{"item":{"uri":"at://did:plc:bcgltzqazw5tb6k2g3ttenbj/dev.knotless.pull/3mza7y32l3kkq","kind":"pull","title":"grain-serve has an image, /healthz, /_status and a rollout, as knotless","state":"closed","author":{"did":"did:plc:bcgltzqazw5tb6k2g3ttenbj","handle":"chadtmiller.com","avatar":"https://cdn.bsky.app/img/avatar/plain/did:plc:bcgltzqazw5tb6k2g3ttenbj/bafkreig5bcb7dl7aphw6eg4e7kjkvpdshfexdvk7jldg53ypre6ecdhesu@jpeg"},"createdAt":"2026-11-01T06:53:19.740Z","comments":6},"body":"## What changes\n\nStacked on the flags pull (at://did:plc:bcgltzqazw5tb6k2g3ttenbj/dev.knotless.pull/3mza7mqh2ofzo), whose compose passes flags: it lands after that one.\n\n**An image of grain-serve and its pages.** `deploy/Dockerfile` builds\ngrain-serve, the `grain` CLI, grain-mcp and grain-import with\n`--profile deploy --locked` (a new `[profile.deploy]` in Cargo.toml:\nrelease's, without LTO across crates and in 16 units), stamped with the\ncommit it was built from (`GRAIN_COMMIT`), beside the SvelteKit app built\nwith adapter-node, under tini as the node user. Its own\n`Dockerfile.dockerignore` keeps `target/` and `node_modules` out of the\ncontext. The root `Dockerfile` is the old server's and is left as it is:\nmain and hetzner-infra build it until cutover, so the two coexist by\nname, and at cutover this one takes the root's place.\n\n**`/healthz` and `/_status`, as knotless-serve answers them.** `/healthz`\nis `ok` while it listens. `/_status` is 200 or 503 with JSON: Jetstream\nconnected and bringing an event in the last two minutes (the follower now\ntells the index's `feeds` as it connects and hears), the index answering a\nread, the disk under it with room (15% low, 5% full), and the version and\ncommit running; `Cache-Control: no-store`.\n\n**`--check-index `**: says whether the index there is of this\nbuild's tables, without changing it, and serves nothing. grain's index\nmigrates rather than rebuilds, so the answer is \"keeps it\", \"would\nmigrate it\" (rollout.sh then stops the old one first) or \"past this\nbuild's\" (not started).\n\n**`deploy/`, in knotless's shape**: `docker-compose.yml` (project\n`grain-serve`: `serve` on 2600 and `pages` on 2601, journald logging,\nhealthchecks with `start_interval`, every setting a flag from\n`${GRAIN_*:-}`, secrets from `/etc/grain-serve/serve.env` on the host),\n`deploy.sh` (build / up / drop, over SSH to the host's docker, its own\nbuild cgroup, the `.env` written on the host), `rollout.sh` (no-gap\nrollover, with the index check), `logs.sh` (the journal through jq),\n`local.env.example`, `README.md`; `just deploy` and `just logs`.\n\n## Why\n\nThe audit against knotless: grain-serve had no image, health or status\nroute, index check or rollout; knotless has all of them, and grain's move\noff the old server deploys this way.\n\nMirrors knotless's `Dockerfile`, `[profile.deploy]` in `Cargo.toml`,\n`/healthz` and `/_status` (`crates/knotless-serve/src/lib.rs` routes,\n`crates/knotless-serve/src/status.rs`, `crates/knotless/src/status.rs`),\n`--check-index` (`check_index` in `crates/knotless-serve/src/lib.rs`), and\n`deploy/{docker-compose.yml,rollout.sh,deploy.sh,logs.sh,local.env.example,README.md}`.\nKept grain-specific: the Dockerfile is `deploy/Dockerfile`, beside the old\nserver's root one; the pages are built from the root `package.json`, as\nthe web still is, so the image carries its pruned `node_modules` (knotless's\nweb is bundled whole); the index check speaks of migrating, not\nrebuilding; `/_status` has no mirror probe and adds the version and\ncommit; the feed state lives on the `Index` rather than `App`, so no test\nor pull in flight that builds an `App` changes; deploy.sh has no runner,\ntriager or reviewer.\n\n## The hand-off to hetzner-infra\n\nProduction compose stays in `~/code/hetzner-infra` (`stacks/grain`), which\nthis does not change. grain-serve is a second compose project on grain's\nhost, in `/etc/grain-serve`, as knotless's is in `/etc/knotless`, reached\non an external network, `grain-serve`, that deploy.sh makes. At cutover\nhetzner-infra:\n\n- puts Caddy on the `grain-serve` network, as it is on `knotless`, and\n proxies grain's domain to `grain-serve:2600` for grain-serve's paths and\n `grain-pages:2601` for the rest (the Caddyfile is in deploy/README.md),\n or all of it to `grain-serve:2600` once grain-serve hands the pages on\n (`--web`, in flight elsewhere);\n- drops the `grain` service and its build from `grain-deploy`;\n- writes `/etc/grain-serve/serve.env` from its secrets (the CDN key and\n salt, the push key file paths, Clef's token) and moves the push key\n files to `/mnt/data/grain-serve/certs`;\n- runs `grain-import` once into `/mnt/data/grain-serve/index.db` before\n serve first starts.\n\ndeploy.yml then runs `deploy/deploy.sh build` and `up`, as knotless's\ndeploy workflow does; until cutover it deploys the old server.\n\n## How it was checked\n\nUnit tests: `status.rs` (feeds, thresholds, the disk, both routes and\ntheir `no-store`), `check_index` against an index at, behind and past this\nbuild's tables, and `tests/main.rs` runs `grain-serve --check-index`.\nClippy here on grain-serve; `docker compose config` on the compose file;\n`bash -n`/`sh -n` on the scripts. The checks run the rest.\n\n## Shortcomings\n\n- The image has not been built: nothing in CI builds it, and a release\n build is not run on this machine. The first `deploy.sh build` on the\n host is its test.\n- `deploy.sh` has not been run against a host.\n- Until grain-serve hands the pages every request it does not answer,\n the proxy has to know grain-serve's paths.\n\n## Review\n\nThe status module (`crates/grain-serve/src/status.rs`) and\n`deploy/docker-compose.yml` first; deploy.sh and rollout.sh follow\nknotless's line by line.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)","html":"

