build: isolate golangci-lint cache and lock per checkout (closes #121)

script/lint used golangci-lint's per-user global state, which breaks
when several checkouts on one host lint concurrently. Two independent
failure modes, two causes:

- Cross-contamination. The analysis cache (GOLANGCI_LINT_CACHE,
  default ~/.cache/golangci-lint) is keyed by content, not by
  checkout, so a hit written by another checkout is replayed with
  that checkout's file paths. A run reports findings for files it
  never linted.

- Lock collision. golangci-lint locks os.TempDir()/golangci-lint.lock
  (pkg/commands/run.go, acquireFileLock), which is NOT in the cache
  directory, with a 5s timeout. Peers that hold it longer make the
  run abort with "parallel golangci-lint is running" - a non-result
  that reads as a lint failure. Isolating the cache does not move it.

Point GOLANGCI_LINT_CACHE and TMPDIR at .lint-cache/ under the
checkout root, using the existing $ROOT idiom. TMPDIR is what makes
the lock per-checkout, so the lock keeps serialising the runs that
actually share a cache instead of being disabled. .lint-cache/ is
git-ignored and Docker-ignored, and the cache persists across runs in
a checkout, so caching is not lost.

Reproduced both modes on the unfixed script across 12 copies of this
tree: 10 of 12 concurrent runs void with the lock error, and 11 of 12
sequential runs reported findings at ../w1/... after an identical
lint-failing file was added to every copy. After the fix, 20-way
concurrency gives 0 void and 0 foreign paths, and each copy reports
only its own relative path.

.dockerignore

@@ -1,5 +1,6 @@
 .git/
 bin/
+.lint-cache/
 *.md
 LICENSE
 .editorconfig

.gitignore

@@ -1,6 +1,7 @@
 bin/
 vendor/
 data/
+.lint-cache/
 .env
 *.exe
 /dnswatcher

.golangci.yml

@@ -10,20 +10,14 @@ run:
 
 linters:
   default: all
-  enable:
-    # Successor to the deprecated gomodguard. Named explicitly, rather than
-    # left to `default: all`, because it carries the module policy below.
-    - gomodguard_v2
   disable:
     # Genuinely incompatible with project patterns
     - exhaustruct      # Requires all struct fields
+    - depguard         # Dependency allow/block lists
     - godot            # Requires comments to end with periods
+    - wsl              # Deprecated, replaced by wsl_v5
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go
-    # Deprecated: the warning is attached to the old name, so it is
-    # silenced by disabling that name, not by enabling the successor.
-    - wsl              # Deprecated, replaced by wsl_v5
-    - gomodguard       # Deprecated, replaced by gomodguard_v2
   settings:
     lll:
       line-length: 88
@@ -34,68 +28,6 @@ linters:
       max-complexity: 15
     dupl:
       threshold: 100
-    depguard:
-      # Test-support code must not be compiled into the shipped binary. A
-      # test-support package exists to hand a test privileges the program
-      # itself must never have, so a file that is not a test must not import
-      # one. Test files, and the files inside a package whose directory name
-      # ends in `test`, are where that code belongs, and are exempt.
-      #
-      # The deny list below is the one part of this file a repository is
-      # expected to extend, and the only part it may. depguard matches an
-      # import path against a list of prefixes, so it cannot be told "any path
-      # whose last segment ends in test"; a repository's own test-support
-      # packages have to be named here one at a time, by full import path,
-      # under a module path that differs from repository to repository. Add
-      # them; change nothing else.
-      rules:
-        test-support:
-          list-mode: lax
-          files:
-            - "$all"
-            - "!$test"
-            - "!**/*test/**"
-          deny:
-            - pkg: net/http/httptest
-              desc: >-
-                Test-support code belongs in test files and in packages whose
-                directory name ends in test, not in the shipped binary.
-            - pkg: sneak.berlin/go/dnswatcher/internal/livednstest
-              desc: >-
-                Live-DNS test support belongs in test files and in packages
-                whose directory name ends in test, not in the shipped binary.
-    # Only decisions already recorded in the Go package defaults are
-    # listed here. Every entry matches the module path exactly.
-    gomodguard_v2:
-      blocked:
-        - module: github.com/rs/zerolog
-          recommendations:
-            - log/slog
-          reason: "Structured logging is stdlib log/slog."
-        # One entry per pre-fork module path, because the later releases
-        # are separate paths. A prefix match would be shorter but would
-        # also reach github.com/go-redis/redismock, the test double for
-        # the successor these entries recommend.
-        - module: github.com/go-redis/redis
-          recommendations:
-            - github.com/redis/go-redis/v9
-          reason: "Pre-fork module; use the maintained go-redis v9."
-        - module: github.com/go-redis/redis/v7
-          recommendations:
-            - github.com/redis/go-redis/v9
-          reason: "Pre-fork module; use the maintained go-redis v9."
-        - module: github.com/go-redis/redis/v8
-          recommendations:
-            - github.com/redis/go-redis/v9
-          reason: "Pre-fork module; use the maintained go-redis v9."
-        - module: github.com/sergi/go-diff
-          recommendations:
-            - github.com/aymanbagabas/go-udiff
-          reason: "No unified diff output; use go-udiff."
-        - module: github.com/hexops/gotextdiff
-          recommendations:
-            - github.com/aymanbagabas/go-udiff
-          reason: "Unmaintained fork; use go-udiff."
 
 issues:
   max-issues-per-linter: 0

Dockerfile

@@ -1,29 +1,13 @@
-# Lint stage - fast feedback on lint issues, before the build starts.
-# The linter is invoked directly rather than through `make lint`: that
-# target shells out to `docker build -f Dockerfile.lint`, and there is
-# no docker daemon inside a docker build.
-# script/cibuild and script/docker name this stage in --no-cache-filter.
-# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-10
-FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
-
-WORKDIR /src
-COPY go.mod go.sum ./
-RUN go mod download
-
-COPY . .
-
-RUN make fmt-check
-RUN golangci-lint run --config .golangci.yml ./...
-
 # Build stage
-# script/cibuild and script/docker name this stage in --no-cache-filter.
 # golang 1.25-alpine, 2026-02-28
 FROM golang@sha256:f6751d823c26342f9506c03797d2527668d095b0a15f1862cddb4d927a7a4ced AS builder
 
 RUN apk add --no-cache git make gcc musl-dev binutils-gold
 
-# Force BuildKit to run the lint stage before proceeding
+# golangci-lint v2.12.2, 2026-08-07
-COPY --from=lint /src/go.sum /dev/null
+RUN go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@c0d3ddc9cf3faa61a4e378e879ece580256d76e5
+# goimports v0.42.0
+RUN go install golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0
 
 WORKDIR /src
 COPY go.mod go.sum ./
@@ -31,46 +15,27 @@ RUN go mod download
 
 COPY . .
 
-# Run the tests - build fails if any test fails
+# Run all checks - build fails if any check fails
-RUN make test
+RUN make check
 
-# Build the binary. .dockerignore leaves out .git, so `git describe` in
+# Build the binary
-# the Makefile cannot find the version here: script/docker passes it as
+RUN make build
-# --build-arg VERSION, and a build that passes none reports `dev`.
-ARG VERSION=dev
-RUN make build VERSION="${VERSION}"
 
 # Runtime stage
 # alpine 3.21, 2026-02-28
 FROM alpine@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709
 
-RUN apk add --no-cache ca-certificates tzdata su-exec
+RUN apk add --no-cache ca-certificates tzdata
 
-COPY --from=builder /src/bin/dnswatcher /usr/local/bin/dnswatcher
+WORKDIR /app
-COPY deploy/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
 
-# dnswatcher runs as this unprivileged user. The entrypoint creates the
+COPY --from=builder /src/bin/dnswatcher /app/dnswatcher
-# data directory and gives it to this user on every start.
+
-RUN addgroup -S -g 10001 dnswatcher \
+# Create data directory
-    && adduser -S -G dnswatcher -u 10001 dnswatcher
+RUN mkdir -p /var/lib/dnswatcher
 
 ENV DNSWATCHER_DATA_DIR=/var/lib/dnswatcher
 
-# Config loading also reads a `.env` file and a file named `dnswatcher`
-# (any config extension, or none) from the working directory. `/` holds
-# neither, so every setting comes from the environment. Do not make the
-# data directory, or the binary's directory, the working directory.
-WORKDIR /
-
-# No USER: the entrypoint must start as root to set up the data
-# directory; it then runs dnswatcher as the dnswatcher user.
-
 EXPOSE 8080
 
-# busybox wget (already in alpine) probes the health endpoint every 10
+ENTRYPOINT ["/app/dnswatcher"]
-# seconds, so the container is healthy well before upaas reads its health
-# 60 seconds after a deploy and fails the deploy unless it is healthy.
-HEALTHCHECK --interval=10s --timeout=5s --start-period=10s --retries=3 \
-    CMD wget -q -O /dev/null "http://127.0.0.1:${PORT:-8080}/.well-known/healthcheck" || exit 1
-
-ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]

Dockerfile.lint

@@ -1,29 +0,0 @@
-# Lint-only image: used by script/lint. golangci-lint is never run on
-# the host — the repo is COPYed into the build context and the linter
-# runs as a build step, so a successful build IS a clean lint. This
-# also works where the docker daemon is remote and bind mounts are
-# impossible.
-#
-# `golangci-lint config verify` is deliberately NOT run here: it
-# fetches its JSON schema over a live, unpinned HTTPS call, which would
-# make linting network-dependent and defeat hash-pinning. The cost of
-# that: unknown top-level keys in .golangci.yml are silently ignored,
-# so a mistyped or wrong-schema key lints clean while applying nothing.
-#
-# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-10
-FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS deps
-
-WORKDIR /src
-
-# Dependencies first, so this stage stays cached across lint runs.
-COPY go.mod go.sum ./
-RUN go mod download
-
-# Everything below is invalidated on every run by the
-# --no-cache-filter=lint that script/lint passes: caching is explicitly
-# waived for linting, and a cached build lints nothing.
-FROM deps AS lint
-
-COPY . .
-
-RUN golangci-lint run --config .golangci.yml ./...

LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 sneak
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

Makefile

@@ -1,8 +1,6 @@
 .PHONY: all bootstrap setup build lint fmt fmt-check test check clean hooks docker
 
 BINARY := dnswatcher
-# `make build VERSION=...` overrides this; the Dockerfile does so, as the
-# image has no .git to describe.
 VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
 LDFLAGS := -X main.Version=$(VERSION)
 

README.md

@@ -1,6 +1,6 @@
 # dnswatcher
 
-dnswatcher is an MIT-licensed, pre-1.0 Go daemon by [@sneak](https://sneak.berlin) that monitors DNS records, TCP port availability, and TLS certificates, delivering real-time change notifications via Slack, Mattermost, and ntfy webhooks.
+dnswatcher is a pre-1.0 Go daemon by [@sneak](https://sneak.berlin) that monitors DNS records, TCP port availability, and TLS certificates, delivering real-time change notifications via Slack, Mattermost, and ntfy webhooks.
 
 > ⚠️ Pre-1.0 software. APIs, configuration, and behavior may change without notice.
 
@@ -61,10 +61,6 @@ rejected.
   record types: A, AAAA, CNAME, MX, TXT, SRV, CAA, NS.
 - Stores results **per nameserver**. The state for a hostname is not a
   merged view — it is a map from nameserver to record set.
-- DNS names inside record values (CNAME, MX, SRV and NS targets) are
-  stored in lower case, because names are case-insensitive and
-  nameservers may answer in any letter case. TXT and CAA values keep
-  their letter case; they are not lower-cased.
 - Any observable change in any nameserver's response triggers a
   notification. This includes:
   - **Record change**: A nameserver returns different records than it
@@ -74,15 +70,8 @@ rejected.
     This is distinct from "responded with no records."
   - **NS recovery**: A previously-unreachable nameserver starts
     responding again.
-  - **Inconsistency detected**: Two nameservers return different record
+  - **Inconsistency detected**: Two nameservers that previously agreed
-    sets for the same hostname and did not already differ on the previous
+    now return different record sets for the same hostname.
-    check. Every pair of nameservers is compared. The alert is sent once
-    for each such pair, on the check where they start to disagree, and not
-    again while they keep disagreeing, including after a restart. A
-    nameserver that was not in the previous check (newly added, or back
-    after dropping out) and answers differently is reported on the check
-    where it appears. If a pair agrees again and later disagrees, the
-    alert is sent again.
 
 ### TCP Port Monitoring
 
@@ -193,67 +182,6 @@ dnswatcher exposes a lightweight HTTP API for operational visibility:
 | `GET /api/v1/status`                  | Current monitoring state       |
 | `GET /metrics`                        | Prometheus metrics (optional)  |
 
-#### Server timeouts
-
-The HTTP server sets all four socket-level timeouts. These are compile-time
-constants in `internal/server/server.go`, not configurable via environment
-variables.
-
-| Timeout             | Value | Purpose                                       |
-|---------------------|-------|-----------------------------------------------|
-| `ReadHeaderTimeout` | 10s   | Bounds the request header read (slowloris)    |
-| `ReadTimeout`       | 15s   | Bounds the whole request read, headers + body |
-| `WriteTimeout`      | 75s   | Bounds handler execution plus response flush  |
-| `IdleTimeout`       | 120s  | Reaps idle keep-alive connections             |
-
-These are distinct from the 60s per-request handler budget applied by
-`chimw.Timeout` in `internal/server/routes.go`, which cancels the request
-context but does not touch the socket. `WriteTimeout` is deliberately
-larger than that budget: the write deadline is armed once request headers
-are read, so a smaller value would sever the connection before a handler
-using its full budget could respond. `IdleTimeout` exceeds common
-Prometheus scrape intervals so the scraper reuses its connection.
-
-### Security Headers
-
-Every response — the dashboard, the static assets under `/s/...`, the
-healthchecks, the JSON API, and `/metrics` — carries the following
-headers, set by a global middleware:
-
-| Header                      | Value                                 |
-|-----------------------------|---------------------------------------|
-| `Strict-Transport-Security` | `max-age=31536000; includeSubDomains` |
-| `Content-Security-Policy`   | see below                             |
-| `X-Frame-Options`           | `DENY`                                |
-| `X-Content-Type-Options`    | `nosniff`                             |
-| `Referrer-Policy`           | `no-referrer`                         |
-| `Permissions-Policy`        | all unused browser features denied    |
-
-The content security policy is:
-
-```
-default-src 'self'; script-src 'none'; style-src 'self'; img-src 'self';
-font-src 'none'; connect-src 'none'; object-src 'none'; base-uri 'none';
-form-action 'none'; frame-ancestors 'none'
-```
-
-The dashboard ships no JavaScript (the 30-second refresh is a
-`<meta http-equiv="refresh">`), no inline styles, no inline event
-handlers, and no images; its only subresource is the embedded stylesheet
-at `/s/css/tailwind.min.css`, which `style-src 'self'` permits. The
-policy therefore needs neither `unsafe-inline` nor `unsafe-eval`.
-`frame-ancestors 'none'` is the primary anti-framing control, with
-`X-Frame-Options: DENY` retained as the legacy fallback.
-
-HSTS is emitted unconditionally, including over plain HTTP. dnswatcher is
-expected to run behind a TLS-terminating reverse proxy, and the browser
-must still be told to enforce HTTPS end to end, so the header is never
-gated on whether the request itself arrived over TLS.
-
-`Referrer-Policy: no-referrer` is stricter than the
-`strict-origin-when-cross-origin` baseline: the dashboard has no
-cross-origin navigation needs, and its URL may name internal hosts.
-
 ---
 
 ## Architecture
@@ -266,8 +194,7 @@ internal/
   globals/globals.go           Build-time variables (version)
   logger/logger.go             slog structured logging (TTY detection)
   healthcheck/healthcheck.go   Health check service
-  middleware/middleware.go      HTTP middleware (logging, CORS, security
+  middleware/middleware.go      HTTP middleware (logging, CORS, metrics auth)
-                               headers, metrics auth and rate limit)
   handlers/handlers.go         HTTP request handlers
   server/
     server.go                  HTTP server lifecycle
@@ -278,8 +205,6 @@ internal/
   tlscheck/tlscheck.go        TLS certificate inspector
   notify/notify.go             Notification service (Slack, Mattermost, ntfy)
   watcher/watcher.go           Main monitoring orchestrator and scheduler
-  livednstest/livednstest.go   Retry and concurrency limit for tests
-                               against live DNS (imported only by tests)
 ```
 
 ### Design Principles
@@ -293,8 +218,7 @@ internal/
 - **Structured logging**: All logs use `log/slog` with JSON output in
   production (TTY detection for development).
 - **Graceful shutdown**: All background goroutines respect context
-  cancellation and the fx lifecycle. In-flight notification deliveries
+  cancellation and the fx lifecycle.
-  are drained on shutdown, bounded by the shutdown timeout.
 
 ---
 
@@ -320,8 +244,8 @@ the following precedence (highest to lowest):
 | `DNSWATCHER_SLACK_WEBHOOK`      | Slack incoming webhook URL                 | `""`        |
 | `DNSWATCHER_MATTERMOST_WEBHOOK` | Mattermost incoming webhook URL            | `""`        |
 | `DNSWATCHER_NTFY_TOPIC`         | ntfy topic URL                             | `""`        |
-| `DNSWATCHER_DNS_INTERVAL`       | DNS check interval, a positive duration such as `30m`; empty means the default, anything else stops startup | `1h` |
+| `DNSWATCHER_DNS_INTERVAL`       | DNS check interval                         | `1h`        |
-| `DNSWATCHER_TLS_INTERVAL`       | TLS check interval, a positive duration such as `6h`; empty means the default, anything else stops startup | `12h` |
+| `DNSWATCHER_TLS_INTERVAL`       | TLS check interval                         | `12h`       |
 | `DNSWATCHER_TLS_EXPIRY_WARNING` | Days before expiry to warn                 | `7`         |
 | `DNSWATCHER_SENTRY_DSN`         | Sentry DSN for error reporting             | `""`        |
 | `DNSWATCHER_MAINTENANCE_MODE`   | Enable maintenance mode                    | `false`     |
@@ -335,23 +259,6 @@ is a misconfiguration, so dnswatcher fails fast with a clear error message
 rather than running silently. Set `DNSWATCHER_TARGETS` to a comma-separated
 list of DNS names before starting.
 
-**`/metrics` is rate limited.** Each client address may send it 30 requests a
-minute, failed logins included; beyond that it answers `429 Too Many Requests`
-without checking the password. A Prometheus server scraping every 15 seconds
-sends 4 a minute. IPv6 addresses in one /64 count as one client. When the
-request comes from a private or loopback address, such as a reverse proxy's,
-the client address is taken from the `X-Real-IP` header the proxy sets, or else
-from `X-Forwarded-For`, as the last address in it that is not private or
-loopback. A proxy that sets neither makes all its clients share one allowance.
-
-**`DNSWATCHER_DNS_INTERVAL` and `DNSWATCHER_TLS_INTERVAL`** take a positive
-duration: a number followed by a unit such as `s`, `m` or `h`, for example
-`90s`, `30m`, `1h` or `1h30m`. There is no unit for days; write `24h`. An
-unset or empty variable (`DNSWATCHER_DNS_INTERVAL=`) means the default. If
-either is set to anything else, including a bare number or a zero or negative
-duration, dnswatcher refuses to start with an error naming the variable and
-the value.
-
 ### Example `.env`
 
 ```sh
@@ -473,36 +380,23 @@ standard: normalized scripts in `script/` are the entrypoints for the
 development workflow, and the Makefile targets are thin shims that call
 them. We provide:
 
