feat: ingest burst hardening — defer lifecycle/auth, workers, nginx (v0.5.5)

Defer notify_lifecycle and notify_auth_login after commit; SAC_UVICORN_WORKERS via sac-api-start.sh; nginx /api/v1/events timeout; mass-update confirm in Hosts UI.

deploy/env.native.example

@@ -7,6 +7,8 @@ DATABASE_URL=postgresql+psycopg2://sac:CHANGE_ME_POSTGRES_PASSWORD@127.0.0.1:543
 # SQLAlchemy pool (uvicorn workers × concurrent ingest). Было по умолчанию 5+10 — мало для штурма 09:00.
 SAC_DB_POOL_SIZE=15
 SAC_DB_MAX_OVERFLOW=25
+# Uvicorn workers (ingest burst). Читает deploy/systemd/sac-api-start.sh; при >1 отключите in-process host_silence scan ниже.
+SAC_UVICORN_WORKERS=4
 
 SAC_PUBLIC_URL=https://sac.kalinamall.ru
 # Опционально: другой базовый URL для WinRM-скачивания RDP bundle с ПК (LAN / split-DNS).

deploy/nginx/sac.conf.example

@@ -44,6 +44,19 @@ server {
         proxy_read_timeout 960s;
     }
 
+    # Ingest burst: lifecycle/auth deferred в API, но POST всё равно может ждать notify_event/problem.
+    location = /api/v1/events {
+        proxy_pass http://sac_api;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_connect_timeout 30s;
+        proxy_send_timeout 120s;
+        proxy_read_timeout 120s;
+    }
+
     location / {
         proxy_pass http://sac_api;
         proxy_http_version 1.1;

deploy/nginx/sac.conf.tls.example

@@ -69,6 +69,19 @@ server {
         proxy_read_timeout 960s;
     }
 
+    # Ingest burst: lifecycle/auth deferred в API, но POST всё равно может ждать notify_event/problem.
+    location = /api/v1/events {
+        proxy_pass http://sac_api;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_connect_timeout 30s;
+        proxy_send_timeout 120s;
+        proxy_read_timeout 120s;
+    }
+
     location / {
         proxy_pass http://sac_api;
         proxy_http_version 1.1;

deploy/sac-deploy.sh

@@ -93,6 +93,10 @@ if [ -f "${APP_ROOT}/deploy/systemd/${SERVICE_NAME}.service" ]; then
   systemctl daemon-reload
  fi
 fi
+START_SH="${APP_ROOT}/deploy/systemd/sac-api-start.sh"
+if [ -f "${START_SH}" ]; then
+ chmod 755 "${START_SH}"
+fi
 
 log "Проверка DATABASE_URL (как у uvicorn через SAC_CONFIG_FILE)"
 sudo -u "${APP_USER}" bash -c "

deploy/systemd/sac-api-start.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# Uvicorn launcher: SAC_UVICORN_WORKERS из sac-api.env (без systemd EnvironmentFile).
+set -euo pipefail
+
+APP_ROOT="${SAC_APP_ROOT:-/opt/security-alert-center}"
+CONFIG_FILE="${SAC_CONFIG_FILE:-${APP_ROOT}/config/sac-api.env}"
+VENV="${APP_ROOT}/backend/.venv"
+HOST="127.0.0.1"
+PORT="8000"
+WORKERS=4
+
+_read_env_int() {
+	local key="$1" default="$2" line val
+	[ -f "$CONFIG_FILE" ] || {
+		printf '%s\n' "$default"
+		return 0
+	}
+	line="$(grep -E "^[[:space:]]*${key}=" "$CONFIG_FILE" 2>/dev/null | tail -1)" || {
+		printf '%s\n' "$default"
+		return 0
+	}
+	val="${line#*=}"
+	val="${val#"${val%%[![:space:]]*}"}"
+	val="${val%"${val##*[![:space:]]}"}"
+	val="${val#\"}"
+	val="${val%\"}"
+	val="${val#\'}"
+	val="${val%\'}"
+	if [[ "$val" =~ ^[0-9]+$ ]] && [ "$val" -ge 1 ]; then
+		printf '%s\n' "$val"
+	else
+		printf '%s\n' "$default"
+	fi
+}
+
+WORKERS="$(_read_env_int SAC_UVICORN_WORKERS 4)"
+
+exec "${VENV}/bin/uvicorn" app.main:app \
+	--host "$HOST" \
+	--port "$PORT" \
+	--workers "$WORKERS" \
+	--timeout-graceful-shutdown 30

deploy/systemd/sac-api.service

@@ -13,7 +13,7 @@ WorkingDirectory=/opt/security-alert-center/backend
 # Конфиг читает само приложение (pydantic), не systemd — иначе ломаются пароли с #, $ и т.д.
 Environment=SAC_CONFIG_FILE=/opt/security-alert-center/config/sac-api.env
 Environment=PYTHONPATH=/opt/security-alert-center/backend
-ExecStart=/opt/security-alert-center/backend/.venv/bin/uvicorn app.main:app --host 127.0.0.1 --port 8000 --workers 2 --timeout-graceful-shutdown 30
+ExecStart=/opt/security-alert-center/deploy/systemd/sac-api-start.sh
 Restart=on-failure
 RestartSec=5
 TimeoutStopSec=20