What changes

Stacked on the flags pull (grain-serve is set by flags, as knotless-serve is), whose compose passes flags: it lands after that one.

An image of grain-serve and its pages. deploy/Dockerfile builds\ngrain-serve, the grain CLI, grain-mcp and grain-import with\n--profile deploy --locked (a new [profile.deploy] in Cargo.toml:\nrelease's, without LTO across crates and in 16 units), stamped with the\ncommit it was built from (GRAIN_COMMIT), beside the SvelteKit app built\nwith adapter-node, under tini as the node user. Its own\nDockerfile.dockerignore keeps target/ and node_modules out of the\ncontext. The root Dockerfile is the old server's and is left as it is:\nmain and hetzner-infra build it until cutover, so the two coexist by\nname, and at cutover this one takes the root's place.

/healthz and /_status, as knotless-serve answers them. /healthz\nis ok while it listens. /_status is 200 or 503 with JSON: Jetstream\nconnected and bringing an event in the last two minutes (the follower now\ntells the index's feeds as it connects and hears), the index answering a\nread, the disk under it with room (15% low, 5% full), and the version and\ncommit running; Cache-Control: no-store.

--check-index <file>: says whether the index there is of this\nbuild's tables, without changing it, and serves nothing. grain's index\nmigrates rather than rebuilds, so the answer is \"keeps it\", \"would\nmigrate it\" (rollout.sh then stops the old one first) or \"past this\nbuild's\" (not started).

deploy/, in knotless's shape: docker-compose.yml (project\ngrain-serve: serve on 2600 and pages on 2601, journald logging,\nhealthchecks with start_interval, every setting a flag from\n${GRAIN_*:-}, secrets from /etc/grain-serve/serve.env on the host),\ndeploy.sh (build / up / drop, over SSH to the host's docker, its own\nbuild cgroup, the .env written on the host), rollout.sh (no-gap\nrollover, with the index check), logs.sh (the journal through jq),\nlocal.env.example, README.md; just deploy and just logs.

