Bind 0.0.0.0 to IPv4 only (closes #528)

Go listens on any unspecified address with one socket that answers
IPv4 and IPv6, so BIND_ADDRESS=0.0.0.0 also bound every IPv6 address,
which the README says it does not. The listener now uses tcp4 for an
IPv4 address; :: still binds both. The server's start hook suppresses
contextcheck, as the other start hooks do.

The image's health check asked for localhost, which wget reached over
::1 only. It now asks for the container's own address from hostname
-i, which a 0.0.0.0 or :: bind answers and a loopback bind does not.
The README drops the bindv6only condition from :: (Go sets that
socket option itself) and names an ss check.

Model: opus-5-5

Dockerfile

@@ -274,8 +274,12 @@ EXPOSE 8080
 # port.
 ENV BIND_ADDRESS=0.0.0.0
 
+# The probe requests the container's own address, not loopback, so a
+# listener that answers only on loopback (an empty or loopback
+# BIND_ADDRESS) fails it. hostname -i prints one IPv4 address per
+# network the container is on; the first is enough.
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
-    CMD wget --no-verbose --tries=1 --spider http://localhost:8080/.well-known/healthcheck || exit 1
+    CMD wget --no-verbose --tries=1 --spider "http://$(hostname -i | cut -d ' ' -f 1):8080/.well-known/healthcheck" || exit 1
 
 ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
 CMD ["/app/webhooker"]

README.md

@@ -316,10 +316,9 @@ The value must be an IP address literal:
 
 - `127.0.0.1` — loopback only (the binary's default). Use this with a reverse
   proxy on the same host.
-- `0.0.0.0` — every IPv4 address. The image's default; on a bare host, only
-  behind a firewall on the port.
-- `::` — every address, IPv6 and (on Linux, with the default
-  `net.ipv6.bindv6only=0`) IPv4 as well.
+- `0.0.0.0` — every IPv4 address and no IPv6 address. The image's default; on a
+  bare host, only behind a firewall on the port.
+- `::` — every IPv6 address and every IPv4 address.
 - A specific address such as `10.0.0.5` — that interface only.
 
 An **empty** value is treated as unset, as everywhere else here, and takes the
@@ -340,7 +339,8 @@ machine that has no such interface — is a valid literal, so it reaches the
 listener and fails there. The process logs the bind error and exits non-zero
 rather than staying up with nothing listening. The effective value is in the
 `bindAddress` field of the startup log line, which is the way to check what a
-running deployment actually bound.
+running deployment actually bound. On a bare host, `ss -ltn` lists the socket
+itself as `0.0.0.0:8080` for a `0.0.0.0` bind and as `*:8080` for `::`.
 
 #### Metrics credentials
 
@@ -668,8 +668,8 @@ Either set a literal or leave the variable out entirely.
 Overriding `BIND_ADDRESS` to a loopback address in a container — by that route
 or deliberately — makes the container unreachable from outside its namespace
 even with `-p`. The published port answers nothing, and the health check fails
-too: it requests `http://localhost:8080`, `localhost` resolves to `::1` first,
-and a `127.0.0.1` bind is not listening there. The container then goes
+too: it requests the container's own address (the first one `hostname -i`
+prints), where a loopback bind is not listening. The container then goes
 `unhealthy` about **65 seconds** after start — from
 `HEALTHCHECK --start-period=5s --interval=30s --retries=3`, so failing probes at
 5s, 35s and 65s, and `unhealthy` on the third. (Docker's probe cadence during
@@ -726,8 +726,8 @@ the credentials.
       address (directly, or through anything that can rewrite source addresses,
       such as NAT or a published container port). The `remoteIP` field of the
       `http request` log line for a request that came through the proxy shows
-      that address; the health check's own lines show `::1`. See
-      [Trusted proxies](#trusted-proxies).
+      that address; the health check's own lines show the container's own
+      address. See [Trusted proxies](#trusted-proxies).
     - Leave `BIND_ADDRESS` and `DATA_DIR` unset: the image sets `BIND_ADDRESS`
       to `0.0.0.0`, and `DATA_DIR` defaults to `/var/lib/webhooker`.
     - Everything else is optional; see [Configuration](#configuration).
@@ -1317,20 +1317,22 @@ webhooker solves this by acting as a durable intermediary:
    nothing is lost if downstream targets are unavailable.
 
