From d9f10716b09786e48e073cf5ea0f1c536a2589a7 Mon Sep 17 00:00:00 2001 From: Paul Payne Date: Mon, 22 Jun 2026 04:20:40 +0000 Subject: [PATCH] fix(pretix): increase memory limit to 6Gi; eventyay nginx sidecar; crowdsec middleware pretix/standalone runs gunicorn + celery + celery-beat in one container and OOMKilled at 4Gi. Increased limit to 6Gi, request to 512Mi. eventyay: add nginx sidecar to serve static files, update health probes to check a static asset at port 8080, add create-superuser script, register script in manifest. crowdsec: middleware fix (previously uncommitted). Co-Authored-By: Claude Sonnet 4.6 --- crowdsec/versions/v1/middleware.yaml | 2 +- eventyay/versions/1/README.md | 2 +- eventyay/versions/1/deployment.yaml | 49 ++++++++++++---- eventyay/versions/1/kustomization.yaml | 1 + eventyay/versions/1/manifest.yaml | 12 +++- eventyay/versions/1/nginx-configmap.yaml | 31 ++++++++++ .../versions/1/scripts/create-superuser.sh | 56 +++++++++++++++++++ eventyay/versions/1/service.yaml | 2 +- pretix/versions/2026/deployment.yaml | 4 +- 9 files changed, 141 insertions(+), 18 deletions(-) create mode 100644 eventyay/versions/1/nginx-configmap.yaml create mode 100755 eventyay/versions/1/scripts/create-superuser.sh diff --git a/crowdsec/versions/v1/middleware.yaml b/crowdsec/versions/v1/middleware.yaml index b0037a2..0af0b47 100644 --- a/crowdsec/versions/v1/middleware.yaml +++ b/crowdsec/versions/v1/middleware.yaml @@ -48,7 +48,6 @@ spec: browserXssFilter: true contentTypeNosniff: true forceSTSHeader: true - frameDeny: true sslRedirect: true stsIncludeSubdomains: true stsPreload: true @@ -72,6 +71,7 @@ spec: X-Forwarded-Proto: https customResponseHeaders: Server: "" + X-Frame-Options: SAMEORIGIN X-Robots-Tag: noindex,nofollow,nosnippet,noarchive,notranslate,noimageindex --- apiVersion: traefik.io/v1alpha1 diff --git a/eventyay/versions/1/README.md b/eventyay/versions/1/README.md index 0548eba..4dc9e71 100644 --- a/eventyay/versions/1/README.md +++ b/eventyay/versions/1/README.md @@ -27,7 +27,7 @@ Key settings in `config.yaml`: 2. Create the superuser account: ```bash - kubectl exec -n eventyay deploy/eventyay -- python manage.py createsuperuser + EMAIL=you@example.com scripts/create-superuser.sh ``` 3. Log in at `/orga/login/` with the credentials you just created. diff --git a/eventyay/versions/1/deployment.yaml b/eventyay/versions/1/deployment.yaml index e53a7d4..18f37dd 100644 --- a/eventyay/versions/1/deployment.yaml +++ b/eventyay/versions/1/deployment.yaml @@ -122,26 +122,48 @@ spec: mountPath: /home/app/.gunicorn livenessProbe: httpGet: - path: / - port: 8000 - httpHeaders: - - name: Host - value: "{{ .domain }}" + path: /static/pretixbase/img/eventyay-icon.svg + port: 8080 initialDelaySeconds: 120 timeoutSeconds: 10 periodSeconds: 30 failureThreshold: 6 readinessProbe: httpGet: - path: / - port: 8000 - httpHeaders: - - name: Host - value: "{{ .domain }}" + path: /static/pretixbase/img/eventyay-icon.svg + port: 8080 initialDelaySeconds: 60 timeoutSeconds: 5 periodSeconds: 15 failureThreshold: 3 + - name: nginx + image: nginxinc/nginx-unprivileged:1.27-alpine + ports: + - name: nginx-http + containerPort: 8080 + protocol: TCP + volumeMounts: + - name: eventyay-static + mountPath: /static + readOnly: true + - name: nginx-config + mountPath: /etc/nginx/conf.d + readOnly: true + resources: + limits: + cpu: 200m + memory: 128Mi + requests: + cpu: 10m + memory: 32Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + add: + - NET_BIND_SERVICE + readOnlyRootFilesystem: false volumes: - name: eventyay-data persistentVolumeClaim: @@ -150,6 +172,9 @@ spec: emptyDir: {} - name: eventyay-gunicorn emptyDir: {} + - name: nginx-config + configMap: + name: eventyay-nginx restartPolicy: Always --- apiVersion: apps/v1 @@ -237,9 +262,9 @@ spec: limits: cpu: "2" ephemeral-storage: 1Gi - memory: 1Gi + memory: 4Gi requests: cpu: 50m ephemeral-storage: 50Mi - memory: 512Mi + memory: 2Gi restartPolicy: Always diff --git a/eventyay/versions/1/kustomization.yaml b/eventyay/versions/1/kustomization.yaml index a1e479c..5ad1689 100644 --- a/eventyay/versions/1/kustomization.yaml +++ b/eventyay/versions/1/kustomization.yaml @@ -10,6 +10,7 @@ labels: resources: - namespace.yaml - pvc.yaml + - nginx-configmap.yaml - deployment.yaml - service.yaml - ingress.yaml diff --git a/eventyay/versions/1/manifest.yaml