Three defects found by running a real WebRTC viewer through the whole
stack for the first time (continuum-backend/scripts/e2e-camera.sh).
1. go2rtc was orphaned on every ordinary stop. `kill_on_drop(true)` was
set, but main handled no signals, so SIGTERM - what `kill`, `docker
stop` and a service manager send - ended the process on the spot with
no destructor run and the child was never dropped. The orphan keeps
:1984 and :8555 bound, so the restarted proxy cannot start its own,
and it keeps a printer's access code in memory. One had been running
for 4.5 days. main now selects on SIGTERM/SIGINT so it returns
normally and the supervisor is dropped. A SIGKILL or OOM kill still
orphans it; PR_SET_PDEATHSIG would cover that but needs unsafe and a
libc dependency, so it is left for a decision.
2. A camera was advertised before go2rtc could serve it. The comment on
REBUILD_INTERVAL said the first useful rebuild is "a few seconds
after startup", but a tokio interval ticks immediately - with the
fleet still empty - and the next tick was 30s away. For that window
the cloud offered a camera and go2rtc answered "stream not found".
Polling every 5s costs nothing: it reads in-memory reports and only
restarts go2rtc when the rendered config changes.
3. The generated go2rtc.yaml was created 0644 by tokio::fs::write. It
holds the printer's access code and go2rtc's API password, so any
local user could read both. It is now created owner-only and fresh,
because a temp file left by a crash would otherwise keep its old
mode. The new test pre-creates a stale 0644 temp file; against the
old implementation it fails with mode 420 (0o644) where 384 (0o600)
is expected.
cargo test: 193 lib tests and all integration tests pass.
octoturge
af8bac4bf3