 2. **Guaranteed delivery** — Events are queued for delivery to each configured
-   target. Failed deliveries are retried with configurable backoff. Every
-   delivery attempt is logged with status codes, response bodies, and timing.
+   target. Failed deliveries are retried with configurable backoff. Delivery
+   attempts are logged with status codes, response bodies, and timing.
 
     **That guarantee is at-least-once, not exactly-once.** When a send reaches
     its target but the write recording that outcome fails, the delivery is
     deliberately left in a recoverable state rather than marked done — losing a
     delivery is the worse failure — so the pending sweep picks it up about
     fifteen minutes later, or the next restart does, and the target receives a
-    payload it already got. webhooker adds no delivery identifier of its own to
-    an outbound request, so **make your receiver idempotent** against whatever
-    the payload itself carries.
+    payload it already got. A send still in flight when the service stops is
+    left the same way: its attempt is not recorded, and the next start sends it
+    again (see Shutdown). webhooker adds no delivery identifier of its own to an
+    outbound request, so **make your receiver idempotent** against whatever the
+    payload itself carries.
 
 3. **Observability** — Full request/response logging for every webhook received
-   and every delivery attempted. Prometheus metrics expose volume, latency, and
+   and for delivery attempts. Prometheus metrics expose volume, latency, and
    error rates. The web UI provides real-time visibility into event flow.
 
 4. **Fan-out** — A single incoming webhook can be delivered to multiple targets
@@ -1768,7 +1770,7 @@ is what bounds it.
 #### DeliveryResult
 
 The result of a single delivery attempt. Every attempt (including retries) is
-individually logged for full observability.
+individually logged, except one cut off by a stop (see Shutdown).
 
 | Field           | Type    | Description                               |
 | --------------- | ------- | ----------------------------------------- |
@@ -2206,12 +2208,16 @@ This means:
   buffer rather than spawning more goroutines.
 - **Independent results** — each worker records its own delivery result in the
   per-webhook database without coordination.
-- **Graceful shutdown** — cancel the context, workers finish their current task
-  and exit. The stop hook waits for the pool via `lifecycle.WaitForShutdown`,
-  which bounds that wait by fx's stop timeout rather than blocking forever on a
-  wedged worker. On timeout it logs at `ERROR` and returns an error, and the
-  goroutines that did not finish are still running — an unclean shutdown is
-  reported rather than hidden.
+- **Graceful shutdown** — the stop hook cancels the workers' context. A worker
+  may still take tasks already queued before it exits. An `http` or `slack`
+  request in flight is cut off, and one started after the cancel fails at once.
+  Neither is recorded or counted in the metrics, and the next start sends the
+  delivery again (see Shutdown). A `database` or `log` task runs as normal. The
+  stop hook waits for the pool via `lifecycle.WaitForShutdown`, which bounds
+  that wait by fx's stop timeout rather than blocking forever on a wedged
+  worker. On timeout it logs at `ERROR` and returns an error, and the goroutines
+  that did not finish are still running — an unclean shutdown is reported rather
+  than hidden.
 
