tailscale-proxy: pin 3proxy's nofile limit too

Completes the pair started in e41b55c, which deliberately left the proxy service out because it was still on a runtime prlimit only and had not yet had its maintenance window. ts-lan-proxy was subject to the same Docker default soft limit of 1024 that took Telemt down on 2026-09-09 — 3proxy does not raise its own limit either, and the container's HostConfig.Ulimits was null. Steady state is ~22 descriptors, so the ceiling was ~2% used in normal operation. Applied on the client-02 host at 22:45 MSK with docker compose up -d --no-deps --force-recreate proxy never a whole-stack up -d, which would also recreate ts-vpn and leave ts-lan-ikev2 holding a stale namespace. Verified afterwards: HostConfig.Ulimits now 65536/524288, container IP unchanged (172.31.0.4), egress through the proxy still measures the exit node 89.167.72.79 against a direct-egress control of 212.116.102.42, 3proxy.cfg untouched so the conditional-auth behaviour is unchanged, and the syslog log driver still emits access lines (confirmed on the wire). This file is STILL missing ts-vpn and ts-lan-ikev2, which have run on the host since 2026-09-05 — deploying it as-is would take the IKEv2 VPN down. That drift is unrelated to this commit and still needs its own.
2026-09-09 22:48:00 +03:00
parent e41b55ca4f
commit 331c274b8b
1 changed files with 6 additions and 0 deletions
@@ -22,6 +22,12 @@ services:
    image: ghcr.io/3proxy/3proxy:latest
    container_name: ts-lan-proxy
    restart: unless-stopped
    # Same Docker default-1024 trap that took Telemt down on 2026-09-09; 3proxy
    # does not raise its own soft limit either. Steady state is ~22 descriptors.
    ulimits:
      nofile:
        soft: 65536
        hard: 524288
    depends_on: [ts-proxy]
    volumes:
      - "/mnt/containers/tailscale-proxy/3proxy.cfg:/etc/3proxy/3proxy.cfg:ro,z"