Fix boot-time bringup aborting on slow crowdsec start #169

Open

mysticalsoap wants to merge 1 commit from fix/boot-crowdsec-health into trunk

mysticalsoap commented

2026-08-25 16:49:06 -04:00

Owner

Problem: On today's cold boot, docker-compose-boot.service failed: crowdsec's entrypoint runs a hub update plus ~20 data-file downloads before the LAPI starts listening, which blew its health budget (30s start_period + 5×10s retries ≈ 73s). Compose --wait declared it unhealthy, traefik's depends_on aborted, and just up exited 1 — traefik and every later stack never started until a manual re-run.

Fix: Raise crowdsec's healthcheck start_period to 300s (a success during start_period still flips it healthy immediately, so fast starts cost nothing), and let the boot unit retry with Restart=on-failure / RestartSec=60 (capped at 3 tries per 30min). RemainAfterExit=yes dropped — systemd refuses it in combination with Restart=.

Verification: just up infra recreated crowdsec with the new healthcheck (start_period=5m0s confirmed via inspect); crowdsec and traefik both healthy, traefik not restarted. Unit change takes effect at next boot; sudo systemctl daemon-reload still pending on the host.

🤖 Generated with Claude Code

**Problem:** On today's cold boot, `docker-compose-boot.service` failed: crowdsec's entrypoint runs a hub update plus ~20 data-file downloads before the LAPI starts listening, which blew its health budget (30s start_period + 5×10s retries ≈ 73s). Compose `--wait` declared it unhealthy, traefik's `depends_on` aborted, and `just up` exited 1 — traefik and every later stack never started until a manual re-run. **Fix:** Raise crowdsec's healthcheck `start_period` to 300s (a success during start_period still flips it healthy immediately, so fast starts cost nothing), and let the boot unit retry with `Restart=on-failure` / `RestartSec=60` (capped at 3 tries per 30min). `RemainAfterExit=yes` dropped — systemd refuses it in combination with `Restart=`. **Verification:** `just up infra` recreated crowdsec with the new healthcheck (`start_period=5m0s` confirmed via inspect); crowdsec and traefik both healthy, traefik not restarted. Unit change takes effect at next boot; `sudo systemctl daemon-reload` still pending on the host. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

mysticalsoap added 1 commit

2026-08-25 16:49:06 -04:00

Fix boot-time bringup aborting on slow crowdsec start 69185deca8

On cold boot crowdsec's entrypoint runs a hub update plus ~20 data-file
downloads before the LAPI listens, which blew the old 30s+5x10s health
budget; compose --wait then declared it unhealthy and traefik's
depends_on aborted the entire boot-time `just up` (2026-08-25, ~1min
manual recovery). Give the healthcheck a 300s start_period and let
docker-compose-boot.service retry on failure (RemainAfterExit dropped —
systemd refuses it alongside Restart=).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

This pull request can be merged automatically.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin fix/boot-crowdsec-health:fix/boot-crowdsec-health

git switch fix/boot-crowdsec-health

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch trunk

git merge --no-ff fix/boot-crowdsec-health

git switch fix/boot-crowdsec-health

git rebase trunk

git switch trunk

git merge --ff-only fix/boot-crowdsec-health

git switch fix/boot-crowdsec-health

git rebase trunk

git switch trunk

git merge --no-ff fix/boot-crowdsec-health

git switch trunk

git merge --squash fix/boot-crowdsec-health