 **Recovery paths:**
 
@@ -2317,7 +2323,7 @@ getting anywhere.
 | Metric                                 | Type      | Meaning                                                                                                                                                                                                                                                                                                   |
 | -------------------------------------- | --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `webhooker_events_received_total`      | counter   | Events received and durably stored. Compare against the delivery counters on one dashboard                                                                                                                                                                                                                |
-| `webhooker_delivery_attempts_total`    | counter   | Delivery attempts actually dispatched to a target. A delivery a circuit breaker refused is not one: it is counted as a retry instead, but only when the refusal moves it into `retrying`                                                                                                                  |
+| `webhooker_delivery_attempts_total`    | counter   | Delivery attempts actually dispatched to a target. A delivery a circuit breaker refused is not one: it is counted as a retry instead, but only when the refusal moves it into `retrying`. An attempt cut off by a stop is not counted (see Shutdown)                                                      |
 | `webhooker_deliveries_succeeded_total` | counter   | Deliveries that reached `delivered`                                                                                                                                                                                                                                                                       |
 | `webhooker_deliveries_failed_total`    | counter   | Deliveries that failed terminally and will not be retried                                                                                                                                                                                                                                                 |
 | `webhooker_delivery_retries_total`     | counter   | Deliveries put back into `retrying`                                                                                                                                                                                                                                                                       |
@@ -3284,7 +3290,8 @@ stop-hook log:
 3. `server` — the HTTP drain, bounded by `server.ShutdownTimeout` (**3
    seconds**) and by what the hooks before it left, then a Sentry flush if
    `SENTRY_DSN` is set
-4. `delivery.Engine` — waits for its workers, then closes the archive databases
+4. `delivery.Engine` — cuts off any `http` or `slack` request in flight, waits
+   for its workers, then closes the archive databases
 5. `healthcheck`
 6. `WebhookDBManager`
 7. the database close
@@ -3295,6 +3302,12 @@ by the stop context, so a wedge there consumes the 5 seconds before the HTTP
 server hook is ever entered. The hooks after the server are microsecond-scale in
 normal operation.
 
+The delivery engine cancels a delivery request in flight. That attempt is not
+recorded or counted in the metrics, and the delivery keeps its `pending` or
+`retrying` status, so startup recovery sends it again on the next start (see
+Recovery paths under Bounded Worker Pool). If the receiver already had it, it
+receives it twice: the at-least-once duplicate described under Rationale.
+
 The HTTP drain budget is deliberately **shorter** than the sequence budget. Were
 the two equal, a drain that used its whole budget would exhaust the sequence
 budget at the instant it finished, and every later hook — the delivery engine,

internal/delivery/delivery_totals_test.go

@@ -32,8 +32,9 @@ func targetTotals(
 
 // TestUpdateDeliveryStatus_FinishTimeAndTargetTotals pins what a status
 // write records for the webhook page's statistics: the time a delivery
-// finished, set only when it becomes delivered or failed, and one more
-// on its target's delivered or failed total.
+// finished, set only when it becomes delivered or failed and stored in
+// the same form as created_at, and one more on its target's delivered
+// or failed total.
 func TestUpdateDeliveryStatus_FinishTimeAndTargetTotals(t *testing.T) {
 	t.Parallel()
 
@@ -75,6 +76,16 @@ func TestUpdateDeliveryStatus_FinishTimeAndTargetTotals(t *testing.T) {
 			if tt.finished {
 				require.NotNil(t, stored.FinishedAt)
 				assert.False(t, stored.FinishedAt.Before(before))
+
+				var createdAt, finishedAt string
+
+				require.NoError(t, db.Raw(
+					`SELECT CAST(created_at AS TEXT),
+						CAST(finished_at AS TEXT)
+					FROM deliveries WHERE id = ?`, d.ID,
+				).Row().Scan(&createdAt, &finishedAt))
+				assertStoredTime(t, createdAt)
+				assertStoredTime(t, finishedAt)
 			} else {
 				assert.Nil(t, stored.FinishedAt)
 			}

internal/delivery/engine.go

@@ -1701,8 +1701,11 @@ func writeDeliveryStatus(
 			database.DeliveryStatusFailed,
 		}).
 		Updates(map[string]any{
-			"status":      status,
-			"finished_at": time.Now(),
+			"status": status,
+			// GORM's clock, the one that stamps created_at. A bare
+			// time.Now() carries a monotonic clock reading, which the
+			// driver would store as an " m=+…" suffix.
+			"finished_at": tx.NowFunc(),
 		})
 	if res.Error != nil || res.RowsAffected == 0 {
 		return res.Error
@@ -1906,12 +1909,13 @@ func (e *Engine) takeForRedispatch(
 		return false
 	}
 
