bneradt opened a new pull request, #481: URL: https://github.com/apache/trafficserver-ci/pull/481
## Summary Audit of `github-mirror/` against the live controller (`/opt/github-mirror`, the running containers, cron, ATS remap, and Jenkins job config) found the README accurate in most places but missing several things the live mirror depends on, plus uncommitted changes deployed on the controller on 2026-10-14. This PR brings the repo back to being the source of truth. ## What changed and why ### Commit 1: docs (`README.md`, `ats/mirror-smart-http-remap-snippet.config`) - **Nightly maintenance cron.** The README said no cron file is needed, but the controller has `/etc/cron.d/github-mirror-maintenance`. It runs `docker-compose run --rm github-mirror-fallback /opt/github-mirror/bin/maintain-mirrors.sh` daily at 09:30 UTC and logs to `/var/log/github-mirror-maintenance.log`. The README now documents it, gives a manual install step and a manual repack command, and adds both to the inventory. - **Fallback.** The README now gives the timer interval (every 5 min, 2 min after boot) and says the fallback image also runs the maintenance job. - **Mirror UID/GID.** `.env` has `MIRROR_UID=116` (`gitdaemon`) and `MIRROR_GID=65534` (`nogroup`), and the containers run as that user. Manual `git` commands in Troubleshooting now use `sudo -u gitdaemon`, because running them as root fails with `detected dubious ownership` (reproduced on the controller). - **Cache wording.** The README said "Keep `proxy.config.http.cache.http=0`", but the global value is 1. Caching is disabled only for `/mirror/`, through `conf_remap`, and the README now says so. - **Remap snippet.** The live `/mirror/` remap also sets `proxy.config.http.server_session_sharing.match=none`. Without it, ATS reuses an origin session that httpd already closed behind docker-proxy, and the request stalls until the 180s no-activity timeout. This PR adds that option and its comment to the snippet and the README. - **Inventory.** Adds `check-mirror.sh`, `check-docker-access.sh`, `install-controller.sh`, `maintain-mirrors.sh`, and `/home/mirror/.locks/`. ### Commit 2: sync deployed config (deployed 2026-10-14, never committed) The controller has `.bak-20261014` copies of the files below. - `docker-compose.yml`: format `2.4`, because docker-compose 1.25 ignores `mem_limit` in 3.x without `--compatibility`. Adds `mem_limit: 2g`, `memswap_limit: 3g` and `oom_score_adj: 500` for `github-mirror-smart-http`. - `httpd/Dockerfile`: system git pack/memory limits (`pack.threads 1`, `pack.windowMemory 64m`, `pack.deltaCacheSize 32m`, `core.packedGitLimit 256m`, `core.packedGitWindowSize 32m`, `core.deltaBaseCacheLimit 32m`). - `httpd/mirror.conf`: event MPM caps (`ServerLimit 2`, `ThreadsPerChild 8`, `MaxRequestWorkers 16`, `ListenBacklog 511`), so a CI fanout queues instead of forking 40+ `git-upload-pack` processes. - New `bin/maintain-mirrors.sh`: repack with bitmaps (`repack -a -d -b`), split commit-graph, and prune. It takes the same per-repo `flock` that `update-mirror.sh` uses. ## Verification - Compared the repo against the deployed copy with `diff -r`, leaving out the webhook secret env file. After this PR, the only differences left are the deployed `.env` and the `*.bak-20261014` backups. - Checked the live state: containers, ports 9417/9419 (localhost) and 9418, systemd units and timer, `remap.config`, the bare repo configs, `quietPeriod=0` and `GITHUB_URL` in Jenkins `Github_PR_Checks`, and the maintenance log. - `bash -n` passes on all `github-mirror/bin/*.sh`. `docker-compose.yml` parses as YAML, and the same file is what's running on the controller. - The diff contains no secrets. ## Questions for reviewers 1. Should the maintenance cron come from `install-controller.sh`, or become a systemd timer next to `github-mirror-fallback.timer`, instead of a hand-made `/etc/cron.d` file? This PR only documents the current manual setup. 2. Please confirm the 2026-10-14 deployed tuning should be upstreamed as-is: compose 2.4 with memory limits, the httpd git pack limits, and the MPM caps. Who made it? It was applied directly on the controller and never committed. 3. `maintain-mirrors.sh` uses `pack.threads=2` and `pack.windowMemory=128m`, while the smart-http image limits serving to `pack.threads 1` and `64m`. Is that difference intended? 4. git-daemon listens on `0.0.0.0:9418` (and IPv6), not only localhost. The README calls it a diagnostic/emergency fallback. Should it stay publicly bound? 5. The live webhook env file's header comment still points at `/etc/trafficserver-github-mirror/...`, which is stale; the repo example is already correct. It's harmless, but worth fixing on the controller next time that file is edited. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
