modules/python-http-handlers: better daemon handling

This commit extends the python http handler template with the following
things:

- Integration with systemd notify
- Named systemd sockets, to avoid depending on expected FD number
- Graceful and customizable handling of SIGHUP reloads
- Graceful shutdown on SIGTERM with timeout
- Multithreaded HTTP server, one thread per request
- Better error message on undefined handler

base/services/irqbalance.nix

@@ -1,22 +1,4 @@
-{ config, pkgs, lib, ... }:
-let
-  cfg = config.services.irqbalance;
-in
+{ ... }:
 {
   services.irqbalance.enable = true;
-
-  # irqbalance only has meaningful work to do on multi-socket machines, so
-  # skip starting it pointlessly everywhere else.
-  systemd.services.irqbalance.serviceConfig.ExecCondition = let
-    isMultiSocket = pkgs.writeShellApplication {
-      name = "irqbalance-is-multi-socket";
-      runtimeInputs = [ pkgs.coreutils ];
-      text = ''
-        sockets=$(cat /sys/devices/system/cpu/cpu*/topology/physical_package_id | sort -u | wc -l)
-        [ "$sockets" -gt 1 ]
-      '';
-    };
-  in lib.mkIf cfg.enable [
-    (lib.getExe isMultiSocket)
-  ];
-}
+}

hosts/bekkalokk/services/idp-simplesamlphp/default.nix

@@ -177,11 +177,6 @@ in
       };
     };
 
-    systemd.services."phpfpm-idp" = {
-      after = [ "sops-install-secrets.service" ];
-      requires = [ "sops-install-secrets.service" ];
-    };
-
     services.nginx.virtualHosts."idp.pvv.ntnu.no" = {
       forceSSL = true;
       enableACME = true;

hosts/bekkalokk/services/mediawiki/default.nix

@@ -287,7 +287,6 @@ in {
 
   systemd.services.mediawiki-init = lib.mkIf cfg.enable {
     after = [ "sops-install-secrets.service" ];
-    requires = [ "sops-install-secrets.service" ];
     serviceConfig = {
       UMask = lib.mkForce "0007";
     };
@@ -295,7 +294,6 @@ in {
 
   systemd.services.phpfpm-mediawiki = lib.mkIf cfg.enable {
     after = [ "sops-install-secrets.service" ];
-    requires = [ "sops-install-secrets.service" ];
     serviceConfig = {
       UMask = lib.mkForce "0007";
     };

hosts/bekkalokk/services/vaultwarden.nix

@@ -61,11 +61,6 @@ in {
     };
   };
 
-  systemd.services.vaultwarden = {
-    after = [ "sops-install-secrets.service" ];
-    requires = [ "sops-install-secrets.service" ];
-  };
-
   services.nginx.virtualHosts."${domain}" = {
     forceSSL = true;
     enableACME = true;

hosts/bekkalokk/services/webmail/roundcube.nix

@@ -49,11 +49,6 @@ in
     '';
   };
 
-  systemd.services."phpfpm-roundcube" = {
-    after = [ "sops-install-secrets.service" ];
-    requires = [ "sops-install-secrets.service" ];
-  };
-
   # TODO: move this back to `webmail.pvv.ntnu.no/roundcube` subpath
 
   services.nginx.virtualHosts.${domain} = {

hosts/bekkalokk/services/website/default.nix

@@ -116,11 +116,6 @@ in {
     ];
   };
 
-  systemd.services."phpfpm-pvv-nettsiden" = {
-    after = [ "sops-install-secrets.service" ];
-    requires = [ "sops-install-secrets.service" ];
-  };
-
   services.nginx.virtualHosts."pvv.ntnu.no" = {
     globalRedirect = cfg.domainName;
     redirectCode = 307;

hosts/bicep/services/calendar-bot.nix

@@ -35,9 +35,4 @@ in {
       onCalendar = "*-*-* 09:00:00";
     };
   };
-
-  systemd.services.pvv-calendar-bot = {
-    after = [ "sops-install-secrets.service" ];
-    requires = [ "sops-install-secrets.service" ];
-  };
 }

hosts/bicep/services/git-mirrors/default.nix

@@ -20,8 +20,6 @@ in
       lfs = false;
     };
 