+	// GORM's clock, as writeDeliveryStatus explains.
 	res := webhookDB.
 		Model(&database.Delivery{}).
 		Where(
 			"id = ? AND status = ?", deliveryID, eligible,
 		).
-		UpdateColumn("updated_at", time.Now())
+		UpdateColumn("updated_at", webhookDB.NowFunc())
 
 	if res.Error != nil {
 		e.log.Error(

internal/delivery/engine_lifecycle_test.go

@@ -2,11 +2,16 @@ package delivery_test
 
 import (
 	"context"
+	"io"
+	"net/http"
+	"net/http/httptest"
 	"path/filepath"
+	"sync"
 	"testing"
 	"time"
 
 	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/fx"
 	"gorm.io/gorm/clause"
@@ -272,6 +277,154 @@ func TestEngine_StopHookHonoursStopTimeout(t *testing.T) {
 	requireStopHookExpires(t, lc.hooks[0], "delivery engine")
 }
 
+// seedHeldDelivery gives the setup's webhook an http target with
+// maxRetries, pointed at a receiver that keeps every request open until
+// the client gives up on it, and seeds one delivery to that target at
+// status. It returns the task that sends attempt attemptNum of the
+// delivery, and a channel that is closed when a request reaches the
+// receiver.
+func seedHeldDelivery(
+	t *testing.T,
+	s iSetup,
+	maxRetries int,
+	status database.DeliveryStatus,
+	attemptNum int,
+) (delivery.Task, <-chan struct{}) {
+	t.Helper()
+
+	arrived := make(chan struct{})
+
+	var once sync.Once
+
+	ts := httptest.NewServer(http.HandlerFunc(
+		func(_ http.ResponseWriter, r *http.Request) {
+			// The server notices the client hanging up only once the
+			// body has been read; until then r.Context() never ends.
+			_, _ = io.Copy(io.Discard, r.Body)
+
+			once.Do(func() { close(arrived) })
+
+			<-r.Context().Done()
+		},
+	))
+	t.Cleanup(ts.Close)
+
+	cfg := iHTTPConfig(ts.URL)
+	targetID := uuid.New().String()
+
+	iCreateWebhook(t, s.MainDB, s.WebhookID, "hook")
+	iCreateTarget(
+		t, s.MainDB, targetID, s.WebhookID, "held",
+		database.TargetTypeHTTP, cfg, maxRetries,
+	)
+
+	event := iSeedEvent(t, s.WebhookDB, s.WebhookID, `{"held":true}`)
+	d := iSeedDelivery(t, s.WebhookDB, event.ID, targetID, status)
+
+	bodyStr := event.Body
+
+	return iTask(
+		d, event, s.WebhookID, targetID, "held", cfg,
+		maxRetries, attemptNum, &bodyStr,
+	), arrived
+}
+
+// stopDuringAttempt waits until the receiver holds an attempt open, then
+// stops the engine through its real stop hook.
+func stopDuringAttempt(
+	t *testing.T, lc *recordingLifecycle, arrived <-chan struct{},
+) {
+	t.Helper()
+
+	select {
+	case <-arrived:
+	case <-time.After(5 * time.Second):
+		t.Fatal("the delivery attempt never reached the receiver")
+	}
+
+	require.NoError(t, lc.hooks[0].OnStop(context.Background()))
+}
+
+// requireRequeued runs restart recovery on the stopped engine and
+// requires it to queue task's attempt again on ch.
