feat(cmd): wire config, discovery, queue, http server, metrics

cmd/server/main.go

@@ -1,7 +1,130 @@
 package main
 
-import "fmt"
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	"github.com/docker/docker/client"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/shcizo/package-updater/internal/api"
+	"github.com/shcizo/package-updater/internal/config"
+	"github.com/shcizo/package-updater/internal/discovery"
+	"github.com/shcizo/package-updater/internal/logging"
+	"github.com/shcizo/package-updater/internal/metrics"
+	"github.com/shcizo/package-updater/internal/updater"
+)
+
+// Build info is injected at link time via -ldflags="-X main.version=..."
+var (
+	version   = "dev"
+	commit    = "unknown"
+	buildTime = "unknown"
+)
 
 func main() {
-	fmt.Println("package-updater (scaffold)")
+	if err := run(); err != nil {
+		fmt.Fprintln(os.Stderr, "fatal:", err)
+		os.Exit(1)
+	}
+}
+
+func run() error {
+	cfg, err := config.Load()
+	if err != nil {
+		return err
+	}
+
+	logger := logging.New(cfg.LogLevel)
+	logger.Info("starting",
+		"version", version, "commit", commit, "port", cfg.Port,
+		"stacks_root", cfg.StacksRoot, "opt_in_label", cfg.OptInLabel,
+	)
+
+	dockerCli, err := client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation())
+	if err != nil {
+		return fmt.Errorf("docker client: %w", err)
+	}
+	defer dockerCli.Close()
+
+	disc := discovery.New(dockerCli, cfg.StacksRoot, cfg.OptInLabel)
+	exec := updater.NewComposeExecutor()
+	queue := updater.NewQueue(exec)
+	queue.Start(context.Background())
+	defer queue.Stop()
+
+	reg := prometheus.NewRegistry()
+	m := metrics.New(reg)
+	m.BuildInfo.WithLabelValues(version, commit).Set(1)
+
+	handlers := api.NewHandlers(disc, &submitterAdapter{queue: queue, timeout: cfg.UpdateTimeout}, dockerCli, version, commit, buildTime)
+
+	mux := http.NewServeMux()
+	mux.HandleFunc("POST /update", handlers.Update)
+	mux.HandleFunc("GET /healthz", handlers.Healthz)
+	mux.HandleFunc("GET /version", handlers.Version)
+	mux.Handle("GET /metrics", metrics.Handler(reg))
+
+	authed := api.Auth(cfg.APIKey)
+	handler := api.RequestID(api.RequestLogger(logger)(routeAuth(mux, authed)))
+
+	srv := &http.Server{
+		Addr:              ":" + cfg.Port,
+		Handler:           handler,
+		ReadHeaderTimeout: 10 * time.Second,
+	}
+
+	errCh := make(chan error, 1)
+	go func() {
+		logger.Info("listening", "addr", srv.Addr)
+		errCh <- srv.ListenAndServe()
+	}()
+
+	sig := make(chan os.Signal, 1)
+	signal.Notify(sig, syscall.SIGINT, syscall.SIGTERM)
+
+	select {
+	case s := <-sig:
+		logger.Info("shutdown_signal", "signal", s.String())
+	case err := <-errCh:
+		if err != nil && err != http.ErrServerClosed {
+			return err
+		}
+	}
+
+	shutdownCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	_ = srv.Shutdown(shutdownCtx)
+	return nil
+}
+
+// routeAuth applies the bearer-token middleware to /update only.
+// /healthz, /metrics, /version are unauthenticated by design (internal
+// network only; healthcheck and Prometheus scraper need to reach them
+// without secrets).
+func routeAuth(next *http.ServeMux, mw func(http.Handler) http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/update" {
+			mw(next).ServeHTTP(w, r)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+// submitterAdapter wraps Queue.Submit to inject the per-request timeout
+// from config, satisfying the api.Submitter interface.
+type submitterAdapter struct {
+	queue   *updater.Queue
+	timeout time.Duration
+}
+
+func (s *submitterAdapter) Submit(ctx context.Context, jobs []discovery.Job) []updater.Result {
+	ctx, cancel := context.WithTimeout(ctx, s.timeout)
+	defer cancel()
+	return s.queue.Submit(ctx, jobs)
 }