scripts/setup-host.sh - master - zcl1ax/BBR_platform

scripts/setup-host.sh
81 строка4 KB
Zcl1aX
fix: nuclei OOM — severity filter + host swap setup
02 авг 2026, 17:00
02 авг 2026, 17:00e7d3792
#!/usr/bin/env sh
# Configure host-level swap for the BBR platform VPS.
#
# WHY: a 4GB VPS running nuclei routinely OOM-kills the nuclei subprocess
# inside the worker container's 2GB memory cgroup — nuclei peaks ~700-800MB
# loading 13k templates, on top of the other worker processes, and the host has
# no swap to absorb the spike. Adding swap lets the kernel spill cold file-rss
# and ride out peaks instead of killing the scanner.
#
# This is a HOST-LEVEL script: run it on the VPS itself (not in a container).
# It is idempotent — safe to re-run; it never removes an existing swap or
# overwrites an existing fstab entry.
#
# Usage:
#   sudo sh scripts/setup-host.sh
#   sudo SWAP_SIZE=4G SWAP_FILE=/swapfile sh scripts/setup-host.sh
#
# Defaults: 4GB at /swapfile, vm.swappiness=10 (prefer RAM, swap only for peaks).
set -eu

SWAP_FILE="${SWAP_FILE:-/swapfile}"
SWAP_SIZE="${SWAP_SIZE:-4G}"
SWAPPINESS="${SWAPPINESS:-10}"

# ── 1. Preflight ────────────────────────────────────────────────────────────
if [ "$(id -u)" -ne 0 ]; then
    echo "Error: must run as root (use sudo)." >&2
    exit 1
fi

# SwapTotal is in kB. awk returns 0 if the line is absent (no swap).
current_kb=$(awk '/^SwapTotal:/ {print $2}' /proc/meminfo)
current_kb=${current_kb:-0}
# Only treat it as "configured" if non-trivial (>1MB).
if [ "$current_kb" -gt 1024 ]; then
    current_mb=$((current_kb / 1024))
    echo "Swap already active: ${current_mb}MB. Nothing to do."
    echo "To recreate, first run:  swapoff ${SWAP_FILE} && rm ${SWAP_FILE}"
    exit 0
fi

# ── 2. Create the swap file ────────────────────────────────────────────────
# Prefer fallocate (instant); fall back to dd if the filesystem doesn't support
# it (e.g. some ext4 configs, ZFS). `dd` is slow for multi-GB files.
echo "Creating ${SWAP_SIZE} swap file at ${SWAP_FILE} ..."
if fallocate -l "$SWAP_SIZE" "$SWAP_FILE" 2>/dev/null; then
    : # fallocate succeeded
else
    echo "fallocate not supported on this fs; falling back to dd (slower) ..."
    dd if=/dev/zero of="$SWAP_FILE" bs=1M count=$((${SWAP_SIZE%G} * 1024)) status=progress
fi

chmod 600 "$SWAP_FILE"
mkswap "$SWAP_FILE" >/dev/null
swapon "$SWAP_FILE"

# ── 3. Persist across reboots (idempotent fstab edit) ──────────────────────
if ! grep -q "^${SWAP_FILE} " /etc/fstab; then
    printf '%s none swap sw 0 0\n' "$SWAP_FILE" >> /etc/fstab
    echo "Added ${SWAP_FILE} to /etc/fstab (persists across reboots)."
else
    echo "${SWAP_FILE} already in /etc/fstab."
fi

# ── 4. Tune swappiness (persist + apply now) ───────────────────────────────
# swappiness=10: keep data in RAM, only swap under memory pressure. The
# standard value for servers running databases / containers.
CONF_FILE=/etc/sysctl.d/99-bbr-swap.conf
{
    echo "# Added by BBR platform scripts/setup-host.sh"
    echo "vm.swappiness=${SWAPPINESS}"
} > "$CONF_FILE"
sysctl -w "vm.swappiness=${SWAPPINESS}" >/dev/null

# ── 5. Verify ──────────────────────────────────────────────────────────────
echo
echo "Done. Current memory:"
free -h
echo
echo "Swap devices:"
swapon --show 2>/dev/null || echo "(swapon --show unavailable)"