+func requireRequeued(
+	t *testing.T, s iSetup, ch <-chan delivery.Task, task delivery.Task,
+) {
+	t.Helper()
+
+	s.Engine.ExportRecoverWebhookDeliveries(
+		context.Background(), s.WebhookID,
+	)
+
+	select {
+	case got := <-ch:
+		assert.Equal(t, task.DeliveryID, got.DeliveryID)
+		assert.Equal(t, task.AttemptNum, got.AttemptNum)
+	case <-time.After(5 * time.Second):
+		t.Fatal("restart recovery did not queue the delivery again")
+	}
+}
+
+// TestEngine_StopLeavesFireAndForgetAttemptPending is the regression
+// test for a stop that turned an attempt in flight into a terminal
+// failure. Stopping the engine cancels the request; for a target with
+// no retries that was the delivery's only attempt, recorded as failed
+// with "context canceled", and nothing ever sent it again. The
+// delivery must instead stay pending, with no result and no count in
+// the attempt metrics, for restart recovery to send.
+func TestEngine_StopLeavesFireAndForgetAttemptPending(t *testing.T) {
+	t.Parallel()
+
+	s := newISetup(t)
+	reg := mIsolate(t, s)
+	lc := startEngineViaHook(t, s.Engine)
+
+	task, arrived := seedHeldDelivery(
+		t, s, 0, database.DeliveryStatusPending, 1,
+	)
+
+	s.Engine.Notify([]delivery.Task{task})
+	stopDuringAttempt(t, lc, arrived)
+
+	iAssertStatus(
+		t, s.WebhookDB, task.DeliveryID, database.DeliveryStatusPending,
+	)
+	assert.Empty(t, iResults(t, s.WebhookDB, task.DeliveryID))
+	assert.Zero(t, mCounter(t, reg, mAttempts, mTypeHTTP))
+	assert.Zero(t, mHTTPDurations(t, reg))
+
+	requireRequeued(t, s, s.Engine.ExportDeliveryCh(), task)
+}
+
+// TestEngine_StopLeavesLastRetryAttemptRetrying is the same regression
+// for a target with retries, on its last attempt: the cancelled attempt
+// used to exhaust the retries and end the delivery failed. It must stay
+// retrying with only its earlier attempt recorded, and restart recovery
+// must send that last attempt again.
+func TestEngine_StopLeavesLastRetryAttemptRetrying(t *testing.T) {
+	t.Parallel()
+
+	const maxRetries = 2
+
+	s := newISetup(t)
+	lc := startEngineViaHook(t, s.Engine)
+
+	task, arrived := seedHeldDelivery(
+		t, s, maxRetries, database.DeliveryStatusRetrying, maxRetries,
+	)
+	iSeedFailedResult(t, s.WebhookDB, task.DeliveryID)
+
+	s.Engine.ExportScheduleRetry(task, 0)
+	stopDuringAttempt(t, lc, arrived)
+
+	iAssertStatus(
+		t, s.WebhookDB, task.DeliveryID, database.DeliveryStatusRetrying,
+	)
+	assert.Len(t, iResults(t, s.WebhookDB, task.DeliveryID), 1)
+
+	requireRequeued(t, s, s.Engine.ExportRetryCh(), task)
+}
+
 // deliverToArchive gives the setup's webhook a database target,
 // runs one delivery to it through the running engine, and returns
 // the target's ID and archive file path. The archive writer holds