-    # TODO: add a module setting to specify additional systemd dependencies
-    #       and then mark "sops-install-secrets.service" as a dependency here
     instances = let
       defaultGithubConfig = {
         settings.token_file = config.sops.secrets."gickup/github-token".path;

hosts/bicep/services/matrix/coturn.nix

@@ -55,11 +55,6 @@
   # It needs this to be allowed to access the files with the acme group
   systemd.services.coturn.serviceConfig.PrivateUsers = lib.mkForce false;
 
-  systemd.services.coturn = {
-    requires = [ "sops-install-secrets.service" ];
-    after = [ "sops-install-secrets.service" ];
-  };
-
   systemd.services."acme-${config.services.coturn.realm}".serviceConfig = {
     AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
   };

hosts/bicep/services/matrix/discord.nix

@@ -39,8 +39,6 @@ in
   };
 
   systemd.services.mx-puppet-discord = {
-    after = [ "sops-install-secrets.service" ];
-    requires = [ "sops-install-secrets.service" ];
     serviceConfig.SupplementaryGroups = [
       config.users.groups.keys-matrix-registrations.name
     ];

hosts/bicep/services/matrix/hookshot/default.nix

@@ -183,7 +183,6 @@ in
   };
 
   services.matrix-hookshot.serviceDependencies = [
-    "sops-install-secrets.service"
     "matrix-synapse.target"
     "nginx.service"
   ];

hosts/bicep/services/matrix/livekit.nix

@@ -43,12 +43,7 @@ in
     keyFile = config.sops.templates."matrix-livekit-keyfile".path;
   };
 
-  systemd.services.lk-jwt-service = lib.mkIf cfg.enable {
-    after = [ "sops-install-secrets.service" ];
-    requires = [ "sops-install-secrets.service" ];
-
-    environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = builtins.concatStringsSep "," [ "pvv.ntnu.no" "dodsorf.as" ];
-  };
+  systemd.services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = lib.mkIf cfg.enable (builtins.concatStringsSep "," [ "pvv.ntnu.no" "dodsorf.as" ]);
 
   services.nginx.virtualHosts.${matrixDomain} = lib.mkIf cfg.enable {
     locations."^~ /livekit/jwt/" = {

hosts/bicep/services/matrix/mjolnir.nix

@@ -55,57 +55,52 @@
     pantalaimon.username = "bot_admin";
   };
 
-  systemd.services.mjolnir = {
-    requires = [ "sops-install-secrets.service" ];
-    after = [ "sops-install-secrets.service" ];
+  systemd.services.mjolnir.serviceConfig = {
+    DynamicUser = true;
+    RuntimeDirectory = [ "mjolnir/root-mnt" ];
+    RootDirectory = "/run/mjolnir/root-mnt";
+    BindReadOnlyPaths = [
+      config.sops.secrets."matrix/mjolnir/access_token".path
+      builtins.storeDir
+      "/etc"
+      "/run/nscd"
+      "/var/run/nscd"
+    ];
 
-    serviceConfig = {
-      DynamicUser = true;
-      RuntimeDirectory = [ "mjolnir/root-mnt" ];
-      RootDirectory = "/run/mjolnir/root-mnt";
-      BindReadOnlyPaths = [
-        config.sops.secrets."matrix/mjolnir/access_token".path
-        builtins.storeDir
-        "/etc"
-        "/run/nscd"
-        "/var/run/nscd"
-      ];
-
-      AmbientCapabilities = "";
-      CapabilityBoundingSet = "";
-      LockPersonality = true;
-      MemoryDenyWriteExecute = false; # node needs this
-      NoNewPrivileges = true;
-      PrivateDevices = true;
-      PrivateMounts = true;
-      PrivateTmp = true;
-      PrivateUsers = true;
-      ProcSubset = "pid";
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHome = true;
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      ProtectSystem = "strict";
-      RemoveIPC = true;
-      RestrictAddressFamilies = [
-        "AF_INET"
-        "AF_INET6"
-        "AF_UNIX"
-      ];
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "@system-service"
-        "~@privileged"
-        "~@resources"
-      ];
-      UMask = "0077";
-    };
+    AmbientCapabilities = "";
+    CapabilityBoundingSet = "";
+    LockPersonality = true;
+    MemoryDenyWriteExecute = false; # node needs this
+    NoNewPrivileges = true;
+    PrivateDevices = true;
+    PrivateMounts = true;
+    PrivateTmp = true;
+    PrivateUsers = true;
+    ProcSubset = "pid";
+    ProtectClock = true;
+    ProtectControlGroups = true;
+    ProtectHome = true;
+    ProtectHostname = true;
+    ProtectKernelLogs = true;
+    ProtectKernelModules = true;
+    ProtectKernelTunables = true;
+    ProtectProc = "invisible";
+    ProtectSystem = "strict";
+    RemoveIPC = true;
+    RestrictAddressFamilies = [
+      "AF_INET"
+      "AF_INET6"
+      "AF_UNIX"
+    ];
+    RestrictNamespaces = true;
+    RestrictRealtime = true;
+    RestrictSUIDSGID = true;
+    SystemCallArchitectures = "native";
+    SystemCallFilter = [
+      "@system-service"
+      "~@privileged"
+      "~@resources"
+    ];
+    UMask = "0077";
   };
 }

