2025-10-15 - 2026-10-15
Overview
2 Releases published by 1 user
Published
v1.0.0-rc2
Published
v1.0.0-rc1
114 Pull requests merged by 2 users
Merged
#290 watcher: a hostname whose zone's nameservers all stop answering gets NS Failure (closes #284)
Merged
#282 watcher: an IPv6 address is written in brackets before its port (closes #270)
Merged
#283 docs: TODO.md names only open issues as next steps (closes #281)
Merged
#280 watcher: a port check that finds 443 closed removes its certificate entries (closes #265)
Merged
#278 state: a state file without a section loads it empty (closes #267)
Merged
#279 watcher: a stop during the first scan sends no startup notification (closes #271)
Merged
#273 watcher: a removed nameserver is an NS Change, not an NS Failure (closes #262)
Merged
#277 config: a metrics username without a password stops startup (closes #268)
Merged
#276 state: Save syncs the state file before renaming it into place (closes #264)
Merged
#275 server: a port that cannot be bound stops startup (closes #266)
Merged
#274 config: a bad number or true/false setting stops startup (closes #269)
Merged
#272 state: GetSnapshot copies the state's maps (closes #261)
Merged
#259 build: re-vendor canonical files from prompts dd4027b (closes #257)
Merged
#258 watcher, config: no Record Change or Inconsistency for listed names (closes #255)
Merged
#254 resolver: a nameserver with a failed record type is not nodata (closes #253)
Merged
#250 resolver, watcher: a domain's nameservers are only its own delegation (closes #222)
Merged
#252 resolver: the refused-query test asks several operators, one query each (closes #251)
Merged
#246 watcher: a name removed from the targets leaves the state (closes #223)
Merged
#234 resolver, watcher: a record type whose query fails keeps its previous records (closes #231)
Merged
#249 watcher: Port Change notifications list domains apart from hostnames (closes #248)
Merged
#247 dashboard and status API list a port's domains apart from its hostnames (closes #245)
Merged
#242 resolver: ask a referral's nameservers that come without addresses (closes #221)
Merged
#244 dashboard, status API and notifications tell apex domains from hostnames (closes #224)
Merged
#243 dashboard: list record types in the README's order (closes #226)
Merged
#235 dashboard and status API show why a check failed (closes #225)
Merged
#236 resolver: store a name's CNAME once per nameserver (closes #220)
Merged
#237 watcher: a lookup cut short by shutdown is not logged as an error (closes #229)
Merged
#238 watcher: change messages name only the record types that differ (closes #219)
Merged
#241 watcher: startup notification no longer says every endpoint works (closes #230)
Merged
#240 notify: a failed Mattermost delivery's error names Mattermost
Merged
#239 log: write durations as text, not nanoseconds (closes #228)
Merged
#209 watcher: follow a watched name's CNAME for port and TLS checks (closes #203)
Merged
#232 resolver tests: retry an answer missing the record type read (closes #218)
Merged
#213 docker: a plain docker build . stamps the git version (closes #210)
Merged
#212 resolver: never resend a refused query asking for recursion (closes #206)
Merged
#217 ci: a push cancels its branch's older run, checkout keeps no token (closes #216)
Merged
#215 watcher tests: far fewer live queries, longer live attempts (closes #214)
Merged
#199 resolver: try servers in a random order on each resolution (closes #138)
Merged
#205 README: correct claims the code does not bear out (closes #108)
Merged
#211 config: watch a target listed twice only once (closes #207)
Merged
#208 watcher: warn of an expiring certificate on every TLS check (closes #204)
Merged
#202 resolver: take a domain's NS set from its delegation (closes #200)
Merged
#198 docs: add the README sections policy requires (closes #173)
Merged
#201 resolver: pass over a server that answers SERVFAIL or refers no closer (closes #197)
Merged
#195 watcher: keep port state when no nameserver of a name answered (closes #193)
Merged
#194 resolver: error from ResolveIPAddresses when no nameserver answered (closes #190)
Merged
#196 fmt: format and check Markdown with prettier in a container (closes #119)
Merged
#192 fmt: check goimports in fmt-check, run it at its pinned commit (#119)
Merged
#191 resolver: query a hostname at its own zone's servers (closes #189)
Merged
#187 watcher: notify nameserver address changes (closes #105)
Merged
#186 watcher: save state when it stops and wait for that save (closes #114)
Merged
#184 server: report HTTP handler panics to Sentry (closes #107)
Merged
