feat: health check for signature updates

Author: Marius Benthin

README.md

@@ -35,16 +35,13 @@ A contract token can be retrieved from the [Nextron Portal](https://portal.nextr
 
 If you want to use the techpreview channel (currently THOR 11) you need to set `TECHPREVIEW=1`. If it is omitted it will downgrade to the stable channel again.
 
-The compose file contains commented environment variables for all available configuration options. Some options only apply to specific THOR major versions, for example, `SIGNATURE_UPDATE_INTERVAL` is only available for THOR 11.
+The compose file contains commented environment variables for all available configuration options. Some options only apply to specific THOR major versions, for example, `QUEUE_WARN_SIZE` is only available for THOR 11.
 
 ## Signature Updates
 
-On every container start, THOR signatures are updated automatically. You can enforce a signature update by restarting the service with a brief downtime:
-```
-docker compose up -d --force-recreate
-```
+THOR signatures are updated automatically on every container start. To keep them fresh without manually restart, set `SIGNATURE_UPDATE_INTERVAL` (in hours) to schedule recurring updates.
 
-If a brief downtime is not acceptable, you may want to consider a Docker Swarm setup with start-first update config or use the [techpreview channel](#tech-preview) (currently THOR 11) which allows you to update signatures periodically while running. By default, THOR 11 updates signatures every 24 hours but it can be customized via `SIGNATURE_UPDATE_INTERVAL` environment variable.
+The update mechanism depends on the THOR major version. On THOR 10, new signatures only take effect after a restart. Docker's health check therefore marks the container as unhealthy once `SIGNATURE_UPDATE_INTERVAL` has elapsed, prompting Docker to restart it. The new signatures are then fetched as part of the regular container start, at the cost of a brief API downtime. THOR 11 uses Thunderstorm's built-in signature-update feature to download and apply signatures in-place, leaving the API available throughout.
 
 ## Additional Arguments
 

docker-compose.yml

@@ -8,6 +8,8 @@ services:
       CONTRACT_TOKEN: "${CONTRACT_TOKEN}"
       # Optional: upgrade to THOR techpreview channel
       # TECHPREVIEW: "true"
+      # Optional: hours between signature updates (default: 0)
+      # SIGNATURE_UPDATE_INTERVAL: "0"
       # Optional: result cache size (default: 250000)
       # RESULT_CACHE_SIZE: "250000"
       # Optional: enforce maximum file size for all file types including registry hives and log files
@@ -35,8 +37,6 @@ services:
       # --- THOR 11 only ---
       # Optional: minimum score for storing samples (default: 200)
       # STORE_SAMPLES_SCORE: "200"
-      # Optional: hours between signature updates (default: 24)
-      # SIGNATURE_UPDATE_INTERVAL: "24"
       # Optional: upload queue size warning threshold (default: 50000)
       # QUEUE_WARN_SIZE: "50000"
       # Optional: enable VFS directory mirroring uploaded files per host (also uncomment volume below)
@@ -47,6 +47,16 @@ services:
       # Optional: mount TLS certificate and private key (uncomment TLS_CERT/TLS_KEY above as well)
       # - ./tls_cert:/run/secrets/tls_cert:ro
       # - ./tls_key:/run/secrets/tls_key:ro#
+    restart: unless-stopped
+    # THOR 10: periodically restart the container by signaling PID 1 once uptime exceeds
+    # SIGNATURE_UPDATE_INTERVAL hours; restart policy brings it back up. Skipped when
+    # SIGNATURE_UPDATE_INTERVAL is 0 (disabled, default) or TECHPREVIEW is set (THOR 11
+    # updates signatures in-process).
+    healthcheck:
+      test: ["CMD-SHELL", "[ -n \"$$TECHPREVIEW\" ] || [ \"$${SIGNATURE_UPDATE_INTERVAL:-0}\" = \"0\" ] || [ $$(($$(date +%s) - $$(stat -c %Y /proc/1))) -lt $$(( $${SIGNATURE_UPDATE_INTERVAL} * 3600 )) ] || kill 1"]
+      interval: 5m
+      timeout: 10s
+      start_period: 10m
 
 volumes:
   thunderstorm: