mirror of
https://github.com/kuhyx/signal-bot.git
synced 2026-11-10 20:27:17 +01:00
Krzysztof kuhy Rudnicki
d5c63b423b
Today the bot was up, healthy and answering nothing for three hours. A host
firewall change (fixed in testsAndMisc 334c0cd9) cut every Docker container
off the internet; signal-cli lost Signal and reconnected in a loop from
15:32:50 onward. Nothing noticed:
- the container's own healthcheck answered 204
- /v1/groups answered 200 out of local state, so discovery saw no change
- the bot's WebSocket to the container stayed OPEN, so the transport's
reconnect logic never fired
- /healthz answered {"status": "ok"} the entire time
The only symptom was silence, which is also what a quiet evening looks like.
signal_bot/liveness.py asks the one question that cannot be answered from a
cache -- GET /v1/devices, which needs a live round trip -- but only after
SILENCE_SECONDS (120) with no frame of any kind, so a busy group costs
nothing and an idle one costs one request per window. Three consecutive
failures and /healthz answers 503 with the reason. Verified end to end in
scripts/e2e.sh against the real process: 503 after 84s with the fake's
connection cut, back to 200 on its own 30s after restoring it.
scripts/signal_api_watchdog.sh + a two-minute user timer do the recovery the
bot cannot do for itself, since a wedged bot cannot restart the container it
depends on. Two tiers, so the steady state costs no Signal round trip at
all: the bot's own /healthz first, the authenticated probe only when that is
not 200. It stops after 3 restarts in 6 hours and escalates instead -- a
deregistered account or a blocked network is not fixable by restarting, and
a restart loop would hide it. Its own bash suite stubs curl and docker and
drives every branch including the give-up cap.
signal_bot/trust.py answers the other half: TRUSTED_INVITERS decides who may
put this bot in a group. The gate sits in GroupDirectory._permitted, which
both _join_pending and _adopt already route through -- gating only invites
would gate the door nobody uses, since prime_profile.sh exists precisely so
that an add becomes a direct join. Evidence is either the group-update
envelope, which is the only frame naming an inviter, or a trusted identity
being a full member in the listing. A refusal is logged once, with that
group's members, so the operator can see which string to add.
verify_allowlist moved to membership.py to keep discovery.py under the
250-line gate; it was already the module that owns MembershipError.
Verified live, by stopping the container by hand and touching nothing else:
18:54:35 docker stop signal-api
18:56:36 liveness: failure 1 of 3 after 123s of silence
18:57:36 failure 3 of 3 -> /healthz answers 503 from 18:57:45
18:58:18 watchdog: probe failed (1/2)
19:00:28 watchdog: probe failed (2/2) -> docker restart signal-api
19:00:36 liveness: receive path recovered after 8 failed probe(s)
19:01:13 watchdog: signal-api is back
Six minutes, unattended, against three hours of silence this afternoon. All
four real groups are still adopted with TRUSTED_INVITERS=+48123456789 set,
and no group was refused.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KbjfWdAyHbCubac7wJKJZW
66 lines
2.7 KiB
Plaintext
66 lines
2.7 KiB
Plaintext
# Copy to .env and fill in. Every value here is read by signal_bot/config.py.
|
|
# The bot refuses to start if any REQUIRED value is missing or blank.
|
|
|
|
# REQUIRED. The account signal-cli is linked to, in +E.164 form.
|
|
PHONE_NUMBER=
|
|
|
|
# OPTIONAL, and normally left empty. Comma-separated group ids.
|
|
#
|
|
# Empty means "every group this account is a member of", discovered at
|
|
# runtime: adding the bot to a group is then the whole procedure, with no
|
|
# edit here and no restart. That is safe when the bot has its OWN number,
|
|
# because such an account has no other chats.
|
|
#
|
|
# Set it when the bot runs as a LINKED DEVICE on a personal account, where
|
|
# it would otherwise see every group on that account. scripts/live_smoke.sh
|
|
# writes it for you in that case; scripts/register_bot.sh deliberately does
|
|
# not. Startup fails if a listed group is not one the bot has joined.
|
|
#
|
|
# Find the ids with: curl -s localhost:9922/v1/groups/$PHONE_NUMBER | jq
|
|
#
|
|
# Replies, rate limits and the daily tally are per group either way: a
|
|
# command is answered in the group that asked and nowhere else, so there is
|
|
# no send target to configure. GROUP_ID is still accepted as the one-group
|
|
# spelling; GROUP_ID_SEND was removed and now fails startup if set.
|
|
GROUP_IDS=
|
|
|
|
# Optional. The signal-cli-rest-api container. Point this at the fake server
|
|
# to run entirely offline. Default: http://localhost:9922
|
|
API_BASE_URL=
|
|
|
|
# Optional. Tally database. Survives restarts. Default: signal_bot.sqlite3
|
|
DATABASE_PATH=
|
|
|
|
# Optional. When the daily tally is posted. Default: 21:37
|
|
REPORT_HOUR=
|
|
REPORT_MINUTE=
|
|
|
|
# Optional. Per-user, per-command cooldown in seconds. Default: 10
|
|
COOLDOWN_SECONDS=
|
|
|
|
# Optional but recommended. Comma-separated +E.164 numbers -- or member
|
|
# UUIDs, which is how /v1/groups spells anybody the account has never
|
|
# messaged -- allowed to add this bot to a group.
|
|
#
|
|
# Empty means anyone who knows the number can pull the bot into a group and
|
|
# have it answer there. With it set, "add the bot" is still the whole setup
|
|
# for you, and a stranger's group is refused with one WARNING naming that
|
|
# group's members, so you can see exactly which string to add here.
|
|
TRUSTED_INVITERS=
|
|
|
|
# Optional. How long the bot may hear nothing at all -- no message, no
|
|
# receipt, no typing indicator -- before it probes /v1/devices to find out
|
|
# whether it has gone deaf. Three failed probes and /healthz turns 503.
|
|
# Default: 120. scripts/e2e.sh sets it to 0 to prove the gate really fires.
|
|
SILENCE_SECONDS=
|
|
|
|
# Optional. Image APIs. Overridden by scripts/e2e.sh to serve local fixtures.
|
|
CAT_API_URL=
|
|
DOG_API_URL=
|
|
|
|
# Optional. Where the /healthz readiness probe binds.
|
|
# Default: 127.0.0.1:8137 -- deliberately not 8000, which unrelated dev
|
|
# servers grab, and below the ephemeral range so the kernel cannot take it.
|
|
BIND_HOST=
|
|
BIND_PORT=
|