#188 watcher: save and notify nothing for a cut-short port or TLS check (closes #185)
Merged
#183 middleware: take the client address from the right of X-Forwarded-For (closes #181)
Merged
#175 watcher: notify NS query failure and recovery (closes #104)
Merged
#178 config: stop startup on an invalid DNS or TLS interval
Merged
#180 metrics: rate limit /metrics per client address before Basic Auth (closes #101)
Merged
#182 docker: report the real version in the image (closes #109)
Merged
#179 notify: release held deliveries so shutdown tests fail, not hang (closes #176)
Merged
#170 script/install-precommit: work where .git is a file (closes #129)
Merged
#171 docs: bring TODO.md up to date (closes #146)
Merged
#167 docker: set up the data directory in an entrypoint (closes #166)
Merged
#172 server: limit wildcard CORS to the public routes (closes #100)
Merged
#169 Move the test-only constructors into export_test.go (closes #111)
Merged
#174 notify: make the shutdown tests fail with the right message (closes #116)
Merged
#165 tests: rename internal/livedns to livednstest and deny it outside tests
Merged
#163 golangci: re-vendor the org config with gomodguard_v2
Merged
#162 tests: remove the DNS stand-ins from the watcher and resolver tests
Merged
#161 watcher: send the inconsistency alert once per disagreement
Merged
#160 resolver: lower-case DNS names in record values (closes #157)
Merged
#155 script: force lint and test to run in cibuild and docker
Merged
#153 server: assert timeouts on the served http.Server, not just the constructor
Merged
#156 docker: run as non-root, add health check, document upaas
Merged
#112 feat: add security response headers middleware (closes #98)
Merged
#154 Add tests for globals, healthcheck, and logger packages
Merged
#150 gomod: drop stale golang.org/x/sync indirect line
Merged
#151 Merge main into next to restore ancestry (resolve TODO.md)
Merged
#118 server: set ReadTimeout, WriteTimeout, and IdleTimeout (closes #99)
Merged
#136 next
Merged
#113 notify: drain in-flight deliveries at shutdown (closes #106)
Merged
#96 build: update golangci-lint to v2.12.2 with org-standard v2 config
Merged
#95 docs: document the no-DNS-mocking policy in README (closes #94)
Merged
#92 scripts-to-rule-them-all
Merged
#91 TODO
Merged
#87 feat: add retry with exponential backoff for notification delivery
Merged
#89 config: use /var/lib/dnswatcher as default data directory
Merged
#86 feat: enhance /api/v1/status endpoint with full monitoring data
Merged
#85 feat: add DNSWATCHER_SEND_TEST_NOTIFICATION env var
Merged
#83 feat: add unauthenticated web dashboard showing monitoring state and recent alerts
Merged
#79 test(notify): add comprehensive tests for notification delivery
Merged
#80 test(state): add comprehensive test coverage for internal/state package
Merged
#81 test(config): add comprehensive tests for config loading path
Merged
#74 docs: fix README inaccuracies found during QA audit
Merged
#75 feat: fail fast when no monitoring targets configured
Merged
#63 fix: use context.Background() for watcher goroutine lifetime
Merged
#65 fix: track multiple hostnames per IP:port in port state
Merged
#64 fix: enforce DNS-first ordering for port and TLS checks
Merged
#40 REPO_POLICIES compliance audit
Merged
#28 fix: 700ms query timeout, proper iterative resolution (closes #24)
Merged
#38 Simplify CI: docker build instead of manual toolchain setup
Merged
#37 fix: distinguish timeout from negative DNS responses (closes #35)
Merged
#23 fix: remove ErrNotImplemented stub — all checks fully implemented (closes #16)
Merged
#21 fix: look up A/AAAA records for apex domains to enable port/TLS checks (closes #19)
Merged
#22 fix: deduplicate TLS expiry warnings to prevent notification spam (closes #18)
Merged
#30 Reduce DNS query timeout and limit root server fan-out (closes #29)
Merged
#34 doc: add TESTING.md — real DNS only, no mocks
Merged
#20 fix: use full Lock in State.Save() to prevent data race (closes #17)
Merged
#6 feat: implement TCP port connectivity checker (closes #3)
Merged
#9 feat: implement iterative DNS resolver (closes #1)
Merged
#7 feat: implement TLS certificate inspector (closes #4)
Merged
#13 fix: suppress gosec G704 SSRF false positive on webhook URLs
Merged
#14 ci: add Gitea Actions workflow for make check
Merged
#8 feat: implement watcher monitoring orchestrator (closes #2)
Merged
#11 feat: unify DOMAINS/HOSTNAMES into single TARGETS config (closes #10)
2 Pull requests proposed by 1 user
Proposed
#152 next
Proposed
#291 A nameserver is asked at each of its addresses in turn
152 Issues closed from 2 users
Closed
