Operating brisvox-server

How the server process starts, hosts its call listeners, reports its health and shuts down . Code: brisvox_server::{settings, hosting, runner, providers, tools, health, lifecycle}, crates/brisvox-server/src/main.rs.

The binary loads one agent definition (BRISVOX_AGENT_FILE, docs/CONFIG.md), builds its STT, LLM and TTS adapters once (their keys come from the environment variables the definition names), starts the inference pool (half the cores) and binds the call listeners below. Every call runs the engine (run_call) as one session of the session manager, with the bundled Silero VAD (feature silero-tract, on by default). The generic websocket, Twilio, Telnyx, RTVI and (with the sip / webrtc features) SIP and WebRTC listeners are hosted. The provider adapters are cargo features of brisvox-server (provider-*, or all-providers); the default build has none, so build the binary with the ones the agent names (cargo build --release -p brisvox-server --features all-providers), otherwise the definition is refused at startup with the feature to turn on.

Tools (docs/TOOLS.md "In the server binary"): every tool the definition lists in agent.tools must exist, or the start fails with the tool's position in the file and what would provide it. The binary provides the telephony tools transfer_call, send_dtmf and end_call when a carrier's call control is configured (BRISVOX_CALL_CONTROL, cargo feature call-control) and, with the cargo feature demo-tools (never for callers), canned lookup_order and book_appointment for the examples. An application's own tools plug in through brisvox_server::tools::AppTools in its own main, one line over this library: brisvox_server::app::run_with_tools(Arc::new(MyTools)) (docs/TOOLS.md "Rust tools in your own binary", examples/rust-tools).

Command line. brisvox-server with no arguments runs the server. brisvox-server check <agent-file> [--require-secrets] validates an agent file offline (docs/CONFIG.md "Checking a file"; exit 0 ok, 1 errors), --version and --help print and exit, and any other argument is refused with exit status 2 instead of starting a server.

Smart Turn (cargo feature smart-turn-ort; the ONNX Runtime binaries are downloaded at build time): an agent whose turn policy is adaptive (the default) gets the Smart Turn v3.2 model, loaded at startup from BRISVOX_SMART_TURN_MODEL (default $BRISVOX_MODELS_DIR/smart-turn-v3.2-cpu.onnx, models/ when unset; fetch it with scripts/models/fetch_models.py). A model that does not load stops the start; off runs without it. A build without the feature logs a warning and adaptive turns end at their fallback deadline. The analyses run on an executor of their own (BRISVOX_SMART_TURN_THREADS): its queue holds 32 analyses per thread and refuses the rest, and a refused analysis makes that turn end at its fallback deadline (logged as smart turn analysis failed); the VAD's pool, and the admission control reading it, are not affected, so watch brisvox_smart_turn_rejected_total and brisvox_smart_turn_timed_out_total (see Metrics). The executor's threads are named brisvox-turn-<i>.

Provider resilience: every call runs its STT, LLM and TTS behind the resilience layer with its default settings. The circuit breakers are per provider instance and shared by all calls (5 consecutive failures open one for 30 s), retries are budgeted per call (3) and per process (50), a dead STT or TTS session is recovered in place, and an idle TTS session is replaced at 80 % of the provider's idle limit (Cartesia: 4 of its 5 minutes). Nothing is configured for this; a second provider per stage to fail over to is the agent definition's [stt|llm|tts].secondary (docs/CONFIG.md), whose API keys must be set like the primaries'.

Build for a phone deployment with everything: cargo build --release -p brisvox-server --features all-providers,call-control,smart-turn-ort.

Settings (environment)

Agent definitions (docs/CONFIG.md) describe agents; the process itself is configured by environment variables. Unset or blank means the default; an invalid value stops the start with exit status 1 and a message naming the variable.

A listener address is host:port or off. Without any listener (BRISVOX_WS_ADDR=off and the others unset) the binary serves its health endpoints only and needs no agent file.

Port placeholder. The listener address variables (BRISVOX_HEALTH_ADDR, BRISVOX_WS_ADDR, BRISVOX_TWILIO_ADDR, BRISVOX_TELNYX_ADDR, BRISVOX_RTVI_ADDR, BRISVOX_SIP_ADDR, BRISVOX_SIP_TLS_ADDR, BRISVOX_WEBRTC_ADDR, BRISVOX_WEBRTC_UDP_ADDR, BRISVOX_WEBRTC_TCP_ADDR, BRISVOX_CALLBACK_ADDR) accept the exact token ${PORT}, replaced by the PORT variable that PaaS hosts (Railway, Heroku, Fly, Cloud Run) inject: BRISVOX_WS_ADDR=[::]:${PORT}. No other expansion happens ($PORT, ${port}). A value that uses the token while PORT is unset or not a number from 1 to 65535 stops the start with a message naming both variables. A value without the token never reads PORT.

