126 lines
5.4 KiB
Markdown
126 lines
5.4 KiB
Markdown
# Performance & Production Readiness Audit
|
|
|
|
**Date:** 2026-01-27
|
|
**Auditor:** Antigravity (AI)
|
|
**Target:** Laravel 10 / PHP 8.1+ / MySQL / Redis
|
|
|
|
---
|
|
|
|
## 1. CRITICAL PERFORMANCE RISKS (Must fix before production)
|
|
|
|
### 🔴 Synchronous vCenter Calls in Livewire
|
|
**File:** `app/Http/Livewire/VPSReinstallModal.php`
|
|
**Description:** The `getIPFromVCenter()` method calls `vCenterService->loginServer()` and `GetIPAddressVirtualMachine` **synchronously** during component initialization (`loadOsData`).
|
|
**Risk:** If vCenter is slow (common) or down, the user's browser will hang indefinitely/timeout when opening the modal. This blocks the PHP-FPM worker.
|
|
**Fix:**
|
|
- Move vCenter lookup to a background Queue Job.
|
|
- Use `wire:poll` or Echo to check for the IP status after the modal opens.
|
|
- **Immediate:** Wrap the call in a short timeout or remove it from the read path if not strictly necessary for the initial view.
|
|
|
|
### 🔴 Self-Calling HTTP Requests (Loopback)
|
|
**File:** `app/Http/Livewire/VPSReinstallModal.php`
|
|
**Description:** `confirmReinstall` uses `Http::withoutVerifying()->post(route('service.reinstall.vm')...)` to trigger logic.
|
|
**Risk:**
|
|
1. **Ineufficiency:** It consumes an extra PHP-FPM worker for the loopback request (Request A waits for Request B).
|
|
2. **Security:** `withoutVerifying()` bypasses SSL checks.
|
|
**Fix:** Refactor the logic inside `ServiceController::reinstallVM` into a `ReinstallService` and call it directly from the Livewire component.
|
|
|
|
### 🔴 Job-within-Job Synchronous Execution
|
|
**File:** `app/Jobs/VirtualMachine/ProcessOrderPaymentJob.php`
|
|
**Description:** `ProcessOrderPaymentJob` instantiates `CreateVirtualMachineJob` and calls `$vmJob->handle(...)` directly.
|
|
**Risk:** If `CreateVirtualMachineJob` takes long (e.g., 2 minutes for vCenter), `ProcessOrderPaymentJob` might timeout (default 60s/90s). If creating 5 VMs, it will surely fail.
|
|
**Fix:**
|
|
- Dispatch `CreateVirtualMachineJob::dispatch(...)` to the queue.
|
|
- Let `ProcessOrderPaymentJob` only *initiate* the process or use a `Batch` to monitor progress.
|
|
|
|
---
|
|
|
|
## 2. DATABASE PERFORMANCE REVIEW
|
|
|
|
### ⚠️ `Select *` in Repositories
|
|
**File:** `app/Repositories/BaseCachedRepository.php`
|
|
**Description:** `getAll()` uses `parent::getAll()` which likely does `$model->all()`.
|
|
**Risk:** Tables like `vps` (with `text` description) or `user_logs` will eventually destroy memory when `getAll()` is called and cached.
|
|
**Fix:**
|
|
- Remove `getAll()` from `BaseCachedRepository`.
|
|
- Implement `paginate()` by default.
|
|
- Use `select(['id', 'name', ...])` for lists.
|
|
|
|
### ⚠️ Missing Explicit Indices
|
|
**File:** `database/migrations/2026_01_27_151851_update_forigin_key_module_ip_table.php`
|
|
**Description:** FKs added to `module_host_id` and `module_network_id`. While MySQL often indexes FKs, explicit indexing ensures query performance for `where('module_host_id', $id)`.
|
|
**Fix:** Verify indices exist or add `$table->index('module_host_id')`.
|
|
|
|
---
|
|
|
|
## 3. LIVEWIRE & FRONTEND PERFORMANCE
|
|
|
|
### ⚠️ Heavy Mount Logic
|
|
**File:** `app/Http/Livewire/VPSReinstallModal.php`
|
|
**Description:** `loadOsData` performs multiple DB queries (`VPS::with`, `OsGroup::with` with closures) and checking Invoice items.
|
|
**Fix:** Use **Lazy Loading** (`wire:init` or `lazy` attribute in Livewire 3) to load heavy data *after* the modal opens.
|
|
|
|
---
|
|
|
|
## 4. QUEUE, REDIS & BACKGROUND JOBS
|
|
|
|
### ⚠️ Queue Blocking
|
|
**Description:** `ProcessOrderPaymentJob` combines "Payment Logic" (fast) with "VM Creation" (slow).
|
|
**Fix:**
|
|
- Separate queues: `queue:work --queue=high,default,low`.
|
|
- Put `CreateVirtualMachineJob` on `low` or `provisioning` queue.
|
|
- Keep `ProcessOrderPaymentJob` on `high` to update payment status quickly.
|
|
|
|
---
|
|
|
|
## 5. CACHING STRATEGY REVIEW
|
|
|
|
### 🔴 Dangerous 'getAll' Cache
|
|
**File:** `app/Repositories/BaseCachedRepository.php`
|
|
**Description:** Caches the *entire table result* of `getAll()`.
|
|
**Risk:** Redis memory exhaustion.
|
|
**Fix:**
|
|
- **Delete** `getAll` caching logic.
|
|
- Cache *individual* items by ID (`find($id)` is fine).
|
|
- Cache configuration/settings, not transactional data lists.
|
|
|
|
---
|
|
|
|
## 6. SECURITY & PRODUCTION CONFIG CHECK
|
|
|
|
### ⚠️ SSL Verification Disabled
|
|
**File:** `app/Http/Livewire/VPSReinstallModal.php`
|
|
**Description:** `Http::withoutVerifying()` is used.
|
|
**Fix:** Fix the root cause (self-signed certs?) or use internal service calls instead of HTTP loopbacks.
|
|
|
|
### ⚠️ Sensitive Logging
|
|
**File:** `app/Jobs/VirtualMachine/ProcessOrderPaymentJob.php`
|
|
**Description:** Sends detailed error logs to Telegram.
|
|
**Risk:** Ensure `trace` or `message` doesn't contain API keys / credit card info (unlikely in exception message, but possible).
|
|
|
|
---
|
|
|
|
## 7. SCALABILITY BOTTLENECKS
|
|
|
|
### At 1k Users
|
|
- `BaseCachedRepository::getAll()` will start causing 500 errors (OOM).
|
|
|
|
### At 10k Users
|
|
- Synchronous vCenter calls will cause "No child processes" in PHP-FPM during traffic spikes.
|
|
- Redis will fill up if `getAll` isn't removed.
|
|
|
|
---
|
|
|
|
## 8. FINAL PRODUCTION CHECKLIST
|
|
|
|
### Must Fix Before Launch
|
|
- [ ] **Refactor**: Remove `Http::withoutVerifying()` loopback in `VPSReinstallModal`.
|
|
- [ ] **Async**: Move `getIPFromVCenter` to background or make it lazy/optional.
|
|
- [ ] **Cache**: Disable `getAll()` caching in `BaseCachedRepository`.
|
|
- [ ] **Queue**: Decouple `CreateVirtualMachineJob` from `ProcessOrderPaymentJob` (dispatch don't call handle).
|
|
|
|
### Should Fix Soon
|
|
- [ ] **Database**: Add explicit indices for searching fields in `vps` and `orders`.
|
|
- [ ] **Refactor**: Move logic from Controllers/Livewire to Services to avoid loopback HTTP calls.
|
|
|