feat/webserver: support serving over Unix sockets#1058
Closed
keegancsmith wants to merge 5 commits into
Closed
Conversation
zoekt-webserver could proxy to the indexserver over a socket, but the public webserver itself only bound TCP addresses. That made deployments with nginx-to-socket upstreams require an extra TCP hop even though Go's HTTP server can serve the same mux on a Unix listener.\n\nAdd a dedicated -listen_unix flag that swaps the listener while preserving the existing TCP default, watchdog health checks, graceful shutdown, and TLS handling. Amp-Thread-ID: https://ampcode.com/threads/T-019e1765-d2ff-756b-a3ba-28594ca68956 Co-authored-by: Amp <amp@ampcode.com>
Unix domain socket support is intended for local proxy handoff, where adding TLS inside the socket only makes the new path harder to reason about without improving the deployment story. Rejecting TLS flags in this mode keeps the watchdog and server setup aligned with the simple HTTP-over-socket behavior. Amp-Thread-ID: https://ampcode.com/threads/T-019e1772-2eba-7270-8871-f9ebf6b45a56 Co-authored-by: Amp <amp@ampcode.com>
The socket file cleanup lives in the serving goroutine, so main needs to let that goroutine finish after shutdown. Waiting for the server result preserves the existing fatal behavior for serve errors while ensuring the Unix socket path is removed before process exit. Amp-Thread-ID: https://ampcode.com/threads/T-019e1772-2eba-7270-8871-f9ebf6b45a56 Co-authored-by: Amp <amp@ampcode.com>
Go tracks whether it created a Unix socket path and unlinks it when the listener closes. Leaving a second Remove behind can race with a replacement process that has already rebound the same path, so rely on the listener's ownership-aware cleanup instead. Amp-Thread-ID: https://ampcode.com/threads/T-019e1772-2eba-7270-8871-f9ebf6b45a56 Co-authored-by: Amp <amp@ampcode.com>
The startup message should describe the endpoint actually used by the webserver. Moving the log into serveHTTP keeps the TCP and Unix socket paths from reporting unrelated configuration values together, which makes the log less ambiguous when Unix sockets are enabled. Amp-Thread-ID: https://ampcode.com/threads/T-019e1788-6ac1-744f-8b2d-c987f9132c24 Co-authored-by: Amp <amp@ampcode.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
zoekt-webserver already knew how to proxy to the indexserver over
<index>/indexserver.sock, but the webserver itself could only bind the TCP address from-listen. This adds a dedicated-listen_unixflag for deployments that want nginx or another local proxy to connect through a Unix domain socket instead of a TCP listener.When
-listen_unixis set, the webserver removes any stale socket path before binding, listens on the Unix socket, chmods it so a proxy running as a different user can connect, and relies on Go's Unix listener cleanup when the server shuts down. The health watchdog also dials the Unix socket in this mode, so the usual self-check keeps working.Unix socket serving is intentionally plain HTTP only. These sockets are local and permission-protected, and supporting TLS on top of them adds complexity without helping the nginx handoff use case; combining
-listen_unixwith-ssl_certor-ssl_keynow fails fast. I kept this as a dedicated flag rather than overloading-listenwith aunix://pseudo-address so the existing TCP listen address flag does not need scheme parsing or ambiguous precedence rules.Closes #1057.
Test Plan
go test ./cmd/zoekt-webserver/...Formal code review run after the follow-up fixes; no blocking issues remained.
Changelog
zoekt-webservernow supports serving HTTP and gRPC over a Unix domain socket with-listen_unix.