@" do