-- `script/bootstrap` — install all dependencies (go, pinned goimports,
+- `script/bootstrap` — install all dependencies (go, pinned
-  `go mod download`). It does not install golangci-lint: see
+  golangci-lint and goimports, `go mod download`)
-  `script/lint` below.
 - `script/setup` — make a fresh clone ready for development: bootstrap
   plus the git pre-commit hook
 - `script/projectname` — print the project name (used for the Docker
   image tag)
-- `script/test` — run the test suite (race detector, coverage). Caching
+- `script/test` — run the test suite (race detector, coverage)
-  is waived for testing, exactly as it is for linting: `-count=1`
+- `script/lint` — run golangci-lint, with its cache and its lock file
-  forces every invocation to execute, because the suite queries live
+  isolated to this checkout (under the git-ignored `.lint-cache/`) so
-  DNS and a cached pass queries nothing. Failures are rerun with `-v`
+  concurrent checkouts on one host cannot share cache entries or
-  automatically, and the build fails even if that rerun passes.
+  contend on a single lock
-- `script/lint` — run golangci-lint, always inside Docker: it builds
-  `Dockerfile.lint`, which COPYs the repo into the digest-pinned
-  `golangci-lint` image and lints as a build step, so a successful
-  build is a clean lint. The linter is never installed or run on the
-  host, and Docker is the only prerequisite. Caching is waived for
-  linting: the lint stage is forced to execute on every run with
-  `--no-cache-filter`, because a cached build lints nothing.
 - `script/fmt` — format all code (gofmt -s, goimports)
 - `script/fmt-check` — check formatting (read-only)
 - `script/check` — run test, lint, and fmt-check
-- `script/docker` — build the Docker image tagged via `script/projectname`, with
+- `script/docker` — build the Docker image tagged via
-  `--no-cache-filter=lint,builder` so the lint stage and the builder stage,
+  `script/projectname`
-  which runs the tests, run on every invocation, and with the version from
+- `script/cibuild` — CI entrypoint: plain `docker build .`
-  `git describe` passed as `--build-arg VERSION`
-- `script/cibuild` — CI entrypoint: `docker build` with
-  `--no-cache-filter=lint,builder`, so the lint stage and the builder stage,
-  which runs the tests, run on every invocation, because a cached build lints
-  nothing and queries no DNS
 - `script/precommit` — run by the git pre-commit hook; `go mod tidy`
   guard, then `script/check`
 - `script/install-precommit` — install the git pre-commit hook
@@ -512,7 +406,7 @@ them. We provide:
 ```sh
 make build      # Build binary to bin/dnswatcher
 make test       # Run tests with race detector
-make lint       # Run golangci-lint in Docker (requires docker)
+make lint       # Run golangci-lint
 make fmt        # Format code
 make check      # Run all checks (test, lint, fmt-check)
 make clean      # Remove build artifacts
@@ -520,14 +414,11 @@ make clean      # Remove build artifacts
 
 ### Build-Time Variables
 
-`make build` sets the version with `-ldflags "-X main.Version=..."`, taking
+Version is injected via `-ldflags`:
-it from `git describe --tags --always --dirty`, or from `VERSION` when given
-on the command line (`make build VERSION=1.2.3`). The version appears in the
-startup log and in the health check response.
 
-The Docker image has no `.git`, so the `Dockerfile` takes the version as
+```sh
-`--build-arg VERSION`. `make docker` passes it; a plain `docker build`
+go build -ldflags "-X main.Version=$(git describe --tags --always)" ./cmd/dnswatcher
-passes none, and that image reports `dev`.
+```
 
 ---
 
@@ -546,47 +437,11 @@ docker run -d \
 
 ---
 
-## Running under upaas
-
-[upaas](https://git.eeqj.de/sneak/upaas) builds the image from this
-repository's `Dockerfile` and runs it. The app needs:
-
-- **Branch:** `prod`. `prod` is cut from `main`, and merging a `main` to
-  `prod` pull request is a deploy.
-- **Volume:** one host directory mounted at `/var/lib/dnswatcher`, where
-  the state file lives.
-- **Network and port:** the dashboard is unauthenticated and shows every
-  watched name and recent alert, and upaas publishes every mapped port on
-  all interfaces of the host
-  ([upaas issue 113](https://git.eeqj.de/sneak/upaas/issues/113)). Add a
-  port mapping to container port `8080` only if the dashboard should be
-  public. Otherwise add none: set the app's Docker network in upaas to
-  your reverse proxy's Docker network, and the proxy reaches the app at
-  `upaas-` followed by the app name, port `8080`.
-- **Required environment:** `DNSWATCHER_TARGETS`, a comma-separated list
-  of the domains and hostnames to watch. dnswatcher refuses to start
-  without it.
-- **Recommended environment:** at least one notification endpoint
-  (`DNSWATCHER_SLACK_WEBHOOK`, `DNSWATCHER_MATTERMOST_WEBHOOK`,
-  `DNSWATCHER_NTFY_TOPIC`); without one, changes show only on the
-  dashboard. `DNSWATCHER_METRICS_USERNAME` and
-  `DNSWATCHER_METRICS_PASSWORD` serve `/metrics` behind basic auth.
-- **Leave unset:** `DNSWATCHER_DATA_DIR`, which the image sets to
-  `/var/lib/dnswatcher`, and `PORT`, which defaults to `8080`. Every
-  setting comes from the environment; the image holds no config file.
-- **Health check:** the image's own, which requests
-  `/.well-known/healthcheck` every 10 seconds. upaas reads the
-  container's health 60 seconds after a deploy and marks the deploy
-  failed unless it is `healthy`.
-
----
-
 ## Monitoring Lifecycle
 
-1. **Startup**: Check that the data directory can be written, and exit
+1. **Startup**: Load state from disk. If no state file exists, start
-   with an error naming it if not. Load state from disk. If no state
+   with empty state (first check will establish baseline without
-   file exists, start with empty state (first check will establish
+   triggering change notifications).
-   baseline without triggering change notifications).
 2. **Initial check**: Immediately perform all DNS, port, and TLS checks
    on startup.
 3. **Periodic checks** (DNS always runs first):
@@ -600,14 +455,8 @@ repository's `Dockerfile` and runs it. The app needs:
      from a previous cycle.
 4. **On change detection**: Send notifications to all configured
    endpoints, update in-memory state, persist to disk.
-5. **Shutdown**: Persist final state to disk, wait for in-flight
+5. **Shutdown**: Persist final state to disk, complete in-flight
-   notification deliveries to complete, stop gracefully. The wait is
+   notifications, stop gracefully.
-   bounded by the fx shutdown timeout (15s by default): deliveries still
-   retrying against an unreachable endpoint when that expires are
-   abandoned, and the number abandoned is logged at warn level rather
-   than dropped silently. Notifications generated after shutdown has
-   begun are refused and logged, so a late burst cannot extend the
-   shutdown.
 
 ---
 
@@ -629,9 +478,8 @@ Viper for configuration.
 
 ## License
 
-dnswatcher is released under the MIT License, Copyright (c) 2026
+License has not yet been chosen for this project. Pending decision by the
-[@sneak](https://sneak.berlin). See the [`LICENSE`](./LICENSE) file in the
+author (MIT, GPL, or WTFPL).
-repository root for the full text.
 
 ## Author
 

REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-08-07
+last_modified: 2026-07-06
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -189,13 +189,8 @@ style conventions are in separate documents:
   module under test to verify it compiles/parses. There is no excuse for
   `make test` to be a no-op.
 
-- `make test` must complete in under 60 seconds. That is the hard cap, and a
+- `make test` must complete in under 20 seconds. Add a 30-second timeout in the
-  suite that exceeds it fails. Under 20 seconds is the target. A suite between
+  Makefile.
-  20 and 60 seconds is still green, but the overage must be filed as an
-  improvement bug against that repo. Add a 90-second timeout to the test
-  invocation in the Makefile (`go test -timeout 90s`). The backstop deliberately
-  sits above the hard cap so that it catches a genuinely hung test rather than a
-  merely slow one.
 
 - **`make test` should use the conditional verbose rerun pattern.** Run tests
   without `-v` (verbose) first. If tests fail, automatically rerun with `-v` to
@@ -214,9 +209,9 @@ style conventions are in separate documents:
 
     ```makefile
     test:
-    	@go test -timeout 90s -race -cover ./... || \
+    	@go test -timeout 30s -race -cover ./... || \
     		{ echo "--- Rerunning with -v for details ---"; \
-    		  go test -timeout 90s -race -v ./...; exit 1; }
+    		  go test -timeout 30s -race -v ./...; exit 1; }
     ```
 
     Python example:
@@ -265,10 +260,7 @@ style conventions are in separate documents:
 
 - `.golangci.yml` is standardized and must _NEVER_ be modified by an agent, only
   manually by the user. Fetch from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`. The
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`.
-  canonical golangci-lint version is v2.12.2 (released 2026-05-06), installed
-  commit-pinned via
-  `go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@c0d3ddc9cf3faa61a4e378e879ece580256d76e5`.
 
 - When pinning images or packages by hash, add a comment above the reference
   with the version and date (YYYY-MM-DD).

TESTING.md

@@ -2,12 +2,8 @@
 
 ## DNS Resolution Tests
 
-DNS is never mocked in this project, not in tests and not anywhere
+All resolver tests **MUST** use live queries against real DNS servers.
-else; see the README section "No DNS mocking. Ever." Every test that
+No mocking of the DNS client layer is permitted.
-looks something up in DNS **MUST** query live DNS servers, never a
-stand-in. Logic that works on record data, such as comparing or
-formatting records, may be tested on that data directly with no
-lookup.
 
 ### Rationale
 
@@ -21,25 +17,18 @@ real servers ensures the resolver works correctly in production.
 
 - Tests hit real DNS infrastructure and require network access
 - Test duration depends on network conditions; timeout tuning keeps
-  the suite within the 60-second target
+  the suite within the 30-second target
 - Query timeout is calibrated to 3× maximum antipodal RTT (~300ms)
   plus processing margin
 - Root server fan-out is limited to reduce parallel query load
-- Live lookups that expect an answer go through `internal/livednstest`,
-  which limits how many run at once in a test binary and retries a
-  lookup that got none
 - Flaky failures from transient network issues are acceptable and
   should be investigated as potential resolver bugs, not papered over
   with mocks or skip flags
 
 ### What NOT to do
 
-- **Do not mock, fake or stub DNS** anywhere: no stand-in `DNSClient`,
+- **Do not mock `DNSClient`** for resolver tests (the mock constructor
-  no stand-in for the watcher's `DNSResolver`, no fake DNS server, no
+  exists for unit-testing other packages that consume the resolver)
-  canned responses
 - **Do not add `-short` flags** to skip slow tests
 - **Do not increase `-timeout`** to hide hanging queries
-- **Do not remove `-count=1` from `script/test`** — Go's test cache
-  replays a previous run's output without querying anything, so a
-  cached pass is not evidence that live resolution works
 - **Do not modify linter configuration** to suppress findings

TODO.md

@@ -1,115 +1,162 @@
 # Workflow
 
-* branch (from `next`)
+* branch (from `main`)
 * do the work in Next Step
 * move Next Step to the top of Completed Steps
 * move the top item of Future Steps into Next Step
 * commit (`TODO.md` changes in the same commit as the work)
+* merge to `main` if the branch is not protected, otherwise open a PR
 * push
-* open a PR against `next`
 
 # Status
 
-pre-1.0. No git tags. Work lands on `next` by PR. Open work for 1.0 is tracked
+pre-1.0. No git tags. Core resolver work in flight on feature/resolver
-on the 1.0 milestone: https://git.eeqj.de/sneak/dnswatcher/milestone/7
+(dirty: internal/resolver/resolver_test.go). Local checkout has diverged
+from origin: origin/main is 8 commits ahead (watcher orchestrator,
+unified TARGETS) and origin/feature/resolver already contains the full
+iterative resolver implementation with hermetic mocked tests.
 
 # Next Step
 
-NS failure and NS recovery notifications:
+Policy scaffold commit: add LICENSE, REPO_POLICIES.md, .editorconfig,
-https://git.eeqj.de/sneak/dnswatcher/issues/104
+.dockerignore, and .gitea/workflows/check.yml, and add the missing
+fmt-check, docker, and hooks targets to the Makefile. One commit, then
+confirm make check still passes.
 
 # Completed Steps
 
-- 2026-10-01: the client address from `X-Forwarded-For` is the last entry that
+- 2026-08-09: `script/lint` now isolates golangci-lint's per-user global
-  is not a trusted proxy, not the first, which the client sets (closes #181).
+  state to the checkout (#121): `GOLANGCI_LINT_CACHE` and `TMPDIR` are
-- 2026-10-01: a `DNSWATCHER_DNS_INTERVAL` or `DNSWATCHER_TLS_INTERVAL` that is
+  both pointed at the git-ignored, Docker-ignored `.lint-cache/`. The
-  not a positive duration stops startup; empty means the default (closes #177).
+  cache fixes cross-contamination; `TMPDIR` is what moves the lock,
-- 2026-10-01: `/metrics` allows each client address 30 requests a minute,
+  which lives at `$TMPDIR/golangci-lint.lock` and not in the cache
-  counted before Basic Auth, and answers 429 beyond that (closes #101).
+  directory. Reproduced both failure modes on the unfixed script (10 of
-- 2026-10-01: the image built by `make docker` reports the `git describe`
+  12 concurrent runs void with `parallel golangci-lint is running`; 11
-  version, not `dev`, and the startup log now shows it (closes #109).
+  of 12 reporting another checkout's paths) and both are gone at 20-way
-- 2026-10-01: two notify shutdown tests always release the delivery they hold,
+  concurrency after the fix
-  so a drain that returns early fails them instead of hanging (closes #176).
+- 2026-08-07: golangci-lint bumped to v2.12.2 (commit-pinned installs
-- 2026-10-01: `script/install-precommit` asks git for the repository's git
+  in `Dockerfile` and `script/bootstrap`); `.golangci.yml` set to the
-  directory, so `make hooks` also works where `.git` is a file (closes #129).
+  org-standard v2-schema config used across the org's repos
-- 2026-10-01: `TODO.md` brought up to date: open issues listed by URL, every
+  (owner-authorized; same file is being landed as canonical via prompts
-  Completed Steps entry cut to at most two lines (closes #146).
+  PR #24), with settings under `linters.settings` so the
-- 2026-10-01: wildcard CORS now applies only to the public routes, not to
+  lll/funlen/cyclop/dupl thresholds apply; fixed the resulting
-  `/metrics`, and allows only the methods they serve (closes #100).
+  `goconst`, `dupl`, and `lll` findings; the informational `gomodguard`
-- 2026-10-01: `internal/state` and `internal/watcher` no longer export test-only
+  deprecation warning under this config is accepted
-  constructors: two moved to `export_test.go`, one is deleted (closes #111).
+- 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
-- 2026-10-01: notify shutdown tests use one timing constant per meaning, name
+  Makefile shims, README Entrypoints section
-  the bound they check, and require the drain's debug line (closes #116).
+- 2026-02-20: iterative DNS resolver implemented; tests made hermetic
-- 2026-09-29: the entrypoint chowns the data directory to `dnswatcher` and runs
+  with mocked DNS (origin/feature/resolver, unmerged)
-  dnswatcher as that user, so a host bind mount needs no chown (closes #166).
+- 2026-02-20: CI actions and go install refs pinned to commit SHAs;
-- 2026-09-29: the live-DNS test package is renamed `internal/livednstest`;
+  Gitea Actions workflow for make check (origin/ci/make-check, unmerged)
-  `make lint` fails when program code imports it (closes #164).
-- 2026-09-29: `.golangci.yml` re-fetched from `sneak/prompts`, with
-  `gomodguard_v2` and the org `depguard` `test-support` rule (closes #123).
-- 2026-09-29: watcher and resolver tests that look something up in DNS use the
-  real resolver against live DNS servers (closes #159).
-- 2026-09-28: the inconsistency alert is sent once, when two nameservers start
-  to disagree; every pair of nameservers is compared (closes #158).
-- 2026-09-28: DNS names in record values (CNAME, MX, SRV and NS targets) are
-  lower-cased, so letter case alone is not a change (closes #157).
-- 2026-09-28: lint and tests run on every build: `script/cibuild` and
-  `script/docker` pass `--no-cache-filter=lint,builder` (closes #115).
-- 2026-09-28: the server timeout test drives `Run` and checks the timeouts on
-  the `http.Server` it serves (closes #120).
-- 2026-09-28: upaas deploy readiness: the image runs as user `dnswatcher` with a
-  `HEALTHCHECK`; README "Running under upaas" (closes #147).
-- 2026-09-21: added behavioural tests for `internal/globals`,
-  `internal/healthcheck`, and `internal/logger` (closes #110).
-- 2026-09-21: `go mod tidy` dropped the redundant `golang.org/x/sync`
-  `// indirect` line so `script/bootstrap` leaves a clean tree (#132)
-- 2026-08-10: comment-only corrections to `script/bootstrap`, `script/cibuild`
-  and `Dockerfile.lint`; no behaviour changed.
-- 2026-08-10: MIT `LICENSE` added at the repository root; the README's first
-  line and License section name the licence.
