Give Traefik a GC target it can live under, and more room

[HarryCordewener]

What happened (2026-09-28, ~22:55 UTC onward)

A distributed crawler behind Cloudflare requested random facet combinations on /games and /zh-Hans/games at about 100 req/s (64,240 requests in ten minutes, of which 60,246 got a 429). web stayed healthy throughout, answering /health in 1.5 ms and /games in 0.56 s from inside its network. Traefik failed:

• Memory was at 511.9/512 MiB against GOMEMLIMIT=96MiB. A Go runtime over its soft limit collects continuously, and Traefik was at 62% CPU.
• Its load-balancer health probe to web missed the 3 s timeout, so it marked the only backend down. Every path returned 503, then 522 once Cloudflare timed out on Traefik.
• The host swapped about 870 MB between 22:55 and 23:01.

Change

	Before	After
GOMEMLIMIT	96MiB	640MiB
mem_limit / memswap_limit	512m	768m
websecure readTimeout / idleTimeout	60s / 180s (defaults)	15s / 30s
Access log	every status	everything except 429

• No writeTimeout: it bounds the whole response, and MCP crawl_run_cycle or a slow reader of a large listing legitimately runs long.
• Why 429s are dropped from the log: they were 94% of the lines, so the 100 MiB json-file rotation covered only ten minutes and the start of the flood had already rotated out.
• Memory: the host was overcommitted before this change and still is (limits sum to about 4.1 GB on 3.73 GiB). The compose comment now says so.

Verification

• Ran traefik:v3.7 with the new flags: it accepted them, and its parsed config shows readTimeout: 15s, idleTimeout: 30s and statusCodes: ["100-428","430-599"].
• Parsed the overlay YAML.
• Not run: docker compose config --quiet. The workstation has only podman-compose, which can't handle the existing !reset tag, so it needs to run on the box.

Deploy

Watchtower does not apply compose changes. In /opt/muindex:

git pull --ff-only origin main && docker compose config --quiet && docker compose up -d --no-deps traefik

Not in this PR: stopping the flood at the edge, which needs a Cloudflare WAF rule on stacked facet queries.

🤖 Generated with Claude Code

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Essentials

Run ID: c7c23f70-56b9-4876-9e21-e28a30071619

📥 Commits

Reviewing files that changed from the base of the PR and between 630f655 and 0d5a909.

📒 Files selected for processing (2)

• deploy/compose.production.yaml
• docs/deploy.md

---

_{Comment @coderabbitai help to get the list of available commands.}