hosts/bicep/services/matrix/out-of-your-element.nix

@@ -56,15 +56,7 @@ in
     enableSynapseIntegration = false;
   };
 
-  systemd.services."matrix-ooye-pre-start" = {
-    after = [ "sops-install-secrets.service" ];
-    requires = [ "sops-install-secrets.service" ];
-  };
-
   systemd.services."matrix-ooye" = {
-    after = [ "sops-install-secrets.service" ];
-    requires = [ "sops-install-secrets.service" ];
-
     serviceConfig = {
       RuntimeDirectory = [ "matrix-ooye/root-mnt" ];
       RootDirectory = "/run/matrix-ooye/root-mnt";

hosts/bicep/services/matrix/synapse.nix

@@ -44,11 +44,6 @@ in {
     };
   };
 
-  systemd.targets."matrix-synapse" = {
-    after = [ "sops-install-secrets.service" ];
-    requires = [ "sops-install-secrets.service" ];
-  };
-
   services.matrix-synapse-next = {
     enable = true;
 
@@ -79,7 +74,7 @@ in {
         name = "psycopg2";
         args = {
           host = "/var/run/postgresql";
-          dbname = "synapse";
+          database = "synapse";
           user = "matrix-synapse";
           cp_min = 1;
           cp_max = 5;

hosts/bicep/services/minecraft-heatmap.nix

@@ -23,15 +23,6 @@ in
   };
 
   systemd.services.minecraft-heatmap-ingest-logs = lib.mkIf cfg.enable {
-    after = [
-      "sops-install-secrets.service"
-      "network-online.target"
-    ];
-    requires = [
-      "sops-install-secrets.service"
-      "network-online.target"
-    ];
-
     serviceConfig = {
       LoadCredential = [
         "sshkey:${config.sops.secrets."minecraft-heatmap/ssh-key/private".path}"

hosts/bicep/services/mysql/default.nix

@@ -56,13 +56,9 @@ in
 
   systemd.services.mysql = lib.mkIf cfg.enable {
     after = [
-      "sops-install-secrets.service"
       "systemd-tmpfiles-setup.service"
       "systemd-tmpfiles-resetup.service"
     ];
-    requires = [
-      "sops-install-secrets.service"
-    ];
 
     serviceConfig = {
       BindPaths = [ "${dataDir}:${cfg.dataDir}" ];

hosts/bicep/services/postgresql/default.nix

@@ -14,7 +14,6 @@ in
     extensions = ps: with ps; [ pg_repack ];
     enableTCPIP = true;
 
-    # NOTE: md5 accepts both md5 and scram-sha-256
     authentication = ''
       host all all ${values.ipv4-space} md5
       host all all ${values.ipv6-space} md5
@@ -77,15 +76,6 @@ in
       maintenance_io_concurrency = 100;
       wal_recycle = true;
 
-      # -------------------------------- #
-
-      # Authentication
-      password_encryption = "scram-sha-256";
-
-      # Logging
-      log_connections = "authorization";
-      log_disconnections = true;
-
       # SSL
       ssl = true;
       ssl_cert_file = "/run/credentials/postgresql.service/cert";

hosts/gluttony/services/bluemap.nix

@@ -82,15 +82,6 @@ in {
   };
 
   systemd.services."render-bluemap-maps" = {
-    after = [
-      "sops-install-secrets.service"
-      "network-online.target"
-    ];
-    requires = [
-      "sops-install-secrets.service"
-      "network-online.target"
-    ];
-
     serviceConfig = {
       StateDirectory = [ "bluemap/world" ];
       ExecStartPre = let

hosts/ildkule/services/monitoring/grafana.nix

@@ -79,11 +79,6 @@ in {
     };
   };
 
