Documentation
¶
Overview ¶
Package safemode keeps a boot ledger so a control plane that cannot start stops restarting and serves a read-only recovery page instead.
Index ¶
Constants ¶
const ( EnvAfterFailures = "APP_SAFE_MODE_AFTER_FAILURES" EnvBackoffBase = "APP_BOOT_BACKOFF_BASE" EnvBackoffMax = "APP_BOOT_BACKOFF_MAX" EnvHealthyAfter = "APP_BOOT_HEALTHY_AFTER" )
Environment variables that tune boot failure handling.
const ( ReasonDBCorrupt = "db_corrupt" ReasonMigrationFailed = "migration_failed" ReasonStoreFailed = "store_open_failed" ReasonCrashLoop = "crash_loop" )
Reasons the control plane enters safe mode.
const ( ActionRestore = "restore" ActionRetry = "retry" )
Recovery actions.
const LedgerFilename = "boot-ledger.json"
LedgerFilename is the boot ledger under the data dir.
const TokenFilename = "safe-mode-token"
TokenFilename holds the one-time code that unlocks recovery. Reading it needs host access.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
DataDir string
Brand string
Version string
Entry Entry
Backups integrity.BackupLister
Ledger *Ledger
// Restart asks the process to exit so its supervisor relaunches it.
Restart func()
Logger *slog.Logger
Now func() time.Time
}
Config wires the recovery page to the process.
type Ledger ¶
type Ledger struct {
// contains filtered or unexported fields
}
Ledger counts consecutive boots that never became healthy.
func (*Ledger) Begin ¶
Begin records a start. A previous start that never reached MarkHealthy or MarkClean counts as one more failure.
func (*Ledger) ExitSafeMode ¶
ExitSafeMode records that safe mode ended without a recovery action. The next boot gets exactly one more attempt, so a manual restart after fixing the cause works and a broken install lands back in safe mode.
func (*Ledger) MarkClean ¶
func (l *Ledger) MarkClean()
MarkClean records a deliberate stop so it is not counted as a crash.
func (*Ledger) MarkHealthy ¶
func (l *Ledger) MarkHealthy()
MarkHealthy records that this boot stayed up, which clears the failure count.
type Policy ¶
type Policy struct {
Threshold int
BackoffBase time.Duration
BackoffMax time.Duration
HealthyAfter time.Duration
}
Policy turns a failure count into a delay and a safe mode decision.
func PolicyFromEnv ¶
PolicyFromEnv reads the APP_SAFE_MODE_* and APP_BOOT_* overrides.
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
Server is the read-only recovery surface served instead of the dashboard.