08d4579a

By: Michael Lynch <git@mtlynch.io>

Expose privacy-safe readiness and structured operations

The service previously emitted positional request logs with no duration or lifecycle context and used /login as its health check. Operators could not distinguish startup, active media processing, draining, or a stuck request, while logging concrete paths risked exposing media identifiers or login-token query data.

Litestream v0.5.14 in files log.go, internal/log.go, store.go, and db.go uses slog child loggers, stable attributes, explicit diagnostic state, and health signals tied to meaningful lifecycle progress. Adapt that principle proportionally: this small service needs process-local state and structured events, not Litestream's full Prometheus and database-phase machinery.

Add JSON slog events for startup, requests, media processing, and shutdown; track ready, draining, and active-request state in one runtime object; and expose a public empty /readyz response that changes from 503 to 200 only after startup and back to 503 before draining. Fly now checks that route. Request recording preserves the first HTTP status, counts bytes from Write and ReadFrom, exposes the wrapped writer through Unwrap, and reports duration without logging URLs, query strings, users, filenames, media IDs, storage locations, or raw processor errors.

The difficult part was preserving net/http semantics and privacy simultaneously. A response wrapper can otherwise overwrite the recorded status after duplicate WriteHeader calls or hide optimized file-transfer behavior. Readiness also had to transition before http.Server.Shutdown without changing the existing successful shutdown path, because the Litestream parent still needs the application to exit normally and leave time for its final sync. The state remains intentionally process-local and does not claim dependency or backup freshness.

No external blockers were encountered. Focused handler tests, the full Go checks, and every flake target passed before the amendment.

Timeline