Nobody is told when the console serves without Temporal, its identity provider or its session store #253

New Issue

2026-10-24T05:00:56Z

cgalo5758 commented

2026-10-24 05:00:56 +00:00

What a person cannot do today

Tell that the console is running without one of the services it depends on. With #141, the console keeps serving when Temporal (the workflow engine that processes payment events, ends grants on time and runs the background sweeps), the identity provider or the session store is unreachable, and it keeps retrying in the background. The only sign is the log: Temporal's retry line turns from Warn to Error after temporal-connect-timeout, and the identity provider's after ninety seconds. On the pages an operator meets the effects one at a time: an end date on a grant is refused, the Stripe page answers "Temporal is unavailable.", a wiki site action says it is not available. Nothing names the cause, and an uptime monitor sees a console that answers.

What they should be able to do

Operators read, in the overview's attention section (#78), which of these services is not connected and since when. The line is marked critical and sits above the other attention items, and it disappears once the service is connected again. A connection lost after start counts too, not only the wait at start.
Whoever hosts the console points an uptime monitor at a health address that answers 200 when every service the console uses is connected, and 503 naming each one that is not. It is an alerting check: an orchestrator that restarted the console on it would bring back the restart loop that serving without these services avoids, so the deployment docs say not to use it as a liveness check.

The severity of these lines is a first case for #168's notifications: a fault that stops start (invalid configuration, the database, a session store that refuses the console's credentials) needs no notice because the console is not running; a service the console serves without but whose features stop, Temporal above all, is critical; other attention items follow.

Why it matters

Temporal carries the console's core work: payments are processed, grants end and wiki sites are provisioned through it. The console serves without it so that sign-in, the pages and the certificate check for every wiki site keep working, but serving without it must not look like serving normally.

Where

The operator overview and its attention section; a new health route in internal/server; the connection state the background loops already hold (identity provider discovery in internal/auth, the Temporal connector in cmd, the session store probe).

Done when

With Temporal stopped, the operator overview shows a critical line naming Temporal and since when the console has been without it, and the line disappears after Temporal connects. The same holds for the identity provider and the session store, and for a connection lost after start.
The health address answers 503 naming each service that is not connected, and 200 when all are; the deployment docs describe it as an alerting check, not a liveness check.

## What a person cannot do today Tell that the console is running without one of the services it depends on. With #141, the console keeps serving when Temporal (the workflow engine that processes payment events, ends grants on time and runs the background sweeps), the identity provider or the session store is unreachable, and it keeps retrying in the background. The only sign is the log: Temporal's retry line turns from Warn to Error after `temporal-connect-timeout`, and the identity provider's after ninety seconds. On the pages an operator meets the effects one at a time: an end date on a grant is refused, the Stripe page answers "Temporal is unavailable.", a wiki site action says it is not available. Nothing names the cause, and an uptime monitor sees a console that answers. ## What they should be able to do - **Operators** read, in the overview's attention section (#78), which of these services is not connected and since when. The line is marked critical and sits above the other attention items, and it disappears once the service is connected again. A connection lost after start counts too, not only the wait at start. - **Whoever hosts the console** points an uptime monitor at a health address that answers 200 when every service the console uses is connected, and 503 naming each one that is not. It is an alerting check: an orchestrator that restarted the console on it would bring back the restart loop that serving without these services avoids, so the deployment docs say not to use it as a liveness check. The severity of these lines is a first case for #168's notifications: a fault that stops start (invalid configuration, the database, a session store that refuses the console's credentials) needs no notice because the console is not running; a service the console serves without but whose features stop, Temporal above all, is critical; other attention items follow. ## Why it matters Temporal carries the console's core work: payments are processed, grants end and wiki sites are provisioned through it. The console serves without it so that sign-in, the pages and the certificate check for every wiki site keep working, but serving without it must not look like serving normally. ## Where The operator overview and its attention section; a new health route in `internal/server`; the connection state the background loops already hold (identity provider discovery in `internal/auth`, the Temporal connector in `cmd`, the session store probe). ## Done when - With Temporal stopped, the operator overview shows a critical line naming Temporal and since when the console has been without it, and the line disappears after Temporal connects. The same holds for the identity provider and the session store, and for a connection lost after start. - The health address answers 503 naming each service that is not connected, and 200 when all are; the deployment docs describe it as an alerting check, not a liveness check.

cgalo5758 added the

kind

enhancement

area/operator-ui area/ops labels 2026-10-24 05:00:56 +00:00

cgalo5758 referenced this issue

2026-10-24 06:17:50 +00:00

The console serves nothing, not even the certificate ask, until Temporal and the identity provider are reachable #141

Sign in to join this conversation.