Agent definition in a variable. BRISVOX_AGENT_DEFINITION holds the text of the agent definition instead of a file path (docs/CONFIG.md, "The agent definition from the environment"); brisvox-server check --env validates it offline.

Authentication (docs/SECURITY.md). The generic websocket protocol has no authentication of its own (docs/WEBSOCKET_PROTOCOL.md), and its connections take the same session reservations as every other listener's: anyone who reaches an open one can run the agent on your STT/LLM/TTS keys, and a few hundred idle sockets (each holds a reservation for its 5 s handshake) fill BRISVOX_MAX_SESSIONS, so that signed Twilio calls get 503. That is why it is never on by default next to another listener, and listens on loopback only when it is the only one. And the generic websocket, RTVI, WebRTC signaling and Telnyx listeners refuse to start on a non-loopback address without authentication: set BRISVOX_SESSION_SECRET (your backend mints short-lived single-use tokens; the production way) or the listener's static token (BRISVOX_WS_TOKEN, BRISVOX_RTVI_TOKEN, BRISVOX_WEBRTC_TOKEN, BRISVOX_TELNYX_STREAM_TOKEN; development, logged as a warning), or accept the risk with BRISVOX_INSECURE_LISTENERS=1 (logged as a warning per exposed listener). Loopback binds need nothing. Twilio always verifies its signature; SIP has its own source ACL and digest rule. Terminate TLS in a reverse proxy in front of every public listener.

The WebRTC listener (feature webrtc: cargo build -p brisvox-server --features all-providers,webrtc, which compiles libopus and needs a C compiler and cmake, docs/TESTING.md) hosts brisvox_transport::webrtc (docs/ARCHITECTURE.md "WebRTC transport"; a runnable page: examples/web-assistant). Media is UDP on one shared socket: forward BRISVOX_WEBRTC_UDP_ADDR and set BRISVOX_WEBRTC_CANDIDATE_IP to the address browsers reach. A network that blocks UDP connects through ICE-TCP (BRISVOX_WEBRTC_TCP_ADDR) or a browser-side TURN relay (BRISVOX_TURN_PROVIDER); a server host with no inbound UDP (a one-port PaaS such as Railway) uses the WebSocket fallback or the server's own TURN relay (BRISVOX_WEBRTC_TURN_RELAY, the server allocates a relayed address on a TURN service over TLS/443). All of it is in docs/DEPLOY.md. Differences from the websocket listeners:

• No gate before the handshake. A call reaches the engine once its ICE and DTLS completed and is admitted then; with no room (BRISVOX_MAX_SESSIONS, overload, provider budget, draining) the browser connects and the call is hung up at once, logged as call without a reservation refused. The transport's own call limit (twice the manager's) bounds the sockets.
• Authentication. Signaling needs BRISVOX_SESSION_SECRET (a session token per call in Authorization: Bearer) or BRISVOX_WEBRTC_TOKEN (shared, for development) on a non-loopback address, like the other exposed listeners (above): anyone who reaches an open one runs the agent on your provider keys. Signaling must be served over HTTPS (a proxy in front of the TCP port): the DTLS fingerprint travels in the SDP, and over plain HTTP an on-path attacker can swap it and hear the call. DELETE is authorized by the session URL when session tokens are in use. A session token's max_s caps the call.
• Flood limits. Per client address: 5 offers a minute (BRISVOX_WEBRTC_OFFERS_PER_MINUTE, 429), 8 calls at once (BRISVOX_WEBRTC_MAX_CALLS_PER_IP, 429); calls still handshaking are capped at a quarter of BRISVOX_MAX_SESSIONS (BRISVOX_WEBRTC_MAX_HANDSHAKING, 503). Behind a proxy set BRISVOX_TRUSTED_PROXIES so the address is the visitor's, not the proxy's. The counters are in WebRtcServer::stats().
• Codec on the inference pool. The Opus work of every call (90 to 376 us a frame) runs on the server's inference pool, never on tokio workers.
• Like every listener it stops with the server: the cancel stage ends its calls.

