Separate bootstrap settings from runtime overrides with a dedicated runtime settings manager

backend/app/tasks/blocklist_import.py

@@ -21,6 +21,7 @@ import structlog
 from app.db import open_db
 from app.models.blocklist import ScheduleFrequency
 from app.services import blocklist_service
+from app.utils.runtime_state import get_effective_settings
 
 if TYPE_CHECKING:
     import aiosqlite
@@ -35,7 +36,8 @@ JOB_ID: str = "blocklist_import"
 
 
 async def _get_db(app: Any) -> tuple[aiosqlite.Connection, bool]:
-    db = await open_db(app.state.settings.database_path)
+    settings = get_effective_settings(app)
+    db = await open_db(settings.database_path)
     return db, True
 
 
@@ -50,8 +52,9 @@ async def _run_import(app: Any) -> None:
             APScheduler ``kwargs``.
     """
     db, close_db = await _get_db(app)
+    settings = get_effective_settings(app)
     http_session = app.state.http_session
-    socket_path: str = app.state.settings.fail2ban_socket
+    socket_path: str = settings.fail2ban_socket
 
     log.info("blocklist_import_starting")
     try:

backend/app/tasks/geo_cache_flush.py

@@ -16,6 +16,7 @@ from typing import TYPE_CHECKING, Any
 import structlog
 
 from app.db import open_db
+from app.utils.runtime_state import get_effective_settings
 
 if TYPE_CHECKING:
     import aiosqlite
@@ -34,7 +35,8 @@ JOB_ID: str = "geo_cache_flush"
 
 
 async def _get_db(app: Any) -> tuple[aiosqlite.Connection, bool]:
-    db = await open_db(app.state.settings.database_path)
+    settings = get_effective_settings(app)
+    db = await open_db(settings.database_path)
     return db, True
 
 

backend/app/tasks/geo_re_resolve.py

@@ -22,6 +22,7 @@ from typing import TYPE_CHECKING
 import structlog
 
 from app.db import open_db
+from app.utils.runtime_state import get_effective_settings
 
 if TYPE_CHECKING:
     import aiosqlite
@@ -40,7 +41,8 @@ JOB_ID: str = "geo_re_resolve"
 
 
 async def _get_db(app: FastAPI) -> tuple[aiosqlite.Connection, bool]:
-    db = await open_db(app.state.settings.database_path)
+    settings = get_effective_settings(app)
+    db = await open_db(settings.database_path)
     return db, True
 
 

backend/app/tasks/health_check.py

@@ -25,6 +25,7 @@ import structlog
 from app.models.config import PendingRecovery
 from app.models.server import ServerStatus
 from app.services import health_service
+from app.utils.runtime_state import get_effective_settings
 
 if TYPE_CHECKING:  # pragma: no cover
     from fastapi import FastAPI
@@ -56,14 +57,15 @@ async def _run_probe(app: FastAPI) -> None:
     ``app.state.pending_recovery``.
 
     This is the APScheduler job callback.  It reads ``fail2ban_socket`` from
-    ``app.state.settings``, runs the health probe, and writes the result to
-    ``app.state.server_status``.
+    the effective runtime settings, runs the health probe, and writes the
+    result to ``app.state.server_status``.
 
     Args:
         app: The :class:`fastapi.FastAPI` application instance passed by the
             scheduler via the ``kwargs`` mechanism.
     """
-    socket_path: str = app.state.settings.fail2ban_socket
+    settings = get_effective_settings(app)
+    socket_path: str = settings.fail2ban_socket
     prev_status: ServerStatus = getattr(
         app.state, "server_status", ServerStatus(online=False)
     )

backend/app/tasks/history_sync.py

@@ -17,6 +17,7 @@ import structlog
 from app.db import open_db
 from app.repositories import fail2ban_db_repo
 from app.utils.fail2ban_db_utils import get_fail2ban_db_path
+from app.utils.runtime_state import get_effective_settings
 
 if TYPE_CHECKING:  # pragma: no cover
     from fastapi import FastAPI
@@ -34,7 +35,8 @@ BACKFILL_WINDOW: int = 648000
 
 
 async def _get_db(app: FastAPI) -> tuple[aiosqlite.Connection, bool]:
-    db = await open_db(app.state.settings.database_path)
+    settings = get_effective_settings(app)
+    db = await open_db(settings.database_path)
     return db, True
 
 
@@ -47,7 +49,8 @@ async def _get_last_archive_ts(db) -> int | None:
 
 
 async def _run_sync(app: FastAPI) -> None:
-    socket_path: str = app.state.settings.fail2ban_socket
+    settings = get_effective_settings(app)
+    socket_path: str = settings.fail2ban_socket
     db, close_db = await _get_db(app)
 
     try: