ingestion: cmd/server has no signal handling; symlinkguard.Watch gets context.Background() so its shutdown flush never runs #184

New Issue

2026-10-05T14:28:00Z

mathias commented

2026-10-05 14:28:00 +00:00

Source: PR #180 round-2 review (comments 15467 finding 4, 15487 finding 3).

ingestion/cmd/server/main.go:~368-370 does ctx := context.Background() and go symlinkguard.Watch(ctx, ...). The server has no SIGTERM/SIGINT handling, so ctx never ends. On a Flux rollout the process is killed and Watch never returns, so:

the drain + final flush at shutdown (PR #180) never runs in the pod
an alert that is mid-send at SIGTERM is lost, the same as on main
the "not delivered at shutdown" error log line added in PR #180 is never written

In production, the flush on handoff (PR #180) is what keeps the shutdown window at parity with main. The drain only protects callers that cancel.

Done when: main derives ctx from signal.NotifyContext(ctx, SIGTERM, SIGINT) (or equivalent), cancels it on shutdown, and waits for Watch to return (bounded by shutdownFlushTimeout) before the process exits. The HTTP server's graceful shutdown should be considered at the same time. A test covers the wiring: extract it from main() if needed.

Out of scope for PR #180.

Created via git-mcp on behalf of @mathias

Source: PR #180 round-2 review (comments 15467 finding 4, 15487 finding 3). `ingestion/cmd/server/main.go:~368-370` does `ctx := context.Background()` and `go symlinkguard.Watch(ctx, ...)`. The server has no SIGTERM/SIGINT handling, so ctx never ends. On a Flux rollout the process is killed and Watch never returns, so: - the drain + final flush at shutdown (PR #180) never runs in the pod - an alert that is mid-send at SIGTERM is lost, the same as on main - the "not delivered at shutdown" error log line added in PR #180 is never written In production, the flush on handoff (PR #180) is what keeps the shutdown window at parity with main. The drain only protects callers that cancel. **Done when:** main derives ctx from `signal.NotifyContext(ctx, SIGTERM, SIGINT)` (or equivalent), cancels it on shutdown, and waits for Watch to return (bounded by `shutdownFlushTimeout`) before the process exits. The HTTP server's graceful shutdown should be considered at the same time. A test covers the wiring: extract it from `main()` if needed. Out of scope for PR #180. --- _Created via git-mcp on behalf of @mathias_

mathias referenced this issue

2026-10-05 14:28:09 +00:00

fix(symlinkguard): deliver alerts beside the scan, not inside it (#164) #180

mathias referenced this issue

2026-10-05 14:34:30 +00:00

ingestion main.go: symlink tripwire wiring, buildMux arguments and ListenAndServe line remain untested (split from #154) #182

mathias referenced this issue

2026-10-05 14:48:16 +00:00

fix(symlinkguard): deliver alerts beside the scan, not inside it (#164) #180

mathias referenced this issue

2026-10-05 14:48:16 +00:00

symlinkguard: a hung ntfy delays symlink removal (alert flush runs in the scan goroutine) #164