Support standard GRANIAN_* env vars and the rloop event loop

- Launcher now only injects --interface/--host/--port when the matching GRANIAN_* env var is unset, so every granian option (GRANIAN_LOOP, GRANIAN_WORKERS, GRANIAN_HTTP, GRANIAN_HOST, GRANIAN_PORT, ...) can be configured via granian's standard GRANIAN_* environment variables - Add the rloop event loop as a runtime dependency so GRANIAN_LOOP=rloop works out of the box (previously failed with a missing 'rloop' package)
Add Kubernetes manifests to deploy rbcs and kaya-rbcs in the rbcs namespace
2026-08-03 05:28:04 +00:00 · 2026-08-02 23:10:55 +00:00 · 2026-08-02 15:48:47 +00:00
9 changed files with 527 additions and 30 deletions
@@ -1,31 +1,46 @@
-FROM alpine:3.24
+# syntax=docker/dockerfile:1
 # Multi-stage production build for the kaya-rbcs app on the Kaya framework.
 # Base: alpine:3.24 (python3 = 3.14). Deps are installed into a venv in the
 # builder; apk and pip caches use BuildKit cache mounts so they persist across
 # builds and never land in the image layers. Requires BuildKit (default for
 # `docker build` / `docker buildx` on modern daemons).
-ENV PYTHONDONTWRITEBYTECODE=1 \
+# --- Builder ---------------------------------------------------------------
-    PYTHONUNBUFFERED=1 \
+FROM alpine:3.24 AS builder
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PIP_NO_CACHE_DIR=1 \
    RBCS_HOST=0.0.0.0 \
    RBCS_PORT=8080 \
    RBCS_MEMCACHE_HOST=memcached \
    RBCS_MEMCACHE_PORT=11211
-RUN apk add --no-cache python3
+RUN --mount=type=cache,target=/var/cache/apk \
    apk add python3
-WORKDIR /opt/kaya-rbcs
+WORKDIR /build
 COPY requirements.txt ./
-RUN python3 -m venv /opt/venv \
+
 RUN --mount=type=cache,target=/root/.cache/pip \
    python3 -m venv /opt/venv \
 && /opt/venv/bin/pip install -r requirements.txt
 COPY pyproject.toml README.md ./
 COPY src ./src
 RUN /opt/venv/bin/pip install --no-deps .
-RUN addgroup -S rbcs \
+RUN --mount=type=cache,target=/root/.cache/pip \
-    && adduser -S -G rbcs rbcs \
+    /opt/venv/bin/pip install --no-deps .
    && chown -R rbcs:rbcs /opt/kaya-rbcs /opt/venv
-ENV PATH="/opt/venv/bin:${PATH}"
+# --- Runtime ---------------------------------------------------------------
 FROM alpine:3.24
 RUN --mount=type=cache,target=/var/cache/apk \
    apk add python3 ca-certificates tzdata \
 && addgroup -S rbcs && adduser -S -G rbcs rbcs
 COPY --from=builder /opt/venv /opt/venv
 ENV PATH="/opt/venv/bin:${PATH}" \
    PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    RBCS_HOST=0.0.0.0 \
    RBCS_PORT=8080 \
    RBCS_MEMCACHE_HOST=memcached \
    RBCS_MEMCACHE_PORT=11211
 USER rbcs
@@ -52,6 +52,35 @@ Configuration is read from environment variables:
 | `RBCS_DIGEST`           | *(unset)*     | Hash the key with this algorithm (e.g. `sha256`) |
 | `RBCS_MAX_AGE`          | `7d`          | Value TTL (`s`/`m`/`h`/`d`)         |
 ### Configuring Granian
 The server runs on [Granian](https://github.com/emmett-framework/granian) via
 its RSGI interface. Any granian option can be configured with its standard
 `GRANIAN_*` environment variables (see `granian --help`), for example:
 ```bash
 GRANIAN_LOOP=rloop GRANIAN_WORKERS=4 GRANIAN_HTTP=2 rbcs-server
 ```
 Every granian CLI option has a matching `GRANIAN_*` variable
 (`GRANIAN_LOOP`, `GRANIAN_WORKERS`, `GRANIAN_HTTP`, `GRANIAN_TASK_IMPL`,
 `GRANIAN_RUNTIME_THREADS`, `GRANIAN_BLOCKING_THREADS`, `GRANIAN_LOG_LEVEL`,
 `GRANIAN_METRICS`, `GRANIAN_WS`, ...).
