config: a metrics username without a password stops startup (closes #268)

DNSWATCHER_METRICS_USERNAME turns on /metrics, and its Basic Auth used DNSWATCHER_METRICS_PASSWORD as it was, empty included, so the username with an empty password got in. config.New now refuses a username without a password with ErrNoMetricsPassword, whose message names both variables. The README's variable table says the password is required with the username. Judgement call: the check is in New, after buildConfig, since it compares two settings buildConfig has already read; buildConfig is also at the linter's length limit. Model: opus-5-5
2026-10-13 16:13:29 +00:00
parent 2ae6110414
commit 33cd81a5ff
4 changed files with 32 additions and 1 deletions
@@ -437,7 +437,7 @@ following precedence (highest to lowest):
 | `DNSWATCHER_SENTRY_DSN`                | Sentry DSN for error reporting                                                                                                        | `""`                  |
 | `DNSWATCHER_MAINTENANCE_MODE`          | Only sets `maintenanceMode` in the health check response; changes nothing else                                                        | `false`               |
 | `DNSWATCHER_METRICS_USERNAME`          | Basic auth username for /metrics, which is served only when this is set                                                               | `""`                  |
-| `DNSWATCHER_METRICS_PASSWORD`          | Basic auth password for /metrics                                                                                                      | `""`                  |
+| `DNSWATCHER_METRICS_PASSWORD`          | Basic auth password for /metrics; required when `DNSWATCHER_METRICS_USERNAME` is set, and startup stops without it                    | `""`                  |
 | `DNSWATCHER_SEND_TEST_NOTIFICATION`    | Send a test notification after first scan completes                                                                                   | `false`               |

 **`DNSWATCHER_TARGETS` is required.** dnswatcher will refuse to start if no