The SIP listener needs BRISVOX_SIP_ALLOWED_SOURCES or the digest credentials (or both): an open SIP port is scanned within minutes, and the binary refuses to start without either. For a trunk across the internet add SIPS and SRTP: BRISVOX_SIP_TLS_ADDR (5061) with BRISVOX_SIP_TLS_CERT and BRISVOX_SIP_TLS_KEY, and BRISVOX_SIP_SRTP=required. SDES keys are only ever taken from TLS signaling, so with required the cleartext UDP/TCP port refuses every call (488); keep it for health checks or close it with the ACL. The certificate must be one the carrier trusts (a public CA for Twilio and Telnyx). SipStats counts tls_connections, tls_rejected, tls_handshake_failures, tls_idle_closed, srtp_calls, rejected_insecure, srtp_packets_rejected, srtp_flood_hangups and insecure_dialog_requests (in-dialog requests of a TLS dialog that did not come over TLS: refused or stripped of their SDP; a steady count means someone on the signaling network is probing). Never run the server with RUST_LOG lifting rsipstack (it cannot: the filter is fixed, see BRISVOX_LOG_SIP_STACK). A start-up warning from rsipstack about an unsupported listener type is expected with SIPS (the placeholder that makes requests to TLS callees carry a TLS Via).

Durations are a whole number with ms, s or m (500ms, 45s, 10m); a bare number is seconds; at most one day.

Callback listener

With a carrier's call control (BRISVOX_CALL_CONTROL, feature call-control) and BRISVOX_CALLBACK_ADDR set, the binary serves a small HTTP listener through which the world tells a live call what the carriers' REST call control cannot return (the endpoints, the authentication and the limits are in brisvox_server::callbacks):

{call} is the carrier's id of the caller's call: Twilio's CallSid, Telnyx's call_control_id. The application that originates or receives the call has it; it is also in the call's stream metadata.

Every request needs the shared secret as Authorization: Bearer <secret>, or as the password of Authorization: Basic for carriers that can only put credentials in a URL (https://user:<secret>@host/v1/amd/twilio); the compare is constant time and a request without it gets 401 before its body is read. The secret travels in a header: serve the listener over TLS (a proxy) and keep it on a private address when you can. Carrier webhooks are not signature-checked by this listener. Errors are {"error":"<code>","message":"..."}: 404 no_such_call (the call ended, or never was), 409 no_warm_transfer / no_voicemail, 502 carrier_error, 504 timeout, 400/413/431/501 for malformed requests.

The listener is bounded: 32 requests at once (more are closed unanswered), 5 s to read a request or write the answer, 25 s for the handler, head 8 KiB, body 16 KiB, no keep-alive and no chunked bodies. It serves through the drain (a call that is still running may need its callbacks) and stops after the transports. It is a separate port from the health probes on purpose: it changes calls and is authenticated; the probes are neither.

A warm transfer nobody finishes does not leave the caller alone: when the call's session ends (the stream's linger passed, shutdown) with the transfer pending, the server aborts it and hangs the caller up.

Agent process

An agent that is down, slow or rejects a call never fails the call: it runs on the agent file (logged as a warning), and a link that fails during a call leaves the call running on the agent file's tools. The call waits for its agent before it starts: the caller hears up to CONNECT_TIMEOUT_MS + HANDSHAKE_TIMEOUT_MS (4 s by default) of silence when the agent URL is unreachable or slow, so keep both small. The agent's transfer command goes through the call's carrier call control (BRISVOX_CALL_CONTROL, docs/TELEPHONY.md) when the call has one, and answers unsupported otherwise. A link that fails during a call is reopened (bounded backoff) when the agent declared resume; the definition's [agent_link] section and the route named by a call's start message pick the agent process per definition and per call (docs/AGENT_PROTOCOL.md, "Reconnecting" and "Routing").

Admission

Every listener admits through the one session manager (brisvox_server::hosting):

• Right after the TCP accept, before the websocket upgrade, the listener reserves a session (SessionManager::try_admit). No room (BRISVOX_MAX_SESSIONS calls live or reserved, counting every listener): HTTP 503 with Retry-After: 1. Draining: HTTP 503 without Retry-After (go to another instance). No upgrade, no work spent on a refused connection.
• SIP reserves on every new INVITE, before the digest challenge and the SDP: no room is a 503 with Retry-After, draining a 503 without it. The reservation is held through the 200 OK and the ACK; an INVITE that does not become a call (refused, cancelled, no ACK) gives it back.
• The reservation travels with the connection through the handshake and the protocol's start; the call's session is spawned into it. A connection that never becomes a call (a failed handshake, a start timeout, a bad Twilio signature) gives the reservation back.
• /readyz and the listeners agree: full when every slot is taken, overloaded or provider_budget while admission control refuses (below), draining once the drain began.
• Each listener also bounds its sockets at twice BRISVOX_MAX_SESSIONS (a connection keeps its socket through the close handshake after its call ended; SIP: its own call limit, at most 100000); the session limit is the one that refuses calls.

