Found by the e2e harness (postguard-e2e) as a CI cold-start race; it is a real startup-ordering fragility.
Behavior. The PKG fetches the IRMA server's JWT verification key from {IRMA_SERVER}/publickey once, during worker startup (pg-pkg/src/middleware/auth.rs, AuthType::Jwt init). If the IRMA server is not reachable at that moment, every worker fails and the process exits:
ERROR pg_pkg::middleware::auth] Failed to retrieve JWT public key from http://irma-server:8088/publickey: error sending request
ERROR actix_http::service] Initialization of HTTP service error: ()
ERROR actix_server::worker] can not start worker: ()
Error: IO error: can not start server service 0
Impact. Hard restart-order dependency between PKG and IRMA server. Any deploy/restart where the IRMA server comes up a few seconds later (or is briefly unavailable) kills the PKG instead of degrading. In the e2e stack this needed an explicit readiness gate (postguard-e2e stack/docker-compose.yml, irma-ready).
Suggestion. Retry with backoff at startup, or fetch the key lazily on first JWT validation and cache it. Related: #234 (the cached key is also never refreshed).
Found by the e2e harness (
postguard-e2e) as a CI cold-start race; it is a real startup-ordering fragility.Behavior. The PKG fetches the IRMA server's JWT verification key from
{IRMA_SERVER}/publickeyonce, during worker startup (pg-pkg/src/middleware/auth.rs,AuthType::Jwtinit). If the IRMA server is not reachable at that moment, every worker fails and the process exits:Impact. Hard restart-order dependency between PKG and IRMA server. Any deploy/restart where the IRMA server comes up a few seconds later (or is briefly unavailable) kills the PKG instead of degrading. In the e2e stack this needed an explicit readiness gate (
postguard-e2estack/docker-compose.yml,irma-ready).Suggestion. Retry with backoff at startup, or fetch the key lazily on first JWT validation and cache it. Related: #234 (the cached key is also never refreshed).