Why

The audit against knotless: grain-serve had no image, health or status\nroute, index check or rollout; knotless has all of them, and grain's move\noff the old server deploys this way.

Mirrors knotless's Dockerfile, [profile.deploy] in Cargo.toml,\n/healthz and /_status (crates/knotless-serve/src/lib.rs routes,\ncrates/knotless-serve/src/status.rs, crates/knotless/src/status.rs),\n--check-index (check_index in crates/knotless-serve/src/lib.rs), and\ndeploy/{docker-compose.yml,rollout.sh,deploy.sh,logs.sh,local.env.example,README.md}.\nKept grain-specific: the Dockerfile is deploy/Dockerfile, beside the old\nserver's root one; the pages are built from the root package.json, as\nthe web still is, so the image carries its pruned node_modules (knotless's\nweb is bundled whole); the index check speaks of migrating, not\nrebuilding; /_status has no mirror probe and adds the version and\ncommit; the feed state lives on the Index rather than App, so no test\nor pull in flight that builds an App changes; deploy.sh has no runner,\ntriager or reviewer.

The hand-off to hetzner-infra

Production compose stays in ~/code/hetzner-infra (stacks/grain), which\nthis does not change. grain-serve is a second compose project on grain's\nhost, in /etc/grain-serve, as knotless's is in /etc/knotless, reached\non an external network, grain-serve, that deploy.sh makes. At cutover\nhetzner-infra:

puts Caddy on the grain-serve network, as it is on knotless, and\nproxies grain's domain to grain-serve:2600 for grain-serve's paths and\ngrain-pages:2601 for the rest (the Caddyfile is in deploy/README.md),\nor all of it to grain-serve:2600 once grain-serve hands the pages on\n(--web, in flight elsewhere);
drops the grain service and its build from grain-deploy;
writes /etc/grain-serve/serve.env from its secrets (the CDN key and\nsalt, the push key file paths, Clef's token) and moves the push key\nfiles to /mnt/data/grain-serve/certs;
runs grain-import once into /mnt/data/grain-serve/index.db before\nserve first starts.

deploy.yml then runs deploy/deploy.sh build and up, as knotless's\ndeploy workflow does; until cutover it deploys the old server.

How it was checked

Unit tests: status.rs (feeds, thresholds, the disk, both routes and\ntheir no-store), check_index against an index at, behind and past this\nbuild's tables, and tests/main.rs runs grain-serve --check-index.\nClippy here on grain-serve; docker compose config on the compose file;\nbash -n/sh -n on the scripts. The checks run the rest.

Shortcomings

The image has not been built: nothing in CI builds it, and a release\nbuild is not run on this machine. The first deploy.sh build on the\nhost is its test.
deploy.sh has not been run against a host.
Until grain-serve hands the pages every request it does not answer,\nthe proxy has to know grain-serve's paths.

Review

The status module (crates/grain-serve/src/status.rs) and\ndeploy/docker-compose.yml first; deploy.sh and rollout.sh follow\nknotless's line by line.

🤖 Generated with Claude Code

\n","base":"feature/rust","head":{"repo":{"did":"did:plc:e7rftrdyz5e2rw4y6ocszew2","handle":"grain.social","name":"grain"},"branch":"infra/deploy"},"comments":[{"uri":"at://did:plc:kqi2glvzerg4dt66k64co2sl/dev.knotless.comment/3mzaa22hp5l2b","author":{"did":"did:plc:kqi2glvzerg4dt66k64co2sl","handle":"review.knotless.dev","bot":true},"createdAt":"2026-11-01T06:54:26.231Z","body":"This pull adds `/healthz` and `/_status`, `--check-index`, a `deploy/Dockerfile`, and a compose project with `deploy.sh`, `rollout.sh` and `logs.sh`. It mirrors knotless's deploy shape.\n\nI didn't read the whole diff. It's about 2,500 lines and the tool output was truncated, so I read the files at the head commit instead:\n- `status.rs`\n- `deploy/docker-compose.yml`\n- `deploy/Dockerfile`\n- `deploy/rollout.sh`\n- the `feeds` call sites\n\nI did not read `deploy.sh`, `logs.sh`, `check_index` or its tests, `tests/main.rs`, the Cargo profile or the README.\n\nI found nothing that must change.\n- **Status logic:** the disk thresholds and the 200/503 mapping are consistent with their tests.\n- **Rollout:** the serve path stops the old container first when the index would migrate, and refuses to start when the index is past the build or the check can't run.\n- **Env var:** `GRAIN_SERVE_URL` is the name the web code reads.\n- **Feeds:** only Jetstream is registered as a feed, so `fed` being true when any feed is ok matches the single-feed case. If you add a second feed, one dead feed would give 200 with a problem listed.\n\nAll four checks (test, rust, harness, check) were still queued when I looked, so none had passed. As you say, the image has never been built and `deploy.sh` has never run against a host. The first host build is the real test.","html":"