internal/delivery/engine_test.go

@@ -117,6 +117,18 @@ func seedDelivery(
 	return d
 }
 
+// assertStoredTime asserts that text, a timestamp as SQLite holds it,
+// is in the form GORM stores created_at in: the layout of
+// time.Time.String, with no " m=+…" monotonic clock reading after it.
+func assertStoredTime(t *testing.T, text string) {
+	t.Helper()
+
+	_, err := time.Parse(
+		"2006-01-02 15:04:05.999999999 -0700 MST", text,
+	)
+	assert.NoError(t, err, "stored as %q", text)
+}
+
 // httpDeliveryFixture holds the task and delivery needed
 // for HTTP delivery tests.
 type httpDeliveryFixture struct {

internal/delivery/inflight_test.go

@@ -462,7 +462,8 @@ func TestScheduledRetryIsNotSweptDuringBackoff(t *testing.T) {
 
 // TestRedispatchStampsTheRow pins the cadence control: a stranded
 // delivery that has just been handed out is not selected again by the
-// next tick a minute later.
+// next tick a minute later. The stamp is stored in the same form as
+// created_at.
 func TestRedispatchStampsTheRow(t *testing.T) {
 	t.Parallel()
 
@@ -493,4 +494,13 @@ func TestRedispatchStampsTheRow(t *testing.T) {
 		"a re-dispatched delivery must be stamped so the "+
 			"next tick does not select it again",
 	)
+
+	var createdAt, updatedAt string
+
+	require.NoError(t, s.WebhookDB.Raw(
+		`SELECT CAST(created_at AS TEXT), CAST(updated_at AS TEXT)
+		FROM deliveries WHERE id = ?`, d.ID,
+	).Row().Scan(&createdAt, &updatedAt))
+	assertStoredTime(t, createdAt)
+	assertStoredTime(t, updatedAt)
 }

internal/delivery/target.go

@@ -32,7 +32,8 @@ type Scheduler interface {
 // Engine.observeAttempt, alongside the DeliveryResult it records for
 // it. Deliver is also entered for attempts that never happen — an
 // open circuit breaker refuses one — so the count cannot be taken
-// from around this call.
+// from around this call. An attempt cut off by a stop is neither
+// counted nor recorded.
 type Target interface {
 	Deliver(
 		ctx context.Context,

internal/delivery/target_database_archive.go

@@ -277,7 +277,11 @@ func (w *archiveWriter) write(
 		}
 	}
 
-	row.ArchivedAt = time.Now()
+	// GORM's clock, the one that stamps created_at in the other
+	// databases, so this is stored in the same form. A bare time.Now()
+	// carries a monotonic clock reading, which the driver would store
+	// as an " m=+…" suffix.
+	row.ArchivedAt = w.db.NowFunc()
 
 	err := w.db.Create(&row).Error
 	if err != nil {

internal/delivery/target_database_test.go

@@ -150,6 +150,13 @@ func TestArchiveWriter_WritesRow(t *testing.T) {
 	assert.Equal(t, row.ContentType, got[0].ContentType)
 	assert.JSONEq(t, `{"hello":"world"}`, got[0].Body)
 	assert.False(t, got[0].ArchivedAt.IsZero())
+
+	var archivedAt string
+
+	require.NoError(t, w.DB().Raw(
+		"SELECT CAST(archived_at AS TEXT) FROM archived_events",
+	).Row().Scan(&archivedAt))
+	assertStoredTime(t, archivedAt)
 }
 
 func TestArchiveWriter_RecreatesAfterRemoval(

internal/delivery/target_http.go

@@ -57,7 +57,11 @@ type httpCore struct {
 // recorded and no circuit breaker is consulted. A positive
 // maxRetries gates the attempt on the circuit breaker and
 // schedules a backed-off retry on failure.
+//
+// ctx is the context attempt sends its request with. Stopping the
+// engine cancels it; see interruptedByStop.
 func (c *httpCore) deliver(
+	ctx context.Context,
 	webhookDB *gorm.DB,
 	d *database.Delivery,
 	task *Task,
@@ -66,21 +70,55 @@ func (c *httpCore) deliver(
 	attempt func() attemptResult,
 ) {
 	if maxRetries == 0 {
-		c.fireAndForget(webhookDB, d, attempt())
+		c.fireAndForget(ctx, webhookDB, d, attempt())
 
 		return
 	}
 
 	c.withRetry(
-		webhookDB, d, task, sched, maxRetries, attempt,
+		ctx, webhookDB, d, task, sched, maxRetries, attempt,
 	)
 }
 
