From c93b52d99cf8d7f37732f077280cd01a2e005792 Mon Sep 17 00:00:00 2001
From: sorcier <sorcier@sorcier-research.com>
Date: Thu, 5 Nov 2026 23:46:02 +0100
Subject: [PATCH] perf(core): eliminate PHP session file lock contention on
 API/metrics, tune PHP-FPM pool, and remove redundant Keepalived restarts on
 sync

---
 install.sh             | 10 ++++++++++
 public/api.php         | 27 +++++++++++++++++----------
 src/ClusterManager.php | 12 ++++++++----
 3 files changed, 35 insertions(+), 14 deletions(-)

diff --git a/install.sh b/install.sh
index 92aafed..e13201c 100755
--- a/install.sh
+++ b/install.sh
@@ -524,6 +524,16 @@ chmod +x /etc/profile.d/nexus-motd.sh
 echo -e "${C_GREEN}[8/8] Démarrage et activation des services système...${C_RESET}"
 systemctl daemon-reload
 
+# Optimisation de la réserve de processus PHP-FPM pour supporter la télémétrie temps réel et le cluster HA
+for pool in /etc/php/*/fpm/pool.d/www.conf; do
+    if [ -f "$pool" ]; then
+        sed -i 's/^pm.max_children = .*/pm.max_children = 25/' "$pool"
+        sed -i 's/^pm.start_servers = .*/pm.start_servers = 4/' "$pool"
+        sed -i 's/^pm.min_spare_servers = .*/pm.min_spare_servers = 2/' "$pool"
+        sed -i 's/^pm.max_spare_servers = .*/pm.max_spare_servers = 6/' "$pool"
+    fi
+done
+
 # Redémarrage PHP-FPM (rechargement de l'appartenance au groupe asterisk)
 systemctl restart php*-fpm 2>/dev/null || true
 PHP_SVC=$(systemctl list-unit-files --type=service 2>/dev/null | grep -E "php.*-fpm" | awk '{print $1}' | head -n 1 || echo "php8.4-fpm")
diff --git a/public/api.php b/public/api.php
index 41386b4..763414b 100644
--- a/public/api.php
+++ b/public/api.php
@@ -42,7 +42,6 @@ header('Cache-Control: no-store, no-cache, must-revalidate');
 
 try {
     $db = Database::getConnection();
-    Auth::startSession();
 
     $action  = trim((string)($_GET['action'] ?? ''));
     $rawBody = file_get_contents('php://input');
@@ -51,6 +50,23 @@ try {
         $payload = $_POST;
     }
 
+    // Action inter-serveurs réplication Cluster (authentifiée par signature HMAC - aucune session requise)
+    if ($action === 'cluster_receive_sync') {
+        $signature = $_SERVER['HTTP_X_NEXUS_CLUSTER_SIGNATURE'] ?? '';
+        $cm = new ClusterManager($db);
+        $res = $cm->receiveSyncPayload($rawBody ?: '', $signature);
+        echo json_encode($res);
+        exit;
+    }
+
+    Auth::startSession();
+
+    // Pour les requêtes en lecture seule fréquente (polling métriques / statut), libérer immédiatement le verrou de session
+    // Cela évite de saturer les workers PHP-FPM par des verrous de fichiers sessions concurrents
+    if (session_status() === PHP_SESSION_ACTIVE && ($action === 'get_metrics' || $action === 'cluster_status' || $action === 'get_system_info')) {
+        session_write_close();
+    }
+
     // Actions publiques (Login / Logout)
     if ($action === 'login') {
         $username = trim((string)($payload['username'] ?? ''));
@@ -86,15 +102,6 @@ try {
         exit;
     }
 
-    // Action inter-serveurs réplication Cluster (authentifiée par signature HMAC)
-    if ($action === 'cluster_receive_sync') {
-        $rawBody = file_get_contents('php://input') ?: '';
-        $signature = $_SERVER['HTTP_X_NEXUS_CLUSTER_SIGNATURE'] ?? '';
-        $cm = new ClusterManager($db);
-        $res = $cm->receiveSyncPayload($rawBody, $signature);
-        echo json_encode($res);
-        exit;
-    }
 
     // Toutes les autres actions requièrent une session authentifiée
     if (!Auth::isAuthenticated()) {
diff --git a/src/ClusterManager.php b/src/ClusterManager.php
index c1ce44c..7341e71 100644
--- a/src/ClusterManager.php
+++ b/src/ClusterManager.php
@@ -564,13 +564,14 @@ class ClusterManager
             curl_setopt($ch, CURLOPT_POSTFIELDS, $jsonPayload);
             curl_setopt($ch, CURLOPT_HTTPHEADER, [
                 'Content-Type: application/json',
+                'Expect:', // Désactive l'en-tête Expect: 100-continue pour éviter les blocages intermédiaires
                 'X-Nexus-Cluster-Signature: ' . $signature,
             ]);
             curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
             curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
             curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
-            curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 4);
-            curl_setopt($ch, CURLOPT_TIMEOUT, 30);
+            curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 3);
+            curl_setopt($ch, CURLOPT_TIMEOUT, 20);
 
             $response = curl_exec($ch);
             $httpCode = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
@@ -754,9 +755,12 @@ class ClusterManager
             shell_exec('/usr/sbin/asterisk -rx "pjsip send unregister *" 2>/dev/null || true');
         }
 
-        // Si le cluster est actif, actualiser le service Keepalived
+        // Si le cluster est activé mais que Keepalived n'est pas encore démarré, le démarrer
         if (!empty($localClusterSettings['enabled'])) {
-            $this->applyKeepalivedConfig();
+            $keepalivedRunning = trim((string)shell_exec('pidof keepalived 2>/dev/null')) !== '';
+            if (!$keepalivedRunning) {
+                $this->applyKeepalivedConfig();
+            }
         }
 
         return [