-- 2026-08-10: policy scaffold present: `REPO_POLICIES.md`, `.editorconfig`,
-  `.dockerignore`, CI workflow, `make fmt-check`, `make docker`, `make hooks`.
-- 2026-08-10: Go's test cache disabled in `script/test` (`-count=1`), so every
-  run queries live DNS; a failed run is rerun with `-v`.
-- 2026-08-10: live-DNS tests made robust rather than gated (#93): a limit on
-  concurrent lookups, retries, and a quorum across nameservers.
-- 2026-08-10: all linting moved into Docker: `script/lint` builds
-  `Dockerfile.lint`, and the root `Dockerfile` has its own lint stage.
-- 2026-08-09: in-flight notification deliveries are drained at shutdown, bounded
-  by the shutdown deadline (#106).
-- 2026-08-09: `http.Server` sets all four socket timeouts; `WriteTimeout` stays
-  above the 60s handler timeout (#99).
-- 2026-08-09: `SecurityHeaders()` middleware sets HSTS, CSP and the other
-  security headers `REPO_POLICIES.md` requires on every response.
-- 2026-08-07: golangci-lint bumped to v2.12.2 and `.golangci.yml` set to the org
-  config; fixed the resulting `goconst`, `dupl` and `lll` findings.
-- 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints, Makefile
-  shims, README Entrypoints section
-- 2026-02-20: iterative DNS resolver implemented
-- 2026-02-20: CI actions and go install refs pinned to commit SHAs; Gitea
-  Actions workflow added
 - 2026-02-20: watcher monitoring orchestrator merged to main (#8)
 - 2026-02-20: DOMAINS/HOSTNAMES unified into single TARGETS config (#11)
 - 2026-02-19: TCP port connectivity checker, made concurrent with port
   validation; gosec G704 SSRF findings fixed without suppression
-- 2026-02-19: TLS certificate inspector with no-peer-certificates error path and
+  (feature branches, unmerged)
-  IP SANs
+- 2026-02-19: TLS certificate inspector with no-peer-certificates error
+  path and IP SANs (feature branch, unmerged)
 - 2026-02-19: gosec SSRF and formatting fixes on main
 - 2026-02-19: initial scaffold with per-nameserver DNS monitoring model
 
 # Future Steps
 
-- nameserver IP address changes: https://git.eeqj.de/sneak/dnswatcher/issues/105
+Compliance:
-- `DNSWATCHER_SENTRY_DSN` does nothing:
+
-  https://git.eeqj.de/sneak/dnswatcher/issues/107
+- Add README sections required by policy (Description, Getting Started,
-- trial run of the finished image:
+  Rationale, Design, TODO, License, Author) if any are missing
-  https://git.eeqj.de/sneak/dnswatcher/issues/149
+- Pin Dockerfile base images by sha256 and ensure the Docker build runs
-- 1.0 readiness: run it with a real config and read the logs:
+  make check
-  https://git.eeqj.de/sneak/dnswatcher/issues/66
+
-- `goimports` in `make fmt-check`, Markdown formatting:
+Branch reconciliation:
-  https://git.eeqj.de/sneak/dnswatcher/issues/119
+
-- final state save at shutdown: https://git.eeqj.de/sneak/dnswatcher/issues/114
+- Sync local checkout with origin: local main is 8 commits behind
-- README accuracy sweep: https://git.eeqj.de/sneak/dnswatcher/issues/108
+  origin/main; local feature/resolver has diverged from
-- README sections required by policy:
+  origin/feature/resolver, which already implements the resolver
-  https://git.eeqj.de/sneak/dnswatcher/issues/173
+- Merge in-flight branches to main once green: feature/resolver,
-- fixed root server order: https://git.eeqj.de/sneak/dnswatcher/issues/138
+  ci/make-check, feature/portcheck-implementation,
-- review toward 1.0: https://git.eeqj.de/sneak/dnswatcher/issues/144
+  feature/tlscheck-implementation
+
+Resolver (plan from untracked TODO.md; largely implemented on
+origin/feature/resolver, verify each item before closing):
+
+- Add github.com/miekg/dns dependency
+- roots.go: hardcoded IANA root server list (a through m, IPv4/IPv6),
+  rootServers() returning ip:53 strings
+- query.go: low-level query(ctx, server, name, qtype): UDP with TCP
+  fallback on truncation, RD=0, context respected, 5s per-query timeout,
+  returns raw *dns.Msg
+- trace.go: iterative delegation chasing from roots: referral detection
+  (NOERROR, empty answer, NS in authority), glue extraction with
+  bailiwick check, out-of-bailiwick NS resolved with recursion guard,
+  delegation depth limit (20), retry across nameservers on failure, do
+  not chase CNAMEs inside trace
+- FindAuthoritativeNameservers: NS set via trace, sorted, FQDN
+  normalized, trailing dot handled; must pass its 9 tests
+- QueryNameserver: resolve NS host to IPs, query A/AAAA/CNAME/MX/TXT/
+  SRV/CAA/NS, build NameserverResponse with status mapping (OK,
+  NXDomain, NoData, Error), documented record formatting, sorted values,
+  lame delegation detection; must pass its 16 tests
+- QueryAllNameservers: find NS set for parent domain (public suffix
+  list), query all NS in parallel with bounded concurrency, return map
+  even when all fail, context cancellation; must pass its 4 tests
+- LookupNS: thin wrapper over FindAuthoritativeNameservers, sorted,
+  identical results; must pass its 3 tests
+- ResolveIPAddresses: collect A/AAAA from all NS, follow CNAME chains
+  with MaxCNAMEDepth, dedupe, sort, NXDOMAIN returns empty slice with
+  nil error; must pass its 9 tests
+- All 39 resolver tests pass, make check green, merge to main
+
+Watcher (internal/watcher/watcher.go):
+
+- Scheduling loop in Run(ctx): initial check on startup, separate
+  tickers for DNS/port and TLS intervals, persist state via state.Save()
+  after each cycle, clean shutdown on context cancel
+- Domain check: LookupNS, compare to stored state, store silently on
+  first run, notify with old/new NS lists on change
+- Hostname check: QueryAllNameservers, compare per-NS records; notify on
+  record changes, NS failure, NS recovery, inconsistency detected,
+  inconsistency resolved, empty response; store silently on first run
+- Port check: ResolveIPAddresses, check ports 80 and 443 per IP, notify
+  on open/closed transitions, handle new and disappeared IPs
+- TLS check: for each open IP:443, CheckCertificate; notify on expiry
+  warning, certificate change (CN/issuer/SANs), TLS failure/recovery
+
+Port checker (internal/portcheck/portcheck.go):
+
+- Tests against known-open ports and RFC documentation IPs
+- CheckPort: net.DialTimeout (5s), context respected; (true, nil) open,
+  (false, nil) closed/timeout/refused, error only for unexpected
+  failures
+
+TLS checker (internal/tlscheck/tlscheck.go):
+
+- Tests against known public HTTPS servers, verify fields populated
+- CheckCertificate: tls.Dial to specific IP:443 with hostname as SNI;
+  extract subject CN, issuer CN and org, NotAfter, SANs; error on
+  handshake failure
+
+Notification service (internal/notify/notify.go, Slack/Mattermost/ntfy
+backends exist):
+
+- Structured notification types: DNS change, port change, TLS expiry,
+  TLS change, NS failure, NS recovery, NS inconsistency
+- Per-backend formatting: Slack/Mattermost attachment colors (red
+  failures/expiry, yellow warnings, green recoveries, blue info); ntfy
+  priorities (urgent failures, high warnings, default changes, low
+  recoveries); include hostname, nameserver, old/new values, timestamps
+
+HTTP API handlers:
+
+- Wire *state.State and *watcher.Watcher into handler params
+- GET /api/v1/status: full state snapshot as JSON
+- GET /api/v1/domains: domain states with NS records and last-checked
+- GET /api/v1/hostnames: hostname states with per-NS record data
+
+Infrastructure notes (from untracked TODO.md):
+
+- Module path sneak.berlin/go/dnswatcher differs from the git.eeqj.de
+  remote intentionally; do not "fix" it
+- Dependencies: github.com/miekg/dns, golang.org/x/net/publicsuffix
+- Resolver tests originally used live DNS against *.dns.sneak.cloud
+  (required records documented in the test file header); origin now has
+  mocked hermetic tests, keep them hermetic

cmd/dnswatcher/main.go

@@ -63,7 +63,6 @@ func main() {
 				return n
 			},
 		),
-		fx.Invoke(func(l *logger.Logger) { l.Identify() }),
 		fx.Invoke(func(*server.Server, *watcher.Watcher) {}),
 	).Run()
 }

deploy/docker-entrypoint.sh

@@ -1,17 +0,0 @@
-#!/bin/sh
-# deploy/docker-entrypoint.sh: the Docker image's ENTRYPOINT. It runs as
-# root only to give the data directory to the dnswatcher user: a host
-# directory bind-mounted there keeps its host owner, often root, and may
-# hold a state file left by another uid, which dnswatcher could neither
-# read nor replace. dnswatcher itself always runs as the dnswatcher user.
-set -eu
-
-main() {
-    dir="${DNSWATCHER_DATA_DIR:-/var/lib/dnswatcher}"
-    mkdir -p "$dir"
-    chown -R dnswatcher:dnswatcher "$dir"
-    chmod 700 "$dir"
-    exec su-exec dnswatcher /usr/local/bin/dnswatcher "$@"
-}
-
-main "$@"

go.mod

@@ -6,7 +6,6 @@ require (
 	github.com/99designs/basicauth-go v0.0.0-20230316000542-bf6f9cbbf0f8
 	github.com/go-chi/chi/v5 v5.2.5
 	github.com/go-chi/cors v1.2.2
-	github.com/go-chi/httprate v0.16.0
 	github.com/joho/godotenv v1.5.1
 	github.com/miekg/dns v1.1.72
 	github.com/prometheus/client_golang v1.23.2
@@ -23,7 +22,6 @@ require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.10 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
@@ -36,13 +34,13 @@ require (
 	github.com/spf13/cast v1.10.0 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
-	github.com/zeebo/xxh3 v1.0.2 // indirect
 	go.uber.org/dig v1.19.0 // indirect
 	go.uber.org/multierr v1.10.0 // indirect
 	go.uber.org/zap v1.26.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/mod v0.32.0 // indirect
+	golang.org/x/sync v0.19.0 // indirect
 	golang.org/x/sys v0.41.0 // indirect
 	golang.org/x/text v0.34.0 // indirect
 	golang.org/x/tools v0.41.0 // indirect

go.sum

@@ -14,8 +14,6 @@ github.com/go-chi/chi/v5 v5.2.5 h1:Eg4myHZBjyvJmAFjFvWgrqDTXFyOzjj7YIm3L3mu6Ug=
 github.com/go-chi/chi/v5 v5.2.5/go.mod h1:X7Gx4mteadT3eDOMTsXzmI4/rwUpOwBHLpAfupzFJP0=
 github.com/go-chi/cors v1.2.2 h1:Jmey33TE+b+rB7fT8MUy1u0I4L+NARQlK6LhzKPSyQE=
 github.com/go-chi/cors v1.2.2/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58=
-github.com/go-chi/httprate v0.16.0 h1:8V5DH9j6pSK6UQoBsTpvMyFxycqaKEIToyPKzHJjUa8=
-github.com/go-chi/httprate v0.16.0/go.mod h1:A8lo+qRhk+s9LiuP5saS7XCGDXRXMcrueq0NfIuCa/I=
 github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
 github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
@@ -24,8 +22,6 @@ github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
 github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
 github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
-github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=
-github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -66,10 +62,6 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
-github.com/zeebo/assert v1.3.0 h1:g7C04CbJuIDKNPFHmsk4hwZDO5O+kntRxzaUoNXj+IQ=
-github.com/zeebo/assert v1.3.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
-github.com/zeebo/xxh3 v1.0.2 h1:xZmwmqxHZA8AI603jOQ0tMqmBr9lPeFwGg6d+xy9DC0=
-github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA=
 go.uber.org/dig v1.19.0 h1:BACLhebsYdpQ7IROQ1AGPjrXcP5dF80U3gKoFzbaq/4=
 go.uber.org/dig v1.19.0/go.mod h1:Us0rSJiThwCv2GteUN0Q7OKvU7n5J4dxZ9JKUXozFdE=
 go.uber.org/fx v1.24.0 h1:wE8mruvpg2kiiL1Vqd0CC+tr0/24XIB10Iwp2lLWzkg=

internal/config/config.go

@@ -28,13 +28,6 @@ var ErrNoTargets = errors.New(
 	"no monitoring targets configured: set DNSWATCHER_TARGETS environment variable",
 )
 
-// ErrInvalidInterval is returned when DNSWATCHER_DNS_INTERVAL or
-// DNSWATCHER_TLS_INTERVAL is set but is not a positive duration. An empty
-// value counts as unset and means the default.
-var ErrInvalidInterval = errors.New(
-	"interval must be a positive duration such as 30m or 1h",
-)
-
 // Params contains dependencies for Config.
 type Params struct {
 	fx.In
@@ -132,14 +125,18 @@ func buildConfig(
 		}
 	}
 
-	dnsInterval, err := parseInterval("DNS_INTERVAL")
+	dnsInterval, err := time.ParseDuration(
+		viper.GetString("DNS_INTERVAL"),
+	)
 	if err != nil {
-		return nil, err
+		dnsInterval = defaultDNSInterval
 	}
 
-	tlsInterval, err := parseInterval("TLS_INTERVAL")
+	tlsInterval, err := time.ParseDuration(
+		viper.GetString("TLS_INTERVAL"),
+	)
 	if err != nil {
-		return nil, err
+		tlsInterval = defaultTLSInterval
 	}
 
 	domains, hostnames, err := parseAndValidateTargets()
@@ -171,22 +168,6 @@ func buildConfig(
 	return cfg, nil
 }
 
-// parseInterval reads the DNSWATCHER_-prefixed setting key as a duration. A
-// value that does not parse, or is zero or negative, is an error naming the
-// variable and the value; an unset variable has its default from setupViper.
-func parseInterval(key string) (time.Duration, error) {
-	value := viper.GetString(key)
-
-	interval, err := time.ParseDuration(value)
-	if err != nil || interval <= 0 {
-		return 0, fmt.Errorf(
-			"invalid DNSWATCHER_%s %q: %w", key, value, ErrInvalidInterval,
-		)
-	}
-
-	return interval, nil
-}
-
 func parseAndValidateTargets() ([]string, []string, error) {
 	domains, hostnames, err := ClassifyTargets(
 		parseCSV(viper.GetString("TARGETS")),

internal/config/config_test.go

@@ -1,7 +1,6 @@
 package config_test
 
 import (
-	"strconv"
 	"testing"
 	"time"
 
@@ -114,40 +113,33 @@ func TestNew_OnlyEmptyCSVSegments(t *testing.T) {
 	assert.ErrorIs(t, err, config.ErrNoTargets)
 }
 
-// TestNew_InvalidIntervalStopsStartup checks values that must stop startup;
+func TestNew_InvalidDNSInterval_FallsBackToDefault(t *testing.T) {
-// TestNew_DefaultValues and TestNew_EmptyIntervalMeansDefault check that an
-// unset or empty interval means the default.
-func TestNew_InvalidIntervalStopsStartup(t *testing.T) {
-	variables := []string{"DNSWATCHER_DNS_INTERVAL", "DNSWATCHER_TLS_INTERVAL"}
-	values := []string{
-		"banana", // not a duration
-		"5",      // no unit
-		"1d",     // days are not a unit time.ParseDuration knows
-		"0",      // zero
-		"-1h",    // negative
-	}
-
-	for _, variable := range variables {
-		for _, value := range values {
-			t.Run(variable+"="+value, func(t *testing.T) {
 	viper.Reset()
 	t.Setenv("DNSWATCHER_TARGETS", "example.com")
-				t.Setenv(variable, value)
+	t.Setenv("DNSWATCHER_DNS_INTERVAL", "banana")
 
-				_, err := config.New(nil, newTestParams(t))
+	cfg, err := config.New(nil, newTestParams(t))
-				require.ErrorIs(t, err, config.ErrInvalidInterval)
+	require.NoError(t, err)
-				require.ErrorContains(t, err, variable)
+	assert.Equal(t, time.Hour, cfg.DNSInterval,
-				require.ErrorContains(t, err, strconv.Quote(value))
+		"invalid DNS interval should fall back to 1h default")
-			})
-		}
-	}
 }
 
-func TestNew_EmptyIntervalMeansDefault(t *testing.T) {
+func TestNew_InvalidTLSInterval_FallsBackToDefault(t *testing.T) {
 	viper.Reset()
 	t.Setenv("DNSWATCHER_TARGETS", "example.com")
-	t.Setenv("DNSWATCHER_DNS_INTERVAL", "")
+	t.Setenv("DNSWATCHER_TLS_INTERVAL", "notaduration")
-	t.Setenv("DNSWATCHER_TLS_INTERVAL", "")
+
+	cfg, err := config.New(nil, newTestParams(t))
+	require.NoError(t, err)
+	assert.Equal(t, 12*time.Hour, cfg.TLSInterval,
+		"invalid TLS interval should fall back to 12h default")
+}
+
+func TestNew_BothIntervalsInvalid(t *testing.T) {
+	viper.Reset()
+	t.Setenv("DNSWATCHER_TARGETS", "example.com")
+	t.Setenv("DNSWATCHER_DNS_INTERVAL", "xyz")
+	t.Setenv("DNSWATCHER_TLS_INTERVAL", "abc")
 
 	cfg, err := config.New(nil, newTestParams(t))
 	require.NoError(t, err)

internal/globals/globals_test.go

@@ -1,50 +0,0 @@
-package globals_test
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"sneak.berlin/go/dnswatcher/internal/globals"
-)
-
-// TestGlobals exercises the package-level version and appname
-// variables through their setters and read-back via New. These are
-// shared package state, so the test mutates a global and must run
-// sequentially; it cannot use t.Parallel().
-//
-//nolint:paralleltest // mutates shared package-level globals, must run sequentially
-func TestGlobals(t *testing.T) {
-	versions := []string{"v1.2.3", "dev", "", "v1.2.3-4-gabcdef"}
-	for _, want := range versions {
-		globals.SetVersion(want)
-
-		g, err := globals.New(nil)
-		require.NoError(t, err)
-		assert.Equal(t, want, g.Version,
-			"New must surface the version set by SetVersion")
-	}
-
-	names := []string{"dnswatcher", "other", ""}
-	for _, want := range names {
-		globals.SetAppname(want)
-
-		g, err := globals.New(nil)
-		require.NoError(t, err)
-		assert.Equal(t, want, g.Appname,
-			"New must surface the appname set by SetAppname")
-	}
-
-	// New returns a snapshot: a later SetVersion must not mutate a
-	// Globals handed out earlier.
-	globals.SetVersion("first")
-
-	g, err := globals.New(nil)
-	require.NoError(t, err)
-
-	globals.SetVersion("second")
-	assert.Equal(t, "first", g.Version,
-		"a Globals returned by New must not change when the "+
-			"package variable is set again")
-}

internal/healthcheck/healthcheck_test.go

@@ -1,134 +0,0 @@
-package healthcheck_test
-
-import (
-	"context"
-	"encoding/json"
-	"testing"
-	"time"
-
-	"go.uber.org/fx"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"sneak.berlin/go/dnswatcher/internal/config"
-	"sneak.berlin/go/dnswatcher/internal/globals"
-	"sneak.berlin/go/dnswatcher/internal/healthcheck"
-	"sneak.berlin/go/dnswatcher/internal/logger"
-)
-
-// recordingLifecycle is a minimal fx.Lifecycle that records the hooks
-// appended to it, so healthcheck.New can be exercised through its real
-// constructor without standing up a whole fx application.
-type recordingLifecycle struct {
-	hooks []fx.Hook
-}
-
