openvibers/openvibe.host Commits

Data role: Valkey takes no end-of-line comments (its first start on the host refused 'maxmemory-policy volatile-lru # …'), so the comment has its own line, and the test checks every Valkey line. The role also sets vm.overcommit_memory = 1 (sysctl.d), as Valkey's startup warning recommends for background saves, and resets a failed Valkey unit before restarting it, since systemd refuses a unit that hit its start limit.

OP OpenVibers committed 28 Sept 2026 · 6e2807f245 · 4 files, +10 −4





Changes
ddiff --git a/roles/data/files/sysctl-valkey.conf b/roles/data/files/sysctl-valkey.conf
nnew file mode 100644
iindex 0000000..6d37cf1
---- /dev/null
++++ b/roles/data/files/sysctl-valkey.conf
@@@ -0,0 +1,3 @@
++# OpenVibe data role (ADR-035): Valkey forks for background saves; without overcommit a fork can fail
++# under memory pressure (Valkey's own startup warning recommends this).
++vm.overcommit_memory = 1
ddiff --git a/roles/data/files/valkey-openvibe.conf b/roles/data/files/valkey-openvibe.conf
iindex 3a4767b..746f517 100644
---- a/roles/data/files/valkey-openvibe.conf
++++ b/roles/data/files/valkey-openvibe.conf
@@@ -1,10 +1,11 @@
  # OpenVibe data role (ADR-035): Valkey is shared and never authoritative (ADR-007 2026-09-24 rule 4).
--# Included from /etc/valkey/valkey.conf by roles/data/provision.sh.
++# Included from /etc/valkey/valkey.conf by roles/data/provision.sh. Valkey takes no end-of-line comments.
  bind 127.0.0.1 -::1
  port 6379
  protected-mode yes
  maxmemory 768mb
--maxmemory-policy volatile-lru     # only keys with a TTL (caches) are evicted; queues and counters are not
++# Only keys with a TTL (caches) are evicted; queues and counters are not.
++maxmemory-policy volatile-lru
  appendonly yes
  appendfsync everysec
  aclfile /etc/valkey/users.acl
ddiff --git a/roles/data/provision.sh b/roles/data/provision.sh
iindex 2015b86..d375b9f 100755
---- a/roles/data/provision.sh
++++ b/roles/data/provision.sh
@@@ -94,6 +94,7 @@ CONF
  fi
  
  # ── 4. Valkey ────────────────────────────────────────────────────────────────────────────────
++if install_file "$F/sysctl-valkey.conf" /etc/sysctl.d/60-openvibe-valkey.conf 644 root:root; then sysctl -q -p /etc/sysctl.d/60-openvibe-valkey.conf; fi
  install_file "$F/valkey-openvibe.conf" /etc/valkey/openvibe.conf 640 valkey:valkey && RESTART_VALKEY=1
  if ! grep -qx 'include /etc/valkey/openvibe.conf' /etc/valkey/valkey.conf; then
      if [ "$CHECK" = 1 ]; then log "would include openvibe.conf in /etc/valkey/valkey.conf"
@@@ -110,8 +111,8 @@ if [ "$CHECK" = 1 ]; then log "check done"; exit 0; fi
  systemctl enable -q postgresql valkey-server pgbouncer
  if [ "$RESTART_PG" = 1 ]; then log "restarting PostgreSQL"; systemctl restart "postgresql@$PGV-main"; elif [ "$RELOAD_PG" = 1 ]; then systemctl reload "postgresql@$PGV-main"; fi
  systemctl is-active -q "postgresql@$PGV-main" || systemctl start "postgresql@$PGV-main"
--[ "$RESTART_VALKEY" = 1 ] && { log "restarting Valkey"; systemctl restart valkey-server; }
--systemctl is-active -q valkey-server || systemctl start valkey-server
++[ "$RESTART_VALKEY" = 1 ] && { log "restarting Valkey"; systemctl reset-failed valkey-server 2>/dev/null || true; systemctl restart valkey-server; }
++systemctl is-active -q valkey-server || { systemctl reset-failed valkey-server 2>/dev/null || true; systemctl start valkey-server; }
  
  # Roles every data host has: the PgBouncer auth user (and its lookup function) and the monitoring user.
  BOUNCER_PW=$(secret PGBOUNCER_AUTH_PASSWORD); PGMON_PW=$(secret PG_MONITOR_PASSWORD)
ddiff --git a/test/data-role.test.js b/test/data-role.test.js
iindex f013c2b..d4cdb39 100644
---- a/test/data-role.test.js
++++ b/test/data-role.test.js
@@@ -36,6 +36,7 @@ runTests([
          assert.match(vk, /^bind 127\.0\.0\.1 -::1/m);
          assert.match(vk, /^maxmemory-policy volatile-lru/m);
          assert.match(vk, /^aclfile /m);
++        assert.ok(vk.split('\n').every((l) => l.startsWith('#') || !/\s#/.test(l)), 'Valkey takes no end-of-line comments');
      }),
      test('exporters bind loopback, archiving goes through pgBackRest, and secrets are never echoed', () => {
          const p = read('provision.sh');