commit 39c90581a241f261e09e995d3942ad1faa2981e4
parent bca9ad3b4b389935141e6c5a090ea988646723db
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Fri, 17 Apr 2026 19:37:21 +0200
improve perf
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
7 files changed, 192 insertions(+), 7 deletions(-)
diff --git a/apps/talos_cluster/image-policies/mediawiki.yaml b/apps/talos_cluster/image-policies/mediawiki.yaml
@@ -1,3 +1,27 @@
+# Valkey (shared cache)
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImageRepository
+metadata:
+ name: valkey
+ namespace: flux-system
+spec:
+ image: docker.io/valkey/valkey
+ interval: 6h
+---
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImagePolicy
+metadata:
+ name: valkey
+ namespace: flux-system
+spec:
+ imageRepositoryRef:
+ name: valkey
+ filterTags:
+ pattern: '^\d+-alpine$'
+ policy:
+ alphabetical:
+ order: desc
+---
# Custom MediaWiki image (registry.midnightthoughts.space)
apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImageRepository
diff --git a/apps/talos_cluster/mediawiki/Dockerfile b/apps/talos_cluster/mediawiki/Dockerfile
@@ -9,7 +9,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
https://github.com/wikimedia/mediawiki-extensions-CodeMirror.git \
/var/www/html/extensions/CodeMirror \
&& rm -rf /var/www/html/extensions/CodeMirror/.git \
+ && pecl install apcu \
+ && docker-php-ext-enable apcu \
&& apt-get purge -y git && apt-get autoremove -y \
- && rm -rf /var/lib/apt/lists/*
+ && rm -rf /var/lib/apt/lists/* /tmp/pear
COPY php-custom.ini /usr/local/etc/php/conf.d/mediawiki-custom.ini
diff --git a/apps/talos_cluster/mediawiki/configmap.yaml b/apps/talos_cluster/mediawiki/configmap.yaml
@@ -53,13 +53,21 @@ data:
'password' => getenv('MW_SMTP_PASSWORD') ?: '',
];
- # Caching
- $wgMainCacheType = CACHE_NONE;
- $wgSessionCacheType = CACHE_DB;
+ # Caching — Valkey for shared object/session/parser cache, APCu for localisation
+ $wgObjectCaches['redis'] = [
+ 'class' => 'RedisBagOStuff',
+ 'servers' => ['mediawiki-valkey.mediawiki.svc.cluster.local:6379'],
+ 'persistent' => true,
+ ];
+ $wgMainCacheType = 'redis';
+ $wgSessionCacheType = 'redis';
+ $wgParserCacheType = 'redis';
+
+ # APCu for localisation cache (in-process, fastest for single-language wiki)
+ $wgLocalisationCacheConf = ['store' => 'accel'];
- # Performance
- $wgParserCacheType = CACHE_DB;
- $wgJobRunRate = 1;
+ # Run jobs via CronJob, not on page requests
+ $wgJobRunRate = 0;
# === Spam prevention ===
# Disable public account creation — admins create accounts manually
diff --git a/apps/talos_cluster/mediawiki/cronjob.yaml b/apps/talos_cluster/mediawiki/cronjob.yaml
@@ -0,0 +1,81 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+ name: mediawiki-runJobs
+ namespace: mediawiki
+spec:
+ schedule: "*/5 * * * *"
+ concurrencyPolicy: Forbid
+ successfulJobsHistoryLimit: 1
+ failedJobsHistoryLimit: 3
+ jobTemplate:
+ spec:
+ template:
+ spec:
+ restartPolicy: OnFailure
+ automountServiceAccountToken: false
+ securityContext:
+ runAsNonRoot: false
+ containers:
+ - name: runJobs