-  systemd.services.grafana = {
-    after = [ "sops-install-secrets.service" ];
-    requires = [ "sops-install-secrets.service" ];
-  };
-
   services.nginx.virtualHosts.${cfg.settings.server.domain} = {
     enableACME = true;
     forceSSL = true;

hosts/ildkule/services/monitoring/prometheus/postgres.nix

@@ -37,15 +37,9 @@ in {
     };
   };
 
-  systemd.services.prometheus-postgres-exporter-knakelibrak = {
-    after = [ "sops-install-secrets.service" ];
-    requires = [ "sops-install-secrets.service" ];
-
-    # TODO: is it really necessary to use recursiveUpdate on the entire attrset here?
-    #       Why don't we just update the relevant attrs directly?
-    serviceConfig = let
-      localCfg = config.services.prometheus.exporters.postgres;
-    in lib.recursiveUpdate config.systemd.services.prometheus-postgres-exporter.serviceConfig {
+  systemd.services.prometheus-postgres-exporter-knakelibrak.serviceConfig = let
+    localCfg = config.services.prometheus.exporters.postgres;
+  in lib.recursiveUpdate config.systemd.services.prometheus-postgres-exporter.serviceConfig {
       EnvironmentFile = config.sops.secrets."keys/postgres/postgres_exporter_knakelibrak_env".path;
       ExecStart = ''
         ${pkgs.prometheus-postgres-exporter}/bin/postgres_exporter \
@@ -54,5 +48,4 @@ in {
           ${lib.concatStringsSep " \\\n  " localCfg.extraFlags}
       '';
     };
-  };
 }

hosts/kommode/services/gitea/default.nix

@@ -154,14 +154,8 @@ in {
   environment.systemPackages = [ cfg.package ];
 
   systemd.services.gitea = lib.mkIf cfg.enable {
-    after = [
-      "sops-install-secrets.service"
-      "redis-gitea.service"
-    ];
-    requires = [
-      "sops-install-secrets.service"
-      "redis-gitea.service"
-    ];
+    wants = [ "redis-gitea.service" ];
+    after = [ "redis-gitea.service" ];
 
     serviceConfig = {
       CPUSchedulingPolicy = "batch";
@@ -222,9 +216,6 @@ in {
   };
 
   systemd.services.gitea-dump = {
-    after = [ "sops-install-secrets.service" ];
-    requires = [ "sops-install-secrets.service" ];
-
     serviceConfig.ExecStart = let
       args = lib.cli.toCommandLineShellGNU { } {
         type = cfg.dump.type;

hosts/kommode/services/gitea/gpg.nix

@@ -32,11 +32,7 @@ in
 
   systemd.services.gitea-ensure-gnupg-homedir = {
     description = "Import gpg key for gitea";
-
     before = [ "gitea.service" ];
-    after = [ "sops-install-secrets.service" ];
-    requires = [ "sops-install-secrets.service" ];
-
     environment = { inherit GNUPGHOME; };
     serviceConfig = {
       Type = "oneshot";

hosts/kommode/services/gitea/import-users/default.nix

@@ -12,16 +12,6 @@ in
   systemd.services.gitea-import-users = lib.mkIf cfg.enable {
     enable = true;
     environment.PASSWD_FILE_PATH = "/run/gitea-import-users/passwd";
-    after = [
-      "sops-install-secrets.service"
-      "gitea.service"
-      "network-online.target"
-    ];
-    requires = [
-      "sops-install-secrets.service"
-      "gitea.service"
-      "network-online.target"
-    ];
     serviceConfig = {
       ExecStartPre = ''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /run/gitea-import-users/passwd'';
       ExecStart = pkgs.writers.writePython3 "gitea-import-users" {

hosts/kommode/services/gitea/web-secret-provider/default.nix

@@ -48,16 +48,7 @@ in
   # %d - secrets directory
   systemd.services."gitea-web-secret-provider@" = {
     description = "Ensure all repos in %i has an SSH key to push web content";
-    after = [
-      "sops-install-secrets.service"
-      "gitea.service"
-      "network-online.target"
-    ];
-    requires = [
-      "sops-install-secrets.service"
-      "gitea.service"
-      "network-online.target"
-    ];
+    requires = [ "gitea.service" "network.target" ];
     serviceConfig = {
       Slice = "system-giteaweb.slice";
       Type = "oneshot";

hosts/lupine/services/openvpn.nix

@@ -94,11 +94,6 @@ in
     };
   };
 