#284 A hostname whose zone's nameservers all stop answering gets no NS Failure notification
Closed
#270 An IPv6 address joined with its port, as in a Port Change notification, cannot be told from the port
Closed
#281 TODO.md names closed issues as its next and future steps
Closed
#265 A certificate entry stays ok after its port 443 closes
Closed
#267 A state file holding {} crashes the watcher on its first check
Closed
#271 The startup notification says the initial scan completed when shutdown cut it short
Closed
#262 A nameserver removed from a domain's delegation is also reported as an NS Failure
Closed
#268 /metrics is served with an empty password when only DNSWATCHER_METRICS_USERNAME is set
Closed
#264 The state file is renamed into place without being synced, so a crash can leave it empty and stop the next start
Closed
#266 dnswatcher keeps running without its HTTP server when the listen port is in use
Closed
#269 A setting that is not a valid number or true/false is read as 0 or false instead of stopping startup
Closed
#261 The dashboard and /api/v1/status iterate the state's live maps without the lock, which can crash the process
Closed
#260 Defect hunt before the release candidate: a trial run of next and a read of its code paths
Closed
#263 A non-numeric DNSWATCHER_TLS_EXPIRY_WARNING or PORT is silently read as 0
Closed
#257 Re-vendor the canonical files from sneak/prompts at dd4027b
Closed
#255 Let an admin turn off Record Change and Inconsistency notifications for one name
Closed
#256 Let an admin turn off the record-change notification for one host
Closed
#233 OWNER: names whose nameservers rotate their answers notify on every check
Closed
#144 Review toward 1.0: identify and file all next steps
Closed
#253 A nameserver whose A query got no reply is reported nodata when its other answers were empty
Closed
#222 A name gets a parent zone's nameservers when finding its own fails: a domain that does not exist shows the .com servers
Closed
#251 Red next: the Quad9 refusal test needs all eight of its queries answered at once
Closed
#223 Targets removed from DNSWATCHER_TARGETS stay on the dashboard, in /api/v1/status and in the startup counts
Closed
#231 One lost query saves a nameserver's records with that type missing, and notifies a change
Closed
#248 Port Change notifications list apex domains as hosts
Closed
#245 The dashboard Ports table lists an apex domain as a hostname
Closed
#221 Nameservers that a referral names without addresses are not looked up, so pool.ntp.org cannot be watched
Closed
#224 Apex domains are counted, listed and notified as hostnames
Closed
#226 The dashboard lists each nameserver's records in a random order of record type
Closed
#225 The dashboard and /api/v1/status do not say why a nameserver or certificate check failed
Closed
#220 A hostname's CNAME is stored once for every record type asked for, eight copies in all
Closed
#229 A DNS lookup cut short by shutdown is logged as an error
Closed
#219 Record Change and Inconsistency notifications print every record type in Go map syntax instead of what changed
Closed
#230 The startup notification says all notification channels are working before any delivery is known
Closed
#227 A failed Mattermost delivery is logged as "slack notification failed"
Closed
#228 Durations in the log are bare nanosecond counts
Closed
#203 A watched name whose CNAME points into another zone gets no port or TLS checks
Closed
#218 Resolver tests for AAAA and MX records fail when one query is lost
Closed
#149 Trial run of the finished image against real targets before tagging 1.0
Closed
#210 docker build . stamps dev, not the git tag or short commit
Closed
#206 A query a server refuses is resent asking for recursion, so answers can come from a recursive resolver
Closed
#216 CI runs every pushed head, even after a newer push to the same branch has replaced it
Closed
#214 next is red in CI: watcher tests time out since nameserver addresses are looked up on each domain check
Closed
#138 queryServers always tries servers in fixed order, so every resolution starts at a.root-servers.net
Closed
#108 README accuracy sweep: architecture omissions, undocumented state field, overclaimed MAINTENANCE_MODE and /metrics
Closed
#207 A target listed twice in DNSWATCHER_TARGETS is checked twice
Closed
#204 TLS expiry warning is skipped on some checks, at random
Closed
#200 A domain's NS set comes from whichever server answers first, so it can change between checks when servers disagree
Closed
#173 README lacks the Getting Started, Rationale, Design and TODO sections that REPO_POLICIES.md requires
Closed
