Bastian de Byl
5d0d15f414
After a power cycle a transient HMAC Secrets Manager blip leaves go-fulfillr's gated routes unregistered (404) with the process still up, so nothing restarts it. Add a podman healthcheck probing the new dependency-free /api/v1/health/startup (503 until those routes register) with healthcheck_failure_action: restart, so podman restarts the container in place and the next boot self-heals. - fulfillr.yml + fulfillr-dev.yml: healthcheck via busybox wget (ships in the alpine image), interval 30s / timeout 5s / retries 3 / start_period 30s (covers the ~14s HMAC retry backoff), failure_action restart. Existing restart_policy on-failure:3 kept (process-exit case). - main.yml: bump fulfillr + fulfillr-dev image to 20260628.1930 (the build carrying the /health/startup probe). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
76 lines
2.1 KiB
YAML
76 lines
2.1 KiB
YAML
---
|
|
- import_tasks: gitea/podman-gitea-login.yml
|
|
|
|
- name: create nginx fulfillr-site directory
|
|
become: true
|
|
ansible.builtin.file:
|
|
path: /usr/local/share/fulfillr-site
|
|
state: directory
|
|
owner: "fedora"
|
|
group: "wheel"
|
|
mode: 0755
|
|
|
|
- name: create fulfillr host directory volumes
|
|
become: true
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
owner: "{{ podman_user }}"
|
|
group: "{{ podman_user }}"
|
|
mode: 0755
|
|
notify: restorecon podman
|
|
loop:
|
|
- "{{ fulfillr_path }}"
|
|
|
|
- name: template fulfillr config
|
|
become: true
|
|
ansible.builtin.template:
|
|
src: "templates/fulfillr/{{ item }}.j2"
|
|
dest: "{{ fulfillr_path }}/{{ item }}"
|
|
owner: "{{ podman_user }}"
|
|
group: "{{ podman_user }}"
|
|
mode: 0644
|
|
loop:
|
|
- production.json
|
|
notify:
|
|
- restorecon podman
|
|
|
|
- name: flush handlers
|
|
ansible.builtin.meta: flush_handlers
|
|
|
|
- import_tasks: podman/podman-check.yml
|
|
vars:
|
|
container_name: fulfillr
|
|
container_image: "{{ image }}"
|
|
|
|
- name: create fulfillr server container
|
|
become: true
|
|
become_user: "{{ podman_user }}"
|
|
containers.podman.podman_container:
|
|
name: fulfillr
|
|
image: "{{ image }}"
|
|
image_strict: true
|
|
command: --config /config/production.json
|
|
restart_policy: on-failure:3
|
|
# Self-heal the SCRUM-97 boot race: if a transient Secrets-Manager blip left the
|
|
# gated outreach/newsletter/cases routes unregistered, /health/startup returns 503
|
|
# and podman restarts the container in place (busybox wget ships in the alpine
|
|
# image; start_period covers the ~14s HMAC retry backoff so a healthy boot is never
|
|
# flagged).
|
|
healthcheck: "wget -q -O /dev/null http://localhost:8080/api/v1/health/startup || exit 1"
|
|
healthcheck_interval: 30s
|
|
healthcheck_timeout: 5s
|
|
healthcheck_retries: 3
|
|
healthcheck_start_period: 30s
|
|
healthcheck_failure_action: restart
|
|
log_driver: journald
|
|
volumes:
|
|
- "{{ fulfillr_path }}:/config"
|
|
ports:
|
|
- 9054:8080/tcp
|
|
|
|
- name: create systemd startup job for fulfillr
|
|
include_tasks: podman/systemd-generate.yml
|
|
vars:
|
|
container_name: fulfillr
|