 When a `GRANIAN_*` variable and the corresponding `RBCS_*` variable are both
 set, the granian one wins:
 - `GRANIAN_HOST` overrides `RBCS_HOST` (default `127.0.0.1`)
 - `GRANIAN_PORT` overrides `RBCS_PORT` (default `8080`)
 - `GRANIAN_INTERFACE` overrides the default `rsgi` interface
 The Docker image ships the `rloop` event loop, so `GRANIAN_LOOP=rloop` works
 out of the box:
 ```bash
 docker run -e GRANIAN_LOOP=rloop -e RBCS_MEMCACHE_HOST=memcached kaya-rbcs
 ```
 The app is also a plain ASGI application, so it can be served by any ASGI
 server, e.g. `daphne kaya_rbcs.app:app`.
@@ -0,0 +1,130 @@
 # Manually-triggered benchmark jobs comparing rbcs (java) vs rbcs-kaya (kaya-rbcs).
 # Create them with:
 #   kubectl create -f k8s/benchmark-jobs.yaml
 # (or `kubectl apply` — they only run when created, not on updates).
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: rbcs-client-config
  namespace: rbcs
 data:
  rbcs-client.xml: |
    <?xml version="1.0" encoding="UTF-8"?>
    <profiles xmlns="urn:net.woggioni.rbcs.client">
      <profile name="rbcs"
               base-url="http://rbcs:8080/"
               max-connections="50"
               enable-compression="false">
        <no-auth/>
      </profile>
      <profile name="rbcs-kaya"
               base-url="http://rbcs-kaya:8080/"
               max-connections="50"
               enable-compression="false">
        <no-auth/>
      </profile>
    </profiles>
 ---
 apiVersion: batch/v1
 kind: Job
 metadata:
  name: benchmark-rbcs
  namespace: rbcs
  labels:
    role: benchmark
    target: rbcs
 spec:
  backoffLimit: 1
  ttlSecondsAfterFinished: 3600
  template:
    metadata:
      labels:
        role: benchmark
        target: rbcs
    spec:
      restartPolicy: Never
      containers:
        - name: client
          image: gitea.woggioni.net/woggioni/rbcs:latest
          args:
            - client
            - -p
            - rbcs
            - benchmark
            - -s
            - "256"
            - -e
            - "10000"
          env:
            - name: RBCS_CONFIGURATION_DIR
              value: /etc/rbcs-config
          volumeMounts:
            - name: client-config
              mountPath: /etc/rbcs-config
              readOnly: true
          resources:
            requests:
              cpu: "1"
              memory: 512Mi
            limits:
              cpu: "1"
              memory: 512Mi
      volumes:
        - name: client-config
          configMap:
            name: rbcs-client-config
            items:
              - key: rbcs-client.xml
                path: rbcs-client.xml
 ---
 apiVersion: batch/v1
 kind: Job
 metadata:
  name: benchmark-kaya-rbcs
  namespace: rbcs
  labels:
    role: benchmark
    target: rbcs-kaya
 spec:
  backoffLimit: 1
  ttlSecondsAfterFinished: 3600
  template:
    metadata:
      labels:
        role: benchmark
        target: rbcs-kaya
    spec:
      restartPolicy: Never
      containers:
        - name: client
          image: gitea.woggioni.net/woggioni/rbcs:latest
          args:
            - client
            - -p
            - rbcs-kaya
            - benchmark
            - -s
            - "256"
            - -e
            - "10000"
          env:
            - name: RBCS_CONFIGURATION_DIR
              value: /etc/rbcs-config
          volumeMounts:
            - name: client-config
              mountPath: /etc/rbcs-config
              readOnly: true
          resources:
            requests:
              cpu: "1"
              memory: 512Mi
            limits:
              cpu: "1"
              memory: 512Mi
      volumes:
        - name: client-config
          configMap:
            name: rbcs-client-config
            items:
              - key: rbcs-client.xml
                path: rbcs-client.xml
@@ -0,0 +1,182 @@
 apiVersion: v1
 kind: Namespace
 metadata:
  name: rbcs
  labels:
    kubernetes.io/metadata.name: rbcs
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: memcached