This pull adds /healthz and /_status, --check-index, a deploy/Dockerfile, and a compose project with deploy.sh, rollout.sh and logs.sh. It mirrors knotless's deploy shape.

I didn't read the whole diff. It's about 2,500 lines and the tool output was truncated, so I read the files at the head commit instead:

status.rs
deploy/docker-compose.yml
deploy/Dockerfile
deploy/rollout.sh
the feeds call sites

I did not read deploy.sh, logs.sh, check_index or its tests, tests/main.rs, the Cargo profile or the README.

I found nothing that must change.

Status logic: the disk thresholds and the 200/503 mapping are consistent with their tests.
Rollout: the serve path stops the old container first when the index would migrate, and refuses to start when the index is past the build or the check can't run.
Env var: GRAIN_SERVE_URL is the name the web code reads.
Feeds: only Jetstream is registered as a feed, so fed being true when any feed is ok matches the single-feed case. If you add a second feed, one dead feed would give 200 with a problem listed.

All four checks (test, rust, harness, check) were still queued when I looked, so none had passed. As you say, the image has never been built and deploy.sh has never run against a host. The first host build is the real test.

\n","verdict":"approve","commit":"103aebdc9f4d8447fb5986c7adbc16b4511e1a3a"},{"uri":"at://did:plc:kqi2glvzerg4dt66k64co2sl/dev.knotless.comment/3mzaa75a4oe2b","author":{"did":"did:plc:kqi2glvzerg4dt66k64co2sl","handle":"review.knotless.dev","bot":true},"createdAt":"2026-11-01T06:57:16.901Z","body":"Since my last round the pull has one new commit: `grain-serve` now shuts down gracefully on SIGTERM as well as ctrl-c. That fits the rollout, because docker stops the old container with SIGTERM through tini. I read the change in `lib.rs`. The `select!` over the two signals is correct, and the handler is installed inside the shutdown future. A new test in `tests/main.rs` sends `kill -TERM` and checks that the process exits successfully. The `tokio::signal::unix` call is Unix-only, which is fine for a server image. Nothing from my earlier review needed a follow-up. All four checks were still queued when I looked, so none has passed yet. The image build and `deploy.sh` are still untested against a host, as the pull says.","html":"

Since my last round the pull has one new commit: grain-serve now shuts down gracefully on SIGTERM as well as ctrl-c. That fits the rollout, because docker stops the old container with SIGTERM through tini. I read the change in lib.rs. The select! over the two signals is correct, and the handler is installed inside the shutdown future. A new test in tests/main.rs sends kill -TERM and checks that the process exits successfully. The tokio::signal::unix call is Unix-only, which is fine for a server image. Nothing from my earlier review needed a follow-up. All four checks were still queued when I looked, so none has passed yet. The image build and deploy.sh are still untested against a host, as the pull says.

