How to use SockSite with a pre-connected socket?

[Lonami]

I have a oneshot systemd service defined as follows:

post@.service

[Unit]
Description=REDACTED

[Service]
Type=oneshot
User=REDACTED
Group=REDACTED
WorkingDirectory=REDACTED
ExecStart=python REDACTED/aio_sockserv.py
TimeoutStartSec=30

[Install]
WantedBy=default.target

And corresponding socket file:

post.socket

[Unit]
Description=REDACTED

[Socket]
ListenStream=0.0.0.0:9812
Accept=yes
TimeoutSec=1

[Install]
WantedBy=default.target

Previously, I had managed to get this to work by grabbing code from different places, but the code below now shows this warning:

aio_sockserv.py

import asyncio
import socket
from aiohttp import web
from systemd.daemon import listen_fds

async def main():
    fds = listen_fds()
    with socket.fromfd(fds[0], socket.AF_INET, socket.SOCK_STREAM) as sock:
        app = web.Application(middlewares=[set_no_keep_alive])
        app.router.add_post(REDACTED)

        loop = asyncio.get_running_loop()
        transport, protocol = await loop.create_connection(
            app.make_handler(tcp_keepalive=False), sock=sock
        )

        try:
            await protocol.start()
        finally:
            await protocol.shutdown()

asyncio.run(main())

REDACTED python[209171]: REDACTED/aio_sockserv.py: DeprecationWarning: Application.make_handler(...) is deprecated, use AppRunner API instead

loop.create_connection when given an existing socket won't attempt to connect again, because it is assumed connected.

However, while trying to migrate to the new way:

runner = web.AppRunner(app)
await runner.setup()
try:
    site = web.SockSite(runner, sock)
    await site.start()
    while True:
        await asyncio.sleep(10)
finally:
    await runner.cleanup()

it is crashing, because the socket is already connected:

Traceback (most recent call last):
  File "REDACTED/aio_sockserv.py", line 65, in <module>
    asyncio.run(main())
    ~~~~~~~~~~~^^^^^^^^
  File "/usr/lib64/python3.14/asyncio/runners.py", line 205, in run
    return runner.run(main)
           ~~~~~~~~~~^^^^^^
  File "/usr/lib64/python3.14/asyncio/runners.py", line 128, in run
    return self._loop.run_until_complete(task)
           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^
  File "/usr/lib64/python3.14/asyncio/base_events.py", line 720, in run_until_complete
    return future.result()
           ~~~~~~~~~~~~~^^
  File "REDACTED/aio_sockserv.py", line 58, in main
    await site.start()
  File "REDACTED/.local/lib/python3.14/site-packages/aiohttp/web_runner.py", line 258, in start
    self._server = await loop.create_server(
                   ^^^^^^^^^^^^^^^^^^^^^^^^^
        server, sock=self._sock, ssl=self._ssl_context, backlog=self._backlog
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/usr/lib64/python3.14/asyncio/base_events.py", line 1668, in create_server
    server._start_serving()
    ~~~~~~~~~~~~~~~~~~~~~^^
  File "/usr/lib64/python3.14/asyncio/base_events.py", line 317, in _start_serving
    sock.listen(self._backlog)
    ~~~~~~~~~~~^^^^^^^^^^^^^^^
OSError: [Errno 22] Invalid argument

Is there a way to prevent aiohttp from "reconnecting" the socket?

Thanks in advance.

[Dreamsorcerer]

I've actually just been playing with this myself, and was about to add documentation on how to serve with systemd.

Do you have a reverse proxy? We highly recommend using a reverse proxy, at which point it is recommended to use a Unix socket for the application.

