paivana

commit e51a4872e23736cf7701806ce17700005a21ab92
parent e903d20ba7614ff8010e4177b9542767c612167b
Author: Christian Grothoff <christian@grothoff.org>
Date:   Thu,  6 Aug 2026 18:03:55 +0200

ensure restarts happen if merchant backend is not available when we try to load templates

Diffstat:
M
debian/paivana-httpd.service
 | 
31
++++++++++++++++++++++---------

1 file changed, 22 insertions(+), 9 deletions(-)
diff --git a/debian/paivana-httpd.service b/debian/paivana-httpd.service
@@ -1,22 +1,35 @@
 [Unit]
-Description=Paivana backup backend
-After=postgresql.service network.target
+Description=Paivana Taler paywall reverse proxy
+After=network.target
 Requires=paivana-httpd.socket
 
+# Startup is deliberately fail-closed: paivana-httpd refuses to serve
+# anything until it has loaded every paywall template from the merchant
+# backend, because a template it could not load is a set of URLs it
+# would hand out for free.  A backend that is merely restarting must
+# therefore be ridden out by restarting us, which is what the back-off
+# below is for -- so the start rate limiter must NOT be allowed to give
+# up and leave the unit failed.  A configuration error is the opposite
+# case and is handled by RestartPreventExitStatus.
+StartLimitIntervalSec=0
+
 [Service]
 User=paivana-httpd
 Type=simple
 Restart=always
 RestartMode=direct
+
+# Exponential back-off: 1s, 2s, 4s ... capped at 5min.  A merchant
+# backend that comes back after a minute costs us a minute of downtime,
+# while one that is gone for a day does not spin.
 RestartSec=1s
-RestartPreventExitStatus=9
+RestartSteps=10
+RestartMaxDelaySec=300s
 
-# Disable the service if more than 5 restarts are encountered within 5s.
-# These are usually the systemd defaults, but can be overwritten, thus we set
-# them here explicitly, as the exchange code assumes StartLimitInterval
-# to be >=5s.
-StartLimitBurst=5
-StartLimitInterval=5s
+# 9 is EXIT_NO_RESTART, 6 is EXIT_NOTCONFIGURED (src/include/platform.h).
+# Neither is transient: retrying a missing DESTINATION_BASE_URL or an
+# unparseable TRUSTED_PROXIES only fills the journal.
+RestartPreventExitStatus=6 9
 
 RuntimeMaxSec=3600s
 # -f: we are served over a Unix socket by nginx/Apache (see the