-func (l *recordingLifecycle) Append(hook fx.Hook) {
-	l.hooks = append(l.hooks, hook)
-}
-
-// newHealthcheck builds a Healthcheck through the real constructor and
-// runs the registered OnStart hook so StartupTime is set the same way
-// the fx lifecycle would set it.
-func newHealthcheck(
-	t *testing.T,
-	maintenance bool,
-	version string,
-) *healthcheck.Healthcheck {
-	t.Helper()
-
-	g := &globals.Globals{Appname: "dnswatcher", Version: version}
-
-	log, err := logger.New(nil, logger.Params{Globals: g})
-	require.NoError(t, err)
-
-	lifecycle := &recordingLifecycle{}
-
-	hc, err := healthcheck.New(lifecycle, healthcheck.Params{
-		Globals: g,
-		Config:  &config.Config{MaintenanceMode: maintenance},
-		Logger:  log,
-	})
-	require.NoError(t, err)
-
-	require.Len(t, lifecycle.hooks, 1,
-		"New must register exactly one lifecycle hook")
-	require.NotNil(t, lifecycle.hooks[0].OnStart)
-	require.NoError(t, lifecycle.hooks[0].OnStart(context.Background()))
-
-	return hc
-}
-
-func TestCheckStatusAndPayloadShape(t *testing.T) {
-	t.Parallel()
-
-	hc := newHealthcheck(t, false, "v9.9.9")
-	resp := hc.Check()
-
-	assert.Equal(t, "ok", resp.Status)
-
-	// The JSON shape and field names are part of the contract for the
-	// /health and /.well-known/healthcheck routes, so assert on the
-	// exact set of keys the response marshals to.
-	raw, err := json.Marshal(resp)
-	require.NoError(t, err)
-
-	var fields map[string]json.RawMessage
-	require.NoError(t, json.Unmarshal(raw, &fields))
-
-	wantKeys := []string{
-		"status",
-		"now",
-		"uptimeSeconds",
-		"uptimeHuman",
-		"version",
-		"appname",
-		"maintenanceMode",
-	}
-	assert.Len(t, fields, len(wantKeys),
-		"response must marshal to exactly the documented fields")
-
-	for _, key := range wantKeys {
-		assert.Contains(t, fields, key, "missing JSON field %q", key)
-	}
-
-	// The Now field is documented as RFC3339Nano; a change to the
-	// format constant should turn this red.
-	_, err = time.Parse(time.RFC3339Nano, resp.Now)
-	assert.NoError(t, err, "Now must be RFC3339Nano")
-}
-
-func TestCheckMaintenanceModeReflectsConfig(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name        string
-		maintenance bool
-	}{
-		{"maintenance off", false},
-		{"maintenance on", true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			hc := newHealthcheck(t, tt.maintenance, "test")
-			resp := hc.Check()
-			assert.Equal(t, tt.maintenance, resp.Maintenance,
-				"maintenanceMode must mirror Config.MaintenanceMode")
-		})
-	}
-}
-
-func TestCheckSurfacesVersionAndAppname(t *testing.T) {
-	t.Parallel()
-
-	hc := newHealthcheck(t, false, "surfaced-version-123")
-	resp := hc.Check()
-
-	assert.Equal(t, "surfaced-version-123", resp.Version,
-		"version from globals must appear in the payload")
-	assert.Equal(t, "dnswatcher", resp.Appname)
-}

internal/livednstest/livednstest.go

@@ -1,121 +0,0 @@
-// Package livednstest runs the live DNS operations of tests. Tests that
-// look something up in DNS query live DNS servers, never a stand-in —
-// see TESTING.md. Nothing here mocks, fakes, stubs, records or replays
-// DNS, and nothing here skips a test: it only changes *how* the live
-// queries are issued, so that a single dropped UDP packet or one slow
-// authoritative server does not turn correct code into a red build.
-//
-// Two mechanisms:
-//
-//  1. Bounded concurrency. Tests run in parallel and the build hosts
-//     have many cores, so without a limit every test starts its own
-//     iterative resolution at the same instant and they all hit the
-//     first root server within a few milliseconds of each other. Root
-//     servers rate-limit that, which shows up as a different arbitrary
-//     subset of tests failing on each run. Run caps how many live
-//     operations are in flight at once in one test binary.
-//
-//  2. Retry with exponential backoff. Each live operation gets several
-//     attempts with its own timeout. An attempt is retried when it
-//     obtained nothing to check, never because of what the test
-//     asserts about the result, so a wrong result still fails on the
-//     first attempt. A fault in the code under test that leaves
-//     nothing to check looks the same as live DNS not answering, and
-//     fails only after the last attempt.
-package livednstest
-
-import (
-	"context"
-	"errors"
-	"testing"
-	"time"
-)
-
-const (
-	// attempts is how many times a live DNS operation is attempted
-	// before the test fails.
-	attempts = 3
-
-	// AttemptTimeout bounds one attempt. Worst case for an operation
-	// is attempts * AttemptTimeout plus the backoff — about 26
-	// seconds, well inside the 90-second `go test -timeout` backstop
-	// even when several operations exhaust their attempts.
-	AttemptTimeout = 8 * time.Second
-
-	// backoffBase is the delay after the first failed attempt; it is
-	// multiplied by backoffFactor each time.
-	backoffBase = 500 * time.Millisecond
-
-	// backoffFactor is the exponential backoff multiplier.
-	backoffFactor = 2
-
-	// Concurrency caps how many live operations may be in flight
-	// across one test binary at once.
-	Concurrency = 6
-)
-
-// gate bounds concurrent live operations. It has to be package scoped:
-// the whole point is that it is shared by every parallel test in the
-// test binary.
-//
-//nolint:gochecknoglobals // package-wide live query rate limit
-var gate = make(chan struct{}, Concurrency)
-
-// ErrNoAnswer reports that a live operation produced no usable answer,
-// which is retried rather than asserted on.
-var ErrNoAnswer = errors.New("no answer from live DNS")
-
-// Run executes one attempt of a live operation, holding a slot in gate
-// for its duration and bounding it with its own timeout.
-func Run(op func(ctx context.Context) error) error {
-	gate <- struct{}{}
-	defer func() { <-gate }()
-
-	ctx, cancel := context.WithTimeout(
-		context.Background(), AttemptTimeout,
-	)
-	defer cancel()
-
-	return op(ctx)
-}
-
-// Retry runs op until it reports success, retrying failures with
-// exponential backoff, and fails the test if every attempt fails. op
-// returns an error only for a failure to obtain an answer — never for
-// an answer the test disagrees with, which belongs in an assertion so
-// that it fails immediately. op stores whatever it obtained where its
-// caller can find it.
-func Retry(
-	t *testing.T,
-	what string,
-	op func(ctx context.Context) error,
-) {
-	t.Helper()
-
-	var last error
-
-	backoff := backoffBase
-
-	for attempt := range attempts {
-		if attempt > 0 {
-			t.Logf(
-				"%s: attempt %d of %d failed (%v), "+
-					"retrying in %s",
-				what, attempt, attempts, last, backoff,
-			)
-			time.Sleep(backoff)
-
-			backoff *= backoffFactor
-		}
-
-		last = Run(op)
-		if last == nil {
-			return
-		}
-	}
-
-	t.Fatalf(
-		"%s: all %d live attempts failed: %v",
-		what, attempts, last,
-	)
-}

internal/livednstest/livednstest_test.go

@@ -1,103 +0,0 @@
-package livednstest_test
-
-import (
-	"context"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-
-	"sneak.berlin/go/dnswatcher/internal/livednstest"
-)
-
-// Tests for the retry and the concurrency limit themselves. They
-// perform no DNS resolution of any kind.
-
-func TestRetryRecoversFromTransientFailure(t *testing.T) {
-	t.Parallel()
-
-	const wantAttempts = 2
-
-	attempts := 0
-
-	livednstest.Retry(t, "transient", func(_ context.Context) error {
-		attempts++
-
-		if attempts < wantAttempts {
-			return livednstest.ErrNoAnswer
-		}
-
-		return nil
-	})
-
-	assert.Equal(t, wantAttempts, attempts)
-}
-
-func TestRetryGivesEachAttemptADeadline(t *testing.T) {
-	t.Parallel()
-
-	livednstest.Retry(t, "deadline", func(ctx context.Context) error {
-		deadline, ok := ctx.Deadline()
-		assert.True(t, ok, "attempt should carry a deadline")
-
-		remaining := time.Until(deadline)
-
-		assert.LessOrEqual(t, remaining, livednstest.AttemptTimeout)
-
-		// Lower bound too: without one this passes for a
-		// deadline far shorter than intended, which would
-		// silently turn every live attempt into an instant
-		// timeout.
-		assert.Greater(t, remaining, livednstest.AttemptTimeout/2)
-
-		return nil
-	})
-}
-
-func TestRunBoundsConcurrency(t *testing.T) {
-	t.Parallel()
-
-	const workers = 24
-
-	var (
-		mu       sync.Mutex
-		wg       sync.WaitGroup
-		inFlight int
-		maxSeen  int
-	)
-
-	wg.Add(workers)
-
-	for range workers {
-		go func() {
-			defer wg.Done()
-
-			_ = livednstest.Run(func(_ context.Context) error {
-				mu.Lock()
-				inFlight++
-
-				if inFlight > maxSeen {
-					maxSeen = inFlight
-				}
-				mu.Unlock()
-
-				time.Sleep(time.Millisecond)
-
-				mu.Lock()
-				inFlight--
-				mu.Unlock()
-
-				return nil
-			})
-		}()
-	}
-
-	wg.Wait()
-
-	assert.Positive(t, maxSeen)
-	assert.LessOrEqual(
-		t, maxSeen, livednstest.Concurrency,
-		"live queries must stay under the package-wide gate",
-	)
-}

internal/logger/logger_test.go

@@ -1,66 +0,0 @@
-package logger_test
-
-import (
-	"context"
-	"log/slog"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"sneak.berlin/go/dnswatcher/internal/globals"
-	"sneak.berlin/go/dnswatcher/internal/logger"
-)
-
-func newTestLogger(t *testing.T) *logger.Logger {
-	t.Helper()
-
-	g := &globals.Globals{Appname: "dnswatcher", Version: "test"}
-
-	l, err := logger.New(nil, logger.Params{Globals: g})
-	require.NoError(t, err)
-
-	return l
-}
-
-// TestNewReturnsUsableLogger checks that the constructor yields a
-// working *slog.Logger.
-func TestNewReturnsUsableLogger(t *testing.T) {
-	t.Parallel()
-
-	l := newTestLogger(t)
-	require.NotNil(t, l.Get(), "Get must return a non-nil logger")
-}
-
-// TestDefaultLevelExcludesDebug verifies the default configuration
-// logs at info: debug records are suppressed, info records pass.
-func TestDefaultLevelExcludesDebug(t *testing.T) {
-	t.Parallel()
-
-	log := newTestLogger(t).Get()
-	ctx := context.Background()
-
-	assert.False(t, log.Enabled(ctx, slog.LevelDebug),
-		"debug must be suppressed at the default level")
-	assert.True(t, log.Enabled(ctx, slog.LevelInfo),
-		"info must be enabled at the default level")
-}
-
-// TestEnableDebugLoggingChangesLevel verifies the debug and non-debug
-// configurations differ as intended: enabling debug makes debug
-// records pass where they previously did not.
-func TestEnableDebugLoggingChangesLevel(t *testing.T) {
-	t.Parallel()
-
-	l := newTestLogger(t)
-	log := l.Get()
-	ctx := context.Background()
-
-	require.False(t, log.Enabled(ctx, slog.LevelDebug),
-		"debug must start disabled")
-
-	l.EnableDebugLogging()
-
-	assert.True(t, log.Enabled(ctx, slog.LevelDebug),
-		"debug must be enabled after EnableDebugLogging")
-}

internal/middleware/export_test.go

@@ -1,19 +0,0 @@
-package middleware
-
-import (
-	"net/http"
-	"time"
-)
-
-// The /metrics rate limit, exported so the tests can count requests
-// against it.
-const (
-	MetricsRequestLimit                = metricsRequestLimit
-	MetricsRequestWindow time.Duration = metricsRequestWindow
-)
-
-// RealIP is realIP, exported so the tests can check which address it
-// takes as the client's.
-func RealIP(r *http.Request) string {
-	return realIP(r)
-}

internal/middleware/middleware.go

@@ -5,14 +5,12 @@ import (
 	"log/slog"
 	"net"
 	"net/http"
-	"net/netip"
 	"strings"
 	"time"
 
 	"github.com/99designs/basicauth-go"
 	"github.com/go-chi/chi/v5/middleware"
 	"github.com/go-chi/cors"
-	"github.com/go-chi/httprate"
 	"go.uber.org/fx"
 
 	"sneak.berlin/go/dnswatcher/internal/config"
@@ -23,71 +21,6 @@ import (
 // corsMaxAge is the maximum age for CORS preflight responses.
 const corsMaxAge = 300
 
-// Rate limit for /metrics: each client address may send
-// metricsRequestLimit requests per metricsRequestWindow. Every request
-// counts, so password guessing gets at most 30 tries a minute per
-// address. One Prometheus server scraping every 15 seconds sends 4
-// requests a minute, and two scraping every 5 seconds from one address
-// send 24, so normal scraping stays under the limit.
-const (
-	metricsRequestLimit  = 30
-	metricsRequestWindow = time.Minute
-)
-
-// Security response header values applied to every response.
-//
-// The CSP is as strict as the dashboard allows: the template ships no
-// JavaScript, no inline styles, no inline event handlers and no images,
-// and its only subresource is the embedded stylesheet at
-// /s/css/tailwind.min.css, which style-src 'self' permits. Neither
-// unsafe-inline nor unsafe-eval is used. frame-ancestors 'none' is the
-// primary anti-framing control; X-Frame-Options is the legacy fallback.
-const (
-	// hstsValue is emitted unconditionally, including over plain HTTP,
-	// because the service runs behind a TLS-terminating proxy and the
-	// browser must still enforce HTTPS end to end.
-	hstsValue = "max-age=31536000; includeSubDomains"
-
-	cspValue = "default-src 'self'; " +
-		"script-src 'none'; " +
-		"style-src 'self'; " +
-		"img-src 'self'; " +
-		"font-src 'none'; " +
-		"connect-src 'none'; " +
-		"object-src 'none'; " +
-		"base-uri 'none'; " +
-		"form-action 'none'; " +
-		"frame-ancestors 'none'"
-
-	frameOptionsValue = "DENY"
-
-	contentTypeOptionsValue = "nosniff"
-
-	// referrerPolicyValue is stricter than the policy minimum of
-	// strict-origin-when-cross-origin: the dashboard has no
-	// cross-origin navigation needs and its URL may name internal
-	// hosts.
-	referrerPolicyValue = "no-referrer"
-
-	permissionsPolicyValue = "accelerometer=(), " +
-		"autoplay=(), " +
-		"camera=(), " +
-		"display-capture=(), " +
-		"encrypted-media=(), " +
-		"fullscreen=(), " +
-		"geolocation=(), " +
-		"gyroscope=(), " +
-		"magnetometer=(), " +
-		"microphone=(), " +
-		"midi=(), " +
-		"payment=(), " +
-		"picture-in-picture=(), " +
-		"publickey-credentials-get=(), " +
-		"screen-wake-lock=(), " +
-		"usb=(), " +
-		"xr-spatial-tracking=()"
-)
-
 // Params contains dependencies for Middleware.
 type Params struct {
 	fx.In
@@ -209,12 +142,6 @@ func isTrustedProxy(ip net.IP) bool {
 
 // realIP extracts the client's real IP address from the request.
 // Proxy headers are only trusted from RFC1918/loopback addresses.
-//
-// Each proxy adds to the end of X-Forwarded-For the address it got the
-// request from, so the client can write every entry before the one the
-// first trusted proxy added. The client address is therefore the
-// rightmost entry that is not a trusted proxy, or the leftmost entry
-// when they all are.
 func realIP(r *http.Request) string {
 	addr := ipFromHostPort(r.RemoteAddr)
 	remoteIP := net.ParseIP(addr)
@@ -229,100 +156,36 @@ func realIP(r *http.Request) string {
 		return ip
 	}
 
-	// A proxy may add its entry as a header line of its own instead of
+	if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
-	// appending to the line the client sent, so all lines form one list.
+		if parts := strings.SplitN(
-	entries := strings.Split(
+			xff, ",", 2, //nolint:mnd
-		strings.Join(r.Header.Values("X-Forwarded-For"), ","), ",",
+		); len(parts) > 0 {
-	)
+			if ip := strings.TrimSpace(parts[0]); ip != "" {
-	client := strings.TrimSpace(entries[0])
+				return ip
-
-	for i := len(entries) - 1; i > 0; i-- {
-		entry := strings.TrimSpace(entries[i])
-		if !isTrustedProxy(net.ParseIP(entry)) {
-			client = entry
-
-			break
 			}
 		}
-
-	if client != "" {
-		return client
 	}
 
 	return addr
 }
 
-// CORS returns middleware that lets any origin read a response. It is
+// CORS returns CORS middleware.
-// for the public, read-only routes only, so it allows only the
-// methods those routes serve and no Authorization header.
 func (m *Middleware) CORS() func(http.Handler) http.Handler {
 	return cors.Handler(cors.Options{
 		AllowedOrigins: []string{"*"},
-		AllowedMethods:   []string{"GET", "OPTIONS"},
+		AllowedMethods: []string{
-		AllowedHeaders:   []string{"Accept", "Content-Type"},
+			"GET", "POST", "PUT", "DELETE", "OPTIONS",
+		},
+		AllowedHeaders: []string{
+			"Accept", "Authorization",
+			"Content-Type", "X-CSRF-Token",
+		},
 		ExposedHeaders:   []string{"Link"},
 		AllowCredentials: false,
 		MaxAge:           corsMaxAge,
 	})
 }
 
-// SecurityHeaders returns middleware that sets the security response
-// headers required for production internet exposure on every response.
-//
-// The headers are set before the request reaches the next handler so
-// that they are present on every response, including panics recovered
-// by chi's Recoverer and timeouts produced by chi's Timeout.
-func (m *Middleware) SecurityHeaders() func(http.Handler) http.Handler {
-	return func(next http.Handler) http.Handler {
-		return http.HandlerFunc(func(
-			writer http.ResponseWriter,
-			request *http.Request,
-		) {
-			header := writer.Header()
-			header.Set("Strict-Transport-Security", hstsValue)
-			header.Set("Content-Security-Policy", cspValue)
-			header.Set("X-Frame-Options", frameOptionsValue)
-			header.Set(
-				"X-Content-Type-Options",
-				contentTypeOptionsValue,
-			)
-			header.Set("Referrer-Policy", referrerPolicyValue)
-			header.Set(
-				"Permissions-Policy",
-				permissionsPolicyValue,
-			)
-
-			next.ServeHTTP(writer, request)
-		})
-	}
-}
-
-// MetricsRateLimit returns middleware for /metrics that answers 429
-// Too Many Requests to a client address over the rate limit. The
-// address is the one realIP works out, so a client that is not a
-// trusted proxy cannot get a fresh allowance by sending its own
-// X-Real-IP or X-Forwarded-For. CanonicalizeIP counts all IPv6
