Previously only the *replaced* value was closed on swap — the
*currently-held* value leaked on process exit. Adds:
- View.Close() — closes the held value (if it implements io.Closer)
and clears the pointer; idempotent.
- Set.Close() — joins Close errors across all views in the set.
form2mail defers geoSet.Close() to release the geoip2 file handles on
shutdown.
`any(typedNilPtr)` wraps the nil pointer in a non-nil interface, so the
prior `closer != nil` check didn't catch it — calling Close on the
underlying nil *geoip.Databases segfaulted during the first successful
reload after a failed one.
Also flip form2mail's default blocklist URL from git@ (SSH) to
https:// so fresh deployments work without a GitHub SSH key.
Loader signature changes from func() (*T, error) to
func(context.Context) (*T, error). Set.Load(ctx) already accepts a
ctx; it now flows through reload() into the loader so long-running
parses or downloads can honor ctx.Err() for graceful shutdown.
check-ip's loaders don't consume ctx yet (ipcohort/geoip are
in-memory and fast), but the hook is in place for future work.
BREAKING: dataset.Add and dataset.AddInitial signatures changed.
- reload() Closes replaced value if it implements io.Closer
(geoip readers leak mmap/file handles on hot-swap without this)
- AddInitial pre-populates a view so Value() is non-nil before first
Load — enables async-load startup paths
- View.LoadedAt() and Set.Loaded() expose load state for health checks
Set handles both single-fetcher (one git repo) and multi-fetcher
(GeoLite2 City + ASN) cases uniformly. Any fetcher reporting an update
triggers a view reload. This replaces the per-caller FetcherFunc wrapper
that combined the two MaxMind cachers and the ad-hoc atomic.Pointer +
ticker goroutine in cmd/check-ip — geoip now rides on the same
Set/View/Load/Tick surface as the blocklists.
Stats the given paths and reports updated when any size/modtime
changes since the last call. First call always reports true so the
initial Load populates views.
check-ip uses it for --inbound/--outbound so edits to local lists
get picked up by Group.Tick without a restart.
Libraries shouldn't decide where errors go. Tick now passes Load
errors to onError (nil to ignore); callers pick log/count/page.
check-ip supplies its own stderr writer.
Distilled from the previous net/dataset experiment and the inline
closure version in check-ip. Keeps what actually earned its keep:
- Group ties one Fetcher to N views; a single Load drives all swaps,
so shared sources (one git pull, one zip download) don't get
re-fetched per view.
- View[T].Value() is a lock-free atomic read; the atomic.Pointer is
hidden so consumers never see in-flight reloads.
- Tick runs Load on a ticker with stderr error logging.
Dropped from the v1 design: MultiSyncer (callers fan-out inline when
needed), Close (unused outside geoip), Name (callers wrap the logger),
standalone Dataset type (Group with one view covers it), Sync vs Init
asymmetry (Load handles first-call vs update internally).
check-ip rewires to use it — file/git/http modes all build a Group
with two views, uniform shape.