#197 Finding a zone's servers gives up after the first server answers SERVFAIL or refers onward
Closed
#193 Saved port state is removed when every nameserver of a hostname fails
Closed
#190 ResolveIPAddresses returns no addresses and no error when every nameserver fails
Closed
#119 fmt tooling is incomplete: fmt-check does not verify goimports, and no formatter covers Markdown
Closed
#189 Hostname records are queried at the servers of the name's last two labels, the wrong zone under co.uk-style suffixes and delegated subdomains
Closed
#105 Nameserver glue/IP changes are never detected — README claims they trigger a notification
Closed
#114 Final state persistence at shutdown depends on implicit fx hook ordering and is untested
Closed
#107 DNSWATCHER_SENTRY_DSN is documented and accepted but does nothing: port the Sentry integration from gohttpserver
Closed
#185 A check cut short by shutdown saves every port as closed and every certificate as failed
Closed
#181 The client address taken from X-Forwarded-For is the first entry, which the client itself can set
Closed
#104 Per-nameserver query status is discarded: NS failure and NS recovery notifications never fire
Closed
#177 An invalid DNSWATCHER_DNS_INTERVAL or DNSWATCHER_TLS_INTERVAL is silently replaced by the default
Closed
#101 No rate limiting on the Basic-Auth-protected /metrics endpoint
Closed
#109 Dockerfile does not implement the mandated fail-fast lint stage, and does not pass VERSION as a build ARG
Closed
#176 notify shutdown tests hang until the 90-second timeout instead of failing when a drain returns early
Closed
#129 script/install-precommit fails in a linked worktree: .git is a file, not a directory
Closed
#146 TODO.md is stale: lists shipped work as future steps and tells the reader to keep DNS tests mocked
Closed
#166 The container sets its data directory permissions itself before startup
Closed
#100 CORS wildcard applies to the authenticated /metrics route, and advertises methods that do not exist
Closed
#111 internal/state ships test-only constructors in the production build
Closed
#116 internal/notify shutdown tests: misleading failure diagnostic and an overloaded timing constant
Closed
#164 Test-only package internal/livedns can be compiled into the binary: rename it and name it in the test-support lint rule
Closed
#123 DECISION NEEDED: gomodguard linter is deprecated, and .golangci.yml can only be changed by you
Closed
#159 Watcher tests stub DNS with a mock resolver, against the no-DNS-mocking rule
Closed
#147 Deploy readiness for upaas: non-root image, healthcheck, trial run, README deploy section
Closed
#158 Inconsistency alert repeats on every DNS cycle while nameservers disagree
Closed
#168 Run every build, test and lint step in the Dockerfiles at nice -n 19
Closed
#157 Record values are compared with letter case, so nameservers that agree are reported as inconsistent
Closed
#115 script/cibuild can report a green it did not earn: RUN make check is served from the Docker layer cache
Closed
#120 Server timeout tests protect the constructor but not the call site, and carry an inverted rationale comment
Closed
#126 DECISION/ACCESS NEEDED: the CI job log Gitea returns for a commit does not correspond to that commit
Closed
#98 Add security response headers middleware (HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy)
Closed
#110 internal/globals, internal/healthcheck, and internal/logger have no tests at all
Closed
#132 go.mod is untidy: golang.org/x/sync listed both direct and indirect, so script/bootstrap mutates a tracked file
Closed
#145 next cannot be merged into main: TODO.md conflicts after the squash of the last milestone
Closed
#124 script/docker has the same layer-cache hole as script/cibuild, so make docker can hand a developer an unearned green
Closed
#125 CHECK_EPOCH freshness is host-conditional: busybox date silently drops %N
Closed
#133 script/lint and script/fmt invoke golangci-lint and goimports by bare name, so a PATH shadow still overrides the pin
Closed
#103 script/test always runs with -v instead of the conditional verbose rerun pattern
Closed
#117 script/bootstrap installs pinned tools only when missing, so the golangci-lint pin is inert on any machine that already has one
Closed
#121 script/lint shares one golangci-lint cache and lock across concurrent worktrees, so results can come from another codebase
Closed
#130 Lint cache follow-ups: same-checkout runs abort instead of queueing, and make clean leaves .lint-cache/
Closed
#99 http.Server is missing ReadTimeout, WriteTimeout, and IdleTimeout
Closed
#93 internal/resolver tests query live nameservers and fail nondeterministically
Closed
