@andersbakken/fisk 5.0.2 → 5.0.4

package/daemon/fisk-daemon.js

@@ -3433,6 +3433,40 @@ var output = {
 
 var fs = libExports;
 
+// systemd socket activation: the first passed fd is at SD_LISTEN_FDS_START (3).
+// See sd_listen_fds(3). systemd sets LISTEN_PID to the PID it should be
+// consumed by; a child process must be exec'd (not fork+exec of a wrapper)
+// so its own pid matches. We fail hard on any mismatch rather than silently
+// falling back to path binding, because that fallback would unlink the
+// systemd-owned socket file and re-create a new inode, defeating the whole
+// point of activation (and breaking every docker container that bind-mounted
+// the socket file).
+const SD_LISTEN_FDS_START = 3;
+function systemdListenFd() {
+    const pidRaw = process.env.LISTEN_PID;
+    const fdsRaw = process.env.LISTEN_FDS;
+    // Consume the activation env so any subprocess we spawn does not inherit
+    // stale LISTEN_PID/LISTEN_FDS. sd_listen_fds_with_names(3) recommends
+    // unsetenv after use.
+    delete process.env.LISTEN_PID;
+    delete process.env.LISTEN_FDS;
+    delete process.env.LISTEN_FDNAMES;
+    if (!pidRaw && !fdsRaw) {
+        return "none";
+    }
+    if (!pidRaw || !fdsRaw) {
+        return "mismatch";
+    }
+    const pid = Number(pidRaw);
+    const count = Number(fdsRaw);
+    if (!Number.isInteger(pid) || !Number.isInteger(count) || count < 1) {
+        return "mismatch";
+    }
+    if (pid !== process.pid) {
+        return "mismatch";
+    }
+    return { fd: SD_LISTEN_FDS_START };
+}
 class Server extends EventEmitter__default["default"] {
     constructor(option, common) {
         super();
@@ -3443,6 +3477,7 @@ class Server extends EventEmitter__default["default"] {
         this.option = option;
         this._connections = {};
         this._connectionId = 0;
+        this._activated = false;
     }
     close() {
         if (this.debug) {
@@ -3451,14 +3486,49 @@ class Server extends EventEmitter__default["default"] {
         if (this.server) {
             this.server.close();
         }
-        try {
-            fs.unlinkSync(this.file);
-        }
-        catch (err) {
-            /* */
+        // When socket-activated, systemd owns the socket file. Do not unlink
+        // it -- that would break the bind-mount contract for existing clients.
+        if (!this._activated) {
+            try {
+                fs.unlinkSync(this.file);
+            }
+            catch (err) {
+                /* */
+            }
         }
     }
     listen() {
+        const activation = systemdListenFd();
+        if (activation === "mismatch") {
+            console.error("fisk-daemon: LISTEN_FDS/LISTEN_PID present but do not match our pid. Refusing to fall back to path binding -- exiting so systemd can restart us with correct activation.");
+            process.exit(1);
+        }
+        if (activation !== "none") {
+            const inheritedFd = activation.fd;
+            this._activated = true;
+            if (this.debug) {
+                console.log("Server::listen using systemd-activated fd", inheritedFd);
+            }
+            return new Promise((resolve) => {
+                let connected = false;
+                this.server = net__default["default"].createServer(this._onConnection.bind(this));
+                this.server.listen({ fd: inheritedFd }, () => {
+                    connected = true;
+                    resolve();
+                });
+                this.server.on("error", (err) => {
+                    if (!connected) {
+                        console.error("Got server error", err);
+                        setTimeout(this.listen.bind(this), 1000);
+                    }
+                });
+                this.server.on("close", () => {
+                    if (!connected) {
+                        setTimeout(this.listen.bind(this), 1000);
+                    }
+                });
+            });
+        }
         try {
             fs.unlinkSync(this.file); // this should be more
             // complicated with attempts to

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@andersbakken/fisk",
-    "version": "5.0.2",
+    "version": "5.0.4",
     "description": "Fisk, a distributed compile system",
     "scripts": {
         "lint": "eslint . --ext .ts",