-  systemd.services."openvpn-ov-firewall" = {
-    after = [ "sops-install-secrets.service" ];
-    requires = [ "sops-install-secrets.service" ];
-  };
-
   networking.firewall = {
     allowedTCPPorts = [ 1194 ];
     allowedUDPPorts = [ 1194 ];

hosts/skrot/services/drumknotty.nix

@@ -53,10 +53,5 @@
     };
   };
 
-  systemd.services.drumknotty-screen-session = {
-    after = [ "sops-install-secrets.service" ];
-    requires = [ "sops-install-secrets.service" ];
-  };
-
   services.roowho2.settings.rwhod.ignoreUsers = [ "drumknotty" ];
 }

hosts/temmie/services/userweb/passwd-sync.nix

@@ -29,15 +29,9 @@ in
     systemd.services."httpd-passwd-sync" = {
       requiredBy = [ "userweb.target" ];
       after = [
-        "network-online.target"
-        "sops-install-secrets.service"
         "systemd-tmpfiles-setup.service"
         "systemd-tmpfiles-resetup.service"
       ];
-      requires = [
-        "network-online.target"
-        "sops-install-secrets.service"
-      ];
       serviceConfig = {
         Type = "oneshot";
         Slice = "system-userweb.slice";

modules/matrix-ooye.nix

@@ -159,6 +159,7 @@ in
         description = "Out of Your Element - a Discord bridge for Matrix.";
 
         wants = [
+          "network-online.target"
           "matrix-synapse.service"
           "conduit.service"
           "dendrite.service"
@@ -167,10 +168,7 @@ in
           "matrix-ooye-pre-start.service"
           "network-online.target"
         ];
-        requires = [
-          "network-online.target"
-          "matrix-ooye-pre-start.service"
-        ];
+        requires = [ "matrix-ooye-pre-start.service" ];
         wantedBy = [ "multi-user.target" ];
 
         startLimitIntervalSec = 5;

modules/python-http-handlers.nix

@@ -36,6 +36,9 @@ in
           description = ''
             For each item in this list, a `ListenStream`
             option in the `[Socket]` section will be created.
+
+            Only a single `ListenStream` is currently supported by the handler script; if
+            you need more than one, you'll have to adjust {option}`handler` accordingly.
           '';
         };
 
@@ -98,8 +101,10 @@ in
             "E303" # too many blank lines
             "E305" # expected 2 blank lines after end of function or class
             "E306" # expected 1 blank line before a nested definition
+            "E402" # module level import not at top of file
             "E501" # max line length
             "E704" # multiple statements on one line (def)
+            "F811" # redefined while unused
           ];
           description = ''
             A list of flake8 rules to ignore while linting the python code.
@@ -122,6 +127,11 @@ in
                     self.send_header("Content-Length", str(len(data)))
                     self.end_headers()
                     self.wfile.write(data)
+
+            def on_reload():
+                # This function is called when the service receives SIGHUP (e.g. via `systemctl reload`).
+                # You can use it to clear caches or re-read state. Completely optional
+                pass
           '';
           description = ''
             Python code including the HTTP handler for the server.
@@ -145,6 +155,7 @@ in
           inherit (v) listenStreams;
           socketConfig = {
             Accept = false;
+            FileDescriptorName = v.name;
           } // v.socketConfig;
         };
       }))
@@ -157,30 +168,126 @@ in
         inherit (v) name;
         value = {
           serviceConfig = {
-            Type = "simple";
+            Type = "notify-reload";
+            NotifyAccess = "main";
             DynamicUser = true;
+            TimeoutStopSec = "35s";
 
             ExecStart = let
               package = pkgs.writers.writePython3Bin "${v.name}-bin" {
                 inherit (v) libraries flakeIgnore;
               } ''
+                import os
+                import signal
                 import socket
+                import socketserver
+                import threading
+                import time
                 from http.server import HTTPServer, BaseHTTPRequestHandler
 