#102 Add the MIT LICENSE file and README licence statement (1.0 blocker)
Closed
#134 Run all linting in Docker via Dockerfile.lint + script/lint
Closed
#137 Stale/incorrect comment text in script/bootstrap and script/cibuild, and record the config-verify tradeoff
Closed
#139 make test is served from Go's test cache, so a repeat green proves no DNS was queried
Closed
#106 In-flight notification goroutines are not awaited at shutdown, so alerts are lost
Closed
#140 TODO.md collides on every single PR, and its Workflow section still says to branch from main
Closed
#141 tryExchange discards a prior attempt's timeout error on context cancellation, downgrading StatusTimeout to StatusNoData
Closed
#142 internal/server has no tests: deleting the SecurityHeaders router registration fails nothing
Closed
#143 Live-DNS test harness never retries an answer that is missing the record type under test, so TestQueryNameserver_TXT flakes
Closed
#135 TOP PRIORITY: consolidate all open PRs onto one next branch, one PR
Closed
#94 Document the no-DNS-mocking policy in the README
Closed
#90 Move schema_migrations table creation into 000.sql with INTEGER version column
Closed
#62 Notification delivery: fire-and-forget with no retry
Closed
#88 datadir should not be relative
Closed
#73 /api/v1/status endpoint returns minimal data
Closed
#82 Simple unauthenticated web UI showing test results and recent alerts
Closed
#84 add env var SEND_TEST_NOTIFICATION
Closed
#72 Config package has only 23% test coverage
Closed
#71 Notify package has only 11.1% test coverage
Closed
#70 State package has 0% test coverage
Closed
#78 µPaaS deployment setup
Closed
#67 README documents API endpoints that do not exist
Closed
#68 README documents features not implemented: inconsistency-resolved detection and nxdomain/nodata status values
Closed
#69 No validation or warning when DNSWATCHER_TARGETS is empty
Closed
#53 Watcher startup context bug: startCtx expires after fx startup
Closed
#55 Port check IP↔hostname association is lossy (single hostname per IP:port)
Closed
#58 Race between DNS and port/TLS checks (stale IPs)
Closed
#57 No backoff on persistent NS failures (24 notifications/day)
Closed
#60 State file format migration: no logic for version changes
Closed
#56 TLS cert key collision: duplicate checks for shared IP + SNI targets
Closed
#61 CNAME chain + per-NS storage interaction: incomplete IP resolution
Closed
#54 Per-nameserver state creates unbounded growth (no pruning)
Closed
#52 Notification delivery is fire-and-forget with no retry
Closed
#51 CNAME chain + per-NS storage interaction needs clarification
Closed
#49 No DNSSEC validation in iterative resolution
Closed
#50 State file format migration logic missing
Closed
#48 Race between DNS and port/TLS checks on stale IPs
Closed
#47 No backoff on persistent nameserver failures
Closed
#46 TLS cert key collision for shared IP + SNI targets
Closed
#45 Port check IP↔hostname association is lossy for shared IPs
Closed
#43 Bug: Watcher startup context expires immediately
Closed
#44 Per-nameserver state creates unbounded growth
Closed
#5 Spec review: design issues and edge cases in README
Closed
#15 Add branch protection to main branch
Closed
#39 REPO_POLICIES compliance audit
Closed
#24 CRITICAL: make check hangs on main — resolver tests do real DNS lookups
Closed
#35 Resolver should distinguish timeout from authoritative negative responses and retry on timeout
Closed
#16 CRITICAL: Resolver, PortCheck, and TLSCheck are unimplemented stubs
Closed
#19 CRITICAL: Port and TLS checks for apex domains silently do nothing
Closed
#18 CRITICAL: TLS expiry warning fires on every check cycle with no deduplication
Closed
#29 Reduce DNS query timeout and limit root server fan-out
Closed
#32 Resolver tests hit real DNS, causing slow/flaky/racy test suite
Closed
#17 CRITICAL: Data race in State.Save() — mutates snapshot under RLock
Closed
#3 feat: implement TCP port connectivity checker
Closed
#12 CRITICAL: resolver tests hit real DNS, test suite exceeds 30s
Closed
#1 Implement iterative DNS resolver
Closed
#4 feat: implement TLS certificate inspector
Closed
#2 feat: implement watcher monitoring orchestrator
Closed
#10 Unify DOMAINS and HOSTNAMES into a single TARGETS config
160 Issues created by 2 users
Opened
#1 Implement iterative DNS resolver
Opened
#2 feat: implement watcher monitoring orchestrator
Opened
#3 feat: implement TCP port connectivity checker
Opened
#4 feat: implement TLS certificate inspector
Opened
#5 Spec review: design issues and edge cases in README
Opened
#10 Unify DOMAINS and HOSTNAMES into a single TARGETS config
Opened