\n","verdict":"approve","commit":"5b41fddfacfc47aff52cb6dcc1ced72a3eb84a55"},{"uri":"at://did:plc:kqi2glvzerg4dt66k64co2sl/dev.knotless.comment/3mzacgqbnut2b","author":{"did":"did:plc:kqi2glvzerg4dt66k64co2sl","handle":"review.knotless.dev","bot":true},"createdAt":"2026-11-01T07:37:19.239Z","body":"Since my last round the pull has one new commit. It reformats two `healthcheck.test` arrays in `deploy/docker-compose.yml` across several lines. The commands are character-for-character the same, so nothing changes at runtime. My earlier rounds asked for nothing, so there is nothing to follow up. The image build and `deploy.sh` are still untested against a host, as the pull says.","html":"

Since my last round the pull has one new commit. It reformats two healthcheck.test arrays in deploy/docker-compose.yml across several lines. The commands are character-for-character the same, so nothing changes at runtime. My earlier rounds asked for nothing, so there is nothing to follow up. The image build and deploy.sh are still untested against a host, as the pull says.

\n","verdict":"approve","commit":"06e8bc642fdd52a2a4af7df5611db3633416f6e1"},{"uri":"at://did:plc:bcgltzqazw5tb6k2g3ttenbj/dev.knotless.comment/3mzadjfnigptf","author":{"did":"did:plc:bcgltzqazw5tb6k2g3ttenbj","handle":"chadtmiller.com","avatar":"https://cdn.bsky.app/img/avatar/plain/did:plc:bcgltzqazw5tb6k2g3ttenbj/bafkreig5bcb7dl7aphw6eg4e7kjkvpdshfexdvk7jldg53ypre6ecdhesu@jpeg"},"createdAt":"2026-11-01T07:56:42.510Z","body":"Now stacked on the telemetry pull too (at://did:plc:bcgltzqazw5tb6k2g3ttenbj/dev.knotless.pull/3mza7zqwzhwlt), merged in, since both changed main.rs, FLAGS and serve(); and on origin/batch/one. So it lands after flags, the batch and telemetry. The merge keeps --check-index ahead of telemetry::init, SIGTERM in serve() around telemetry::observed, and the compose file passes --metrics 127.0.0.1:9464 as knotless's does. Also: deploy/docker-compose.yml formatted as vp fmt checks (the check failure at 5b41fdd).","html":"

Now stacked on the telemetry pull too (grain-serve logs JSON lines, a wide line a request, and slow SQL), merged in, since both changed main.rs, FLAGS and serve(); and on origin/batch/one. So it lands after flags, the batch and telemetry. The merge keeps --check-index ahead of telemetry::init, SIGTERM in serve() around telemetry::observed, and the compose file passes --metrics 127.0.0.1:9464 as knotless's does. Also: deploy/docker-compose.yml formatted as vp fmt checks (the check failure at 5b41fdd).

\n"},{"uri":"at://did:plc:kqi2glvzerg4dt66k64co2sl/dev.knotless.comment/3mzadnp23a52b","author":{"did":"did:plc:kqi2glvzerg4dt66k64co2sl","handle":"review.knotless.dev","bot":true},"createdAt":"2026-11-01T07:59:06.564Z","body":"Since my last round the pull has merged in the batch and telemetry branches, plus one commit that adds `--metrics 127.0.0.1:9464` to the `serve` command in `deploy/docker-compose.yml`. I read the compose file at the head. The flag binds to loopback inside the container, so it isn't published and can only be read with `docker exec`, as the comment says. The healthchecks, ports and networks are unchanged. My earlier rounds asked for nothing, so there is nothing to follow up. I did not review the merged batch and telemetry code, since those are separate pulls. All four checks (test, rust, harness, check) were still queued when I looked, so none has passed. The image build and `deploy.sh` are still untested against a host, as the pull says.","html":"

Since my last round the pull has merged in the batch and telemetry branches, plus one commit that adds --metrics 127.0.0.1:9464 to the serve command in deploy/docker-compose.yml. I read the compose file at the head. The flag binds to loopback inside the container, so it isn't published and can only be read with docker exec, as the comment says. The healthchecks, ports and networks are unchanged. My earlier rounds asked for nothing, so there is nothing to follow up. I did not review the merged batch and telemetry code, since those are separate pulls. All four checks (test, rust, harness, check) were still queued when I looked, so none has passed. The image build and deploy.sh are still untested against a host, as the pull says.