Pool pressure and provider budgets

After the drain and session-limit checks, try_admit applies two more rules, so a server that is not at BRISVOX_MAX_SESSIONS still refuses calls it cannot serve well. Every refusal is counted by reason and is answered cleanly by the transport that met it.

• Pool pressure. The calls' DSP and inference run on the shared inference pool, so when it falls behind every call degrades together; so do the Smart Turn analyses when their executor falls behind (a late analysis delays the end of the turn), so that executor is judged too, on its queue waits and refused or timed-out jobs (not its depth: its jobs take 20-25 ms, so a few queued ones are ordinary), and either one hot refuses new calls. The server reads the pools at each admission attempt and each /readyz probe: queued jobs per pool thread, jobs refused or timed out, and the mean time jobs waited in the queue over BRISVOX_OVERLOAD_WINDOW (a job queues only while the cores are busy, so the wait is the CPU signal; it is judged only with at least 8 jobs in the window). It turns overloaded on the first sample over the wait limit or with new refused or timed-out jobs, and on a queue that has stayed over its limit for BRISVOX_OVERLOAD_QUEUE_CONFIRM (a burst of call starts makes a short queue that drains in microseconds: on a 2-thread pool, 50 calls dialing within a second refused dozens of them with the pool almost idle until the confirmation was added). It recovers only after one full window of samples at or below the resume limit (hysteresis: a pool hovering at the limit does not flap). Sampling is lazy (no background task): an orchestrator polling /readyz also advances the recovery.
• Learned ceiling. The pressure signals lag the calls: a call admitted now loads the pool a second or more later, when its caller speaks. Measured on Railway (4 vCPU, a capacity of about 250 calls), dialing 900 calls within seconds admitted about 730 before the pool turned hot, and every call degraded (V2V p50 3.7 s). With BRISVOX_OVERLOAD_CEILING (default) the pool turning hot caps the held calls at 90% of the calls held then, the pool turning calm caps them at the calls held at that moment (what it served well), and the cap grows by 10% per calm window spent at it, so it settles near what the machine serves. Running calls are never ended to get under it. Until the pool was first seen hot it starts cautiously: at most 16 calls, doubling per calm window spent at the cap (16, 32, 64, ... every 2 s), so a rush of dials on a fresh server (a restart, a new instance behind a least-connections balancer) cannot overshoot before the pool shows its load. For a hard limit from the first second, set BRISVOX_MAX_SESSIONS to your measured capacity. One hot spell lowers the cap to at most half of the cap it started from, and never below 16 calls; an idle spell longer than two windows is not a recovery. At the cap /readyz reports overloaded, as it does when the Smart Turn executor is behind.
• Provider budgets. With BRISVOX_PROVIDER_LIMITS, every call holds one permit of each limited provider its agent uses (the STT, LLM and TTS named in the agent file) for its whole life; permits are all-or-none and come back on every end path (hang-up, error, panic, cancel, abort, a connection that never became a call). A limit for a provider the agent does not use is ignored with a warning. Because every call needs a permit of every limited provider, one exhausted provider means no call can be admitted until one ends.
• Refusal per transport. Websocket, Twilio, Telnyx and RTVI listeners answer the HTTP upgrade with 503 and Retry-After: 1 s at the session limit, 5 s overloaded, 2 s provider budget, none when draining; the body names the reason (server busy, server overloaded, provider capacity reached, server shutting down). SIP answers 503 with Retry-After for all three, none when draining.
• Metrics. /readyz carries the counters and the numbers behind the verdict (below), and SessionManager::stats has rejected_at_capacity, rejected_overloaded, rejected_provider_budget and rejected_shutting_down. Entering and leaving overload is logged once each (brisvox::server, warn and info).

Health endpoints

Served on BRISVOX_HEALTH_ADDR over plain HTTP/1.1, GET or HEAD, one request per connection (Connection: close), Cache-Control: no-store.