-// addresses in one /64 as one client, since a client usually holds a
-// whole /64. An IPv4 address a proxy reports in IPv6-mapped form
-// (::ffff:203.0.113.1) is turned back into plain IPv4 first, as every
-// such address is in the same /64.
-func (m *Middleware) MetricsRateLimit() func(http.Handler) http.Handler {
-	return httprate.LimitBy(
-		metricsRequestLimit,
-		metricsRequestWindow,
-		func(request *http.Request) (string, error) {
-			ip := realIP(request)
-
-			addr, err := netip.ParseAddr(ip)
-			if err == nil {
-				ip = addr.Unmap().String()
-			}
-
-			return httprate.CanonicalizeIP(ip), nil
-		},
-	)
-}
-
 // MetricsAuth returns basic auth middleware for /metrics.
 func (m *Middleware) MetricsAuth() func(http.Handler) http.Handler {
 	if m.params.Config.MetricsUsername == "" {

internal/middleware/middleware_test.go

@@ -1,565 +0,0 @@
-package middleware_test
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/go-chi/chi/v5"
-	"go.uber.org/fx/fxtest"
-
-	"sneak.berlin/go/dnswatcher/internal/config"
-	"sneak.berlin/go/dnswatcher/internal/globals"
-	"sneak.berlin/go/dnswatcher/internal/handlers"
-	"sneak.berlin/go/dnswatcher/internal/logger"
-	"sneak.berlin/go/dnswatcher/internal/middleware"
-	"sneak.berlin/go/dnswatcher/internal/notify"
-	"sneak.berlin/go/dnswatcher/internal/state"
-)
-
-// Expected security header values, spelled out literally so that any
-// change to the middleware has to be made deliberately here as well.
-const (
-	wantHSTS = "max-age=31536000; includeSubDomains"
-
-	wantCSP = "default-src 'self'; " +
-		"script-src 'none'; " +
-		"style-src 'self'; " +
-		"img-src 'self'; " +
-		"font-src 'none'; " +
-		"connect-src 'none'; " +
-		"object-src 'none'; " +
-		"base-uri 'none'; " +
-		"form-action 'none'; " +
-		"frame-ancestors 'none'"
-
-	wantFrameOptions = "DENY"
-
-	wantContentTypeOptions = "nosniff"
-
-	wantReferrerPolicy = "no-referrer"
-
-	wantPermissionsPolicy = "accelerometer=(), " +
-		"autoplay=(), " +
-		"camera=(), " +
-		"display-capture=(), " +
-		"encrypted-media=(), " +
-		"fullscreen=(), " +
-		"geolocation=(), " +
-		"gyroscope=(), " +
-		"magnetometer=(), " +
-		"microphone=(), " +
-		"midi=(), " +
-		"payment=(), " +
-		"picture-in-picture=(), " +
-		"publickey-credentials-get=(), " +
-		"screen-wake-lock=(), " +
-		"usb=(), " +
-		"xr-spatial-tracking=()"
-)
-
-// stylesheetPath is the only subresource the dashboard loads.
-const stylesheetPath = "/s/css/tailwind.min.css"
-
-// newTestLogger builds a logger for direct component construction.
-func newTestLogger(t *testing.T) *logger.Logger {
-	t.Helper()
-
-	glob, err := globals.New(nil)
-	if err != nil {
-		t.Fatalf("globals.New: %v", err)
-	}
-
-	log, err := logger.New(nil, logger.Params{Globals: glob})
-	if err != nil {
-		t.Fatalf("logger.New: %v", err)
-	}
-
-	return log
-}
-
-// newTestMiddleware builds a Middleware without an fx application.
-func newTestMiddleware(t *testing.T) *middleware.Middleware {
-	t.Helper()
-
-	glob, err := globals.New(nil)
-	if err != nil {
-		t.Fatalf("globals.New: %v", err)
-	}
-
-	mw, err := middleware.New(nil, middleware.Params{
-		Logger:  newTestLogger(t),
-		Globals: glob,
-		Config:  &config.Config{},
-	})
-	if err != nil {
-		t.Fatalf("middleware.New: %v", err)
-	}
-
-	return mw
-}
-
-// serveWithSecurityHeaders runs a GET through SecurityHeaders and
-// returns the recorded response.
-func serveWithSecurityHeaders(
-	t *testing.T,
-	target string,
-	handler http.Handler,
-) *httptest.ResponseRecorder {
-	t.Helper()
-
-	mw := newTestMiddleware(t)
-	rec := httptest.NewRecorder()
-	req := httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, target, nil,
-	)
-
-	mw.SecurityHeaders()(handler).ServeHTTP(rec, req)
-
-	return rec
-}
-
-// okHandler writes a trivial 200 response.
-func okHandler() http.Handler {
-	return http.HandlerFunc(func(
-		writer http.ResponseWriter,
-		_ *http.Request,
-	) {
-		writer.WriteHeader(http.StatusOK)
-	})
-}
-
-func TestSecurityHeaders(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name   string
-		header string
-		want   string
-	}{
-		{
-			"hsts",
-			"Strict-Transport-Security",
-			wantHSTS,
-		},
-		{
-			"csp",
-			"Content-Security-Policy",
-			wantCSP,
-		},
-		{
-			"frame options",
-			"X-Frame-Options",
-			wantFrameOptions,
-		},
-		{
-			"content type options",
-			"X-Content-Type-Options",
-			wantContentTypeOptions,
-		},
-		{
-			"referrer policy",
-			"Referrer-Policy",
-			wantReferrerPolicy,
-		},
-		{
-			"permissions policy",
-			"Permissions-Policy",
-			wantPermissionsPolicy,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			rec := serveWithSecurityHeaders(t, "/", okHandler())
-
-			got := rec.Header().Get(tt.header)
-			if got != tt.want {
-				t.Errorf(
-					"%s = %q, want %q",
-					tt.header, got, tt.want,
-				)
-			}
-		})
-	}
-}
-
-// TestSecurityHeadersCSPDirectives guards the properties the repo
-// policy requires of the content security policy itself.
-func TestSecurityHeadersCSPDirectives(t *testing.T) {
-	t.Parallel()
-
-	rec := serveWithSecurityHeaders(t, "/", okHandler())
-	csp := rec.Header().Get("Content-Security-Policy")
-
-	forbidden := []string{"unsafe-inline", "unsafe-eval"}
-	for _, directive := range forbidden {
-		if strings.Contains(csp, directive) {
-			t.Errorf("CSP must not contain %q: %q", directive, csp)
-		}
-	}
-
-	required := []string{
-		"default-src 'self'",
-		"script-src 'none'",
-		"style-src 'self'",
-		"frame-ancestors 'none'",
-	}
-	for _, directive := range required {
-		if !strings.Contains(csp, directive) {
-			t.Errorf("CSP must contain %q: %q", directive, csp)
-		}
-	}
-}
-
-// TestSecurityHeadersOnErrorResponse verifies the headers are emitted
-// even when the wrapped handler fails, since they are set before the
-// handler runs.
-func TestSecurityHeadersOnErrorResponse(t *testing.T) {
-	t.Parallel()
-
-	failing := http.HandlerFunc(func(
-		writer http.ResponseWriter,
-		_ *http.Request,
-	) {
-		http.Error(
-			writer,
-			"boom",
-			http.StatusInternalServerError,
-		)
-	})
-
-	rec := serveWithSecurityHeaders(t, "/api/v1/status", failing)
-
-	if rec.Code != http.StatusInternalServerError {
-		t.Fatalf("status = %d, want 500", rec.Code)
-	}
-
-	if got := rec.Header().Get(
-		"X-Content-Type-Options",
-	); got != wantContentTypeOptions {
-		t.Errorf(
-			"X-Content-Type-Options = %q, want %q",
-			got, wantContentTypeOptions,
-		)
-	}
-
-	if got := rec.Header().Get(
-		"Strict-Transport-Security",
-	); got != wantHSTS {
-		t.Errorf(
-			"Strict-Transport-Security = %q, want %q",
-			got, wantHSTS,
-		)
-	}
-}
-
-// newTestHandlers builds real Handlers with empty monitoring state.
-func newTestHandlers(t *testing.T) *handlers.Handlers {
-	t.Helper()
-
-	glob, err := globals.New(nil)
-	if err != nil {
-		t.Fatalf("globals.New: %v", err)
-	}
-
-	log := newTestLogger(t)
-
-	notifier, err := notify.New(fxtest.NewLifecycle(t), notify.Params{
-		Logger: log,
-		Config: &config.Config{},
-	})
-	if err != nil {
-		t.Fatalf("notify.New: %v", err)
-	}
-
-	st, err := state.New(fxtest.NewLifecycle(t), state.Params{
-		Logger: log,
-		Config: &config.Config{DataDir: t.TempDir()},
-	})
-	if err != nil {
-		t.Fatalf("state.New: %v", err)
-	}
-
-	hnd, err := handlers.New(nil, handlers.Params{
-		Logger:  log,
-		Globals: glob,
-		State:   st,
-		Notify:  notifier,
-	})
-	if err != nil {
-		t.Fatalf("handlers.New: %v", err)
-	}
-
-	return hnd
-}
-
-// TestDashboardRendersWithSecurityHeaders renders the real dashboard
-// through the middleware and checks that the policy still permits the
-// one stylesheet the page loads.
-func TestDashboardRendersWithSecurityHeaders(t *testing.T) {
-	t.Parallel()
-
-	mw := newTestMiddleware(t)
-	hnd := newTestHandlers(t)
-
-	router := chi.NewRouter()
-	router.Use(mw.SecurityHeaders())
-	router.Get("/", hnd.HandleDashboard())
-
-	rec := httptest.NewRecorder()
-	req := httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, "/", nil,
-	)
-
-	router.ServeHTTP(rec, req)
-
-	if rec.Code != http.StatusOK {
-		t.Fatalf("status = %d, want 200", rec.Code)
-	}
-
-	body := rec.Body.String()
-	if !strings.Contains(body, stylesheetPath) {
-		t.Errorf("dashboard does not reference %q", stylesheetPath)
-	}
-
-	if !strings.Contains(body, "dnswatcher") {
-		t.Errorf("dashboard body looks empty: %d bytes", len(body))
-	}
-
-	csp := rec.Header().Get("Content-Security-Policy")
-	if csp != wantCSP {
-		t.Errorf("CSP = %q, want %q", csp, wantCSP)
-	}
-
-	// The stylesheet is same-origin, so style-src 'self' allows it.
-	if !strings.Contains(csp, "style-src 'self'") {
-		t.Errorf("CSP would block %q: %q", stylesheetPath, csp)
-	}
-}
-
-// Addresses for the rate limit and realIP tests: a client connecting
-// directly, a trusted proxy, and a client behind that proxy as the
-// proxy's X-Real-IP or X-Forwarded-For header names it.
-const (
-	directClient  = "198.51.100.1:4000"
-	trustedProxy  = "10.0.0.1:4000"
-	proxiedClient = "203.0.113.1"
-)
-
-// statusFrom sends a GET through handler as if from remoteAddr, with
-// an X-Real-IP header when xRealIP is not empty, and returns the
-// response status.
-func statusFrom(
-	t *testing.T,
-	handler http.Handler,
-	remoteAddr string,
-	xRealIP string,
-) int {
-	t.Helper()
-
-	req := httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, "/metrics", nil,
-	)
-	req.RemoteAddr = remoteAddr
-
-	if xRealIP != "" {
-		req.Header.Set("X-Real-IP", xRealIP)
-	}
-
-	rec := httptest.NewRecorder()
-	handler.ServeHTTP(rec, req)
-
-	return rec.Code
-}
-
-// TestMetricsRateLimitAllowsScraping checks that one address can send,
-// within one window, what two Prometheus servers scraping every 5
-// seconds send in that time, without being turned away.
-func TestMetricsRateLimitAllowsScraping(t *testing.T) {
-	t.Parallel()
-
-	const scrapeInterval = 5 * time.Second
-
-	scrapes := 2 * int(middleware.MetricsRequestWindow/scrapeInterval)
-	limited := newTestMiddleware(t).MetricsRateLimit()(okHandler())
-
-	for i := range scrapes {
-		got := statusFrom(t, limited, directClient, "")
-		if got != http.StatusOK {
-			t.Fatalf(
-				"scrape %d of %d: status = %d, want 200",
-				i+1, scrapes, got,
-			)
-		}
-	}
-}
-
-// TestMetricsRateLimitKeysOnClientAddress checks which requests share
-// an allowance. Each case uses up the allowance of one client, then
-// sends one more request.
-func TestMetricsRateLimitKeysOnClientAddress(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name           string
-		usedRemoteAddr string
-		usedXRealIP    string
-		nextRemoteAddr string
-		nextXRealIP    string
-		want           int
-	}{
-		{
-			"same address",
-			directClient, "",
-			directClient, "",
-			http.StatusTooManyRequests,
-		},
-		{
-			"another address",
-			directClient, "",
-			"198.51.100.2:4000", "",
-			http.StatusOK,
-		},
-		{
-			"own X-Real-IP from an untrusted address",
-			directClient, "",
-			directClient, "203.0.113.9",
-			http.StatusTooManyRequests,
-		},
-		{
-			"same client behind the proxy",
-			trustedProxy, proxiedClient,
-			trustedProxy, proxiedClient,
-			http.StatusTooManyRequests,
-		},
-		{
-			"another client behind the proxy",
-			trustedProxy, proxiedClient,
-			trustedProxy, "203.0.113.2",
-			http.StatusOK,
-		},
-		{
-			"another client behind the proxy, IPv6-mapped",
-			trustedProxy, "::ffff:203.0.113.1",
-			trustedProxy, "::ffff:203.0.113.2",
-			http.StatusOK,
-		},
-		{
-			"same IPv6 /64",
-			"[2001:db8::1]:4000", "",
-			"[2001:db8::2]:4000", "",
-			http.StatusTooManyRequests,
-		},
-		{
-			"another IPv6 /64",
-			"[2001:db8::1]:4000", "",
-			"[2001:db8:0:1::1]:4000", "",
-			http.StatusOK,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			limited := newTestMiddleware(t).MetricsRateLimit()(okHandler())
-
-			for range middleware.MetricsRequestLimit {
-				statusFrom(t, limited, tt.usedRemoteAddr, tt.usedXRealIP)
-			}
-
-			got := statusFrom(
-				t, limited, tt.nextRemoteAddr, tt.nextXRealIP,
-			)
-			if got != tt.want {
-				t.Errorf("status = %d, want %d", got, tt.want)
-			}
-		})
-	}
-}
-
-// TestRealIP checks which address realIP takes as the client's. Each
-// element of forwardedFor is sent as an X-Forwarded-For header line of
-// its own, and 198.51.100.9 is always an entry the client wrote itself.
-func TestRealIP(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name         string
-		remoteAddr   string
-		xRealIP      string
-		forwardedFor []string
-		want         string
-	}{
-		{
-			"untrusted peer, both headers ignored",
-			directClient, proxiedClient, []string{"198.51.100.9"},
-			"198.51.100.1",
-		},
-		{
-			"X-Real-IP from a trusted proxy wins",
-			trustedProxy, proxiedClient, []string{"203.0.113.8"},
-			proxiedClient,
-		},
-		{
-			"client's own entry, then the one the proxy added",
-			trustedProxy, "", []string{"198.51.100.9, 203.0.113.1"},
-			proxiedClient,
-		},
-		{
-			"several trusted proxies",
-			trustedProxy, "",
-			[]string{"198.51.100.9, 203.0.113.1, 10.0.0.3, 10.0.0.2"},
-			proxiedClient,
-		},
-		{
-			"proxy adds a header line of its own",
-			trustedProxy, "", []string{"198.51.100.9", proxiedClient},
-			proxiedClient,
-		},
-		{
-			"every entry a trusted proxy",
-			trustedProxy, "", []string{"10.0.0.3, 10.0.0.2"},
-			"10.0.0.3",
-		},
-		{
-			"empty where the client address belongs",
-			trustedProxy, "", []string{"203.0.113.1, , 10.0.0.2"},
-			"10.0.0.1",
-		},
-		{
-			"no headers from a trusted proxy",
-			trustedProxy, "", nil,
-			"10.0.0.1",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			req := httptest.NewRequestWithContext(
-				t.Context(), http.MethodGet, "/", nil,
-			)
-			req.RemoteAddr = tt.remoteAddr
-
-			if tt.xRealIP != "" {
-				req.Header.Set("X-Real-IP", tt.xRealIP)
-			}
-
-			for _, line := range tt.forwardedFor {
-				req.Header.Add("X-Forwarded-For", line)
-			}
-
-			got := middleware.RealIP(req)
-			if got != tt.want {
-				t.Errorf("realIP = %q, want %q", got, tt.want)
-			}
-		})
-	}
-}

internal/notify/export_test.go

@@ -32,27 +32,11 @@ func NewRequestForTest(
 // NewTestService creates a Service suitable for unit testing.
 // It discards log output and uses the given transport.
 func NewTestService(transport http.RoundTripper) *Service {
-	return newService(slog.New(slog.DiscardHandler), transport)
+	return &Service{
+		log:       slog.New(slog.DiscardHandler),
+		transport: transport,
+		history:   NewAlertHistory(),
 	}
-
-// NewTestServiceWithLogger creates a Service that writes to the
-// given handler, so tests can assert on emitted log records.
-func NewTestServiceWithLogger(
-	transport http.RoundTripper,
-	handler slog.Handler,
-) *Service {
-	return newService(slog.New(handler), transport)
-}
-
-// Drain exports drain for testing.
-func (svc *Service) Drain(ctx context.Context) {
-	svc.drain(ctx)
-}
-
-// OutstandingDeliveries reports how many delivery goroutines
-// are currently tracked as in flight.
-func (svc *Service) OutstandingDeliveries() int64 {
-	return svc.outstanding.Load()
 }
 
 // SetNtfyURL sets the ntfy URL on a Service for testing.

internal/notify/notify.go

@@ -12,8 +12,6 @@ import (
 	"log/slog"
 	"net/http"
 	"net/url"
-	"sync"
-	"sync/atomic"
 	"time"
 
 	"go.uber.org/fx"
@@ -117,41 +115,19 @@ type Service struct {
 	history              *AlertHistory
 	retryConfig          RetryConfig
 	sleepFn              func(time.Duration) <-chan time.Time
-
-	// Shutdown draining state.  drainMu guards draining and
-	// serialises it against the counter increment in
-	// startDelivery; inFlight tracks the delivery goroutines
-	// themselves and outstanding mirrors its count so a timed
-	// out drain can report how many were abandoned.
-	drainMu     sync.Mutex
-	draining    bool
-	inFlight    sync.WaitGroup
-	outstanding atomic.Int64
-	abandon     chan struct{}
-	abandonOnce sync.Once
-}
-
-// newService builds a Service with the fields every Service
-// needs regardless of how it was constructed.
-func newService(
-	log *slog.Logger,
-	transport http.RoundTripper,
-) *Service {
-	return &Service{
-		log:       log,
-		transport: transport,
-		history:   NewAlertHistory(),
-		abandon:   make(chan struct{}),
-	}
 }
 
 // New creates a new notify Service.
 func New(
-	lifecycle fx.Lifecycle,
+	_ fx.Lifecycle,
 	params Params,
 ) (*Service, error) {
-	svc := newService(params.Logger.Get(), http.DefaultTransport)
+	svc := &Service{
-	svc.config = params.Config
+		log:       params.Logger.Get(),
+		transport: http.DefaultTransport,
+		config:    params.Config,
+		history:   NewAlertHistory(),
+	}
 
 	if params.Config.NtfyTopic != "" {
 		u, err := ValidateWebhookURL(
@@ -192,14 +168,6 @@ func New(
 		svc.mattermostWebhookURL = u
 	}
 
-	lifecycle.Append(fx.Hook{
-		OnStop: func(ctx context.Context) error {
-			svc.drain(ctx)
-
-			return nil
-		},
-	})
-
 	return svc, nil
 }
 
@@ -226,32 +194,6 @@ func (svc *Service) SendNotification(
 	svc.dispatchMattermost(ctx, title, message, priority)
 }
 
-// dispatch delivers a notification to one endpoint on a
-// tracked background goroutine.
-//
-// The delivery context is detached from ctx with
-// context.WithoutCancel so that a cancelled caller does not
-// kill a delivery already under way; the shutdown drain, not
-// the caller, decides how long deliveries may keep running.
-func (svc *Service) dispatch(
-	ctx context.Context,
-	endpoint string,
-	send func(context.Context) error,
-) {
-	notifyCtx := context.WithoutCancel(ctx)
-
-	svc.startDelivery(endpoint, func() {
