fix: the web service starts once libpq can be found.

debian-package/src/usr/lib/vpn-router/vpnrouter_auth.py

@@ -5,9 +5,7 @@ router and that never leaves it. /auth issues an access token naming the user in
 a refresh token valid REFRESH_SECONDS; vpn-router-token issues tokens with the admin claim and
 any lifetime. A token without the admin claim must expire within MAX_LIFETIME seconds.
 
-psycopg is imported by driver() when the database is used, not when the module is loaded, so the
-module loads while libpq cannot be found yet. A driver that cannot be imported and every
-failure of the database raise DatabaseError, the only database exception callers see.
+Every failure of the database raises DatabaseError, the only database exception callers see.
 
 Refresh tokens are random strings kept in PostgreSQL as their SHA-256, in the database of
 web.database, by default the vpn-router database on this host that provision() creates on the
@@ -24,6 +22,8 @@ import secrets
 import subprocess
 import time
 
+import psycopg
+
 WEB_KEY = pathlib.Path('/etc/vpn-router/web.key')
 DATABASE_SECRET = pathlib.Path('/etc/vpn-router/database.secret')
 
@@ -44,7 +44,7 @@ SCHEMA = 'CREATE TABLE IF NOT EXISTS refresh_tokens (hash text PRIMARY KEY, name
 
 
 class DatabaseError(Exception):
-    """The PostgreSQL driver cannot be loaded, or the database of the refresh tokens failed."""
+    """The database of the refresh tokens failed."""
 
 
 def key():
@@ -117,15 +117,6 @@ def admin_token(seconds):
     return {'token': sign({'admin': True, 'iat': now, 'exp': now + seconds}, secret), 'expires': now + seconds}
 
 
-def driver():
-    """The psycopg module; DatabaseError while libpq cannot be found."""
-    try:
-        import psycopg
-    except ImportError as exc:
-        raise DatabaseError(f'the PostgreSQL driver cannot be loaded: {exc}') from exc
-    return psycopg
-
-
 def connection_string(cfg):
     """web.database, or the database provision() creates; its password, of URL-safe characters, is written unquoted."""
     configured = cfg['web']['database'].strip()
@@ -138,7 +129,6 @@ def connection_string(cfg):
 @contextlib.contextmanager
 def database(cfg):
     """A connection to the database of the refresh tokens, with their table, closed at the end; DatabaseError on any failure."""
-    psycopg = driver()
     try:
         with psycopg.connect(connection_string(cfg), autocommit=True) as connection:
             connection.execute(SCHEMA)

debian-package/src/usr/lib/vpn-router/wait-for-libpq

@@ -0,0 +1,12 @@
+#!/bin/sh
+# Wait until libpq is in the dynamic linker cache, where psycopg looks it up.
+# ExecStartPre= of vpn-router-web.service; TimeoutStartSec= of the unit bounds the wait.
+
+reported=
+until ldconfig -p | grep -q '^[[:space:]]*libpq\.so\.5 '; do
+    if [ -z "$reported" ]; then
+        echo 'waiting for libpq.so.5 in the linker cache'
+        reported=yes
+    fi
+    sleep 2
+done

debian-package/src/usr/lib/vpn-router/web

@@ -30,11 +30,10 @@ default the address the service listens on, is the last entry of its X-Forwarded
 Docker is installed, and the state of site-to-site, road-warrior (IPsec P2S), OpenVPN and
 WireGuard. No configuration data, key or address is shown.
 
-The service first initializes, without listening: it loads the PostgreSQL driver
-(vpnrouter_auth.driver; psycopg finds libpq through the linker cache, which the package manager
-refreshes only at the end of an installation), then it makes the signing key and the refresh
+The service first initializes, without listening: it makes the signing key and the refresh
 tokens' database (vpnrouter_auth), retrying every INIT_RETRY_SECONDS until both are ready and
-logging each failure. Then it listens.
+logging each failure. Then it listens. Its unit starts it only once wait-for-libpq has found libpq
+in the linker cache, where psycopg looks it up.
 
 The service needs nothing else to start and does not end on its own. Every DISCOVERY_SECONDS it
 works out the internal address from /etc/vpn-router/vpn-router.json as general.mode directs,
@@ -697,13 +696,11 @@ def log(message):
 
 
 def initialize():
-    """Load the PostgreSQL driver, make the signing key and the refresh tokens' database, retrying every INIT_RETRY_SECONDS until all are ready."""
+    """Make the signing key and the refresh tokens' database, retrying every INIT_RETRY_SECONDS until both are ready."""
     reported = None
     while True:
-        phase = 'loading the PostgreSQL driver'
+        phase = 'reading the configuration'
         try:
-            vpnrouter_auth.driver()
-            phase = 'reading the configuration'
             cfg = vpnrouter.load_config()
             phase = 'making the signing key'
             vpnrouter_auth.ensure_key()