[erlang-questions] Abandoned (ranch) connection processes?

[Roger Lipscombe]

I'm investigating a problem where I've run out of ranch connections
(I've got max_connections set to 20000).

I'm using a gen_server with {active, once} handling, with ranch_ssl.
As far as I can tell the sequence goes like this:

1. ranch calls my_protocol:start_link.
2. my_protocol:start_link calls proc_lib:spawn_link.
3. my_protocol:init calls ranch:accept_ack.
4. my_protocol:init calls Transport:setopts(Socket, [{active, once}]).
I'm *not* verifying the result.
5. my_protocol:init calls gen_server:enter_loop.

The client, apparently, never sends any data. The socket is, by the
time I examine it, closed (I get {error, close} when I prod it with
ssl:send). It doesn't appear in inet:i().

I never see an {ssl_closed, ...} message in my protocol handler.

It's too early in my application protocol to turn on application level
keep-alives, but I've got TCP keepalive enabled (afaict), and it
doesn't address this problem, apparently.

The only thing I can think of is that the socket is being closed
between ranch:accept_ack and Transport:setopts, and Erlang's not
sending the ssl_closed message. Does this sound likely? How do I deal
with this?

Erlang/OTP-19.3.6.4, incidentally.

Cheers,
Roger.