AV-2082: Better CKAN UWSGI configuration

cdk/bin/opendata.ts

@@ -275,6 +275,10 @@ const ckanStackBeta = new CkanStack(app, 'CkanStack-beta', {
     taskMinCapacity: 0,
     taskMaxCapacity: 1,
   },
+  ckanUwsgiProps: {
+    processes: 4,
+    threads: 2
+  },
   ckanCronEnabled: true,
   archiverSendNotificationEmailsToMaintainers: false,
   archiverExemptDomainsFromBrokenLinkNotifications: [],
@@ -599,6 +603,10 @@ const ckanStackProd = new CkanStack(app, 'CkanStack-prod', {
     taskMinCapacity: 0,
     taskMaxCapacity: 1,
   },
+  ckanUwsgiProps: {
+    processes: 4,
+    threads: 2
+  },
   ckanCronEnabled: true,
   archiverSendNotificationEmailsToMaintainers: true,
   archiverExemptDomainsFromBrokenLinkNotifications: ['fmi.fi'],

cdk/lib/ckan-stack-props.ts

@@ -2,13 +2,15 @@ import { EcsStackProps, EcsStackPropsTaskDef } from './ecs-stack-props';
 import * as ec2 from "aws-cdk-lib/aws-ec2";
 import * as rds from "aws-cdk-lib/aws-rds";
 import {ISecret} from "aws-cdk-lib/aws-secretsmanager";
+import { CkanUwsgiProps } from './ckan-uwsgi-props';
 
 export interface CkanStackProps extends EcsStackProps {
   ckanTaskDef: EcsStackPropsTaskDef,
   ckanCronTaskDef: EcsStackPropsTaskDef,
   datapusherTaskDef: EcsStackPropsTaskDef,
   solrTaskDef: EcsStackPropsTaskDef,
   fusekiTaskDef: EcsStackPropsTaskDef,
+  ckanUwsgiProps: CkanUwsgiProps,
   ckanCronEnabled: boolean;
   archiverSendNotificationEmailsToMaintainers: boolean;
   archiverExemptDomainsFromBrokenLinkNotifications: string[];

cdk/lib/ckan-stack.ts

@@ -223,6 +223,8 @@ export class CkanStack extends Stack {
       CKAN_PROFILING_ENABLED: 'false',
       CKAN_LOG_LEVEL: 'INFO',
       CKAN_EXT_LOG_LEVEL: 'INFO',
+      CKAN_UWSGI_PROCESSES: props.ckanUwsgiProps.processes.toString(),
+      CKAN_UWSGI_THREADS: props.ckanUwsgiProps.threads.toString(),
       // .env
       CKAN_HOST: `ckan.${props.namespace.namespaceName}`,
       CKAN_PORT: '5000',

cdk/lib/ckan-uwsgi-props.ts

@@ -0,0 +1,5 @@
+export interface CkanUwsgiProps {
+  processes: number,
+  threads: number,
+}
+

cdk/test/ckan-stack.test.ts

@@ -154,6 +154,10 @@ test('verify ckan stack resources', () => {
       taskMinCapacity: 0,
       taskMaxCapacity: 1,
     },
+    ckanUwsgiProps: {
+      processes: 2,
+      threads: 2
+    },
     ckanCronEnabled: true,
     archiverSendNotificationEmailsToMaintainers: false,
     archiverExemptDomainsFromBrokenLinkNotifications: [],

ckan/Dockerfile

@@ -168,7 +168,6 @@ COPY templates ${TEMPLATE_DIR}
 COPY supervisor ${SUPERV_DIR}
 COPY cron ${CRON_DIR}
 COPY src/ckan/patches ${SRC_DIR}/ckan/patches
-COPY src/ckan/ckan-uwsgi.ini ${APP_DIR}
 
 # apply patches
 RUN cd ${SRC_DIR}/ckan && \

ckan/scripts/init_ckan.sh

@@ -9,6 +9,7 @@ rsync -au ${DATA_DIR}_base/. ${DATA_DIR}
 # apply templates
 jinja2 ${TEMPLATE_DIR}/production.ini.j2 -o ${APP_DIR}/production.ini
 jinja2 ${TEMPLATE_DIR}/who.ini.j2 -o ${APP_DIR}/who.ini
+jinja2 ${TEMPLATE_DIR}/ckan-uwsgi.ini.j2 -o ${APP_DIR}/ckan-uwsgi.ini
 jinja2 ${TEMPLATE_DIR}/datastore_permissions.sql.j2 -o ${SCRIPT_DIR}/datastore_permissions.sql
 
 # run prerun script that checks connections and inits db

ckan/scripts/reinit_ckan.sh

@@ -6,6 +6,7 @@ echo "reinit_ckan ..."
 # apply templates
 jinja2 ${TEMPLATE_DIR}/production.ini.j2 -o ${APP_DIR}/production.ini
 jinja2 ${TEMPLATE_DIR}/who.ini.j2 -o ${APP_DIR}/who.ini
+jinja2 ${TEMPLATE_DIR}/ckan-uwsgi.ini.j2 -o ${APP_DIR}/ckan-uwsgi.ini
 jinja2 ${TEMPLATE_DIR}/datastore_permissions.sql.j2 -o ${SCRIPT_DIR}/datastore_permissions.sql
 
 # run prerun script that checks connections and inits db

ckan/src/ckan/ckan-uwsgi.ini → ckan/templates/ckan-uwsgi.ini.j2

@@ -1,5 +1,6 @@
 [uwsgi]
 
+strict              =  true
 http                =  0.0.0.0:5000
 env                 =  CKAN_INI=/srv/app/production.ini
 uid                 =  www-data
@@ -12,12 +13,23 @@ master              =  true
 pidfile             =  /tmp/%n.pid
 harakiri            =  50
 max-requests        =  5000
+max-worker-lifetime =  3600
+worker-reload-mercy =  600
 vacuum              =  true
 callable            =  application
 buffer-size         =  32768
 stats               = /tmp/stats.sock
-processes           = 2
-threads             = 2
+processes           = {{ environ('CKAN_UWSGI_PROCESSES') }}
+threads             = {{ environ('CKAN_UWSGI_THREADS') }}
+
+# Avoid multiple interpreters (automatically created in case you need mounts)
+single-interpreter = true
+
+# Fix SIGTERM
+die-on-term = true
+
+# Enable an accept mutex for a more balanced worker load
+thunder-lock = true
 
 # Fix SQLAlchemy SSL errors
 # <https://stackoverflow.com/questions/22752521/uwsgi-flask-sqlalchemy-and-postgres-ssl-error-decryption-failed-or-bad-reco>

docker/.env.ckan.local

@@ -30,3 +30,7 @@ CKAN_CLOUDSTORAGE_USE_SECURE_URLS=1
 CKAN_CLOUDSTORAGE_AWS_USE_BOTO3_SESSIONS=1
 AWS_ACCESS_KEY_ID=""
 AWS_SECRET_ACCESS_KEY=""
+
+# ckan-uwsgi.ini
+CKAN_UWSGI_PROCESSES=2
+CKAN_UWSGI_THREADS=2