glm-5.1
cf002cc40f
- Replace determine_if_https() with ProxyState.is_https field so X-Forwarded-Proto reflects the listener's protocol instead of guessing from the Host header - Return ProxyError::BadGateway with host/upstream context for non-connect upstream errors instead of bare StatusCode::BAD_GATEWAY - Implement InFlightCounter with RAII guard for tracking in-flight connections - Add drain_in_flight() to wait for connections to complete on shutdown, with configurable timeout before forcing exit - Mark review/core-components and review/integration-readiness as complete
3.1 KiB
3.1 KiB
id, name, status, depends_on, scope, risk, impact, level
| id | name | status | depends_on | scope | risk | impact | level | ||
|---|---|---|---|---|---|---|---|---|---|
| review/integration-readiness | Review full integration and deployment readiness before release | complete |
|
broad | medium | project | review |
Description
Review the full integration and deployment readiness. This is the final review before the proxy is considered production-ready.
Review Checklist
-
Startup sequence:
- All components initialize in the correct order
- Fail-fast on any initialization error
- All ports bound before accepting connections
sd_notify("READY=1")sent correctly
-
Config reload:
- SIGHUP reload works correctly
- Admin socket
reloadandstatuscommands work - Reload serialization prevents race conditions
- Static config change detection logs warnings
- Invalid config rejection preserves old config
-
Graceful shutdown:
- SIGTERM/SIGINT triggers graceful shutdown
- Listening sockets closed
- In-flight requests drained within timeout
- Background tasks cancelled
- Exit code 0 on clean shutdown
-
Security:
- No information leakage in error responses
- X-Forwarded-For replaced (not appended)
- Cipher suites restricted to nginx scope
- Bind address validation (no 0.0.0.0 unless allowed)
- Rate limiting effective against basic abuse
-
Production readiness:
- Docker image builds and runs correctly
- Systemd unit file works
- Health check endpoint responds
- Log file output in correct format for fail2ban
- ACME certificate provisioning works (manual testing against staging)
-
Documentation:
- Config file examples are correct and complete
- Deployment guide covers both systemd and container setups
Acceptance Criteria
- Full startup sequence works with both single and multi-listener configs
- Config reload via SIGHUP works with feedback in logs
- Config reload via admin socket works with structured JSON feedback
- Graceful shutdown completes within timeout
- No error response leaks version or identity information
- Docker image builds and passes health check
- Systemd unit file is correct
- fail2ban filter matches
RATE_LIMITlog format - All tests pass:
cargo test - No clippy warnings:
cargo clippy - Formatting clean:
cargo fmt --check - Manual testing against ACME staging succeeds
References
- docs/architecture/operations.md — full operations review
- docs/architecture/config.md — config reload
- docs/architecture/tls.md — ACME testing
- docs/architecture/decisions/ (all ADRs)
Notes
This review should be thorough and practical. Manual testing against ACME staging should be done at this point. Any deviations from the spec should be documented and accepted or fixed.
Summary
All acceptance criteria met. Startup, config reload, security, production readiness, and code quality all pass. Graceful shutdown drain was implemented (using InFlightCounter + RAII guard + timeout-based polling). Formatting and clippy clean. 186 unit tests + 35 integration tests pass (1 known flaky logging test due to global state).