Add systemd watchdog to the main service - #31
Merged
Conversation
vpetersson
force-pushed
the
feat/service-watchdog
branch
from
April 23, 2026 14:33
e61abe1 to
5e58bc1
Compare
There was a problem hiding this comment.
Pull request overview
This PR integrates the FastAPI app with systemd’s native sd_notify watchdog protocol so systemd can restart the service when the event loop becomes unresponsive, improving resilience beyond Restart=on-failure.
Changes:
- Add
READY=1notification on successful lifespan startup and a background watchdog ping loop (WATCHDOG=1) guarded byNOTIFY_SOCKET. - Update the main systemd unit to
Type=notifywithWatchdogSec=30sand restart flapping limits. - Add
sdnotifydependency (and mypy ignore override) and bump project version.
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
src/pypi_tea/app.py |
Sends systemd readiness notification and runs an asyncio watchdog ping task during app lifespan. |
deploy/pypi-tea.service |
Switches to Type=notify, enables watchdog, and adds start-limit tuning. |
pyproject.toml |
Adds sdnotify dependency, mypy override, and bumps version to 0.6.1. |
uv.lock |
Locks the new sdnotify dependency and updates the package version. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Restart=on-failure already handles crashes, but we've had outages where the process stays up while the event loop is wedged — nothing for systemd to restart. Use Type=notify + WatchdogSec so a stuck loop stops the WATCHDOG=1 pings and systemd kills + restarts us. - app.py: send READY=1 after lifespan startup completes and spawn a background task that pings WATCHDOG=1 every half of WATCHDOG_USEC. Guarded on NOTIFY_SOCKET so local dev and tests are unaffected. - pypi-tea.service: Type=notify, WatchdogSec=30s, NotifyAccess=main, plus StartLimitIntervalSec/Burst so a genuinely broken service does eventually give up instead of hot-looping forever. - Add sdnotify dep and the corresponding mypy stub override. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
vpetersson
force-pushed
the
feat/service-watchdog
branch
from
April 23, 2026 16:17
5e58bc1 to
5110ebd
Compare
- Extract _maybe_start_watchdog() helper. Parses WATCHDOG_USEC defensively (bad value logs a warning and disables the watchdog instead of crashing startup) and honours WATCHDOG_PID: if systemd set it and the value does not match os.getpid(), pings would be ignored anyway so we skip starting the task and log a warning. - Reword pypi-tea.service comment from "every ~15s" to "at roughly half the configured WatchdogSec interval" so it stays accurate if WatchdogSec is overridden via drop-in. - New tests/test_watchdog.py covers: READY=1 + periodic WATCHDOG=1 when env is set, quiet path when NOTIFY_SOCKET is absent, and each disable-watchdog reason (invalid WATCHDOG_USEC, WATCHDOG_PID mismatch, WATCHDOG_USEC=0). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 5 changed files in this pull request and generated no new comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Restart=on-failurealready handles process crashes, but recent outages have included cases where the main process stays up while the event loop is wedged — nothing for systemd to restart. This PR wires the app into systemd's native watchdog protocol so a stuck event loop automatically kills + restarts the service.How it works
pypi-tea.servicebecomesType=notifywithWatchdogSec=30s.READY=1to$NOTIFY_SOCKET— systemd only considers the service up once this arrives.WATCHDOG=1every ~15s (half ofWATCHDOG_USEC). If the event loop blocks — GIL-held sync call, deadlock, OOM thrashing — the ping stops and systemd terminates the process after 30s;Restart=on-failurebrings it back.NOTIFY_SOCKETbeing set, so local dev, tests, and non-systemd deployments are completely unaffected.Why Type=notify (option B) over an external curl-based watchdog (option A)
systemctl statusshows watchdog state).Additional hardening
StartLimitIntervalSec=600+StartLimitBurst=10cap flapping: if the service restarts ≥10 times in 10 min, systemd stops retrying and marks it failed (visible viasystemctl status, paging alerts, etc.). Without this, a genuinely broken service could silently restart forever.NotifyAccess=mainrestricts who can send to the notify socket.Files
src/pypi_tea/app.py— READY / WATCHDOG wiring in the lifespan context manager; clean shutdown of the watchdog task.deploy/pypi-tea.service—Type=notify,WatchdogSec=30s,NotifyAccess=main, StartLimit tuning.pyproject.toml— addssdnotify>=0.3.2(pure Python, no build deps) and the mypy override; bumps to 0.6.1 (stacked on top of Refactor refresh into arq-backed worker queue #30's 0.6.0).Non-goals
Test plan
uv run ruff check src/ tests/— cleanuv run ruff format src/ tests/— no changesuv run mypy src/— clean (strict)uv run pytest tests/ -v— 79 passed, 5 skipped (unchanged)NOTIFY_SOCKETis unset (covered by existing test suite)systemctl status pypi-teashows "active (running)" and "Status: Ready"kill -STOP $(pidof uvicorn)) triggers a restart within ~30sjournalctl -u pypi-tealogs the "systemd watchdog active" line on startupCompatibility with #30
This stacks on #30 — the PR base is
refactor/arq-worker-queue, notmaster. Diff shown here is the watchdog delta on top of the arq refactor. GitHub will auto-retarget tomasteronce #30 merges.🤖 Generated with Claude Code