It should then look roughly along the lines of:

# /etc/systemd/system/myapp.socket
[Unit]
Description=myapp HTTP socket

[Socket]
ListenStream=/run/myapp/http.sock
SocketGroup=www-data
SocketMode=0660

[Install]
WantedBy=sockets.target

# /etc/systemd/system/myapp.service
[Unit]
Description=myapp
Requires=myapp.socket

[Service]
User=myapp
ExecStart=python -m myapp
Restart=on-failure

[Install]
WantedBy=multi-user.target

# myapp/__main__.py
from aiohttp import web
from systemd import daemon

from myapp.app import init_app


def main(sock: socket.socket) -> None:
    """Run the server in production environment."""
    # Get the Unix socket FD
    fds = daemon.listen_fds()
    if len(fds) != 1:
        raise RuntimeError(f"expected exactly one socket from systemd, got {len(fds)}")
    if not daemon.is_socket_unix(fds[0], type=socket.SOCK_STREAM, listening=1):
        raise RuntimeError(f"fd {fds[0]} is not a listening Unix stream socket")

    app = init_app()
    web.run_app(app, sock=socket.socket(fileno=fds[0]))


if __name__ == "__main__":
    main()

# /etc/nginx/nginx.conf

[...]
	upstream myapp {
		server unix:/run/myapp/http.sock fail_timeout=0;
	}
[...]

We highly recommend using run_app(), rather than trying to use AppRunner and SockSite directly (these are meant for weird edge cases, where the aiohttp app is not the primary app).

[Lonami]

Thanks for the reply (to you and everyone; _{though my LLM detection senses are pretty bad if that's why the others are low quality}). The sample systemd socket and service files are much appreciated as well as full Python code snippet.

Yes, my current Caddyfile was setup to reverse-proxy to the systemd socket I posted:

handle_path /api/* {
        reverse_proxy 127.0.0.1:9812
}

Seems like Caddy's reverse proxy upstream addresses should be able of handling unix sockets just fine as well!

[Lonami]

One more thing since run_app seems synchronous: I actually just want to serve the one request and shutdown (that's why I have the "oneshot" setup with systemd), so I would want some sort of short timeout, which I'm not sure is easily doable with run_app? Mainly to protect against actors that open a connection and just let it idle. I might be approaching this the wrong way.

Maybe with keepalive_timeout… but I really just want the whole thing to stop after a short period of time.

[Dreamsorcerer]

Mainly to protect against actors that open a connection and just let it idle.

Your reverse proxy usually handles that protection. aiohttp itself also has keepalive_timeout (defaulting to 75s) which does the same thing (though I suggest relying on the reverse proxy for better robustness).

but I really just want the whole thing to stop after a short period of time

I guess this is a weird edge case then. But, my first thought would be to use systemd (RuntimeMaxSec=75) to terminate the program (this is still a graceful shutdown). At some point we should add an explicit feature to stop the web app from code within the app, but such functionality is not officially supported today. If you really want to do it from code, I guess the current approach would be closest.

though my LLM detection senses are pretty bad if that's why the others are low quality

Maybe I'm just getting short tempered from wading through bot activity every day, but I highly suspect both responses were fully automated (one even has a Codex attribution). We're very much of the https://distantprovince.by/posts/its-rude-to-show-ai-output-to-people/ school of thought (i.e. if you wanted an AI answer, you'd have asked an AI...).

[Dreamsorcerer]

my first thought would be to use systemd (RuntimeMaxSec=75) to terminate the program

Hmm, that would leave the systemd service in the failed state though, which is probably not desirable.

2 other options:

You could just run a timer after starting the app like systemd-run --on-active=60 systemctl stop myapp.service, which would avoid the failed state.

Or, correcting myself, you could just use SIGTERM from within the code:

@contextlib.asynccontextmanager
async def term_after_delay(_app):
    async def term():
        await asyncio.sleep(60)
        signal.raise_signal(signal.SIGTERM)

    task = asyncio.create_task(term())

    yield

    task.cancel()
    with suppress(asyncio.CancelledError):
        await task  # Ensure any exceptions etc. are raised.

app.cleanup_ctx.append(term_after_delay)