clawbot
bef9986542
All checks were successful
check / check (push) Successful in 3m3s
fx defaults to a 15s stop timeout and the Dockerfile sets no grace override, so Docker SIGKILLed at 10s and the bounded shutdown #130 built — including the log line that tells an operator a component is wedged — was unreachable in the image this repo produces. Sets fx.StopTimeout to 5s, and lowers the HTTP drain to 3s so a full-length drain no longer exhausts the whole sequence budget and skip every later hook, database close included. The Sentry flush, which runs in the same hook and honours no context, is clamped to the remaining stop budget less a 2s tail reserve, so a stalled flush drops Sentry events rather than the database close. Also fixes a latent coin flip in the shared stop-hook waiter, which reported "shutdown timed out" about half the time for a component that drained cleanly against an already-expired context. Independently reviewed three times. The final reviewer derived a stronger invariant than the implementation claims — the server hook's absolute end is bounded at stopTimeout minus the reserve regardless of drain length or of time consumed by preceding hooks — and confirmed the guard's 10ms sweep cannot step over the maximum, since both breakpoints land on its grid. Both Sentry probe arms, the docker stop demo and every mutation were reproduced independently. Known residual, filed separately: the HTTP drain itself is not clamped by the reserve, so slow preceding hooks can still jointly exhaust the budget. Demonstrated with a 2.2s sweeper delay.
101 lines
3.2 KiB
Go
101 lines
3.2 KiB
Go
// Package main is the entry point for the webhooker application.
|
|
package main
|
|
|
|
import (
|
|
"time"
|
|
|
|
"go.uber.org/fx"
|
|
"sneak.berlin/go/webhooker/internal/config"
|
|
"sneak.berlin/go/webhooker/internal/database"
|
|
"sneak.berlin/go/webhooker/internal/delivery"
|
|
"sneak.berlin/go/webhooker/internal/globals"
|
|
"sneak.berlin/go/webhooker/internal/handlers"
|
|
"sneak.berlin/go/webhooker/internal/healthcheck"
|
|
"sneak.berlin/go/webhooker/internal/logger"
|
|
"sneak.berlin/go/webhooker/internal/middleware"
|
|
"sneak.berlin/go/webhooker/internal/server"
|
|
"sneak.berlin/go/webhooker/internal/session"
|
|
)
|
|
|
|
// stopTimeout bounds the whole fx stop sequence, not each hook.
|
|
//
|
|
// fx defaults to 15s, which is longer than Docker's 10s default
|
|
// stop grace: the container would be SIGKILLed before the bound
|
|
// could fire, so nothing bounded by it would ever be observed.
|
|
// 5s leaves headroom inside that grace for signal delivery and
|
|
// process exit; the observed wedge case already exits at ~5.3s,
|
|
// so a larger bound would trade a rare skipped database close for
|
|
// a more common hard kill.
|
|
//
|
|
// The server's stop hook must fit inside it with room to spare: a
|
|
// hook that used the whole budget would exhaust it at that instant,
|
|
// and fx would skip every hook after the server — the delivery
|
|
// engine, the healthcheck, the webhook DB manager and the database
|
|
// close. That hook is the 3s HTTP drain plus the Sentry flush that
|
|
// follows it in the same hook, so the flush is clamped to the stop
|
|
// context's remaining time less server.TailHookReserve rather than
|
|
// running for its own fixed 2s; the reserve is what the tail hooks
|
|
// live on, and they are microsecond-scale in normal operation.
|
|
// TestStopTimeout_LeavesHeadroomForTailHooks pins the arithmetic
|
|
// across every drain length.
|
|
//
|
|
// This does not make the database close unconditional: the
|
|
// ArchiveSweeper and RetentionReaper hooks run before the server
|
|
// and can still consume the whole budget on their own.
|
|
const stopTimeout = 5 * time.Second
|
|
|
|
// Build-time variables set via -ldflags.
|
|
//
|
|
//nolint:gochecknoglobals // Build-time variables injected by the linker.
|
|
var (
|
|
version = "dev"
|
|
appname = "webhooker"
|
|
)
|
|
|
|
func main() {
|
|
globals.Appname = appname
|
|
globals.Version = version
|
|
|
|
newApp().Run()
|
|
}
|
|
|
|
// newApp builds the application graph. It is separate from main so
|
|
// a test can assert the options it carries.
|
|
func newApp() *fx.App {
|
|
return fx.New(
|
|
fx.StopTimeout(stopTimeout),
|
|
fx.Provide(
|
|
globals.New,
|
|
logger.New,
|
|
config.New,
|
|
database.New,
|
|
database.NewWebhookDBManager,
|
|
database.NewRetentionReaper,
|
|
healthcheck.New,
|
|
session.New,
|
|
handlers.New,
|
|
middleware.New,
|
|
delivery.New,
|
|
delivery.NewArchiveSweeper,
|
|
// Wire *delivery.Engine as delivery.Notifier so the
|
|
// webhook handler can notify the engine of new deliveries.
|
|
func(e *delivery.Engine) delivery.Notifier { return e },
|
|
// Wire *delivery.Engine as delivery.WebhookEvictor so
|
|
// deleting a webhook releases its archive writer.
|
|
func(e *delivery.Engine) delivery.WebhookEvictor {
|
|
return e
|
|
},
|
|
server.New,
|
|
),
|
|
fx.Invoke(
|
|
func(
|
|
*server.Server,
|
|
*delivery.Engine,
|
|
*database.RetentionReaper,
|
|
*delivery.ArchiveSweeper,
|
|
) {
|
|
},
|
|
),
|
|
)
|
|
}
|