  namespace: rbcs
  labels:
    app: memcached
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: memcached
  template:
    metadata:
      labels:
        app: memcached
    spec:
      containers:
        - name: memcached
          image: memcached:alpine
          args: ["-m", "1024"]
          ports:
            - name: memcache
              containerPort: 11211
          resources:
            requests:
              cpu: "1"
              memory: 1Gi
            limits:
              cpu: "1"
              memory: 1Gi
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: memcached
  namespace: rbcs
 spec:
  selector:
    app: memcached
  ports:
    - port: 11211
      targetPort: 11211
 ---
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: rbcs-server-config
  namespace: rbcs
 data:
  rbcs-server.xml: |
    <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
    <rbcs:server xmlns:xs="http://www.w3.org/2001/XMLSchema-instance"
                 xmlns:rbcs="urn:net.woggioni.rbcs.server"
                 xmlns:rbcs-memcache="urn:net.woggioni.rbcs.server.memcache"
                 xs:schemaLocation="urn:net.woggioni.rbcs.server.memcache jpms://net.woggioni.rbcs.server.memcache/net/woggioni/rbcs/server/memcache/schema/rbcs-memcache.xsd urn:net.woggioni.rbcs.server jpms://net.woggioni.rbcs.server/net/woggioni/rbcs/server/schema/rbcs-server.xsd">
        <bind host="0.0.0.0" port="8080" incoming-connections-backlog-size="1024"/>
        <cache xs:type="rbcs-memcache:memcacheCacheType" max-age="P1D" key-prefix="rbcs">
            <server host="memcached" port="11211" max-connections="50" connection-timeout="PT10S"/>
        </cache>
        <authentication>
            <none/>
        </authentication>
    </rbcs:server>
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: rbcs
  namespace: rbcs
  labels:
    app: rbcs
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: rbcs
  template:
    metadata:
      labels:
        app: rbcs
    spec:
      containers:
        - name: rbcs
          image: gitea.woggioni.net/woggioni/rbcs:memcache
          ports:
            - name: http
              containerPort: 8080
          env:
            - name: RBCS_CONFIGURATION_DIR
              value: /etc/rbcs-config
          volumeMounts:
            - name: config
              mountPath: /etc/rbcs-config
              readOnly: true
          resources:
            requests:
              cpu: "1"
              memory: 512Mi
            limits:
              cpu: "1"
              memory: 512Mi
      volumes:
        - name: config
          configMap:
            name: rbcs-server-config
            items:
              - key: rbcs-server.xml
                path: rbcs-server.xml
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: rbcs
  namespace: rbcs
 spec:
  selector:
    app: rbcs
  ports:
    - port: 8080
      targetPort: 8080
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: rbcs-kaya
  namespace: rbcs
  labels:
    app: rbcs-kaya
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: rbcs-kaya
  template:
    metadata:
      labels:
        app: rbcs-kaya
    spec:
      containers:
        - name: rbcs-kaya
          image: gitea.woggioni.net/woggioni-opencode-agent/kaya-rbcs:0.0.2
          ports:
            - name: http
              containerPort: 8080
          env:
            - name: RBCS_HOST
              value: "0.0.0.0"
            - name: RBCS_PORT
              value: "8080"
            - name: RBCS_MEMCACHE_HOST
              value: memcached
            - name: RBCS_MEMCACHE_PORT
              value: "11211"
            - name: RBCS_KEY_PREFIX
              value: "kaya"
          resources:
            requests:
              cpu: "1"
              memory: 512Mi
            limits:
              cpu: "1"
              memory: 512Mi
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: rbcs-kaya
  namespace: rbcs
 spec:
  selector:
    app: rbcs-kaya
  ports:
