From 159f014c1eda3a3aed37657ad9d7c1b953ba07ab Mon Sep 17 00:00:00 2001
From: Niek Otten <not@respellion.nl>
Date: Mon, 27 Jul 2026 14:32:13 +0000
Subject: [PATCH] =?UTF-8?q?perf:=20cap=20OpenZaak=20+=20NRC=20uWSGI=20work?=
 =?UTF-8?q?ers=20=E2=80=94=20shrink=20verify-stack=20footprint=20(closes?=
 =?UTF-8?q?=20#147)=20(#148)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## What & why

Closes #147. Follow-up to #144/#145. As the stack grew to **37 services** on one runner, `verify-stack` is under memory pressure. #145 capped Objecten/Objecttypen; this caps the two biggest remaining uncapped Django apps.

**OpenZaak** and **NRC** (`nrc-web`) are Maykin/vng uWSGI images running the image default of **4 processes × 4 threads** — ~4 full-Django worker processes (~800 MB) each, idle, serving only single-request smoke checks.

### What

- `UWSGI_PROCESSES: "1"` + `UWSGI_THREADS: "2"` on the `&oz-env` and `&nrc-env` anchors, in both compose files. Frees ~1.2 GB. The anchors are shared with the `-init` (setup_configuration) and `-celery` containers, which ignore the var — they don't run uwsgi.

### Not included (considered, deferred to #147 notes)

JVM heap caps on Keycloak/Flowable; compose profiles to boot per-check subsets.

## Verified locally

OpenZaak brought up healthy with the cap; uwsgi processes **6 → 3** (master + http-router + 1 worker); `/admin/` still 302. `docker compose config` clean on both files. (Full NRC bring-up needs OpenZaak + the seed chain — same image family/lever, validated via OpenZaak.)

## Definition of Done

- [x] Linked issue (#147).
- [x] Conventional Commit referencing #147.
- [x] Verified locally (OpenZaak healthy + worker count dropped + still serving).
- [x] Closed by the merging PR (`closes #147`).

No ADR: config-only tuning of existing services, same class as #145.

🤖 Generated with [Claude Code](https://claude.com/claude-code)Reviewed-on: https://git.labs.respellion.tech/eho/register-referentie/pulls/148
---
 infra/docker-compose.local.yml | 7 +++++++
 infra/docker-compose.yml       | 9 +++++++++
 2 files changed, 16 insertions(+)

diff --git a/infra/docker-compose.local.yml b/infra/docker-compose.local.yml
index a148115..cef59b0 100644
--- a/infra/docker-compose.local.yml
+++ b/infra/docker-compose.local.yml
@@ -56,6 +56,10 @@ services:
   oz-init:
     image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
     environment: &oz-env
+      # 1 uWSGI worker, not the image default of 4×4 (#147) — idle workers pressure the runner; the
+      # -init/-celery containers share this anchor and ignore it (they don't run uwsgi).
+      UWSGI_PROCESSES: "1"
+      UWSGI_THREADS: "2"
       DJANGO_SETTINGS_MODULE: openzaak.conf.docker
       SECRET_KEY: ${OZ_SECRET_KEY:-dev-only-not-for-production}
       DB_HOST: oz-db
@@ -138,6 +142,9 @@ services:
     # bind-mounted here (this twin is the local/no-make path). See ADR-0007.
     image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
     environment: &nrc-env
+      # 1 uWSGI worker, not the image default of 4×4 (#147) — see the oz-env note above.
+      UWSGI_PROCESSES: "1"
+      UWSGI_THREADS: "2"
       DJANGO_SETTINGS_MODULE: nrc.conf.docker
       SECRET_KEY: ${NRC_SECRET_KEY:-dev-only-not-for-production}
       DB_HOST: nrc-db
diff --git a/infra/docker-compose.yml b/infra/docker-compose.yml
index c7a1fde..ee5d0aa 100644
--- a/infra/docker-compose.yml
+++ b/infra/docker-compose.yml
@@ -51,6 +51,12 @@ services:
   oz-init:
     image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
     environment: &oz-env
+      # 1 uWSGI worker, not the image default of 4×4 (#147, same lever as #145): OpenZaak serves
+      # single-request smoke checks here and is not load-tested, so 4 idle Django workers just pin
+      # ~800 MB and pressure the shared runner. The -init (setup_configuration) and -celery containers
+      # share this anchor and ignore it — they don't run uwsgi.
+      UWSGI_PROCESSES: "1"
+      UWSGI_THREADS: "2"
       DJANGO_SETTINGS_MODULE: openzaak.conf.docker
       SECRET_KEY: ${OZ_SECRET_KEY:-dev-only-not-for-production}
       DB_HOST: oz-db
@@ -135,6 +141,9 @@ services:
     # needs no baked config.
     image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
     environment: &nrc-env
+      # 1 uWSGI worker, not the image default of 4×4 (#147) — see the oz-env note above.
+      UWSGI_PROCESSES: "1"
+      UWSGI_THREADS: "2"
       DJANGO_SETTINGS_MODULE: nrc.conf.docker
       SECRET_KEY: ${NRC_SECRET_KEY:-dev-only-not-for-production}
       DB_HOST: nrc-db