vifib-server: Increase memlock from default 64K to 64M

See merge request nexedi/slapos.package!130

playbook/roles/vifib-server/files/etc_systemd_system_cron_service_d_override.conf

@@ -3,3 +3,6 @@
 # (on a normal slapos node server, cron starts slapos, which starts supervisord,
 # which then manage all deployed instances)
 TasksMax=infinity
+
+# NOTE the other limits for subprocesses that cron spawns are defined in
+# /etc/security/limits.d/slapos.conf

playbook/roles/vifib-server/files/slapos_limit.conf

+# Limits for processes run under SlapOS.
+#
+# slapos is started by cron which runs as root user and applies pam_limits.so
+# to spawned processes (see /etc/pam.d/cron for details).
+#
+# For some limits (e.g. memlock), if they are not explicitly defined,
+# pam_limits.so resets them to rather strict default. This means cron/slapos
+# limits cannot be adjusted in /etc/systemd/system/cron.service.d/override.conf
+#
+# NOTE "*", or any other group name, does not cover root user - limits for root
+# has to be explicitly defined.
+
 root             hard    nofile          1048576
+
+# default memlock is 64K originating from ages when machines had ~ 256M of RAM total or less.
+# This days VIFIB machines have at least 16GB of RAM so 64M should not be a big expense.
+# Example use-case: wendelin.core 2 tests need to be able to mlock 64M.
+root             hard    memlock         65536

playbook/roles/vifib-server/tasks/main.yml

@@ -42,7 +42,7 @@
   - file: state=directory path="/etc/systemd/system/cron.service.d/"
     when: systemd_version.stdout | int > 228
 
-  - name: Increase the maximum of subprocesses for cron
+  - name: Increase limits for cron
     copy: src="etc_systemd_system_cron_service_d_override.conf" dest="/etc/systemd/system/cron.service.d/override.conf" mode=0644 owner=root group=root
     when: systemd_version.stdout | int > 228