feat: file based configuration reloading support, relocate http

This change moves the http listener utility for the *http.Server
out of the api package. In addition we implement http.Handler on
the *api.API object so we may wrap it with the recently committed
*reloader.AtomicHandler. I've also removed the sync.WaitGroup that
previously coordinated shutdown with main.go. A single environment
based configuration is still used at startup, but these changes
set us up to add config reloads in an upcoming commit.

Note:
I added a sync.WaitGroup to serve, this means the maximum shutdown
time is now time.Minute*2. More intrusive options to fix this
exist if the team thinks it's important.

cmd/serve_cmd.go

@@ -3,11 +3,16 @@ package cmd
 import (
 	"context"
 	"net"
+	"net/http"
+	"sync"
+	"time"
 
+	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 	"github.com/supabase/auth/internal/api"
 	"github.com/supabase/auth/internal/conf"
+	"github.com/supabase/auth/internal/reloader"
 	"github.com/supabase/auth/internal/storage"
 	"github.com/supabase/auth/internal/utilities"
 )
@@ -32,10 +37,45 @@ func serve(ctx context.Context) {
 	}
 	defer db.Close()
 
-	api := api.NewAPIWithVersion(config, db, utilities.Version)
-
 	addr := net.JoinHostPort(config.API.Host, config.API.Port)
 	logrus.Infof("GoTrue API started on: %s", addr)
 
-	api.ListenAndServe(ctx, addr)
+	a := api.NewAPIWithVersion(config, db, utilities.Version)
+	hr := reloader.NewAtomicHandler(a)
+
+	baseCtx, baseCancel := context.WithCancel(context.Background())
+	defer baseCancel()
+
+	httpSrv := &http.Server{
+		Addr:              addr,
+		Handler:           hr,
+		ReadHeaderTimeout: 2 * time.Second, // to mitigate a Slowloris attack
+		BaseContext: func(net.Listener) context.Context {
+			return baseCtx
+		},
+	}
+	log := logrus.WithField("component", "api")
+
+	var wg sync.WaitGroup
+	defer wg.Wait() // Do not return to caller until this goroutine is done.
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+
+		<-ctx.Done()
+
+		defer baseCancel() // close baseContext
+
+		shutdownCtx, shutdownCancel := context.WithTimeout(context.Background(), time.Minute)
+		defer shutdownCancel()
+
+		if err := httpSrv.Shutdown(shutdownCtx); err != nil && !errors.Is(err, context.Canceled) {
+			log.WithError(err).Error("shutdown failed")
+		}
+	}()
+
+	if err := httpSrv.ListenAndServe(); err != http.ErrServerClosed {
+		log.WithError(err).Fatal("http server listen failed")
+	}
 }

internal/api/api.go

@@ -357,3 +357,9 @@ func (a *API) Mailer() mailer.Mailer {
 	config := a.config
 	return mailer.NewMailer(config)
 }
+
+// ServeHTTP implements the http.Handler interface by passing the request along
+// to its underlying Handler.
+func (a *API) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	a.handler.ServeHTTP(w, r)
+}

main.go

@@ -9,7 +9,6 @@ import (
 
 	"github.com/sirupsen/logrus"
 	"github.com/supabase/auth/cmd"
-	"github.com/supabase/auth/internal/api"
 	"github.com/supabase/auth/internal/observability"
 )
 
@@ -37,14 +36,6 @@ func main() {
 
 	var wg sync.WaitGroup
 
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-
-		// wait for API servers to shut down gracefully
-		api.WaitForCleanup(shutdownCtx)
-	}()
-
 	wg.Add(1)
 	go func() {
 		defer wg.Done()