authorclover caruso <git@paperclover.net> 2026-10-06 23:11:12-07:00
committerclover caruso <git@paperclover.net> 2026-10-09 11:21:14-07:00
log4e0a77820c14a4949c590a7beacb75a31502e9cf
treedb79b1df80bb83440b2b971352160f8fb6aad76e
parentd73490141270d3252e24a89690364d9abc417639
signature Signed by SSH key SHA256:52mNGHRsVFBDED9IAX5pe+LRWUefqTbxEReunq21QvU (~clover)

Keep single-upstream routes reachable after transient failures

1 files changed, 7 insertions(+), 3 deletions(-)

tools/router.py+7-3
...@@ -24,9 +24,13 @@ def nomad(path, token):...@@ -24,9 +24,13 @@ def nomad(path, token):
24 return json.load(response)24 return json.load(response)
2525
2626
27def passive_health(upstreams, indent):
28 return [f"{indent}fail_duration 30s"] if len(upstreams.split()) > 1 else []
29
30
27def proxy(upstreams, indent, uncompressed=False, host=None):31def proxy(upstreams, indent, uncompressed=False, host=None):
28 lines = [f"{indent}reverse_proxy {upstreams} {{", f"{indent} lb_try_duration 5s",32 lines = [f"{indent}reverse_proxy {upstreams} {{", f"{indent} lb_try_duration 5s",
29 f"{indent} fail_duration 30s"]33 *passive_health(upstreams, indent + " ")]
30 if uncompressed:34 if uncompressed:
31 lines.append(f"{indent} header_up Accept-Encoding identity")35 lines.append(f"{indent} header_up Accept-Encoding identity")
32 if host:36 if host:
...@@ -261,7 +265,7 @@ def render(token):...@@ -261,7 +265,7 @@ def render(token):
261 if route["userHeader"]:265 if route["userHeader"]:
262 lines.append(f" request_header -{route['userHeader']}")266 lines.append(f" request_header -{route['userHeader']}")
263 lines += [267 lines += [
264 f" reverse_proxy {auth} {{", " lb_try_duration 5s", " fail_duration 30s", " method GET",268 f" reverse_proxy {auth} {{", " lb_try_duration 5s", *passive_health(auth, " "), " method GET",
265 " rewrite /snow.oauth2/auth", " header_up X-Forwarded-Method {method}",269 " rewrite /snow.oauth2/auth", " header_up X-Forwarded-Method {method}",
266 " header_up X-Forwarded-Uri {uri}", " @unauthorized status 401",270 " header_up X-Forwarded-Uri {uri}", " @unauthorized status 401",
267 " handle_response @unauthorized {",271 " handle_response @unauthorized {",
...@@ -286,7 +290,7 @@ def render(token):...@@ -286,7 +290,7 @@ def render(token):
286 lines += [" handle /snow.oauth2/* {", *proxy(auth," "), " }"]290 lines += [" handle /snow.oauth2/* {", *proxy(auth," "), " }"]
287 lines += [" handle {"]291 lines += [" handle {"]
288 lines += [f" request_header -{name}" for name in scrub]292 lines += [f" request_header -{name}" for name in scrub]
289 lines += [f" reverse_proxy {auth} {{", " lb_try_duration 5s", " fail_duration 30s", " method GET", " rewrite " + ("/auth/file/check" if native else "/snow.oauth2/auth"),293 lines += [f" reverse_proxy {auth} {{", " lb_try_duration 5s", *passive_health(auth, " "), " method GET", " rewrite " + ("/auth/file/check" if native else "/snow.oauth2/auth"),
290 *([f" header_up Studio-Proxy-Token {dashboard_proof}"] if native else []),294 *([f" header_up Studio-Proxy-Token {dashboard_proof}"] if native else []),
291 " header_up X-Forwarded-Method {method}", " header_up X-Forwarded-Uri {uri}",295 " header_up X-Forwarded-Method {method}", " header_up X-Forwarded-Uri {uri}",
292 " @authenticated status 2xx", " handle_response @authenticated {"]296 " @authenticated status 2xx", " handle_response @authenticated {"]