b/eventyay/versions/1/manifest.yaml index 4aa3c72..a33667e 100644 --- a/eventyay/versions/1/manifest.yaml +++ b/eventyay/versions/1/manifest.yaml @@ -1,4 +1,4 @@ -version: main-2 +version: main-5 requires: - name: postgres - name: redis @@ -23,6 +23,16 @@ defaultConfig: port: '{{ .apps.smtp.port }}' from: '{{ .apps.smtp.from }}' user: '{{ .apps.smtp.user }}' +scripts: + - name: create-superuser + path: scripts/create-superuser.sh + description: "Create an Eventyay superuser account for first-time setup." + params: + - name: EMAIL + description: Email address for the superuser account + required: true + - name: PASSWORD + description: Password (leave blank to generate a random one) defaultSecrets: - key: dbPassword - key: djangoSecret diff --git a/eventyay/versions/1/nginx-configmap.yaml b/eventyay/versions/1/nginx-configmap.yaml new file mode 100644 index 0000000..65444be --- /dev/null +++ b/eventyay/versions/1/nginx-configmap.yaml @@ -0,0 +1,31 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: eventyay-nginx + namespace: {{ .namespace }} +data: + nginx.conf: | + server { + listen 8080; + server_name _; + client_max_body_size 100m; + + location /static/ { + alias /static/; + expires 30d; + add_header Cache-Control "public, immutable"; + } + + location /media/ { + alias /media/; + } + + location / { + proxy_pass http://127.0.0.1:8000; + proxy_set_header Host $http_host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto; + proxy_read_timeout 120s; + } + } diff --git a/eventyay/versions/1/scripts/create-superuser.sh b/eventyay/versions/1/scripts/create-superuser.sh new file mode 100755 index 0000000..057f407 --- /dev/null +++ b/eventyay/versions/1/scripts/create-superuser.sh @@ -0,0 +1,56 @@ +#!/bin/bash +# Create an Eventyay superuser (organizer admin account). +# +# Required for first-time setup — the web UI cannot be accessed until +# at least one superuser exists. +# +# Runs on the worker pod because the web pod's memory limit is too tight +# to run an additional Django process alongside gunicorn workers. +set -e +set -o pipefail + +if [ -z "${KUBECONFIG}" ] || [ -z "${WILD_INSTANCE}" ] || [ -z "${WILD_API_DATA_DIR}" ]; then + echo "ERROR: KUBECONFIG, WILD_INSTANCE, and WILD_API_DATA_DIR must be set" + exit 1 +fi + +if [ -z "${EMAIL}" ]; then + echo "ERROR: EMAIL is required" + exit 1 +fi + +CONFIG_FILE="${WILD_API_DATA_DIR}/instances/${WILD_INSTANCE}/config.yaml" + +NAMESPACE="$(yq '.apps.eventyay.namespace' "${CONFIG_FILE}" | tr -d '"')" +NAMESPACE="${NAMESPACE:-eventyay}" + +# Run on the worker pod — same image as web, but with a higher memory limit +# which is needed to run manage.py alongside the existing gunicorn workers. +POD="$(kubectl get pods -n "${NAMESPACE}" -l component=worker --field-selector=status.phase=Running -o jsonpath='{.items[0].metadata.name}' 2>/dev/null)" +if [ -z "${POD}" ]; then + echo "ERROR: No running Eventyay worker pod found in namespace ${NAMESPACE}" + exit 1 +fi + +if [ -z "${PASSWORD}" ]; then + PASSWORD="$(openssl rand -base64 24 | tr -d '/+=' | head -c 24)" +fi + +echo "Creating superuser '${EMAIL}'..." + +kubectl exec -n "${NAMESPACE}" "${POD}" -- \ + python manage.py shell -c " +from django.contrib.auth import get_user_model +User = get_user_model() +if User.objects.filter(email='${EMAIL}').exists(): + raise SystemExit('ERROR: User ${EMAIL} already exists') +User.objects.create_superuser(email='${EMAIL}', password='${PASSWORD}') +" + +echo "" +echo "=== Superuser created ===" +echo "Email: ${EMAIL}" +echo "Password: ${PASSWORD}" +echo "" +echo "Log in at /orga/login/ with these credentials." +echo "Save this password — it will not be shown again." diff --git a/eventyay/versions/1/service.yaml b/eventyay/versions/1/service.yaml index f970c11..147b2c6 100644 --- a/eventyay/versions/1/service.yaml +++ b/eventyay/versions/1/service.yaml @@ -9,5 +9,5 @@ spec: ports: - name: http port: 80 - targetPort: 8000 + targetPort: 8080 protocol: TCP diff --git a/pretix/versions/2026/deployment.yaml b/pretix/versions/2026/deployment.yaml index 7663750..e19c606 100644 --- a/pretix/versions/2026/deployment.yaml +++ b/pretix/versions/2026/deployment.yaml @@ -78,11 +78,11 @@ spec: limits: cpu: "2" ephemeral-storage: 1Gi - memory: 4Gi + memory: 6Gi requests: cpu: 50m ephemeral-storage: 50Mi - memory: 256Mi + memory: 512Mi volumeMounts: - name: pretix-data mountPath: /data