spoold v0.1.0 — durable curl

spoold is durable curl for programs that cannot afford to lose an outbound HTTP request.

Submit a delivery to the local daemon and it acknowledges only after synchronizing the request to disk. Delivery then continues across destination outages, process termination, and machine restarts—without PostgreSQL, Redis, Kafka, a cloud account, or a language-specific SDK.

Accept the request now, deliver it later, and require no database, broker, or cloud service.

This is the first public alpha. The narrow use case is cron jobs, edge agents, appliances, and small self-hosted services that need a local store-and-forward boundary for arbitrary HTTP requests.

Install

Linux and macOS archives are available for amd64 and arm64. Each archive contains spoold and spoolctl.

curl -fsSL https://raw.githubusercontent.com/Rionlyu/spoold/main/scripts/install.sh | sh

Or run the multi-architecture container with persistent storage:

docker run -d \
  --name spoold \
  --restart unless-stopped \
  --publish 127.0.0.1:8080:8080 \
  --volume spoold-data:/var/lib/spoold \
  ghcr.io/rionlyu/spoold:v0.1.0

What is included

• fsync-before-ack append-only journal with deterministic replay, repair, retention, and online compaction;
• arbitrary JSON or binary HTTP bodies, headers, methods, bounded retries, and stable delivery IDs;
• idempotent enqueueing with conflicting-key detection;
• per-origin worker fairness and SSRF-aware DNS and redirect enforcement;
• loopback TCP or owner-only Unix-socket control plane;
• Prometheus-format delivery and journal-health metrics;
• checksummed archives, SPDX SBOMs, keyless Sigstore signatures, GitHub build provenance, and a signed non-root OCI image.

Alpha contract and boundaries

• Delivery is at least once, not exactly once. Destinations should deduplicate by X-Spoold-Delivery-ID when duplicate effects matter.
• One process on one host owns a journal. This is not a highly available queue or a transactional outbox.
• The HTTP control API has no network authentication. Keep it on loopback, an owner-only Unix socket, or another trusted boundary.
• Headers and bodies are stored locally and should be treated as sensitive data.
• Terminal history and its idempotency keys are retained for seven days by default; pending and in-flight work is never pruned by retention.
• Private and loopback delivery targets are blocked by default. Enable them explicitly only when the local trust boundary is appropriate.

See the durability design, launch contract, and security policy for the full semantics.

Verify the release

After downloading checksums.txt and checksums.txt.sigstore.json:

cosign verify-blob checksums.txt \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity \
    'https://github.com/Rionlyu/spoold/.github/workflows/release.yml@refs/tags/v0.1.0' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com'

GitHub provenance can be checked with:

gh attestation verify spoold_0.1.0_linux_amd64.tar.gz \
  --repo Rionlyu/spoold \
  --signer-workflow Rionlyu/spoold/.github/workflows/release.yml

If you try the crash-recovery flow or use spoold in a real script or edge workload, please share what worked or failed. Alpha feedback should shape what comes next.