fix(io): yield in StreamReader.Read when Ogg page boundary scan does not advance

The Ogg-sync branch in StreamReader.Read called FindNextPageBoundary
and continued unconditionally. When the boundary returned the same
offset (no progress — e.g. transcoder started before the source had
captured Ogg headers, or buffer wraparound mid-page) the loop
hot-spun: ReadAt -> skipped=true -> FindNextPageBoundary -> same
offset -> continue, never yielding to the scheduler.

With a busy auto-transcoder pool (3 source mounts x 3 mp3 bitrates =
9 transcoders, plus 3 manual = 12) every transcoder spun on the
buffer mutex, driving %sy to 73% and the load average above 30 with
near-zero useful work — only 2.4% us.

Yield to the signal-channel select when FindNextPageBoundary cannot
advance; once the source writes more bytes, signal fires and the
read resumes.

Empirically: tinyice CPU dropped from ~100% to ~2.7% on the same box
with the same transcoder count.

Also adds contrib/systemd/tinyice.service — opinionated drop-in unit
with Nice / CPUWeight / sandbox flags + CAP_NET_BIND_SERVICE so a
non-root tinyice user can bind ports 80 / 443.

Author: DatanoiseTV

contrib/systemd/tinyice.service

@@ -0,0 +1,57 @@
+[Unit]
+Description=TinyIce streaming server
+Documentation=https://github.com/DatanoiseTV/tinyice
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+
+# Run as a dedicated unprivileged user. Create with:
+#   useradd -r -s /usr/sbin/nologin -d /var/lib/tinyice tinyice
+User=tinyice
+Group=tinyice
+WorkingDirectory=/var/lib/tinyice
+
+# Default config path; override by editing this line or via a drop-in.
+ExecStart=/usr/local/bin/tinyice -config /etc/tinyice/tinyice.json
+Restart=on-failure
+RestartSec=5
+
+# CPU shaping. Tinyice is largely network + light transcoding work,
+# so a small Nice penalty + a sub-default CPUWeight keeps a busy
+# transcoder pool from starving interactive system tasks. Tune up
+# (Nice=0 / CPUWeight=100) if tinyice is the only thing on the box.
+Nice=5
+CPUWeight=70
+IOSchedulingClass=best-effort
+IOSchedulingPriority=4
+
+# Hardening — none of these are required for tinyice to run, but
+# they shrink the blast radius of an exploit.
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+ReadWritePaths=/var/lib/tinyice /etc/tinyice
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+LockPersonality=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+
+# Allow binding to privileged ports (80 / 443) as the unprivileged
+# tinyice user. AmbientCapabilities is the cap actually granted to the
+# process; CapabilityBoundingSet hard-limits the upper set so a child
+# can't gain anything else even if the binary tried to.
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
+
+[Install]
+WantedBy=multi-user.target

relay/io.go

@@ -112,12 +112,22 @@ func (r *StreamReader) Read(p []byte) (int, error) {
 		// Handle Ogg synchronization if enabled. Use the buffer's own
 		// mutex rather than the stream mutex, since the slice we're
 		// scanning is protected by the buffer's lock (not the stream's).
+		//
+		// If FindNextPageBoundary doesn't move us forward we MUST yield
+		// — without this guard the loop hot-spins (skipped=true,
+		// boundary unchanged, continue, repeat) and pegs a CPU per
+		// transcoder. Waiting for the signal channel is correct: a
+		// fresh page only becomes findable once the source has written
+		// more bytes, which is exactly what `signal` tells us.
 		if skipped && r.oggSync && r.stream != nil {
-			r.offset = r.stream.Buffer.FindNextPageBoundaryLocked(next)
-			continue
-		}
-
-		if n > 0 {
+			aligned := r.stream.Buffer.FindNextPageBoundaryLocked(next)
+			if aligned > r.offset {
+				r.offset = aligned
+				continue
+			}
+			// No progress — fall through to the select below so we
+			// block on the signal channel instead of burning CPU.
+		} else if n > 0 {
 			r.offset = next
 			return n, nil
 		}