Kristian Fiskerstrand <kristian.fiskerstr...@sumptuouscapital.com> wrote:
> On 04/24/2017 09:33 PM, Jonathon Weiss wrote: > > Daniel, > > > > I'm pulling your questions into this thread, which I started before > > seeing your mail: > > > > For reference, I can download this key without a problem. While I'm > > topologically closer to pgp.mit.edu than you are, I believe the 1s > > timeout should only count the time passing the info to Apache, not all > > the way back to you (but please correct me if you think I'm wrong here). > > If it is, in fact, taking more than 1s to transfer extremely large keys > > from SKS to Apache, then I'm somewhat between a rock and a hard place > > here. If you go back and try again now, are you still seeing the > > problem? > > Fwiw, I'm still seeing it. I've tested a number of compromise configurations. I'm not sure I've resolved the cascading failure (time will tell) but I was wondering, if I've solved the timeout problem on large keys. Could you re-test? > > As noted, I dropped this timeout form 4s to 1s last week to deal with > > the cascading failure described below. > > > > The reverse proxy is Apache, but it is SKS' wserver_timeout that is set > > to 1s. > > > > Any thoughts and advice would be welcome here. I have a couple, but > > they are either of dubious effectiveness, or relatively drastic / much > > slower to implement. > > > > One thing that springs to mind is multiple instances of SKS behind the > reverse proxy to distribute the load (I run two instances myself - and > that is for lesser load). Would just need separate key port and do local > reconciliation only between them necessary , can make sure stats page > (?op=stats) only reaches the primary so it exposes the external peers on > the reverse proxy. That was my slower to implement thought. Can you explain your configuration in a little more detail? Do I understand correctly that you're running multiple SKS instances on the same machine? Each with their own copy of the DB? Is there any concern about polluting https://sks-keyservers.net/status/ ? I guess all these same questions apply if you have them on seperate VMs rather than the same machine. Jonathon Jonathon Weiss <jwe...@mit.edu> MIT/IS&T/Infrastructure Design & Engineering Cloud Platforms (Server Operations) _______________________________________________ Sks-devel mailing list Sks-devel@nongnu.org https://lists.nongnu.org/mailman/listinfo/sks-devel