#12 CRITICAL: resolver tests hit real DNS, test suite exceeds 30s
Opened
#15 Add branch protection to main branch
Opened
#16 CRITICAL: Resolver, PortCheck, and TLSCheck are unimplemented stubs
Opened
#17 CRITICAL: Data race in State.Save() — mutates snapshot under RLock
Opened
#18 CRITICAL: TLS expiry warning fires on every check cycle with no deduplication
Opened
#19 CRITICAL: Port and TLS checks for apex domains silently do nothing
Opened
#24 CRITICAL: make check hangs on main — resolver tests do real DNS lookups
Opened
#29 Reduce DNS query timeout and limit root server fan-out
Opened
#32 Resolver tests hit real DNS, causing slow/flaky/racy test suite
Opened
#35 Resolver should distinguish timeout from authoritative negative responses and retry on timeout
Opened
#39 REPO_POLICIES compliance audit
Opened
#43 Bug: Watcher startup context expires immediately
Opened
#44 Per-nameserver state creates unbounded growth
Opened
#45 Port check IP↔hostname association is lossy for shared IPs
Opened
#46 TLS cert key collision for shared IP + SNI targets
Opened
#47 No backoff on persistent nameserver failures
Opened
#48 Race between DNS and port/TLS checks on stale IPs
Opened
#49 No DNSSEC validation in iterative resolution
Opened
#50 State file format migration logic missing
Opened
#51 CNAME chain + per-NS storage interaction needs clarification
Opened
#52 Notification delivery is fire-and-forget with no retry
Opened
#53 Watcher startup context bug: startCtx expires after fx startup
Opened
#54 Per-nameserver state creates unbounded growth (no pruning)
Opened
#55 Port check IP↔hostname association is lossy (single hostname per IP:port)
Opened
#56 TLS cert key collision: duplicate checks for shared IP + SNI targets
Opened
#57 No backoff on persistent NS failures (24 notifications/day)
Opened
#58 Race between DNS and port/TLS checks (stale IPs)
Opened
#59 No DNSSEC validation in iterative resolution
Opened
#60 State file format migration: no logic for version changes
Opened
#61 CNAME chain + per-NS storage interaction: incomplete IP resolution
Opened
#62 Notification delivery: fire-and-forget with no retry
Opened
#66 1.0/mvp
Opened
#67 README documents API endpoints that do not exist
Opened
#68 README documents features not implemented: inconsistency-resolved detection and nxdomain/nodata status values
Opened
#69 No validation or warning when DNSWATCHER_TARGETS is empty
Opened
#70 State package has 0% test coverage
Opened
#71 Notify package has only 11.1% test coverage
Opened
#72 Config package has only 23% test coverage
Opened
#73 /api/v1/status endpoint returns minimal data
Opened
#78 µPaaS deployment setup
Opened
#82 Simple unauthenticated web UI showing test results and recent alerts
Opened
#84 add env var SEND_TEST_NOTIFICATION
Opened
#88 datadir should not be relative
Opened
#90 Move schema_migrations table creation into 000.sql with INTEGER version column
Opened
#93 internal/resolver tests query live nameservers and fail nondeterministically
Opened
#94 Document the no-DNS-mocking policy in the README
Opened
#98 Add security response headers middleware (HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy)
Opened
#99 http.Server is missing ReadTimeout, WriteTimeout, and IdleTimeout
Opened
#100 CORS wildcard applies to the authenticated /metrics route, and advertises methods that do not exist
Opened
#101 No rate limiting on the Basic-Auth-protected /metrics endpoint
Opened
#102 Add the MIT LICENSE file and README licence statement (1.0 blocker)
Opened
#103 script/test always runs with -v instead of the conditional verbose rerun pattern
Opened
#104 Per-nameserver query status is discarded: NS failure and NS recovery notifications never fire
Opened
#105 Nameserver glue/IP changes are never detected — README claims they trigger a notification
Opened
#106 In-flight notification goroutines are not awaited at shutdown, so alerts are lost
Opened
#107 DNSWATCHER_SENTRY_DSN is documented and accepted but does nothing: port the Sentry integration from gohttpserver
Opened
#108 README accuracy sweep: architecture omissions, undocumented state field, overclaimed MAINTENANCE_MODE and /metrics
Opened
#109 Dockerfile does not implement the mandated fail-fast lint stage, and does not pass VERSION as a build ARG
Opened
#110 internal/globals, internal/healthcheck, and internal/logger have no tests at all
Opened
#111 internal/state ships test-only constructors in the production build
Opened
#114 Final state persistence at shutdown depends on implicit fx hook ordering and is untested
Opened
#115 script/cibuild can report a green it did not earn: RUN make check is served from the Docker layer cache