\n","verdict":"approve","commit":"40b13ea0329d69257efdbb507e22f2d8cb1fe6cc"},{"uri":"at://did:plc:bcgltzqazw5tb6k2g3ttenbj/dev.knotless.comment/3mzajt4de6p2b","author":{"did":"did:plc:bcgltzqazw5tb6k2g3ttenbj","handle":"chadtmiller.com","avatar":"https://cdn.bsky.app/img/avatar/plain/did:plc:bcgltzqazw5tb6k2g3ttenbj/bafkreig5bcb7dl7aphw6eg4e7kjkvpdshfexdvk7jldg53ypre6ecdhesu@jpeg"},"createdAt":"2026-11-01T09:49:30.723Z","body":"Landed on feature/rust at 164794a, fast-forwarded with infra/justfile (at://did:plc:bcgltzqazw5tb6k2g3ttenbj/dev.knotless.pull/3mzaa2rxkrwa2), which contains this head and passed every check against fc5f686. What the review skipped was read before merging: deploy.sh works only in /etc/grain-serve and /mnt/data/grain-serve under its own compose project, so it cannot touch the running /etc/grain stack; no workflow runs it; logs.sh only reads; deploy.yml now waits on more checks, not fewer.","html":"

Landed on feature/rust at 164794a, fast-forwarded with infra/justfile (The Justfile runs grain-serve and the web, as knotless's does), which contains this head and passed every check against fc5f686. What the review skipped was read before merging: deploy.sh works only in /etc/grain-serve and /mnt/data/grain-serve under its own compose project, so it cannot touch the running /etc/grain stack; no workflow runs it; logs.sh only reads; deploy.yml now waits on more checks, not fewer.

\n"}],"reviews":[{"reviewer":{"did":"did:plc:kqi2glvzerg4dt66k64co2sl","handle":"review.knotless.dev","bot":true},"verdict":"approve","uri":"at://did:plc:kqi2glvzerg4dt66k64co2sl/dev.knotless.comment/3mzadnp23a52b","commit":"40b13ea0329d69257efdbb507e22f2d8cb1fe6cc","outdated":false,"maintainer":false}],"closes":[],"checks":[],"minutes":[{"runner":{"did":"did:plc:4bocpkn5zkwe4wuu4plrj5kt","handle":"runner.knotless.dev","bot":true},"minutes":2505,"freeing":[{"at":"2026-11-25T00:00:00Z","minutes":2},{"at":"2026-11-27T00:00:00Z","minutes":24},{"at":"2026-11-28T00:00:00Z","minutes":10},{"at":"2026-11-29T00:00:00Z","minutes":7},{"at":"2026-11-30T00:00:00Z","minutes":310},{"at":"2026-12-01T00:00:00Z","minutes":1355},{"at":"2026-12-02T00:00:00Z","minutes":509},{"at":"2026-12-06T00:00:00Z","minutes":43},{"at":"2026-12-07T00:00:00Z","minutes":185},{"at":"2026-12-08T00:00:00Z","minutes":16},{"at":"2026-12-09T00:00:00Z","minutes":38}],"updatedAt":"2026-11-10T01:31:15.298Z"},{"runner":{"did":"did:plc:ejh2v3z5ieqhqgz3ybk6r35x","handle":"ci.knotless.dev","bot":true},"minutes":28,"freeing":[{"at":"2026-11-29T00:00:00Z","minutes":2},{"at":"2026-11-30T00:00:00Z","minutes":7},{"at":"2026-12-01T00:00:00Z","minutes":1},{"at":"2026-12-06T00:00:00Z","minutes":6},{"at":"2026-12-07T00:00:00Z","minutes":8}],"updatedAt":"2026-11-08T00:05:20.251Z"}],"changes":{"repo":{"did":"did:plc:e7rftrdyz5e2rw4y6ocszew2","handle":"grain.social","name":"grain"},"commits":[],"files":[],"head":"40b13ea0329d69257efdbb507e22f2d8cb1fe6cc"},"card":"/grain.social/grain/pull/did:plc:bcgltzqazw5tb6k2g3ttenbj/3mza7y32l3kkq/card.png?v=10513b3d4d9121ff"}

grain.social/grain Switch repository Loading…

grain-serve has an image, /healthz, /_status and a rollout, as knotless

grain.social/grain

Switch repository

Loading…