{"status":"ready","accepting":true,"active":3,"reserved":0,"max":256,
 "rejected":{"full":0,"overloaded":0,"provider_budget":0,"shutting_down":0},
 "pressure":{"overloaded":false,"queue_depth":0,"threads":4,"queue_per_thread_milli":0,"mean_wait_us":120,"entered":0},
 "providers":[{"name":"deepgram","limit":50,"in_use":3,"rejected":0}]}

status is ready, full (at max; accepting stays true, a slot frees when a call ends), overloaded (pool pressure, see above), provider_budget (some provider has no permit left) or draining (accepting false, permanent). pressure is present when the server hosts calls (it reads the inference pool); queue_per_thread_milli is queued jobs per thread times 1000, mean_wait_us the mean queue wait of the last judged window and entered how many times the server turned overloaded. providers lists the limited providers. active counts running sessions, reserved the admissions a transport accepted but has not started yet. Other paths answer 404, other methods 405, a malformed request 400, a request head over 4 KiB 431. At most 32 probes are served at once (more are closed unanswered) and each has 2 s to send its request and read the answer.

Use /healthz as the liveness probe and /readyz as the readiness probe. Liveness never fails because of a drain or a full server, so neither restarts the container.

/metrics and the health address. The probes stay open on 0.0.0.0:8081 by default: Kubernetes probes the pod's address and a container runtime probes from outside the network namespace, so a loopback default would break both, and they carry only counts. /metrics (call rates, error rates, latencies) is served without a token only on a loopback health address. On any other address it answers 404 until BRISVOX_METRICS_TOKEN is set, and then requires Authorization: Bearer <token> (constant time, 401 otherwise); the server logs a warning when it turns /metrics off for this reason. BRISVOX_INSECURE_LISTENERS=1 serves it openly (private networks). Prometheus: authorization: { credentials_file: /path/to/token } in the scrape job.

Observability

Metrics, traces and log redaction. Code: brisvox_server::observability; conventions: docs/TRACING.md.

Build the OTLP exporter with --features otlp. It has no dependency of its own.

Prometheus metrics

GET /metrics on BRISVOX_HEALTH_ADDR (text exposition 0.0.4). Scrape it every 5 to 15 s; the cost of a scrape is a few hundred atomic reads and one string. Nothing is recorded per audio frame: histograms and counters are updated once per finished turn, per call end, or read at scrape time.

Useful alerts: rate(brisvox_smart_turn_rejected_total[5m]) > 0 or rate(brisvox_smart_turn_timed_out_total[5m]) > 0 (the Smart Turn executor is overloaded: every affected turn ends at its fallback silence deadline instead of the model's verdict; add executor threads with BRISVOX_SMART_TURN_THREADS or shed calls); brisvox_breaker_state == 2 for more than a minute (a provider is down); rate(brisvox_resilience_events_total{event="failovers"}[5m]) > 0 (calls are running on a secondary); rate(brisvox_resilience_events_total{event="budget_refusals"}[5m]) > 0 (the retry budget is spent: an outage is bigger than the budget allows); rate(brisvox_session_admissions_rejected_total[5m]) by reason; histogram_quantile(0.95, sum by (le) (rate(brisvox_stage_latency_seconds_bucket{stage="response"}[5m]))).

Traces

With BRISVOX_TRACES=otlp each finished turn is one trace: a root span turn (attributes brisvox.session.id, brisvox.agent, brisvox.turn.epoch, brisvox.turn.interrupted, brisvox.turn.llm_rounds, the response latency) and child spans user_speech, end_of_turn, stt_final, llm (one per request of a tool loop), tts, audio_out and, after a barge-in, interruption. The spans carry the real timing of the call's stages (the per-stage marks of the V2V bench), built once when the turn is over: tracing adds no cost while a turn runs. An interrupted turn is exported when the output reports silence (or when the next turn ends), so its interruption span is complete.

Logs

BRISVOX_LOG_FORMAT=json writes one JSON object per line. Every line is scrubbed before it is written: the values of environment variables that look like secrets (*_KEY, *_TOKEN, *_SECRET, *_PASSWORD, *_CREDENTIAL, AUTH_*) are replaced by [REDACTED] wherever they occur, and so are values after credential-looking names (api_key=, "token":"...", Authorization: Bearer ..., ?key=...) and the password of scheme://user:password@host. The scrub over-redacts rather than under-redacts. Credentials in code are brisvox_core::Secret anyway; this is the second line of defence.

