Service¶
shyft-integration-met-no is installed in the Shyft installation’s bin
directory. It runs in the foreground until SIGINT or SIGTERM requests
shutdown. It serves the native wire protocol used by met_no.Client; the
default administration listener is loopback.
Two distinct kinds of configuration¶
Application/bootstrap options control the running process: local service DB, listener, scheduling, shared catalog cache/upstream policy, credentials, and logging. They are command-line options with compiled defaults. There is no bootstrap configuration-file parser or environment-variable option layer.
Persistent MET Config versions control acquisition tasks: product,
forecast-reference period, extraction, fc target, source buffer, interpolation,
and optional cc production. Store them through the installed Python client;
select them explicitly with Client.set_active_version(name, mid) as shown
in Configuration. Storing alone does not activate a version.
Credentials and scheduler settings do not belong in met_no.Config.
Minimal startup (with the installed executable on PATH):
mkdir -p "$HOME/.local/state/shyft"
shyft-integration-met-no \
--db-path "$HOME/.local/state/shyft/met-no" \
--listen 127.0.0.1:20080
This can start with no active configurations. It does not create fc/cc
databases. Active versions already in the service DB are restored on startup.
Bootstrap options¶
The following names/defaults match the installed --help and bootstrap parser.
Numeric durations are in the units indicated by their option names.
Option |
Default |
Meaning/constraints |
|---|---|---|
|
Required |
Local service RocksDB directory; created if absent. Use a writable, persistent path, not a DTSS forecast database name. |
|
|
IPv4 listener address, port 0–65535; 0 requests an ephemeral port. Use a fixed port for deployment. Hostnames/IPv6 are not supported here. |
|
|
Positive automatic reconciliation interval; the initial cycle is scheduled when the agent becomes ready, then subsequent cycles follow. |
|
Off |
Disable automatic cycles; only client requests trigger reconciliation. Conflicts with an explicitly supplied reconciliation interval. |
|
|
Non-negative refresh interval for available recent catalog days. |
|
|
Non-negative recent-day window (48 hours by default); older successful catalog results remain cached. |
|
|
Non-negative retry interval for failed catalog-day discovery. |
|
|
Positive maximum concurrent MET requests, shared across service agents. |
|
|
Non-negative minimum spacing between MET request starts; 0 disables request-start pacing. |
|
|
Non-negative upstream cooldown when throttling provides no usable
|
|
|
Nonempty single-line MET HTTP User-Agent. Do not embed credentials. |
|
Unset |
Optional readable regular file containing a MET upstream bearer token; see the security guidance below. |
|
|
Case-sensitive dlib level: |
|
Unset (stdout) |
Append log output to a regular file instead of stdout. Its parent directory must already exist. |
|
Exit after output |
Print usage without opening the DB; |
|
Exit after output |
Print executable name and Shyft version without opening the DB. |
Catalog cache decisions are shared across configurations in this service DB, and survive process restarts. Recent days may gain new runs; stable historical results are not repeatedly scanned. This is not a cross-process global cache: separate service DBs do not share it. See Catalog-day diagnostics.
Bearer-token security¶
The optional bearer token is service-level MET upstream credential material,
not listener authentication. It is not part of met_no.Config, is not stored
in the service RocksDB, and must not be put in normal versioned acquisition
configuration or ModelInfo.json. The application accepts a secret-file path,
not a token value on the command line.
Provision a file readable only by the service user, for example:
install -d -m 700 "$HOME/.config/shyft"
chmod 600 "$HOME/.config/shyft/met-no.token"
The second command assumes the token file has already been securely provisioned.
Its content is the raw token (not Bearer ...), with at most a final LF or CRLF.
Empty/multiline tokens and embedded NUL bytes are rejected; other whitespace is
preserved. The executable checks that the file is readable and regular, but does
not enforce its ownership/mode: permissions are the operator’s responsibility.
The token is loaded at startup; restart to pick up a changed file.
Startup metadata excludes the token, and upstream diagnostics are sanitized before exposure in logs/status/bookkeeping. Do not put secrets in the User-Agent or other configuration fields. Keep the administration listener on loopback or within a trusted protected network; the upstream token does not secure it.
Logging and lifecycle¶
The executable uses Shyft’s existing dlib logging framework. Normal service
logs go to stdout at the chosen level; argument/startup errors can go to stderr.
--log-file redirects logging to an append-only output file, not a separate
logging framework. Stdout/stderr are suitable for systemd/journald; leave
--log-file unset when using the journal.
Logs expose startup/version/bootstrap policy, readiness/listener and active
configuration count, lifecycle/shutdown events, and service failures. Use the
Python status snapshots and cycle diagnostics for detailed per-agent
reconciliation progress; logs alone are not proof that a forecast is in fc.
On SIGTERM/SIGINT, the process stops the wire service and manager/agents
and exits normally. Argument/startup/runtime failures return a nonzero exit
status. There is no daemonization or bootstrap reload command; change bootstrap
options by restarting the process. A supervisor such as systemd supplies
restart-on-failure behavior, not the executable itself.
Production HTTPS requests use a 30-second total deadline and cancellation for connection, TLS and HTTP I/O; TLS certificates must match the requested hostname. The operating-system DNS resolver may delay cancellation/teardown while an already-running name lookup completes. Use bounded resolver policies on the service host; the deadline is not a hard process-shutdown bound for that lookup.