+// interruptedByStop reports whether an attempt failed because the
+// engine is stopping, which cancels the context its request is made
+// with. Such an attempt is not recorded: no DeliveryResult, no circuit
+// breaker outcome, no status change, no count in the attempt metrics.
+// The delivery stays pending or retrying, and startup recovery sends
+// it again on the next start.
+//
+// A target's own timeout leaves that context alone, so its attempt is
+// still recorded as the failure it is.
+func (c *httpCore) interruptedByStop(
+	ctx context.Context,
+	d *database.Delivery,
+	res attemptResult,
+) bool {
+	if res.success || ctx.Err() == nil {
+		return false
+	}
+
+	c.eng.log.Warn(
+		"delivery attempt interrupted by shutdown; not recorded, "+
+			"it is sent again on the next start",
+		"delivery_id", d.ID,
+		"event_id", d.EventID,
+		"target_id", d.TargetID,
+	)
+
+	return true
+}
+
 func (c *httpCore) fireAndForget(
+	ctx context.Context,
 	webhookDB *gorm.DB,
 	d *database.Delivery,
 	res attemptResult,
 ) {
+	if c.interruptedByStop(ctx, d, res) {
+		return
+	}
+
 	c.eng.observeAttempt(d.Target.Type, res.elapsed())
 
 	err := c.eng.recordResult(
@@ -110,6 +148,7 @@ func (c *httpCore) fireAndForget(
 }
 
 func (c *httpCore) withRetry(
+	ctx context.Context,
 	webhookDB *gorm.DB,
 	d *database.Delivery,
 	task *Task,
@@ -131,6 +170,10 @@ func (c *httpCore) withRetry(
 
 	res := attempt()
 
+	if c.interruptedByStop(ctx, d, res) {
+		return
+	}
+
 	c.eng.observeAttempt(d.Target.Type, res.elapsed())
 
 	err := c.eng.recordResult(
@@ -395,7 +438,7 @@ func (t *httpTarget) Deliver(
 	}
 
 	t.deliver(
-		webhookDB, d, task, sched,
+		ctx, webhookDB, d, task, sched,
 		d.Target.MaxRetries, attempt,
 	)
 }

internal/delivery/target_slack.go

@@ -82,7 +82,7 @@ func (t *slackTarget) Deliver(
 	}
 
 	t.deliver(
-		webhookDB, d, task, sched,
+		ctx, webhookDB, d, task, sched,
 		d.Target.MaxRetries, attempt,
 	)
 }

internal/server/bind_address_test.go

@@ -5,6 +5,7 @@ import (
 	"net"
 	"net/http"
 	"strconv"
+	"syscall"
 	"testing"
 	"time"
 
@@ -25,6 +26,11 @@ const (
 	// its network namespace even with a published port.
 	wildcardV4 = "0.0.0.0"
 
+	// loopbackV6 and wildcardV6 are the IPv6 counterparts of the two
+	// above.
+	loopbackV6 = "::1"
+	wildcardV6 = "::"
+
 	// unavailableAddr is a TEST-NET-1 address (RFC 5737). It is a
 	// well-formed literal that no host is assigned, so binding it
 	// fails with EADDRNOTAVAIL rather than succeeding somewhere
@@ -116,6 +122,24 @@ func otherLocalAddr(t *testing.T) string {
 	return ""
 }
 
+// skipWithoutIPv6 skips the test when this host cannot bind
+// loopbackV6. Without IPv6 there is no second family for a bind to
+// claim or leave alone.
+func skipWithoutIPv6(t *testing.T) {
+	t.Helper()
+
+	var listenCfg net.ListenConfig
+
+	l, err := listenCfg.Listen(
+		t.Context(), "tcp6", net.JoinHostPort(loopbackV6, "0"),
+	)
+	if err != nil {
+		t.Skip("host has no IPv6 loopback to bind")
+	}
+
+	require.NoError(t, l.Close())
+}
+
 // startBoundServer starts the wired app with the given bind address
 // on a free port and returns that port. The app is stopped on
 // cleanup.
@@ -292,6 +316,50 @@ func TestBindAddress_WildcardReachesOtherAddresses(t *testing.T) {
 	requireDialable(t, net.JoinHostPort(other, strconv.Itoa(port)))
 }
 
