Add skiff config set/unset/list, backed by /app/env in the app's dataset

Config vars are plain env vars, injected into both the running app (via
rc.d) and the release phase, and versioned on the same ZFS snapshot
timeline as deploys - a bad config change gets the same automatic
snapshot/restart/health-check/rollback guarantee a bad deploy already
gets. Extracts deploy.go's health check into internal/health so both
paths share it.

Verified end-to-end against a FreeBSD VM: config set/unset, automatic
rollback on a health-check failure, and explicit `skiff rollback` all
correctly carry the env file along with the rest of the dataset.

1 files changed, 40 insertions, 0 deletions

diff --git a/internal/health/health.go b/internal/health/health.go
new file mode 100644
index 0000000..d1c9df3
--- /dev/null
+++ b/internal/health/health.go
@@ -0,0 +1,40 @@
+// Package health checks whether a freshly (re)started app is up, by polling
+// its declared health endpoint - shared by both internal/deploy and skiff
+// config's own restart-and-verify sequence.
+package health
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"time"
+
+	"skiff/internal/appmeta"
+	"skiff/internal/layout"
+)
+
+func WaitHealthy(ctx context.Context, meta appmeta.Meta) error {
+	url := fmt.Sprintf("http://%s:%d%s", meta.IP, meta.Port, meta.HealthPath)
+	deadline := time.Now().Add(layout.HealthTimeoutSecs * time.Second)
+	client := &http.Client{Timeout: 2 * time.Second}
+
+	var lastErr error
+	for time.Now().Before(deadline) {
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+		if err != nil {
+			return err
+		}
+		resp, err := client.Do(req)
+		if err == nil {
+			resp.Body.Close()
+			if resp.StatusCode < 300 {
+				return nil
+			}
+			lastErr = fmt.Errorf("status %d", resp.StatusCode)
+		} else {
+			lastErr = err
+		}
+		time.Sleep(500 * time.Millisecond)
+	}
+	return fmt.Errorf("never became healthy at %s: %w", url, lastErr)
+}