release: retry the web process instead of crash-looping the machine
commit
013c16drelease: retry the web process instead of crash-looping the machine
An unenrolled server key must keep the web surface down (fail-closed on port 4880), not take nginx — and the git transport and ssh path an operator needs to do the enrolling — down with it.
Assisted-by: Claude:claude-fable-5 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Reviews
No reviews of this commit yet — record a verdict below.
Start a review
docker/entrypoint.sh
@@ -29,10 +29,18 @@
spawn-fcgi -s /run/fcgiwrap.sock -M 766 -- /usr/sbin/fcgiwrap
# The web UI refuses to boot until $key's public half is enrolled as a
-# member (`roots.web-signing`) — on a fresh volume, enroll it before the
-# first deploy that ships this entrypoint, or the machine crash-loops
-# with the exact command to run in its logs.
-git-ents serve --hosted --key "$key" --public-host "$public_host" --port 4880 "$repo" &
+# member (`roots.web-signing`). Retry rather than die: an unenrolled key
+# on a fresh volume must not take nginx — and with it the git transport
+# and the ssh path an operator needs to *do* the enrolling — down in a
+# crash loop. The web surface stays fail-closed (nothing listens on 4880
+# until enrollment succeeds); the enroll command prints every attempt.
+(
+ until git-ents serve --hosted --key "$key" --public-host "$public_host" \
+ --port 4880 "$repo"; do
+ echo "web UI not started; retrying in 15s" >&2
+ sleep 15
+ done
+) &
nginx -c /etc/git-ents/nginx.conf -g "daemon off;" &
wait -n