-		err := svc.deliverWithRetry(notifyCtx, endpoint, send)
-		if err != nil {
-			svc.log.Error(
-				"failed to send notification after retries",
-				"endpoint", endpoint,
-				"error", err,
-			)
-		}
-	})
-}
-
 func (svc *Service) dispatchNtfy(
 	ctx context.Context,
 	title, message, priority string,
@@ -260,11 +202,26 @@ func (svc *Service) dispatchNtfy(
 		return
 	}
 
-	svc.dispatch(ctx, "ntfy", func(c context.Context) error {
+	go func() {
+		notifyCtx := context.WithoutCancel(ctx)
+
+		err := svc.deliverWithRetry(
+			notifyCtx, "ntfy",
+			func(c context.Context) error {
 				return svc.sendNtfy(
-			c, svc.ntfyURL, title, message, priority,
+					c, svc.ntfyURL,
+					title, message, priority,
 				)
-	})
+			},
+		)
+		if err != nil {
+			svc.log.Error(
+				"failed to send ntfy notification "+
+					"after retries",
+				"error", err,
+			)
+		}
+	}()
 }
 
 func (svc *Service) dispatchSlack(
@@ -275,11 +232,26 @@ func (svc *Service) dispatchSlack(
 		return
 	}
 
-	svc.dispatch(ctx, "slack", func(c context.Context) error {
+	go func() {
+		notifyCtx := context.WithoutCancel(ctx)
+
+		err := svc.deliverWithRetry(
+			notifyCtx, "slack",
+			func(c context.Context) error {
 				return svc.sendSlack(
-			c, svc.slackWebhookURL, title, message, priority,
+					c, svc.slackWebhookURL,
+					title, message, priority,
 				)
-	})
+			},
+		)
+		if err != nil {
+			svc.log.Error(
+				"failed to send slack notification "+
+					"after retries",
+				"error", err,
+			)
+		}
+	}()
 }
 
 func (svc *Service) dispatchMattermost(
@@ -290,8 +262,11 @@ func (svc *Service) dispatchMattermost(
 		return
 	}
 
-	svc.dispatch(
+	go func() {
-		ctx, "mattermost",
+		notifyCtx := context.WithoutCancel(ctx)
+
+		err := svc.deliverWithRetry(
+			notifyCtx, "mattermost",
 			func(c context.Context) error {
 				return svc.sendSlack(
 					c, svc.mattermostWebhookURL,
@@ -299,6 +274,14 @@ func (svc *Service) dispatchMattermost(
 				)
 			},
 		)
+		if err != nil {
+			svc.log.Error(
+				"failed to send mattermost notification "+
+					"after retries",
+				"error", err,
+			)
+		}
+	}()
 }
 
 func (svc *Service) sendNtfy(

internal/notify/retry.go

@@ -2,7 +2,6 @@ package notify
 
 import (
 	"context"
-	"fmt"
 	"math"
 	"math/rand/v2"
 	"time"
@@ -122,14 +121,6 @@ func (svc *Service) deliverWithRetry(
 		select {
 		case <-ctx.Done():
 			return ctx.Err()
-		case <-svc.abandon:
-			// Shutdown drained past its deadline; stop
-			// sleeping rather than outlive the process.
-			// A nil channel (Service built without a
-			// constructor) simply never fires.
-			return fmt.Errorf(
-				"%w: %s", ErrDeliveryAbandoned, endpoint,
-			)
 		case <-svc.sleepFunc(delay):
 		}
 	}

internal/notify/shutdown.go

@@ -1,119 +0,0 @@
-package notify
-
-import (
-	"context"
-	"errors"
-)
-
-// ErrDeliveryAbandoned is returned by a retry loop that was
-// cut short because shutdown drained past its deadline.
-var ErrDeliveryAbandoned = errors.New(
-	"notification delivery abandoned at shutdown",
-)
-
-// startDelivery runs fn on its own goroutine while tracking it,
-// so that drain can wait for it during shutdown.
-//
-// The WaitGroup counter is incremented here, on the caller's
-// goroutine, before the worker exists: incrementing it inside
-// the worker would race with drain's Wait and could let
-// shutdown sail past a delivery that had not started yet.
-//
-// Once draining has begun the delivery is refused outright
-// rather than queued, so a steady stream of newly submitted
-// notifications cannot keep extending the drain.
-func (svc *Service) startDelivery(endpoint string, fn func()) {
-	svc.drainMu.Lock()
-
-	if svc.draining {
-		svc.drainMu.Unlock()
-
-		svc.log.Warn(
-			"notification not dispatched: shutdown in progress",
-			"endpoint", endpoint,
-		)
-
-		return
-	}
-
-	svc.outstanding.Add(1)
-
-	// WaitGroup.Go increments the counter synchronously, here,
-	// and only then starts the goroutine.
-	svc.inFlight.Go(func() {
-		// Runs before the WaitGroup counter is decremented, so
-		// a drain that times out reports an accurate count.
-		defer svc.outstanding.Add(-1)
-
-		fn()
-	})
-
-	svc.drainMu.Unlock()
-}
-
-// drain waits for in-flight notification deliveries to finish.
-//
-// It first stops accepting new deliveries, then waits until
-// either every outstanding delivery has completed or ctx
-// expires — whichever comes first.  ctx is the context fx
-// passes to the OnStop hook, so a permanently dead webhook
-// cannot hang shutdown indefinitely.
-//
-// When the deadline arrives with deliveries still outstanding,
-// the count is logged at warn level and the abandon channel is
-// closed, which releases any retry loop sleeping in backoff.
-// Deliveries already inside an HTTP round trip are bounded by
-// the existing httpClientTimeout instead.
-//
-// A ctx that is already expired on entry is not by itself cause
-// for alarm: if nothing is outstanding there is nothing to
-// abandon, and the drain says so at debug level rather than
-// warning about deliveries that do not exist.
-func (svc *Service) drain(ctx context.Context) {
-	svc.drainMu.Lock()
-	svc.draining = true
-	svc.drainMu.Unlock()
-
-	done := make(chan struct{})
-
-	go func() {
-		svc.inFlight.Wait()
-		close(done)
-	}()
-
-	select {
-	case <-done:
-		svc.log.Debug(
-			"all in-flight notifications completed",
-		)
-	case <-ctx.Done():
-		// outstanding is decremented before the WaitGroup
-		// counter, and startDelivery can no longer add to it
-		// now that draining is set, so a zero here means every
-		// delivery really did finish.  ctx expiring in that
-		// state (an OnStop context that was already cancelled
-		// on entry is the usual way) abandons nothing, so it
-		// must not close abandon or warn about it.
-		abandoned := svc.outstanding.Load()
-		if abandoned == 0 {
-			svc.log.Debug(
-				"all in-flight notifications completed",
-			)
-
-			return
-		}
-
-		svc.abandonOnce.Do(func() {
-			if svc.abandon != nil {
-				close(svc.abandon)
-			}
-		})
-
-		svc.log.Warn(
-			"shutdown deadline reached with notifications "+
-				"still in flight; abandoning them",
-			"abandoned", abandoned,
-			"error", ctx.Err(),
-		)
-	}
-}

internal/notify/shutdown_test.go

@@ -1,593 +0,0 @@
-package notify_test
-
-import (
-	"bytes"
-	"context"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"go.uber.org/fx"
-
-	"sneak.berlin/go/dnswatcher/internal/config"
-	"sneak.berlin/go/dnswatcher/internal/globals"
-	"sneak.berlin/go/dnswatcher/internal/logger"
-	"sneak.berlin/go/dnswatcher/internal/notify"
-)
-
-// Timings used by the drain tests.  They stay in the same
-// 10-100ms band as the retry tests so the suite never waits on
-// a real backoff delay.
-const (
-	// inFlightHold is how long a delivery is kept mid-request
-	// before the handler is released.
-	inFlightHold = 30 * time.Millisecond
-
-	// drainDeadline bounds a drain that is expected to time
-	// out.
-	drainDeadline = 50 * time.Millisecond
-
-	// timeoutDrainBound is how long a drain given drainDeadline
-	// may take to return before the test gives up on it.  At
-	// forty times drainDeadline it leaves ample room for
-	// scheduling delay on a loaded box under -race, yet it is far
-	// below the test binary's -timeout, so a drain that its
-	// deadline does not bound fails that one test instead of
-	// hanging the package.
-	timeoutDrainBound = 2 * time.Second
-
-	// longDrainDeadline is the deadline given to a drain that is
-	// expected to finish well before it: when the in-flight
-	// delivery completes after inFlightHold, or at once when
-	// nothing is in flight.  It is far above inFlightHold, so
-	// those drains never reach it, and four times
-	// idleDrainBound, so an idle drain that waited for its
-	// deadline instead of returning fails that bound.
-	longDrainDeadline = 2 * time.Second
-
-	// reachEndpointTimeout is how long a submitted delivery may
-	// take to reach the test server.  That normally takes a few
-	// milliseconds; the margin is for a loaded box under -race,
-	// and only a failing run ever waits this long.
-	reachEndpointTimeout = 2 * time.Second
-
-	// settleDelay is how long to wait before asserting that
-	// something did *not* happen.
-	settleDelay = 50 * time.Millisecond
-
-	// idleDrainBound is the upper bound on a drain that has
-	// nothing in flight.  It is deliberately far above the cost
-	// of the goroutine hop through inFlight.Wait() — which
-	// reached 57ms on a loaded box under -race with the package's
-	// parallel tests — and far below longDrainDeadline, the
-	// deadline such a drain is given.  A drain that blocked until
-	// its deadline instead of returning on the WaitGroup
-	// therefore still fails this bound, but scheduling delay
-	// alone cannot.
-	idleDrainBound = 500 * time.Millisecond
-)
-
-// syncBuffer is an io.Writer safe for concurrent use, so log
-// output written from delivery goroutines can be inspected.
-type syncBuffer struct {
-	mu  sync.Mutex
-	buf bytes.Buffer
-}
-
-func (sb *syncBuffer) Write(p []byte) (int, error) {
-	sb.mu.Lock()
-	defer sb.mu.Unlock()
-
-	return sb.buf.Write(p) //nolint:wrapcheck // test helper
-}
-
-func (sb *syncBuffer) String() string {
-	sb.mu.Lock()
-	defer sb.mu.Unlock()
-
-	return sb.buf.String()
-}
-
-// newLoggingService returns a Service writing JSON logs into
-// the returned buffer, debug level included.
-func newLoggingService(
-	transport http.RoundTripper,
-) (*notify.Service, *syncBuffer) {
-	logs := &syncBuffer{}
-	handler := slog.NewJSONHandler(
-		logs, &slog.HandlerOptions{Level: slog.LevelDebug},
-	)
-
-	return notify.NewTestServiceWithLogger(transport, handler),
-		logs
-}
-
-// blockingNtfyServer returns a server whose handler signals on
-// entered, waits for release, and then responds 200.
-func blockingNtfyServer(
-	entered chan<- struct{},
-	release <-chan struct{},
-	served *atomic.Bool,
-) *httptest.Server {
-	var once sync.Once
-
-	return httptest.NewServer(
-		http.HandlerFunc(
-			func(w http.ResponseWriter, _ *http.Request) {
-				once.Do(func() { close(entered) })
-				<-release
-
-				served.Store(true)
-
-				w.WriteHeader(http.StatusOK)
-			}),
-	)
-}
-
-// TestDrainWaitsForInFlightDelivery verifies that a delivery
-// already under way when shutdown starts is allowed to finish.
-func TestDrainWaitsForInFlightDelivery(t *testing.T) {
-	t.Parallel()
-
-	var served atomic.Bool
-
-	entered := make(chan struct{})
-	release := make(chan struct{})
-
-	srv := blockingNtfyServer(entered, release, &served)
-	defer srv.Close()
-
-	// srv.Close waits for the handler, so release it however the
-	// test ends; otherwise a drain that returns early hangs the
-	// package instead of failing this test.
-	releaseHandler := sync.OnceFunc(func() { close(release) })
-	defer releaseHandler()
-
-	topicURL, _ := url.Parse(srv.URL)
-
-	svc := notify.NewTestService(http.DefaultTransport)
-	svc.SetNtfyURL(topicURL)
-
-	svc.SendNotification(
-		context.Background(), "t", "m", prioInfo,
-	)
-
-	// Make sure the delivery really is mid-request before the
-	// drain begins.
-	select {
-	case <-entered:
-	case <-time.After(reachEndpointTimeout):
-		t.Fatal("delivery never reached the endpoint")
-	}
-
-	// As in TestDrainBoundedByContextDeadline: start is captured
-	// before the clock it is compared against, here the timer
-	// holding the delivery open, so elapsed covers the whole hold
-	// and the lower bound cannot come out short from scheduling
-	// delay alone.
-	start := time.Now()
-
-	timer := time.AfterFunc(inFlightHold, releaseHandler)
-	defer timer.Stop()
-
-	ctx, cancel := context.WithTimeout(
-		context.Background(), longDrainDeadline,
-	)
-	defer cancel()
-
-	svc.Drain(ctx)
-
-	elapsed := time.Since(start)
-
-	if !served.Load() {
-		t.Error(
-			"drain returned before the in-flight delivery " +
-				"completed",
-		)
-	}
-
-	if elapsed < inFlightHold {
-		t.Errorf(
-			"drain took %v, want at least %v",
-			elapsed, inFlightHold,
-		)
-	}
-
-	if got := svc.OutstandingDeliveries(); got != 0 {
-		t.Errorf("outstanding deliveries = %d, want 0", got)
-	}
-}
-
-// neverFires returns a channel that never delivers, standing in
-// for a long backoff sleep without actually sleeping.
-func neverFires(_ time.Duration) <-chan time.Time {
-	return make(chan time.Time)
-}
-
-// TestDrainBoundedByContextDeadline verifies that a delivery
-// stuck retrying against a dead endpoint does not hold shutdown
-// past the OnStop context deadline, and that the abandoned
-// deliveries are logged at warn level rather than dropped
-// silently.
-func TestDrainBoundedByContextDeadline(t *testing.T) {
-	t.Parallel()
-
-	var requests atomic.Int64
-
-	srv := httptest.NewServer(
-		http.HandlerFunc(
-			func(w http.ResponseWriter, _ *http.Request) {
-				requests.Add(1)
-
-				w.WriteHeader(http.StatusInternalServerError)
-			}),
-	)
-	defer srv.Close()
-
-	topicURL, _ := url.Parse(srv.URL)
-
-	svc, logs := newLoggingService(http.DefaultTransport)
-	svc.SetNtfyURL(topicURL)
-	// Never let the backoff sleep complete: the delivery is
-	// parked in its retry wait until shutdown releases it.
-	svc.SetSleepFunc(neverFires)
-	svc.SetRetryConfig(notify.RetryConfig{
-		MaxRetries: 5,
-		BaseDelay:  time.Hour,
-		MaxDelay:   time.Hour,
-	})
-
-	svc.SendNotification(
-		context.Background(), "t", "m", prioError,
-	)
-
-	waitForCondition(t, func() bool {
-		return requests.Load() >= 1 &&
-			svc.OutstandingDeliveries() == 1
-	})
-
-	// start must be captured *before* the deadline clock starts,
-	// so that the measured interval is a superset of the deadline
-	// interval.  Capturing it after context.WithTimeout would
-	// make elapsed structurally smaller than drainDeadline and
-	// the lower bound below unfalsifiable-by-luck: it would fail
-	// whenever the two statements were separated by any
-	// scheduling delay, and pass otherwise, regardless of what
-	// the drain did.
-	start := time.Now()
-
-	ctx, cancel := context.WithTimeout(
-		context.Background(), drainDeadline,
-	)
-	defer cancel()
-
-	// The upper bound is enforced by a watchdog rather than by
-	// measuring after the fact: a drain that is not bounded at
-	// all never returns here (the delivery is parked in a backoff
-	// that never fires), so an unbounded drain must fail this
-	// test promptly instead of hanging the package until the test
-	// binary's -timeout.
-	returned := make(chan struct{})
-
-	go func() {
-		defer close(returned)
-
-		svc.Drain(ctx)
-	}()
-
-	select {
-	case <-returned:
-	case <-time.After(timeoutDrainBound):
-		t.Fatalf(
-			"drain did not return within %v; its %v deadline "+
-				"did not bound it",
-			timeoutDrainBound, drainDeadline,
-		)
-	}
-
-	// The lower bound is the real assertion: the drain must have
-	// waited for its whole deadline rather than giving up on the
-	// outstanding delivery early.  With start captured above, an
-	// early return is the only thing that can make it fail.
-	if elapsed := time.Since(start); elapsed < drainDeadline {
-		t.Errorf(
-			"drain returned after %v, before its %v deadline",
-			elapsed, drainDeadline,
-		)
-	}
-
-	assertAbandonLogged(t, logs.String())
-
-	// The abandoned delivery must stop retrying rather than
-	// outlive the drain.
-	waitForCondition(t, func() bool {
-		return svc.OutstandingDeliveries() == 0
-	})
-}
-
-// assertAbandonLogged checks that the drain logged the
-// abandoned deliveries at warn level with a count.
-func assertAbandonLogged(t *testing.T, output string) {
-	t.Helper()
-
-	if !strings.Contains(output, `"level":"WARN"`) {
-		t.Errorf(
-			"abandoned deliveries not logged at warn level; "+
-				"log output: %s",
-			output,
-		)
-	}
-
-	if !strings.Contains(output, `"abandoned":1`) {
-		t.Errorf(
-			"abandoned delivery count not logged; "+
-				"log output: %s",
-			output,
-		)
-	}
-}
-
-// TestDrainRefusesNewDeliveries verifies that notifications
-// submitted after the drain has begun are refused and logged,
-// so a stream of new work cannot extend shutdown indefinitely.
-func TestDrainRefusesNewDeliveries(t *testing.T) {
-	t.Parallel()
-
-	var requests atomic.Int64
-
-	srv := httptest.NewServer(
-		http.HandlerFunc(
-			func(w http.ResponseWriter, _ *http.Request) {
-				requests.Add(1)
-
-				w.WriteHeader(http.StatusOK)
-			}),
-	)
-	defer srv.Close()
-
-	target, _ := url.Parse(srv.URL)
-
-	svc, logs := newLoggingService(http.DefaultTransport)
-	svc.SetNtfyURL(target)
-	svc.SetSlackWebhookURL(target)
-	svc.SetMattermostWebhookURL(target)
-
-	ctx, cancel := context.WithTimeout(
-		context.Background(), longDrainDeadline,
-	)
-	defer cancel()
-
-	// Nothing is in flight, so this returns immediately and
-	// leaves the service refusing further deliveries.
-	svc.Drain(ctx)
-
-	for range 3 {
-		svc.SendNotification(
-			context.Background(), "t", "m", prioInfo,
-		)
-	}
-
-	time.Sleep(settleDelay)
-
-	if got := requests.Load(); got != 0 {
-		t.Errorf(
-			"%d requests reached the endpoint after drain, "+
-				"want 0",
-			got,
-		)
-	}
-
-	if got := svc.OutstandingDeliveries(); got != 0 {
-		t.Errorf("outstanding deliveries = %d, want 0", got)
-	}
-
-	output := logs.String()
-	if !strings.Contains(output, "shutdown in progress") {
-		t.Errorf(
-			"refused deliveries not logged; log output: %s",
-			output,
-		)
-	}
-}
-
-// recordingLifecycle is a minimal fx.Lifecycle that records the
-// hooks appended to it, so the wiring done by notify.New can be
-// inspected without standing up a whole fx application.