-                ${v.handler}
+                SOCKET_NAME = "${v.name}"
+                SHUTDOWN_TIMEOUT = 30
+
+                def sd_notify(message: str):
+                    addr = os.environ.get("NOTIFY_SOCKET")
+                    if not addr:
+                        return
+                    if addr[0] == "@":
+                        addr = "\0" + addr[1:]
+                    with socket.socket(socket.AF_UNIX, socket.SOCK_DGRAM | socket.SOCK_CLOEXEC) as sock:
+                        sock.connect(addr)
+                        sock.sendall(message.encode())
+
+                def sd_listen_fd(name: str) -> int:
+                    if os.environ.get("LISTEN_PID") != str(os.getpid()):
+                        raise RuntimeError("No sockets were passed to this service by systemd")
+
+                    try:
+                        count = int(os.environ.get("LISTEN_FDS", "0"))
+                    except ValueError:
+                        count = 0
+
+                    raw_names = os.environ.get("LISTEN_FDNAMES")
+                    names = raw_names.split(":") if raw_names else []
+
+                    for i in range(count):
+                        if i < len(names) and names[i] == name:
+                            return 3 + i
+
+                    raise RuntimeError(
+                        "No systemd socket named %r was passed to this service; check the "
+                        "FileDescriptorName= of the corresponding .socket unit" % name
+                    )
+
+                class Server(socketserver.ThreadingMixIn, HTTPServer):
+                    daemon_threads = True
 
-                class NoBindHTTPServer(HTTPServer):
                     def server_bind(): pass
                     def server_activate(): pass
 
+                    def __init__(self, *args, **kwargs):
+                        super().__init__(*args, **kwargs)
+                        self._request_threads = []
+                        self._request_threads_lock = threading.Lock()
+
+                    def process_request(self, request, client_address):
+                        thread = threading.Thread(
+                            target=self.process_request_thread,
+                            args=(request, client_address),
+                        )
+                        thread.daemon = self.daemon_threads
+                        with self._request_threads_lock:
+                            self._request_threads.append(thread)
+                        thread.start()
+
+                    def join_request_threads(self, timeout):
+                        deadline = time.monotonic() + timeout
+                        with self._request_threads_lock:
+                            threads = list(self._request_threads)
+                        for thread in threads:
+                            thread.join(max(deadline - time.monotonic(), 0))
+
+                def handle_reload(signum, frame):
+                    monotonic_usec = time.clock_gettime_ns(time.CLOCK_MONOTONIC) // 1000
+                    sd_notify("RELOADING=1\nMONOTONIC_USEC=%d" % monotonic_usec)
+
+                    on_reload = globals().get("on_reload")
+                    if callable(on_reload):
+                        on_reload()
+
+                    sd_notify("READY=1")
+
+                shutdown_requested = threading.Event()
+
+                def handle_sigterm(signum, frame):
+                    sd_notify("STOPPING=1")
+                    shutdown_requested.set()
+
+                ${v.handler}
+
+                assert "Handler" in globals(), "You must define a class Handler(BaseHTTPRequestHandler) in the handler code"
+
                 def main():
-                    httpd = NoBindHTTPServer(
-                        ("", 0),
-                        Handler,
-                        bind_and_activate=False,
-                    )
-                    httpd.socket = socket.fromfd(3, socket.AF_INET, socket.SOCK_STREAM)
-                    httpd.serve_forever()
+                    signal.signal(signal.SIGHUP, handle_reload)
+                    signal.signal(signal.SIGTERM, handle_sigterm)
+
+                    fd = sd_listen_fd(SOCKET_NAME)
+
+                    httpd = Server(("", 0), Handler, bind_and_activate=False)
+                    httpd.socket = socket.socket(fileno=fd)
+
+                    server_thread = threading.Thread(target=httpd.serve_forever, name="http-server", daemon=True)
+                    server_thread.start()
+
+                    sd_notify("READY=1")
+                    shutdown_requested.wait()
+
+                    deadline = time.monotonic() + SHUTDOWN_TIMEOUT
+
+                    httpd.shutdown()
+                    server_thread.join(max(deadline - time.monotonic(), 0))
+                    httpd.join_request_threads(max(deadline - time.monotonic(), 0))
+                    httpd.server_close()
 
                 if __name__ == '__main__':
                     main()