+// TestBindAddress_WildcardV4IsIPv4Only pins that 0.0.0.0 answers on
+// IPv4 alone, as the README says. Go listens on 0.0.0.0 with a socket
+// that answers IPv6 too unless told otherwise, which put the admin UI
+// and the receiver on every IPv6 address of a host whose operator had
+// chosen an IPv4 bind.
+func TestBindAddress_WildcardV4IsIPv4Only(t *testing.T) {
+	t.Parallel()
+
+	skipWithoutIPv6(t)
+
+	port := startBoundServer(t, wildcardV4)
+
+	// Positive control: the service really is up, on IPv4.
+	requireDialable(t, net.JoinHostPort(loopbackV4, strconv.Itoa(port)))
+
+	dialer := net.Dialer{Timeout: dialTimeout}
+
+	conn, err := dialer.DialContext(
+		t.Context(), "tcp",
+		net.JoinHostPort(loopbackV6, strconv.Itoa(port)),
+	)
+	if err == nil {
+		_ = conn.Close()
+	}
+
+	require.ErrorIs(
+		t, err, syscall.ECONNREFUSED,
+		"a %s bind answered on %s", wildcardV4, loopbackV6,
+	)
+}
+
+// TestBindAddress_WildcardV6ReachesBothFamilies is the counterpart:
+// :: is the value that binds IPv6, and it answers IPv4 as well.
+func TestBindAddress_WildcardV6ReachesBothFamilies(t *testing.T) {
+	t.Parallel()
+
+	skipWithoutIPv6(t)
+
+	port := startBoundServer(t, wildcardV6)
+
+	requireDialable(t, net.JoinHostPort(loopbackV6, strconv.Itoa(port)))
+	requireDialable(t, net.JoinHostPort(loopbackV4, strconv.Itoa(port)))
+}
+
 // TestBindAddress_ServesRequestsOnConfiguredAddress proves the bound
 // listener serves the application rather than merely accepting TCP,
 // so a bind address that is honoured cannot be mistaken for one that

internal/server/http.go

@@ -1,9 +1,11 @@
 package server
 
 import (
+	"context"
 	"errors"
 	"net"
 	"net/http"
+	"net/netip"
 	"strconv"
 	"time"
 )
@@ -39,6 +41,21 @@ func (s *Server) listenAddr() string {
 	)
 }
 
+// listenNetwork returns the network the HTTP listener binds on, "tcp4"
+// for an IPv4 BindAddress and "tcp" for any other.
+//
+// On "tcp", Go binds 0.0.0.0 with a socket that answers IPv6 as well,
+// exactly as it binds ::. "tcp4" keeps 0.0.0.0 to IPv4, which is what
+// the README says it means. :: stays on "tcp" and answers both.
+func (s *Server) listenNetwork() string {
+	addr, err := netip.ParseAddr(s.params.Config.BindAddress)
+	if err == nil && addr.Is4() {
+		return "tcp4"
+	}
+
+	return "tcp"
+}
+
 // newHTTPServer builds the HTTP server for this Server's
 // configuration.
 //
@@ -67,7 +84,17 @@ func (s *Server) serveUntilShutdown() {
 
 	s.log.Info("http begin listen", "listenaddr", s.httpServer.Addr)
 
-	err := s.httpServer.ListenAndServe()
+	// ListenAndServe always listens on "tcp", which would undo
+	// listenNetwork.
+	var listenCfg net.ListenConfig
+
+	listener, err := listenCfg.Listen(
+		context.Background(), s.listenNetwork(), s.httpServer.Addr,
+	)
+	if err == nil {
+		err = s.httpServer.Serve(listener)
+	}
+
 	if err != nil && !errors.Is(err, http.ErrServerClosed) {
 		s.log.Error("listen error", "error", err)
 		s.shutdownWithFailure()

internal/server/server.go

@@ -135,6 +135,8 @@ func New(lc fx.Lifecycle, params ServerParams) (*Server, error) {
 	s.httpServer = s.newHTTPServer()
 
 	lc.Append(fx.Hook{
+		//nolint:contextcheck // The listener outlives this hook, whose
+		// context fx cancels once the app has started.
 		OnStart: func(_ context.Context) error {
 			s.startupTime = time.Now()
 			go s.Run()