-type recordingLifecycle struct {
-	hooks []fx.Hook
-}
-
-func (l *recordingLifecycle) Append(hook fx.Hook) {
-	l.hooks = append(l.hooks, hook)
-}
-
-// newNotifyService builds a Service through the real
-// constructor, wired to the given lifecycle.
-func newNotifyService(
-	t *testing.T,
-	lifecycle fx.Lifecycle,
-	ntfyTopic string,
-) *notify.Service {
-	t.Helper()
-
-	g, err := globals.New(nil)
-	if err != nil {
-		t.Fatalf("globals.New: %v", err)
-	}
-
-	log, err := logger.New(nil, logger.Params{Globals: g})
-	if err != nil {
-		t.Fatalf("logger.New: %v", err)
-	}
-
-	svc, err := notify.New(lifecycle, notify.Params{
-		Logger: log,
-		Config: &config.Config{NtfyTopic: ntfyTopic},
-	})
-	if err != nil {
-		t.Fatalf("notify.New: %v", err)
-	}
-
-	return svc
-}
-
-// TestNewRegistersDrainingStopHook verifies that notify.New
-// wires an OnStop hook into the fx lifecycle and that the hook
-// waits for in-flight deliveries.
-func TestNewRegistersDrainingStopHook(t *testing.T) {
-	t.Parallel()
-
-	var served atomic.Bool
-
-	entered := make(chan struct{})
-	release := make(chan struct{})
-
-	srv := blockingNtfyServer(entered, release, &served)
-	defer srv.Close()
-
-	// As in TestDrainWaitsForInFlightDelivery: release the handler
-	// however the test ends, before srv.Close waits for it.
-	releaseHandler := sync.OnceFunc(func() { close(release) })
-	defer releaseHandler()
-
-	lifecycle := &recordingLifecycle{}
-	svc := newNotifyService(t, lifecycle, srv.URL)
-
-	if len(lifecycle.hooks) != 1 {
-		t.Fatalf(
-			"appended %d lifecycle hooks, want 1",
-			len(lifecycle.hooks),
-		)
-	}
-
-	stop := lifecycle.hooks[0].OnStop
-	if stop == nil {
-		t.Fatal("lifecycle hook has no OnStop function")
-	}
-
-	svc.SendNotification(
-		context.Background(), "t", "m", prioInfo,
-	)
-
-	select {
-	case <-entered:
-	case <-time.After(reachEndpointTimeout):
-		t.Fatal("delivery never reached the endpoint")
-	}
-
-	timer := time.AfterFunc(inFlightHold, releaseHandler)
-	defer timer.Stop()
-
-	ctx, cancel := context.WithTimeout(
-		context.Background(), longDrainDeadline,
-	)
-	defer cancel()
-
-	err := stop(ctx)
-	if err != nil {
-		t.Fatalf("OnStop returned error: %v", err)
-	}
-
-	if !served.Load() {
-		t.Error(
-			"OnStop returned before the in-flight delivery " +
-				"completed",
-		)
-	}
-}
-
-// TestDrainWithoutDeliveriesReturnsImmediately verifies the
-// common case: nothing in flight, shutdown is not delayed.
-func TestDrainWithoutDeliveriesReturnsImmediately(t *testing.T) {
-	t.Parallel()
-
-	svc := notify.NewTestService(http.DefaultTransport)
-
-	// Captured before the deadline clock, as elsewhere in this
-	// file; for an upper bound that is the conservative
-	// direction, since the measured interval can then only be
-	// longer than the drain itself.
-	start := time.Now()
-
-	ctx, cancel := context.WithTimeout(
-		context.Background(), longDrainDeadline,
-	)
-	defer cancel()
-
-	svc.Drain(ctx)
-
-	if elapsed := time.Since(start); elapsed > idleDrainBound {
-		t.Errorf(
-			"drain of an idle service took %v, want at most "+
-				"%v; its deadline was %v",
-			elapsed, idleDrainBound, longDrainDeadline,
-		)
-	}
-}
-
-// TestDrainWithCancelledContextDoesNotWarn verifies that an
-// OnStop context that is already dead on entry does not produce
-// an "abandoning them" warning when there was nothing in flight
-// to abandon, and that the drain returns and says at debug level
-// that nothing was in flight.  The expired context wins the
-// select immediately, so only the outstanding count can tell the
-// difference between a genuine timeout and a shutdown that had
-// simply already run out of time with no work left.
-func TestDrainWithCancelledContextDoesNotWarn(t *testing.T) {
-	t.Parallel()
-
-	svc, logs := newLoggingService(http.DefaultTransport)
-
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-
-	// A watchdog, as in TestDrainBoundedByContextDeadline, so
-	// that a drain which never returns fails here instead of
-	// hanging the package.
-	returned := make(chan struct{})
-
-	go func() {
-		defer close(returned)
-
-		svc.Drain(ctx)
-	}()
-
-	select {
-	case <-returned:
-	case <-time.After(idleDrainBound):
-		t.Fatalf(
-			"drain with nothing in flight and a cancelled "+
-				"context did not return within %v",
-			idleDrainBound,
-		)
-	}
-
-	output := logs.String()
-
-	// The absence of a warning alone would also pass if the drain
-	// logged nothing at all, so require the debug line it writes
-	// when it finds nothing outstanding.
-	if !strings.Contains(
-		output, "all in-flight notifications completed",
-	) {
-		t.Errorf(
-			"drain did not log that nothing was in flight; "+
-				"log output: %s",
-			output,
-		)
-	}
-
-	if strings.Contains(output, `"level":"WARN"`) {
-		t.Errorf(
-			"drain with nothing in flight warned about "+
-				"abandoned deliveries; log output: %s",
-			output,
-		)
-	}
-}

internal/resolver/dns_client.go

@@ -7,8 +7,8 @@ import (
 	"github.com/miekg/dns"
 )
 
-// DNSClient sends one DNS message to a nameserver and returns the
+// DNSClient abstracts DNS wire-protocol exchanges so the resolver
-// reply. The resolver holds one for UDP and one for TCP.
+// can be tested without hitting real nameservers.
 type DNSClient interface {
 	ExchangeContext(
 		ctx context.Context,

internal/resolver/export_test.go

@@ -1,8 +0,0 @@
-package resolver
-
-import "github.com/miekg/dns"
-
-// ExtractRecordValue exports extractRecordValue for testing.
-func ExtractRecordValue(rr dns.RR) string {
-	return extractRecordValue(rr)
-}

internal/resolver/iterative.go

@@ -608,10 +608,7 @@ func classifyResponse(resp *NameserverResponse, state queryState) {
 	}
 }
 
-// extractRecordValue formats a DNS RR value as a string. DNS names
+// extractRecordValue formats a DNS RR value as a string.
-// are case-insensitive and nameservers may answer in any letter case,
-// so names are lower-cased to compare equal. TXT and CAA values keep
-// their letter case.
 func extractRecordValue(rr dns.RR) string {
 	switch r := rr.(type) {
 	case *dns.A:
@@ -619,22 +616,22 @@ func extractRecordValue(rr dns.RR) string {
 	case *dns.AAAA:
 		return r.AAAA.String()
 	case *dns.CNAME:
-		return strings.ToLower(r.Target)
+		return r.Target
 	case *dns.MX:
-		return fmt.Sprintf("%d %s", r.Preference, strings.ToLower(r.Mx))
+		return fmt.Sprintf("%d %s", r.Preference, r.Mx)
 	case *dns.TXT:
 		return strings.Join(r.Txt, "")
 	case *dns.SRV:
 		return fmt.Sprintf(
 			"%d %d %d %s",
-			r.Priority, r.Weight, r.Port, strings.ToLower(r.Target),
+			r.Priority, r.Weight, r.Port, r.Target,
 		)
 	case *dns.CAA:
 		return fmt.Sprintf(
 			"%d %s \"%s\"", r.Flag, r.Tag, r.Value,
 		)
 	case *dns.NS:
-		return strings.ToLower(r.Ns)
+		return r.Ns
 	default:
 		return ""
 	}

internal/resolver/iterative_test.go

@@ -1,62 +0,0 @@
-package resolver_test
-
-import (
-	"testing"
-
-	"github.com/miekg/dns"
-	"github.com/stretchr/testify/assert"
-
-	"sneak.berlin/go/dnswatcher/internal/resolver"
-)
-
-func TestExtractRecordValue_LetterCase(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name string
-		rr   dns.RR
-		want string
-	}{
-		{
-			name: "MX target lower-cased",
-			rr:   &dns.MX{Preference: 1, Mx: "ASPMX.L.GOOGLE.COM."},
-			want: "1 aspmx.l.google.com.",
-		},
-		{
-			name: "NS target lower-cased",
-			rr:   &dns.NS{Ns: "x.ns.joker.COM."},
-			want: "x.ns.joker.com.",
-		},
-		{
-			name: "CNAME target lower-cased",
-			rr:   &dns.CNAME{Target: "WWW.Example.Com."},
-			want: "www.example.com.",
-		},
-		{
-			name: "SRV target lower-cased",
-			rr: &dns.SRV{
-				Priority: 10, Weight: 5, Port: 443,
-				Target: "SIP.Example.Com.",
-			},
-			want: "10 5 443 sip.example.com.",
-		},
-		{
-			name: "TXT value keeps its case",
-			rr:   &dns.TXT{Txt: []string{"Verify=AbC123"}},
-			want: "Verify=AbC123",
-		},
-		{
-			name: "CAA value keeps its case",
-			rr:   &dns.CAA{Flag: 0, Tag: "issue", Value: "LetsEncrypt.org"},
-			want: `0 issue "LetsEncrypt.org"`,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			assert.Equal(t, tt.want, resolver.ExtractRecordValue(tt.rr))
-		})
-	}
-}

internal/resolver/livedns_harness_test.go

@@ -1,192 +0,0 @@
-package resolver_test
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-
-	"sneak.berlin/go/dnswatcher/internal/resolver"
-)
-
-// Tests for the live-DNS harness in livedns_test.go itself. These
-// exercise pure logic; they perform no DNS resolution of any kind, so
-// they neither mock DNS nor depend on it.
-
-// Names for the synthetic status maps below. Nothing is ever queried
-// at them: they are map keys handed to the package's pure counting
-// helpers, not a stand-in for a nameserver.
-const (
-	nsExample1 = "ns1.example."
-	nsExample2 = "ns2.example."
-	nsExample3 = "ns3.example."
-	nsExample4 = "ns4.example."
-)
-
-func TestLiveQuorumIsStrictMajority(t *testing.T) {
-	t.Parallel()
-
-	cases := map[int]int{
-		0:  1,
-		1:  1,
-		2:  2,
-		3:  2,
-		4:  3,
-		5:  3,
-		13: 7,
-	}
-
-	for total, want := range cases {
-		assert.Equal(
-			t, want, liveQuorum(total),
-			"liveQuorum(%d)", total,
-		)
-	}
-}
-
-func TestStatusCountingIgnoresSilentNameservers(t *testing.T) {
-	t.Parallel()
-
-	results := map[string]*resolver.NameserverResponse{
-		nsExample1: {
-			Nameserver: nsExample1,
-			Status:     resolver.StatusOK,
-		},
-		nsExample2: {
-			Nameserver: nsExample2,
-			Status:     resolver.StatusOK,
-		},
-		nsExample3: {
-			Nameserver: nsExample3,
-			Status:     resolver.StatusTimeout,
-		},
-		nsExample4: {
-			Nameserver: nsExample4,
-			Status:     resolver.StatusError,
-		},
-	}
-
-	assert.Equal(
-		t, 2, countStatus(results, resolver.StatusOK),
-	)
-	assert.Equal(
-		t, 0, countStatus(results, resolver.StatusNXDomain),
-	)
-
-	// Two of four answered, which is short of the quorum of
-	// three: this is the state that triggers a retry rather
-	// than an assertion failure.
-	assert.Equal(t, 2, answeredCount(results))
-	assert.Less(t, answeredCount(results), liveQuorum(len(results)))
-
-	assert.Equal(
-		t,
-		"ns1.example.=ok ns2.example.=ok "+
-			"ns3.example.=timeout ns4.example.=error",
-		describeStatuses(results),
-	)
-}
-
-// TestUnsanctionedStatusesRejectsWrongAnswers is the regression test
-// for the defect this allowlist exists to prevent: a minority of
-// nameservers answering WRONGLY while quorum keeps the suite green.
-// nodata is the case that motivated it — it is a wrong answer, not
-// silence, and it was previously banned by neither test.
-func TestUnsanctionedStatusesRejectsWrongAnswers(t *testing.T) {
-	t.Parallel()
-
-	// Four nameservers, three OK and one answering nodata: a
-	// quorum of three is satisfied and no NXDOMAIN is present, so
-	// the old blocklist assertions both passed on this input.
-	results := map[string]*resolver.NameserverResponse{
-		nsExample1: {
-			Nameserver: nsExample1,
-			Status:     resolver.StatusOK,
-		},
-		nsExample2: {
-			Nameserver: nsExample2,
-			Status:     resolver.StatusOK,
-		},
-		nsExample3: {
-			Nameserver: nsExample3,
-			Status:     resolver.StatusOK,
-		},
-		nsExample4: {
-			Nameserver: nsExample4,
-			Status:     resolver.StatusNoData,
-		},
-	}
-
-	assert.GreaterOrEqual(
-		t,
-		countStatus(results, resolver.StatusOK),
-		liveQuorum(len(results)),
-	)
-	assert.Zero(t, countStatus(results, resolver.StatusNXDomain))
-
-	// nodata is an ANSWER, so it never triggers a retry: nothing
-	// but the allowlist stands between it and a false green.
-	assert.Equal(t, len(results), answeredCount(results))
-
-	assert.Equal(
-		t,
-		[]string{nsExample4 + "=nodata"},
-		unsanctionedStatuses(
-			results,
-			resolver.StatusOK,
-			resolver.StatusTimeout,
-			resolver.StatusError,
-		),
-		"nodata must be reported as an unsanctioned status",
-	)
-}
-
-func TestUnsanctionedStatusesToleratesSilenceOnly(t *testing.T) {
-	t.Parallel()
-
-	results := map[string]*resolver.NameserverResponse{
-		nsExample1: {
-			Nameserver: nsExample1,
-			Status:     resolver.StatusNXDomain,
-		},
-		nsExample2: {
-			Nameserver: nsExample2,
-			Status:     resolver.StatusTimeout,
-		},
-		nsExample3: {
-			Nameserver: nsExample3,
-			Status:     resolver.StatusError,
-		},
-	}
-
-	allowed := []string{
-		resolver.StatusNXDomain,
-		resolver.StatusTimeout,
-		resolver.StatusError,
-	}
-
-	assert.Empty(
-		t,
-		unsanctionedStatuses(results, allowed...),
-		"timeout and error are non-answers and are tolerated",
-	)
-
-	// The same silent nameservers do not count towards a quorum.
-	assert.Equal(t, 1, answeredCount(results))
-
-	// An unknown status is treated as silence by answeredCount —
-	// so it retries and fails loudly — and is unsanctioned by the
-	// allowlist rather than quietly permitted.
-	const laterStatus = "some-status-added-later"
-
-	results[nsExample4] = &resolver.NameserverResponse{
-		Nameserver: nsExample4,
-		Status:     laterStatus,
-	}
-
-	assert.Equal(t, 1, answeredCount(results))
-	assert.Equal(
-		t,
-		[]string{nsExample4 + "=" + laterStatus},
-		unsanctionedStatuses(results, allowed...),
-	)
-}

internal/resolver/livedns_test.go

@@ -1,385 +0,0 @@
-package resolver_test
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"slices"
-	"sort"
-	"strings"
-	"testing"
-
-	"sneak.berlin/go/dnswatcher/internal/livednstest"
-	"sneak.berlin/go/dnswatcher/internal/resolver"
-)
-
-// ----------------------------------------------------------------
-// Live DNS test support
-// ----------------------------------------------------------------
-//
-// Tests that look something up in DNS query live DNS servers, never a
-// stand-in; logic that works on record data may be tested on that
-// data with no lookup (see TESTING.md). Each live operation below goes
-// through livednstest.Retry, which bounds how many resolutions are in
-// flight at once and retries an operation that got no answer (see
-// package livednstest).
-//
-// Where an assertion spans several independent nameservers, a quorum
-// is enough: a strict majority answering as expected. A server that
-// fails to answer is tolerated, while a server that answers *wrongly*
-// still fails the test.
-//
-// That tolerance is expressed as an ALLOWLIST of sanctioned statuses,
-// never as a blocklist of known-bad ones. A blocklist bans the one
-// wrong answer its author thought of and silently admits every other
-// status, including any added to the resolver later; an allowlist
-// fails on anything nobody explicitly sanctioned. Silence (timeout,
-// error) is the only thing quorum exists to tolerate. A *wrong
-// answer* — nxdomain for a name that exists, ok for one that does
-// not, nodata for either — is never tolerated at any count.
-
-// minNameservers is the smallest nameserver count a well-run zone is
-// expected to publish.
-const minNameservers = 2
-
-// errLiveNoQuorum reports that too few of a domain's nameservers
-// answered for a quorum assertion to be made.
-var errLiveNoQuorum = errors.New("no nameserver quorum")
-
-// liveQuorum is how many of total nameservers must agree for a
-// multi-nameserver assertion to hold: a strict majority.
-func liveQuorum(total int) int {
-	if total < 1 {
-		return 1
-	}
-
-	return total/2 + 1
-}
-
-// countStatus counts the responses carrying the given status.
-func countStatus(
-	results map[string]*resolver.NameserverResponse,
-	status string,
-) int {
-	n := 0
-
-	for _, resp := range results {
-		if resp.Status == status {
-			n++
-		}
-	}
-
-	return n
-}
-
-// liveAnswerStatuses is the closed set of statuses that count as a
-// nameserver having ANSWERED at all, whether or not the test agrees
-// with the answer. It is deliberately an allowlist: a status added
-// to the resolver later is treated as silence, so it can only ever
-// cause a retry and then a loud failure, never a quiet pass.
-func liveAnswerStatuses() []string {
-	return []string{
-		resolver.StatusOK,
-		resolver.StatusNXDomain,
-		resolver.StatusNoData,
-	}
-}
-
-// answeredCount counts the nameservers that produced an answer of
-// any kind, as opposed to failing or timing out.
-func answeredCount(
-	results map[string]*resolver.NameserverResponse,
-) int {
-	answers := liveAnswerStatuses()
-
-	n := 0
-
-	for _, resp := range results {
-		if slices.Contains(answers, resp.Status) {
-			n++
-		}
-	}
-
-	return n
-}
-
-// unsanctionedStatuses returns "nameserver=status" for every result
-// whose status the caller did not explicitly sanction, sorted for a
-// stable failure message. Callers pass the full closed set they will
-// accept — the expected answer plus whichever non-answers (timeout,
-// error) quorum is allowed to tolerate — so that any status outside
-// it fails the test by name.
-func unsanctionedStatuses(
-	results map[string]*resolver.NameserverResponse,
-	allowed ...string,
-) []string {
-	offenders := make([]string, 0, len(results))
-
-	for ns, resp := range results {
-		if slices.Contains(allowed, resp.Status) {
-			continue
-		}
-
-		offenders = append(
-			offenders, fmt.Sprintf("%s=%s", ns, resp.Status),
-		)
-	}
-
-	sort.Strings(offenders)
-
-	return offenders
-}
-
-// describeStatuses renders per-nameserver statuses for use in
-// assertion failure messages.
-func describeStatuses(
-	results map[string]*resolver.NameserverResponse,
-) string {
-	parts := make([]string, 0, len(results))
-	for ns, resp := range results {
-		parts = append(
-			parts, fmt.Sprintf("%s=%s", ns, resp.Status),
-		)
-	}
-
-	sort.Strings(parts)
-
-	return strings.Join(parts, " ")