The line call admitted (target brisvox::server, info, one per started call) carries the fields transport (websocket, webrtc, twilio, ...), session (the engine session id) and call_id: the transport's own id of the call, which for the websocket transport is the server-assigned ws-<n> (a counter per listener, not the call_id a client may send in start, which is only kept as call metadata client_call_id), and - for a transport that does not label its calls. Use it to match the line to a benchmark or client log of the same call, then follow session through the rest of the call's lines.

Recording and privacy

Optional transcript and audio recording, PII redaction and retention. Off unless BRISVOX_RECORDING_DIR is set; what is written, what the redaction does not do and a checklist for the operator (not legal advice) are in docs/PRIVACY.md. A recording variable without the directory is a start error.

The agent file's [recording] table (docs/CONFIG.md) overrides the content settings above. Use a directory dedicated to the recordings: the retention sweeper reads every entry of it.

Provider resilience settings

The circuit breakers and retry budgets of the resilience layer (docs/PROVIDERS.md). The defaults are the ones in the table; each applies process-wide.

The agent file names the secondaries ([stt|llm|tts].secondary, docs/CONFIG.md); these variables set how eagerly the process fails over to them. Breaker states, the budget and the failovers are on /metrics (above).

Shutdown

Signals: SIGTERM or SIGINT on Unix; Ctrl-C or Ctrl-Break on Windows.

1. Drain starts at once. The session manager stops admitting: /readyz answers 503 draining, and every listener answers new connections with HTTP 503 before the upgrade (see Admission; the caller retries elsewhere). The listeners stay bound, so running calls keep their connections. /healthz stays 200. An admission a listener reserved before the signal is honoured: that call runs and is drained like the others.
2. Wait. Running calls get BRISVOX_DRAIN_TIMEOUT (on the injected clock) to end by themselves. The drain ends as soon as none is left. A second signal ends this stage early (an operator who pressed Ctrl-C twice wants out).
3. Cancel. Every remaining session's cancellation token fires; sessions stop their pipeline (bounded by the engine's stop timeout) and return within BRISVOX_CANCEL_GRACE. The listeners' connections are closed at the same moment (the client gets the protocol's stop/close), and a connection still in its handshake gives its reservation back. The SIP listener hangs up its calls with a BYE (bounded by 2 s) while its signaling endpoint still runs, and an INVITE still waiting for its ACK gives its reservation back.
4. Abort. Sessions still running are aborted (their task is dropped; drop guards clean the registry) and get BRISVOX_ABORT_WAIT.
5. Exit. The listeners stop (each transport's shutdown is bounded by 2 s), the health listener closes (up to 1 s), then the tokio runtime is shut down with a 1 s bound (RUNTIME_SHUTDOWN_TIMEOUT): a blocking task left behind by an aborted session (inference, an offload pool shutdown) is abandoned instead of holding the exit, so the status below is still reported. The worst case is the sum of the three timeouts plus about seven seconds (the figure the container stop timeouts in docs/DEPLOY.md use).

Exit status:

The drain's result is logged once (drain finished, with initial, drained, cancelled, aborted, leaked, forced, elapsed).

Kubernetes

Set terminationGracePeriodSeconds above drain + cancel_grace + abort_wait + 7 s (default 30 + 5 + 1 + 7 = 43 s; use 45 s or more), otherwise the kubelet's SIGKILL cuts the drain. Calls are long: a drain timeout of several minutes with a matching grace period lets them end naturally. The pod leaves the Service endpoints when it is deleted; the readiness flip at drain start covers load balancers that only watch /readyz. No pre-stop sleep is needed: the listeners refuse new calls with 503 from the first moment of the drain instead of accepting and then dropping them.

Probes need no token (/healthz, /readyz); give Prometheus BRISVOX_METRICS_TOKEN from a Secret.

livenessProbe:  { httpGet: { path: /healthz, port: 8081 }, periodSeconds: 10 }
readinessProbe: { httpGet: { path: /readyz,  port: 8081 }, periodSeconds: 2 }
terminationGracePeriodSeconds: 45

Docker / systemd

docker stop sends SIGTERM and kills after 10 s by default: pass --time 45 (or stop_grace_period: 45s in compose). For systemd use KillSignal=SIGTERM and TimeoutStopSec=45.

The container image, its healthcheck and an example compose file with a websocket and a Twilio agent are in docs/DEPLOY.md.