From 331c274b8bdb8a201e8aa419346e6f7e3c3fb1a7 Mon Sep 17 00:00:00 2001 From: pipistrello Date: Wed, 9 Sep 2026 22:48:00 +0300 Subject: [PATCH] tailscale-proxy: pin 3proxy's nofile limit too MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Completes the pair started in e41b55c, which deliberately left the proxy service out because it was still on a runtime prlimit only and had not yet had its maintenance window. ts-lan-proxy was subject to the same Docker default soft limit of 1024 that took Telemt down on 2026-09-09 — 3proxy does not raise its own limit either, and the container's HostConfig.Ulimits was null. Steady state is ~22 descriptors, so the ceiling was ~2% used in normal operation. Applied on the client-02 host at 22:45 MSK with docker compose up -d --no-deps --force-recreate proxy never a whole-stack up -d, which would also recreate ts-vpn and leave ts-lan-ikev2 holding a stale namespace. Verified afterwards: HostConfig.Ulimits now 65536/524288, container IP unchanged (172.31.0.4), egress through the proxy still measures the exit node 89.167.72.79 against a direct-egress control of 212.116.102.42, 3proxy.cfg untouched so the conditional-auth behaviour is unchanged, and the syslog log driver still emits access lines (confirmed on the wire). This file is STILL missing ts-vpn and ts-lan-ikev2, which have run on the host since 2026-09-05 — deploying it as-is would take the IKEv2 VPN down. That drift is unrelated to this commit and still needs its own. --- tailscale-proxy/docker-compose.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tailscale-proxy/docker-compose.yaml b/tailscale-proxy/docker-compose.yaml index 293c7da..18f2ae1 100644 --- a/tailscale-proxy/docker-compose.yaml +++ b/tailscale-proxy/docker-compose.yaml @@ -22,6 +22,12 @@ services: image: ghcr.io/3proxy/3proxy:latest container_name: ts-lan-proxy restart: unless-stopped + # Same Docker default-1024 trap that took Telemt down on 2026-09-09; 3proxy + # does not raise its own soft limit either. Steady state is ~22 descriptors. + ulimits: + nofile: + soft: 65536 + hard: 524288 depends_on: [ts-proxy] volumes: - "/mnt/containers/tailscale-proxy/3proxy.cfg:/etc/3proxy/3proxy.cfg:ro,z"