builds / load-balancer / stage-6SHEET 6 / 6 · REV ASIGN IN
ASSEMBLY DIAGRAM — YOUR LOAD BALANCERSCALE: LEARNING
browserthe outside worldFRONT DOOR✓ builtROTOR✓ builtPULSE MONITOR✓ builtSCALES✓ builtINSTRUMENT PANEL✓ builtRELIEF VALVE⚙ building
BUILTUNDER CONSTRUCTIONNOT YET IMAGINED INTO EXISTENCE
STAGE 6 · THE RELIEF VALVE

The Soft Landing

The mark of production software isn't starting up — it's stopping without dropping anything.

What you're wiring up

Two drains, one principle. Backend drain: you want to deploy to b2, so you tell the balancer to stop sending it new work and let its current work finish. That needs a third state, draining, sitting between up and down — invisible to the picker, but its in-flight requests run to completion. When the in-flight count hits zero, it's out and safe to redeploy.

Balancer drain: on SIGTERM you stop accepting new connections, finish everything in flight, and exit 0. Bounded by a timeout, because a single stuck request must not hold shutdown hostage forever. If the timeout expires you force-close and exit nonzero — an honest signal that something didn't land cleanly.

This is why rolling deploys can show literally zero errors: every layer knows how to land softly. Order matters too — shut the traffic server down first and the admin server last, so /status stays readable while the machine is landing.

Assembly steps

[ 01 ]
Add a draining state: pickers treat it as unavailable, health checks pause for it, in-flight requests complete normally, and it transitions to out when in-flight reaches zero.
hint

You already count in-flight per backend — drain is just a state plus watching that counter hit zero.

[ 02 ]
Add admin endpoints POST /backends/{index}/drain and /restore, and report draining and out in /status.
hint

Restore should put a backend back through the health-check thresholds, not straight into rotation on faith.

[ 03 ]
On SIGTERM or SIGINT, stop accepting new traffic, finish in-flight requests, and exit 0 within --drain-timeout (default 10s). Force-close and exit nonzero if the timeout expires.
hint

signal.NotifyContext plus http.Server.Shutdown already means close listeners and wait for active requests.

hint

Your remaining job is the timeout context and the exit code — get both right.

[ 04 ]
Shut down the admin server after the traffic server, so the panel stays live through the landing.

Go deeper (after it passes)

The blueprint is complete — solid ink. Victory lap: put three real services behind it and roll a deploy with zero errors. Then read DDIA M5 (Replicate It) — zero-downtime rotation is the ops face of replica routing — and take Stage 3's you can only stop hearing from it into the Raft track.