Stop a .strm growing on every boot, and let TorrServer come back

[MoonTheRipper]

Two defects found while researching something else. Both verified on the live box.

A legacy .strm grew by one token per restart

The startup sweep decided a file was already signed with:

strings.Contains(cur, "?t=")

The legacy /proxy/stream route spells its token &t=, because that URL already carries a query (?link=…&index=…). So the file never looked signed, was re-signed on every boot, and the token was appended rather than replaced. One file on the live box had the same 43-character token nine times.

The check now parses the URL and asks for a t parameter, and signing sets instead of appending — which also repairs a file that has already grown, because Query() collapses the repeats and Encode() writes one. The grown file fixes itself on the next start rather than needing to be found by hand.

This one was mine, introduced in 0.7.0 alongside the legacy re-signing.

TorrServer could not recover from a clean exit

Its unit used Restart=on-failure, and TorrServer exposes an HTTP /shutdown that exits 0 — which systemd reads as success, so it never restarted.

Nothing else noticed either. vpntorrent/watchdog.sh clears its strike counter for a down TorrServer with the comment "TS down/restarting — systemd Restart= handles it". It does not, and the box was left with no streaming engine until a person looked.

Not hypothetical: that is exactly what happened when a research probe hit /shutdown.

Now Restart=always. An explicit systemctl stop is still respected — systemd does not fight a deliberate stop — so the only behaviour that changes is the one that was broken.

Tests

Both pinned, and both confirmed red against the old behaviour first: the token test asserts re-signing is idempotent and that an already-grown URL collapses to one token while keeping link and index intact; the harness asserts the unit says Restart=always and not on-failure.