    - port: 8080
      targetPort: 8080
@@ -0,0 +1,134 @@
 # Default deny: no traffic in or out of the namespace unless explicitly allowed below.
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: default-deny-all
  namespace: rbcs
 spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]
 ---
 # Allow all pods to resolve services via cluster DNS.
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: allow-dns-egress
  namespace: rbcs
 spec:
  podSelector: {}
  policyTypes: [Egress]
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
 ---
 # memcached: only the two cache servers may reach it; it needs no egress.
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: memcached-allow
  namespace: rbcs
 spec:
  podSelector:
    matchLabels:
      app: memcached
  policyTypes: [Ingress, Egress]
  ingress:
    - from:
        - podSelector:
            matchExpressions:
              - key: app
                operator: In
                values: [rbcs, rbcs-kaya]
      ports:
        - protocol: TCP
          port: 11211
  egress: []
 ---
 # rbcs (java): reachable by benchmark client pods only; egress to memcached only.
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: rbcs-allow
  namespace: rbcs
 spec:
  podSelector:
    matchLabels:
      app: rbcs
  policyTypes: [Ingress, Egress]
  ingress:
    - from:
        - podSelector:
            matchLabels:
              role: benchmark
      ports:
        - protocol: TCP
          port: 8080
  egress:
    - to:
        - podSelector:
            matchLabels:
              app: memcached
      ports:
        - protocol: TCP
          port: 11211
 ---
 # rbcs-kaya (kaya-rbcs): reachable by benchmark client pods only; egress to memcached only.
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: rbcs-kaya-allow
  namespace: rbcs
 spec:
  podSelector:
    matchLabels:
      app: rbcs-kaya
  policyTypes: [Ingress, Egress]
  ingress:
    - from:
        - podSelector:
            matchLabels:
              role: benchmark
      ports:
        - protocol: TCP
          port: 8080
  egress:
    - to:
        - podSelector:
            matchLabels:
              app: memcached
      ports:
        - protocol: TCP
          port: 11211
 ---
 # Benchmark client pods: no ingress; egress only to the two cache servers.
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: benchmark-allow
  namespace: rbcs
 spec:
  podSelector:
    matchLabels:
      role: benchmark
  policyTypes: [Ingress, Egress]
  ingress: []
  egress:
    - to:
        - podSelector:
            matchExpressions:
              - key: app
                operator: In
                values: [rbcs, rbcs-kaya]
      ports:
        - protocol: TCP
          port: 8080
@@ -26,6 +26,7 @@ dependencies = [
 server = [
    "kaya-rsgi",
    "granian",
    "rloop",
 ]
 dev = [
    "httpx",
@@ -4,3 +4,4 @@ kaya-core
 aiomcache
 kaya-rsgi
 granian
 rloop
@@ -25,6 +25,8 @@ pwo==0.1.2
    # via
    #   kaya-core
    #   kaya-rsgi
 rloop==0.3.1
    # via -r requirements.in
 typing-extensions==4.16.0
    # via
    #   kaya-core
@@ -1,3 +1,4 @@
 import os
 import sys
 from typing import List, NoReturn
@@ -14,15 +15,17 @@ def main() -> NoReturn:
        ) from exc
    config = Config.from_env()
-    args: List[str] = [
+    args: List[str] = []
-        '--interface',
+    # Only inject our own values when the equivalent GRANIAN_* environment
-        'rsgi',
+    # variable is not set, so every granian option stays configurable via
-        '--host',
+    # granian's standard GRANIAN_* environment variables.
-        config.host,
+    if not os.getenv('GRANIAN_INTERFACE'):
-        '--port',
+        args += ['--interface', 'rsgi']
-        str(config.port),
+    if not os.getenv('GRANIAN_HOST'):
-        'kaya_rbcs.app:app',
+        args += ['--host', config.host]
-    ]
+    if not os.getenv('GRANIAN_PORT'):
        args += ['--port', str(config.port)]
    args.append('kaya_rbcs.app:app')
    sys.argv = [sys.argv[0], *args]
    entrypoint()  # type: ignore[no-untyped-call]
    raise SystemExit(0)