Opened
#116 internal/notify shutdown tests: misleading failure diagnostic and an overloaded timing constant
Opened
#117 script/bootstrap installs pinned tools only when missing, so the golangci-lint pin is inert on any machine that already has one
Opened
#119 fmt tooling is incomplete: fmt-check does not verify goimports, and no formatter covers Markdown
Opened
#120 Server timeout tests protect the constructor but not the call site, and carry an inverted rationale comment
Opened
#121 script/lint shares one golangci-lint cache and lock across concurrent worktrees, so results can come from another codebase
Opened
#123 DECISION NEEDED: gomodguard linter is deprecated, and .golangci.yml can only be changed by you
Opened
#124 script/docker has the same layer-cache hole as script/cibuild, so make docker can hand a developer an unearned green
Opened
#125 CHECK_EPOCH freshness is host-conditional: busybox date silently drops %N
Opened
#126 DECISION/ACCESS NEEDED: the CI job log Gitea returns for a commit does not correspond to that commit
Opened
#129 script/install-precommit fails in a linked worktree: .git is a file, not a directory
Opened
#130 Lint cache follow-ups: same-checkout runs abort instead of queueing, and make clean leaves .lint-cache/
Opened
#132 go.mod is untidy: golang.org/x/sync listed both direct and indirect, so script/bootstrap mutates a tracked file
Opened
#133 script/lint and script/fmt invoke golangci-lint and goimports by bare name, so a PATH shadow still overrides the pin
Opened
#134 Run all linting in Docker via Dockerfile.lint + script/lint
Opened
#135 TOP PRIORITY: consolidate all open PRs onto one next branch, one PR
Opened
#137 Stale/incorrect comment text in script/bootstrap and script/cibuild, and record the config-verify tradeoff
Opened
#138 queryServers always tries servers in fixed order, so every resolution starts at a.root-servers.net
Opened
#139 make test is served from Go's test cache, so a repeat green proves no DNS was queried
Opened
#140 TODO.md collides on every single PR, and its Workflow section still says to branch from main
Opened
#141 tryExchange discards a prior attempt's timeout error on context cancellation, downgrading StatusTimeout to StatusNoData
Opened
#142 internal/server has no tests: deleting the SecurityHeaders router registration fails nothing
Opened
#143 Live-DNS test harness never retries an answer that is missing the record type under test, so TestQueryNameserver_TXT flakes
Opened
#144 Review toward 1.0: identify and file all next steps
Opened
#145 next cannot be merged into main: TODO.md conflicts after the squash of the last milestone
Opened
#146 TODO.md is stale: lists shipped work as future steps and tells the reader to keep DNS tests mocked
Opened
#147 Deploy readiness for upaas: non-root image, healthcheck, trial run, README deploy section
Opened
#148 OWNER: upaas deployment on fsn1app1 - deploy branch decision and the setup only you can do
Opened
#149 Trial run of the finished image against real targets before tagging 1.0
Opened
#157 Record values are compared with letter case, so nameservers that agree are reported as inconsistent
Opened
#158 Inconsistency alert repeats on every DNS cycle while nameservers disagree
Opened
#159 Watcher tests stub DNS with a mock resolver, against the no-DNS-mocking rule
Opened
#164 Test-only package internal/livedns can be compiled into the binary: rename it and name it in the test-support lint rule
Opened
#166 The container sets its data directory permissions itself before startup
Opened
#168 Run every build, test and lint step in the Dockerfiles at nice -n 19
Opened
#173 README lacks the Getting Started, Rationale, Design and TODO sections that REPO_POLICIES.md requires
Opened
#176 notify shutdown tests hang until the 90-second timeout instead of failing when a drain returns early
Opened
#177 An invalid DNSWATCHER_DNS_INTERVAL or DNSWATCHER_TLS_INTERVAL is silently replaced by the default
Opened
#181 The client address taken from X-Forwarded-For is the first entry, which the client itself can set
Opened
#185 A check cut short by shutdown saves every port as closed and every certificate as failed
Opened
#189 Hostname records are queried at the servers of the name's last two labels, the wrong zone under co.uk-style suffixes and delegated subdomains
Opened
#190 ResolveIPAddresses returns no addresses and no error when every nameserver fails
Opened
#193 Saved port state is removed when every nameserver of a hostname fails
Opened
#197 Finding a zone's servers gives up after the first server answers SERVFAIL or refers onward
Opened