+ image: registry.midnightthoughts.space/mtrnord/mediawiki:1.45.3 # {"$imagepolicy": "flux-system:mediawiki"}
+ command:
+ - php
+ - ./maintenance/run.php
+ - runJobs
+ - --maxtime=240
+ envFrom:
+ - secretRef:
+ name: mediawiki-cred
+ env:
+ - name: MW_DB_NAME
+ valueFrom:
+ secretKeyRef:
+ name: mediawiki-cred
+ key: db-name
+ - name: MW_DB_USER
+ valueFrom:
+ secretKeyRef:
+ name: mediawiki-cred
+ key: username
+ - name: MW_DB_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: mediawiki-cred
+ key: password
+ - name: MW_SECRET_KEY
+ valueFrom:
+ secretKeyRef:
+ name: mediawiki-cred
+ key: wg-secret-key
+ - name: MW_UPGRADE_KEY
+ valueFrom:
+ secretKeyRef:
+ name: mediawiki-cred
+ key: wg-upgrade-key
+ - name: MW_SMTP_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: mediawiki-cred
+ key: smtp-password
+ volumeMounts:
+ - name: mediawiki-config
+ mountPath: /var/www/html/LocalSettings.php
+ subPath: LocalSettings.php
+ readOnly: true
+ - name: mediawiki-images
+ mountPath: /var/www/html/images
+ resources:
+ requests:
+ memory: "128Mi"
+ cpu: "50m"
+ limits:
+ memory: "256Mi"
+ cpu: "200m"
+ volumes:
+ - name: mediawiki-config
+ configMap:
+ name: mediawiki-config
+ - name: mediawiki-images
+ persistentVolumeClaim:
+ claimName: mediawiki-images
diff --git a/apps/talos_cluster/mediawiki/kustomization.yaml b/apps/talos_cluster/mediawiki/kustomization.yaml
@@ -7,5 +7,7 @@ resources:
- configmap.yaml
- pvc.yaml
- mariadb.yaml
+ - valkey.yaml
- deployment.yaml
+ - cronjob.yaml
- route.yaml
diff --git a/apps/talos_cluster/mediawiki/php-custom.ini b/apps/talos_cluster/mediawiki/php-custom.ini
@@ -2,3 +2,15 @@ upload_max_filesize = 50M
post_max_size = 50M
memory_limit = 256M
max_execution_time = 60
+
+; OPcache
+opcache.enable = 1
+opcache.memory_consumption = 128
+opcache.interned_strings_buffer = 16
+opcache.max_accelerated_files = 10000
+opcache.revalidate_freq = 60
+opcache.fast_shutdown = 1
+
+; APCu
+apc.enabled = 1
+apc.shm_size = 64M
diff --git a/apps/talos_cluster/mediawiki/valkey.yaml b/apps/talos_cluster/mediawiki/valkey.yaml
@@ -0,0 +1,56 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: mediawiki-valkey
+ namespace: mediawiki
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app: mediawiki-valkey
+ template:
+ metadata:
+ labels:
+ app: mediawiki-valkey
+ spec:
+ automountServiceAccountToken: false
+ securityContext:
+ runAsUser: 999
+ runAsGroup: 999
+ fsGroup: 999
+ containers:
+ - name: valkey
+ image: valkey/valkey:8-alpine # {"$imagepolicy": "flux-system:valkey"}
+ ports:
+ - containerPort: 6379
+ securityContext:
+ allowPrivilegeEscalation: false
+ readOnlyRootFilesystem: false
+ capabilities:
+ drop:
+ - ALL
+ resources:
+ requests:
+ cpu: 10m
+ memory: 64Mi
+ limits:
+ cpu: 200m
+ memory: 128Mi
+ volumeMounts:
+ - name: data
+ mountPath: /data
+ volumes:
+ - name: data
+ emptyDir: {}
+---
+apiVersion: v1
+kind: Service
+metadata:
+ name: mediawiki-valkey
+ namespace: mediawiki
+spec:
+ selector:
+ app: mediawiki-valkey
+ ports:
+ - port: 6379
+ targetPort: 6379
