perf: preload configured authen modules in the hypnotoad master - #53
Merged
Merged
Conversation
Since the 2.20 merge the SAML2 authentication module is no longer loaded
at startup (the custom Mojolicious::Plugin::Saml2 was retired in favour of
upstream WeBWorK::Authen::Saml2). The dispatcher loads it with runtime_use
inside each worker on its first request, so Net::SAML2 and its dependency
tree (Moose, XML::LibXML, XML::Sig, LWP, ...) are private memory in every
one of the 25 workers instead of copy-on-write pages shared from the
master. With accepts: 100 each recycled worker pays it again. This is the
main structural change behind the web pods roughly doubling their memory
between v2.18.14 and v2.20.x.
Preload every module configured in $authen{user_module},
$authen{admin_module} and $authen{proctor_module} in startup, before
hypnotoad forks. Failures are logged rather than fatal; the dispatcher
raises the real error if a module is actually used.
The push trigger used branches: ["*"], but a single "*" does not match "/" in GitHub Actions filters, so branches such as fix/preload-authen-modules never got an image build. Use "**" for branches and tags.
ionparticle
approved these changes
Sep 14, 2026
ionparticle
left a comment
ionparticle
left a comment
Member
There was a problem hiding this comment.
tested locally, confirmed saml2 login still works fine.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Since the 2.20 merge, the SAML2 authentication module is no longer loaded at startup: the custom
Mojolicious::Plugin::Saml2was retired in favour of upstreamWeBWorK::Authen::Saml2, which the dispatcher now loads withruntime_useinside each hypnotoad worker on its first request. Net::SAML2 and its dependency tree (Moose, XML::LibXML, XML::Sig, LWP, ...) therefore end up as private memory in every worker instead of copy-on-write pages shared from the master, and each recycled worker pays for it again.This PR preloads every module configured in
$authen{user_module},$authen{admin_module}and$authen{proctor_module}instartup, before hypnotoad forks. A small helper reads the configured list without mutating it (WeBWorK::Authen::classshifts entries off the array as they are tried). Load failures are logged as warnings rather than being fatal; the dispatcher still raises the real error if a broken module is actually used.Test plan
.perltidyrcPreloaded authentication module ...line per configured module