#200 A domain's NS set comes from whichever server answers first, so it can change between checks when servers disagree
Opened
#203 A watched name whose CNAME points into another zone gets no port or TLS checks
Opened
#204 TLS expiry warning is skipped on some checks, at random
Opened
#206 A query a server refuses is resent asking for recursion, so answers can come from a recursive resolver
Opened
#207 A target listed twice in DNSWATCHER_TARGETS is checked twice
Opened
#210 docker build . stamps dev, not the git tag or short commit
Opened
#214 next is red in CI: watcher tests time out since nameserver addresses are looked up on each domain check
Opened
#216 CI runs every pushed head, even after a newer push to the same branch has replaced it
Opened
#218 Resolver tests for AAAA and MX records fail when one query is lost
Opened
#219 Record Change and Inconsistency notifications print every record type in Go map syntax instead of what changed
Opened
#220 A hostname's CNAME is stored once for every record type asked for, eight copies in all
Opened
#221 Nameservers that a referral names without addresses are not looked up, so pool.ntp.org cannot be watched
Opened
#222 A name gets a parent zone's nameservers when finding its own fails: a domain that does not exist shows the .com servers
Opened
#223 Targets removed from DNSWATCHER_TARGETS stay on the dashboard, in /api/v1/status and in the startup counts
Opened
#224 Apex domains are counted, listed and notified as hostnames
Opened
#225 The dashboard and /api/v1/status do not say why a nameserver or certificate check failed
Opened
#226 The dashboard lists each nameserver's records in a random order of record type
Opened
#227 A failed Mattermost delivery is logged as "slack notification failed"
Opened
#228 Durations in the log are bare nanosecond counts
Opened
#229 A DNS lookup cut short by shutdown is logged as an error
Opened
#230 The startup notification says all notification channels are working before any delivery is known
Opened
#231 One lost query saves a nameserver's records with that type missing, and notifies a change
Opened
#233 OWNER: names whose nameservers rotate their answers notify on every check
Opened
#245 The dashboard Ports table lists an apex domain as a hostname
Opened
#248 Port Change notifications list apex domains as hosts
Opened
#251 Red next: the Quad9 refusal test needs all eight of its queries answered at once
Opened
#253 A nameserver whose A query got no reply is reported nodata when its other answers were empty
Opened
#255 Let an admin turn off Record Change and Inconsistency notifications for one name
Opened
#256 Let an admin turn off the record-change notification for one host
Opened
#257 Re-vendor the canonical files from sneak/prompts at dd4027b
Opened
#260 Defect hunt before the release candidate: a trial run of next and a read of its code paths
Opened
#261 The dashboard and /api/v1/status iterate the state's live maps without the lock, which can crash the process
Opened
#262 A nameserver removed from a domain's delegation is also reported as an NS Failure
Opened
#263 A non-numeric DNSWATCHER_TLS_EXPIRY_WARNING or PORT is silently read as 0
Opened
#264 The state file is renamed into place without being synced, so a crash can leave it empty and stop the next start
Opened
#265 A certificate entry stays ok after its port 443 closes
Opened
#266 dnswatcher keeps running without its HTTP server when the listen port is in use
Opened
#267 A state file holding {} crashes the watcher on its first check
Opened
#268 /metrics is served with an empty password when only DNSWATCHER_METRICS_USERNAME is set
Opened
#269 A setting that is not a valid number or true/false is read as 0 or false instead of stopping startup
Opened
#270 An IPv6 address joined with its port, as in a Port Change notification, cannot be told from the port
Opened
#271 The startup notification says the initial scan completed when shutdown cut it short
Opened
#281 TODO.md names closed issues as its next and future steps
Opened
#284 A hostname whose zone's nameservers all stop answering gets no NS Failure notification
Opened
#285 A nameserver with several addresses is asked at only the first one, so one unreachable address reports it as failed
Opened
#286 The static asset route serves directory listings at /s/ and /s/css/
Opened
#287 A webhook that answers with a redirect is counted as a successful delivery
Opened
#288 Debug logging writes the Slack, Mattermost and ntfy webhook URLs to the log on every delivery
Opened
#289 TESTING.md describes a root-server fan-out and a calibrated query timeout that the resolver does not have