From c103a1ee05a5f777d21f3e60477c668aa34aadd4 Mon Sep 17 00:00:00 2001
From: Viktor Barzin <viktorbarzin@meta.com>
Date: Sun, 22 Mar 2026 15:22:29 +0200
Subject: [PATCH] fix OOMKilled containers: bump immich/actualbudget memory,
 disable changedetection, cap clickhouse
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- immich-server: 512Mi/1Gi → 1700Mi/1700Mi (VPA upperBound 1.39Gi, 34 OOM restarts)
- actualbudget http-api: 384Mi → 768Mi (VPA upperBound 615Mi, 3 OOM restarts)
- changedetection: replicas 1 → 0 (chronic OOM at 64Mi, not worth memory cost)
- rybbit clickhouse: add ConfigMap capping max_server_memory_usage to 800Mi (within 1Gi limit)
---
 stacks/actualbudget/factory/main.tf |  4 ++--
 stacks/changedetection/main.tf      |  3 ++-
 stacks/immich/main.tf               |  4 ++--
 stacks/rybbit/main.tf               | 25 +++++++++++++++++++++++++
 4 files changed, 31 insertions(+), 5 deletions(-)

diff --git a/stacks/actualbudget/factory/main.tf b/stacks/actualbudget/factory/main.tf
index 95663e4d..18614ccf 100644
--- a/stacks/actualbudget/factory/main.tf
+++ b/stacks/actualbudget/factory/main.tf
@@ -149,10 +149,10 @@ resource "kubernetes_deployment" "actualbudget-http-api" {
           resources {
             requests = {
               cpu    = "50m"
-              memory = "384Mi"
+              memory = "768Mi"
             }
             limits = {
-              memory = "384Mi"
+              memory = "768Mi"
             }
           }
 
diff --git a/stacks/changedetection/main.tf b/stacks/changedetection/main.tf
index 93f7752d..a40e73dc 100644
--- a/stacks/changedetection/main.tf
+++ b/stacks/changedetection/main.tf
@@ -76,7 +76,8 @@ resource "kubernetes_deployment" "changedetection" {
     }
   }
   spec {
-    replicas = 1
+    # Disabled: chronic OOM at 64Mi limit, not worth the memory cost to increase
+    replicas = 0
     strategy {
       type = "Recreate"
     }
diff --git a/stacks/immich/main.tf b/stacks/immich/main.tf
index 34c7bb29..975a3ddc 100644
--- a/stacks/immich/main.tf
+++ b/stacks/immich/main.tf
@@ -284,10 +284,10 @@ resource "kubernetes_deployment" "immich_server" {
           resources {
             requests = {
               cpu    = "100m"
-              memory = "512Mi"
+              memory = "1700Mi"
             }
             limits = {
-              memory = "1Gi"
+              memory = "1700Mi"
             }
           }
         }
diff --git a/stacks/rybbit/main.tf b/stacks/rybbit/main.tf
index 4ecf5a7e..44713396 100644
--- a/stacks/rybbit/main.tf
+++ b/stacks/rybbit/main.tf
@@ -70,6 +70,20 @@ module "nfs_clickhouse_data" {
   nfs_path   = "/mnt/main/clickhouse"
 }
 
+resource "kubernetes_config_map" "clickhouse_memory" {
+  metadata {
+    name      = "clickhouse-memory-config"
+    namespace = kubernetes_namespace.rybbit.metadata[0].name
+  }
+  data = {
+    "memory.xml" = <<-EOF
+      <clickhouse>
+          <max_server_memory_usage>838860800</max_server_memory_usage>
+      </clickhouse>
+    EOF
+  }
+}
+
 resource "kubernetes_deployment" "clickhouse" {
   metadata {
     name      = "clickhouse"
@@ -144,6 +158,11 @@ resource "kubernetes_deployment" "clickhouse" {
             name       = "data"
             mount_path = "/var/lib/clickhouse"
           }
+          volume_mount {
+            name       = "memory-config"
+            mount_path = "/etc/clickhouse-server/config.d/memory.xml"
+            sub_path   = "memory.xml"
+          }
           resources {
             requests = {
               cpu    = "500m"
@@ -160,6 +179,12 @@ resource "kubernetes_deployment" "clickhouse" {
             claim_name = module.nfs_clickhouse_data.claim_name
           }
         }
+        volume {
+          name = "memory-config"
+          config_map {
+            name = kubernetes_config_map.clickhouse_memory.metadata[0].name
+          }
+        }
       }
     }
   }