paivana

commit f015ab179e7af073fd3e694626aed03e7282ae0d
parent 9e2d9339a169917b52a364673e834108d1291fd2
Author: Florian Dold <dold@taler.net>
Date:   Tue,  8 Sep 2026 00:46:10 +0200

services: use DD102 retries and socket lifetime

Diffstat:
M
debian/paivana-httpd.prerm
 | 
2
++
M
debian/paivana-httpd.service
 | 
25
++++++++-----------------
M
debian/paivana-httpd.socket
 | 
1
+
M
debian/rules
 | 
4
++--
M
src/backend/paivana-httpd.c
 | 
6
+++---

5 files changed, 16 insertions(+), 22 deletions(-)
diff --git a/debian/paivana-httpd.prerm b/debian/paivana-httpd.prerm
@@ -6,4 +6,6 @@ if [ -d /run/systemd/system ] && [ "$1" = remove ]; then
         deb-systemd-invoke stop 'paivana-httpd.service' >/dev/null || true
 fi
 
+#DEBHELPER#
+
 exit 0
diff --git a/debian/paivana-httpd.service b/debian/paivana-httpd.service
@@ -1,4 +1,5 @@
 [Unit]
+StartLimitIntervalSec=0
 Description=Paivana Taler paywall reverse proxy
 After=network.target
 Requires=paivana-httpd.socket
@@ -7,36 +8,26 @@ Requires=paivana-httpd.socket
 # anything until it has loaded every paywall template from the merchant
 # backend, because a template it could not load is a set of URLs it
 # would hand out for free.  A backend that is merely restarting must
-# therefore be ridden out by restarting us, which is what the back-off
-# below is for -- so the start rate limiter must NOT be allowed to give
+# therefore be ridden out by restarting us, using the fixed retry
+# delay below -- so the start rate limiter must NOT be allowed to give
 # up and leave the unit failed.  A configuration error is the opposite
 # case and is handled by RestartPreventExitStatus.
-StartLimitIntervalSec=0
 
 [Service]
+# DD102: retry transient failures without a start-rate limit.
+Restart=always
+RestartSec=10s
 User=paivana-httpd
 Type=simple
-Restart=always
 RestartMode=direct
 
-# Exponential back-off: 1s, 2s, 4s ... capped at 5min.  A merchant
-# backend that comes back after a minute costs us a minute of downtime,
-# while one that is gone for a day does not spin.
-RestartSec=1s
-RestartSteps=10
-RestartMaxDelaySec=300s
-
 # 9 is EXIT_NO_RESTART, 6 is EXIT_NOTCONFIGURED (src/include/platform.h).
 # Neither is transient: retrying a missing DESTINATION_BASE_URL or an
 # unparseable TRUSTED_PROXIES only fills the journal.
 RestartPreventExitStatus=6 9
 
-# Recycle hourly to bound process-lifetime library/cache growth.  The 3600 s
-# value is operational hygiene rather than a request deadline.  Paivana first
-# quiesces its copy of the socket and drains accepted requests; the socket unit
-# continues queueing new connections for the replacement process.  SECRET is
-# mandatory and stable, so the restart does not invalidate paid access.
-RuntimeMaxSec=3600s
+# RuntimeMaxSec is incompatible with DD102 socket lifetime on systemd 257:
+# reaching the limit stops the bound socket and cancels automatic recovery.
 
 # Paivana's current GNUnet/Taler event loop uses select(), whose fd_set has
 # 1024 entries on this platform.  Raising this value would let libraries open
diff --git a/debian/paivana-httpd.socket b/debian/paivana-httpd.socket
@@ -1,4 +1,5 @@
 [Unit]
+BindsTo=paivana-httpd.service
 Description=Paivana Socket
 
 [Socket]
diff --git a/debian/rules b/debian/rules
@@ -51,9 +51,9 @@ override_dh_auto_clean:
 	dh_auto_clean
 
 override_dh_installsystemd:
-	dh_installsystemd -ppaivana-httpd --name=paivana-httpd --no-start --no-enable
+	dh_installsystemd -ppaivana-httpd --name=paivana-httpd --no-start --no-enable --no-stop-on-upgrade
 	# final invocation to generate daemon reload
-	dh_installsystemd
+	dh_installsystemd --no-start --no-enable --no-stop-on-upgrade
 
 override_dh_install:
 	dh_install
diff --git a/src/backend/paivana-httpd.c b/src/backend/paivana-httpd.c
@@ -644,13 +644,13 @@ run (void *cls,
                   "Failed to load the paywall templates; is paivana"
                   " installed, and does PAIVANA_PREFIX point at the"
                   " installation?\n");
-      PH_global_ret = EXIT_NOTINSTALLED;
+      PH_global_ret = EXIT_NO_RESTART;
       GNUNET_SCHEDULER_shutdown ();
       return;
     }
     if (! PAIVANA_HTTPD_init_template_languages ())
     {
-      PH_global_ret = EXIT_NOTINSTALLED;
+      PH_global_ret = EXIT_NO_RESTART;
       GNUNET_SCHEDULER_shutdown ();
       return;
     }
@@ -1348,7 +1348,7 @@ main (int argc,
     options,
     &run, NULL);
   if (GNUNET_SYSERR == ret)
-    return EXIT_INVALIDARGUMENT;
+    return EXIT_NOTCONFIGURED;
   if (GNUNET_NO == ret)
     return EXIT_SUCCESS;
   return PH_global_ret;