From 8a54f9a866b836225757bf0b031433ced11828b1 Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Fri, 20 Mar 2026 12:24:06 -0500
Subject: [PATCH] Increase CPU limits to fix SSL connection timeouts (#96)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pods were running at 500m/500m (100% of limit) with 44-47% of scheduling
periods being CPU-throttled. SSL decryption is CPU-intensive — when the
BEAM gets throttled mid ssl_gen_statem:call/2, the SSL recv stalls until
the cgroup allows CPU again, causing the 15s DBConnection timeout.

This was the actual root cause of "client timed out because it queued
and checked out the connection for longer than 15000ms" errors. Previous
fixes (TCP keepalive, pool tuning, oban pruner) were treating symptoms.

- CPU limit: 500m → 2000m (4 cores burst capacity)
- CPU request: 100m → 500m (guarantee adequate baseline)

Reviewed-on: https://git.mcintire.me/graham/towerops-web/pulls/96
---
 k8s/deployment.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/k8s/deployment.yaml b/k8s/deployment.yaml
index b5b56f16..e0970ec4 100644
--- a/k8s/deployment.yaml
+++ b/k8s/deployment.yaml
@@ -212,10 +212,10 @@ spec:
           resources:
             requests:
               memory: "1.5Gi"
-              cpu: "100m"
+              cpu: "500m"
             limits:
               memory: "3Gi"
-              cpu: "500m"
+              cpu: "2000m"
           startupProbe:
             httpGet:
               path: /health