-}
-
-// ----------------------------------------------------------------
-// Live operation wrappers
-// ----------------------------------------------------------------
-
-// liveFindAuthoritative resolves a domain's authoritative
-// nameservers, retrying until the delegation chain can be walked.
-func liveFindAuthoritative(
-	t *testing.T,
-	r *resolver.Resolver,
-	domain string,
-) []string {
-	t.Helper()
-
-	var out []string
-
-	livednstest.Retry(
-		t,
-		"FindAuthoritativeNameservers("+domain+")",
-		func(ctx context.Context) error {
-			ns, err := r.FindAuthoritativeNameservers(ctx, domain)
-			if err != nil {
-				return err
-			}
-
-			if len(ns) == 0 {
-				return fmt.Errorf(
-					"%w: %s has no nameservers",
-					livednstest.ErrNoAnswer, domain,
-				)
-			}
-
-			out = ns
-
-			return nil
-		},
-	)
-
-	return out
-}
-
-// liveLookupNS is liveFindAuthoritative through the LookupNS entry
-// point, so that both entry points stay independently exercised.
-func liveLookupNS(
-	t *testing.T,
-	r *resolver.Resolver,
-	domain string,
-) []string {
-	t.Helper()
-
-	var out []string
-
-	livednstest.Retry(
-		t,
-		"LookupNS("+domain+")",
-		func(ctx context.Context) error {
-			ns, err := r.LookupNS(ctx, domain)
-			if err != nil {
-				return err
-			}
-
-			if len(ns) == 0 {
-				return fmt.Errorf(
-					"%w: %s has no nameservers",
-					livednstest.ErrNoAnswer, domain,
-				)
-			}
-
-			out = ns
-
-			return nil
-		},
-	)
-
-	return out
-}
-
-// liveQueryNameserver queries one nameserver, retrying while that
-// nameserver fails to answer. NXDOMAIN and NODATA are answers and
-// are returned to the caller to assert on.
-func liveQueryNameserver(
-	t *testing.T,
-	r *resolver.Resolver,
-	nameserver string,
-	hostname string,
-) *resolver.NameserverResponse {
-	t.Helper()
-
-	what := fmt.Sprintf(
-		"QueryNameserver(%s, %s)", nameserver, hostname,
-	)
-
-	var out *resolver.NameserverResponse
-
-	livednstest.Retry(
-		t,
-		what,
-		func(ctx context.Context) error {
-			resp, err := r.QueryNameserver(
-				ctx, nameserver, hostname,
-			)
-			if err != nil {
-				return err
-			}
-
-			if resp.Status == resolver.StatusTimeout ||
-				resp.Status == resolver.StatusError {
-				return fmt.Errorf(
-					"%w: %s returned %s: %s",
-					livednstest.ErrNoAnswer, nameserver,
-					resp.Status, resp.Error,
-				)
-			}
-
-			out = resp
-
-			return nil
-		},
-	)
-
-	return out
-}
-
-// liveQueryAllNameservers queries every authoritative nameserver
-// for a hostname, retrying until a quorum of them has answered.
-// Individual nameservers that stay silent are left in the result
-// for the caller to account for.
-func liveQueryAllNameservers(
-	t *testing.T,
-	r *resolver.Resolver,
-	hostname string,
-) map[string]*resolver.NameserverResponse {
-	t.Helper()
-
-	var out map[string]*resolver.NameserverResponse
-
-	livednstest.Retry(
-		t,
-		"QueryAllNameservers("+hostname+")",
-		func(ctx context.Context) error {
-			results, err := r.QueryAllNameservers(ctx, hostname)
-			if err != nil {
-				return err
-			}
-
-			if len(results) == 0 {
-				return fmt.Errorf(
-					"%w: no nameservers queried for %s",
-					livednstest.ErrNoAnswer, hostname,
-				)
-			}
-
-			answered := answeredCount(results)
-			if answered < liveQuorum(len(results)) {
-				return fmt.Errorf(
-					"%w: %d of %d answered: %s",
-					errLiveNoQuorum, answered,
-					len(results), describeStatuses(results),
-				)
-			}
-
-			out = results
-
-			return nil
-		},
-	)
-
-	return out
-}
-
-// liveResolveIPs resolves a hostname that is expected to have
-// addresses, retrying until at least one is returned.
-func liveResolveIPs(
-	t *testing.T,
-	r *resolver.Resolver,
-	hostname string,
-) []string {
-	t.Helper()
-
-	var out []string
-
-	livednstest.Retry(
-		t,
-		"ResolveIPAddresses("+hostname+")",
-		func(ctx context.Context) error {
-			ips, err := r.ResolveIPAddresses(ctx, hostname)
-			if err != nil {
-				return err
-			}
-
-			if len(ips) == 0 {
-				return fmt.Errorf(
-					"%w: no addresses for %s",
-					livednstest.ErrNoAnswer, hostname,
-				)
-			}
-
-			out = ips
-
-			return nil
-		},
-	)
-
-	return out
-}
-
-// liveResolveIPsAllowingEmpty resolves a hostname that may legitimately
-// have no addresses, so the empty result is returned rather than
-// retried. Used for names that must not exist; the corresponding
-// QueryAllNameservers test is what proves the nameservers actively
-// said NXDOMAIN rather than merely staying silent.
-func liveResolveIPsAllowingEmpty(
-	t *testing.T,
-	r *resolver.Resolver,
-	hostname string,
-) []string {
-	t.Helper()
-
-	var out []string
-
-	livednstest.Retry(
-		t,
-		"ResolveIPAddresses("+hostname+")",
-		func(ctx context.Context) error {
-			ips, err := r.ResolveIPAddresses(ctx, hostname)
-			if err != nil {
-				return err
-			}
-
-			out = ips
-
-			return nil
-		},
-	)
-
-	return out
-}

internal/resolver/resolver.go

@@ -67,4 +67,17 @@ func NewFromLogger(log *slog.Logger) *Resolver {
 	}
 }
 
+// NewFromLoggerWithClient creates a Resolver with a custom DNS
+// client, useful for testing with mock DNS responses.
+func NewFromLoggerWithClient(
+	log *slog.Logger,
+	client DNSClient,
+) *Resolver {
+	return &Resolver{
+		log:    log,
+		client: client,
+		tcp:    client,
+	}
+}
+
 // Method implementations are in iterative.go.

internal/resolver/resolver_test.go

@@ -10,6 +10,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/miekg/dns"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -31,17 +32,32 @@ func newTestResolver(t *testing.T) *resolver.Resolver {
 	return resolver.NewFromLogger(log)
 }
 
-// findOneNSForDomain picks one authoritative nameserver to aim a
+func testContext(t *testing.T) context.Context {
-// test at. Quorum handling lives in livedns_test.go, and the live-DNS
+	t.Helper()
-// retry and concurrency limit in package livednstest.
+
+	ctx, cancel := context.WithTimeout(
+		context.Background(), 60*time.Second,
+	)
+	t.Cleanup(cancel)
+
+	return ctx
+}
+
 func findOneNSForDomain(
 	t *testing.T,
 	r *resolver.Resolver,
+	ctx context.Context, //nolint:revive // test helper
 	domain string,
 ) string {
 	t.Helper()
 
-	return liveFindAuthoritative(t, r, domain)[0]
+	nameservers, err := r.FindAuthoritativeNameservers(
+		ctx, domain,
+	)
+	require.NoError(t, err)
+	require.NotEmpty(t, nameservers)
+
+	return nameservers[0]
 }
 
 // ----------------------------------------------------------------
@@ -54,7 +70,13 @@ func TestFindAuthoritativeNameservers_ValidDomain(
 	t.Parallel()
 
 	r := newTestResolver(t)
-	nameservers := liveFindAuthoritative(t, r, "google.com")
+	ctx := testContext(t)
+
+	nameservers, err := r.FindAuthoritativeNameservers(
+		ctx, "google.com",
+	)
+	require.NoError(t, err)
+	require.NotEmpty(t, nameservers)
 
 	hasGoogleNS := false
 
@@ -77,9 +99,13 @@ func TestFindAuthoritativeNameservers_Subdomain(
 	t.Parallel()
 
 	r := newTestResolver(t)
-	nameservers := liveFindAuthoritative(t, r, "www.google.com")
+	ctx := testContext(t)
 
-	assert.NotEmpty(t, nameservers)
+	nameservers, err := r.FindAuthoritativeNameservers(
+		ctx, "www.google.com",
+	)
+	require.NoError(t, err)
+	require.NotEmpty(t, nameservers)
 }
 
 func TestFindAuthoritativeNameservers_ReturnsSorted(
@@ -88,7 +114,12 @@ func TestFindAuthoritativeNameservers_ReturnsSorted(
 	t.Parallel()
 
 	r := newTestResolver(t)
-	nameservers := liveFindAuthoritative(t, r, "google.com")
+	ctx := testContext(t)
+
+	nameservers, err := r.FindAuthoritativeNameservers(
+		ctx, "google.com",
+	)
+	require.NoError(t, err)
 
 	assert.True(
 		t,
@@ -103,8 +134,17 @@ func TestFindAuthoritativeNameservers_Deterministic(
 	t.Parallel()
 
 	r := newTestResolver(t)
-	first := liveFindAuthoritative(t, r, "google.com")
+	ctx := testContext(t)
-	second := liveFindAuthoritative(t, r, "google.com")
+
+	first, err := r.FindAuthoritativeNameservers(
+		ctx, "google.com",
+	)
+	require.NoError(t, err)
+
+	second, err := r.FindAuthoritativeNameservers(
+		ctx, "google.com",
+	)
+	require.NoError(t, err)
 
 	assert.Equal(t, first, second)
 }
@@ -115,8 +155,17 @@ func TestFindAuthoritativeNameservers_TrailingDot(
 	t.Parallel()
 
 	r := newTestResolver(t)
-	ns1 := liveFindAuthoritative(t, r, "google.com")
+	ctx := testContext(t)
-	ns2 := liveFindAuthoritative(t, r, "google.com.")
+
+	ns1, err := r.FindAuthoritativeNameservers(
+		ctx, "google.com",
+	)
+	require.NoError(t, err)
+
+	ns2, err := r.FindAuthoritativeNameservers(
+		ctx, "google.com.",
+	)
+	require.NoError(t, err)
 
 	assert.Equal(t, ns1, ns2)
 }
@@ -127,7 +176,13 @@ func TestFindAuthoritativeNameservers_CloudflareDomain(
 	t.Parallel()
 
 	r := newTestResolver(t)
-	nameservers := liveFindAuthoritative(t, r, "cloudflare.com")
+	ctx := testContext(t)
+
+	nameservers, err := r.FindAuthoritativeNameservers(
+		ctx, "cloudflare.com",
+	)
+	require.NoError(t, err)
+	require.NotEmpty(t, nameservers)
 
 	for _, ns := range nameservers {
 		assert.True(t, strings.HasSuffix(ns, "."),
@@ -144,9 +199,13 @@ func TestQueryNameserver_BasicA(t *testing.T) {
 	t.Parallel()
 
 	r := newTestResolver(t)
-	ns := findOneNSForDomain(t, r, "google.com")
+	ctx := testContext(t)
-	resp := liveQueryNameserver(t, r, ns, "www.google.com")
+	ns := findOneNSForDomain(t, r, ctx, "google.com")
 
+	resp, err := r.QueryNameserver(
+		ctx, ns, "www.google.com",
+	)
+	require.NoError(t, err)
 	require.NotNil(t, resp)
 
 	assert.Equal(t, resolver.StatusOK, resp.Status)
@@ -163,8 +222,13 @@ func TestQueryNameserver_AAAA(t *testing.T) {
 	t.Parallel()
 
 	r := newTestResolver(t)
-	ns := findOneNSForDomain(t, r, "cloudflare.com")
+	ctx := testContext(t)
-	resp := liveQueryNameserver(t, r, ns, "cloudflare.com")
+	ns := findOneNSForDomain(t, r, ctx, "cloudflare.com")
+
+	resp, err := r.QueryNameserver(
+		ctx, ns, "cloudflare.com",
+	)
+	require.NoError(t, err)
 
 	aaaaRecords := resp.Records["AAAA"]
 	require.NotEmpty(t, aaaaRecords,
@@ -183,8 +247,13 @@ func TestQueryNameserver_MX(t *testing.T) {
 	t.Parallel()
 
 	r := newTestResolver(t)
-	ns := findOneNSForDomain(t, r, "google.com")
+	ctx := testContext(t)
-	resp := liveQueryNameserver(t, r, ns, "google.com")
+	ns := findOneNSForDomain(t, r, ctx, "google.com")
+
+	resp, err := r.QueryNameserver(
+		ctx, ns, "google.com",
+	)
+	require.NoError(t, err)
 
 	mxRecords := resp.Records["MX"]
 	require.NotEmpty(t, mxRecords,
@@ -196,8 +265,13 @@ func TestQueryNameserver_TXT(t *testing.T) {
 	t.Parallel()
 
 	r := newTestResolver(t)
-	ns := findOneNSForDomain(t, r, "google.com")
+	ctx := testContext(t)
-	resp := liveQueryNameserver(t, r, ns, "google.com")
+	ns := findOneNSForDomain(t, r, ctx, "google.com")
+
+	resp, err := r.QueryNameserver(
+		ctx, ns, "google.com",
+	)
+	require.NoError(t, err)
 
 	txtRecords := resp.Records["TXT"]
 	require.NotEmpty(t, txtRecords,
@@ -223,10 +297,14 @@ func TestQueryNameserver_NXDomain(t *testing.T) {
 	t.Parallel()
 
 	r := newTestResolver(t)
-	ns := findOneNSForDomain(t, r, "google.com")
+	ctx := testContext(t)
-	resp := liveQueryNameserver(
+	ns := findOneNSForDomain(t, r, ctx, "google.com")
-		t, r, ns, "this-surely-does-not-exist-xyz.google.com",
+
+	resp, err := r.QueryNameserver(
+		ctx, ns,
+		"this-surely-does-not-exist-xyz.google.com",
 	)
+	require.NoError(t, err)
 
 	assert.Equal(t, resolver.StatusNXDomain, resp.Status)
 }
@@ -235,8 +313,13 @@ func TestQueryNameserver_RecordsSorted(t *testing.T) {
 	t.Parallel()
 
 	r := newTestResolver(t)
-	ns := findOneNSForDomain(t, r, "google.com")
+	ctx := testContext(t)
-	resp := liveQueryNameserver(t, r, ns, "google.com")
+	ns := findOneNSForDomain(t, r, ctx, "google.com")
+
+	resp, err := r.QueryNameserver(
+		ctx, ns, "google.com",
+	)
+	require.NoError(t, err)
 
 	for recordType, values := range resp.Records {
 		assert.True(
@@ -253,8 +336,13 @@ func TestQueryNameserver_ResponseIncludesNameserver(
 	t.Parallel()
 
 	r := newTestResolver(t)
-	ns := findOneNSForDomain(t, r, "cloudflare.com")
+	ctx := testContext(t)
-	resp := liveQueryNameserver(t, r, ns, "cloudflare.com")
+	ns := findOneNSForDomain(t, r, ctx, "cloudflare.com")
+
+	resp, err := r.QueryNameserver(
+		ctx, ns, "cloudflare.com",
+	)
+	require.NoError(t, err)
 
 	assert.Equal(t, ns, resp.Nameserver)
 }
@@ -265,10 +353,14 @@ func TestQueryNameserver_EmptyRecordsOnNXDomain(
 	t.Parallel()
 
 	r := newTestResolver(t)
-	ns := findOneNSForDomain(t, r, "google.com")
+	ctx := testContext(t)
-	resp := liveQueryNameserver(
+	ns := findOneNSForDomain(t, r, ctx, "google.com")
-		t, r, ns, "this-surely-does-not-exist-xyz.google.com",
+
+	resp, err := r.QueryNameserver(
+		ctx, ns,
+		"this-surely-does-not-exist-xyz.google.com",
 	)
+	require.NoError(t, err)
 
 	totalRecords := 0
 	for _, values := range resp.Records {
@@ -282,9 +374,18 @@ func TestQueryNameserver_TrailingDotHandling(t *testing.T) {
 	t.Parallel()
 
 	r := newTestResolver(t)
-	ns := findOneNSForDomain(t, r, "google.com")
+	ctx := testContext(t)
-	resp1 := liveQueryNameserver(t, r, ns, "google.com")
+	ns := findOneNSForDomain(t, r, ctx, "google.com")
-	resp2 := liveQueryNameserver(t, r, ns, "google.com.")
+
+	resp1, err := r.QueryNameserver(
+		ctx, ns, "google.com",
+	)
+	require.NoError(t, err)
+
+	resp2, err := r.QueryNameserver(
+		ctx, ns, "google.com.",
+	)
+	require.NoError(t, err)
 
 	assert.Equal(t, resp1.Status, resp2.Status)
 }
@@ -297,9 +398,15 @@ func TestQueryAllNameservers_ReturnsAllNS(t *testing.T) {
 	t.Parallel()
 
 	r := newTestResolver(t)
-	results := liveQueryAllNameservers(t, r, "google.com")
+	ctx := testContext(t)
 
-	assert.GreaterOrEqual(t, len(results), minNameservers)
+	results, err := r.QueryAllNameservers(
+		ctx, "google.com",
+	)
+	require.NoError(t, err)
+	require.NotEmpty(t, results)
+
+	assert.GreaterOrEqual(t, len(results), 2)
 
 	for ns, resp := range results {
 		assert.Equal(t, ns, resp.Nameserver)
@@ -310,37 +417,20 @@ func TestQueryAllNameservers_AllReturnOK(t *testing.T) {
 	t.Parallel()
 
 	r := newTestResolver(t)
-	results := liveQueryAllNameservers(t, r, "google.com")
+	ctx := testContext(t)
 
-	// A quorum, not unanimity: one authoritative server being
+	results, err := r.QueryAllNameservers(
-	// slow or rate-limiting us is a property of the live
+		ctx, "google.com",
-	// internet, not a resolver defect.
-	assert.GreaterOrEqual(
-		t,
-		countStatus(results, resolver.StatusOK),
-		liveQuorum(len(results)),
-		"a quorum of nameservers should answer OK: %s",
-		describeStatuses(results),
 	)
+	require.NoError(t, err)
 
-	// Quorum tolerates SILENCE only. Every individual result must
+	for ns, resp := range results {
-	// be either the expected answer or a non-answer: ok, timeout
+		assert.Equal(
-	// or error, and nothing else. Stated as a closed allowlist so
+			t, resolver.StatusOK, resp.Status,
-	// that a wrong answer no one thought to ban — nxdomain and
+			"NS %s should return OK", ns,
-	// nodata today, any status added later — fails here rather
-	// than sliding through under the quorum.
-	assert.Empty(
-		t,
-		unsanctionedStatuses(
-			results,
-			resolver.StatusOK,
-			resolver.StatusTimeout,
-			resolver.StatusError,
-		),
-		"every nameserver must answer OK or not answer at all: %s",
-		describeStatuses(results),
 		)
 	}
+}
 
 func TestQueryAllNameservers_NXDomainFromAllNS(
 	t *testing.T,
@@ -348,35 +438,21 @@ func TestQueryAllNameservers_NXDomainFromAllNS(
 	t.Parallel()
 
 	r := newTestResolver(t)
-	results := liveQueryAllNameservers(
+	ctx := testContext(t)
-		t, r, "this-surely-does-not-exist-xyz.google.com",
-	)
 
-	assert.GreaterOrEqual(
+	results, err := r.QueryAllNameservers(
-		t,
+		ctx,
-		countStatus(results, resolver.StatusNXDomain),
+		"this-surely-does-not-exist-xyz.google.com",
-		liveQuorum(len(results)),
-		"a quorum of nameservers should report NXDOMAIN: %s",
-		describeStatuses(results),
 	)
+	require.NoError(t, err)
 
-	// Silence is tolerated; any actual answer other than NXDOMAIN
+	for ns, resp := range results {
-	// is not. Closed allowlist for the same reason as above: a
+		assert.Equal(
-	// server answering `ok` or `nodata` for a name that must not
+			t, resolver.StatusNXDomain, resp.Status,
-	// exist is a wrong answer, not a slow one.
+			"NS %s should return nxdomain", ns,
-	assert.Empty(
-		t,
-		unsanctionedStatuses(
-			results,
-			resolver.StatusNXDomain,
-			resolver.StatusTimeout,
-			resolver.StatusError,
-		),
-		"every nameserver must report NXDOMAIN or not answer "+
-			"at all: %s",
-		describeStatuses(results),
 		)
 	}
+}
 
 // ----------------------------------------------------------------
 // LookupNS tests
@@ -386,7 +462,11 @@ func TestLookupNS_ValidDomain(t *testing.T) {
 	t.Parallel()
 
 	r := newTestResolver(t)
-	nameservers := liveLookupNS(t, r, "google.com")
+	ctx := testContext(t)
+
+	nameservers, err := r.LookupNS(ctx, "google.com")
+	require.NoError(t, err)
+	require.NotEmpty(t, nameservers)
 
 	for _, ns := range nameservers {
 		assert.True(t, strings.HasSuffix(ns, "."),
@@ -399,7 +479,10 @@ func TestLookupNS_Sorted(t *testing.T) {
 	t.Parallel()
 
 	r := newTestResolver(t)
-	nameservers := liveLookupNS(t, r, "google.com")
+	ctx := testContext(t)
+
+	nameservers, err := r.LookupNS(ctx, "google.com")
+	require.NoError(t, err)
 
 	assert.True(t, sort.StringsAreSorted(nameservers))
 }
@@ -408,8 +491,15 @@ func TestLookupNS_MatchesFindAuthoritative(t *testing.T) {
 	t.Parallel()
 
 	r := newTestResolver(t)
-	fromLookup := liveLookupNS(t, r, "google.com")
+	ctx := testContext(t)
-	fromFind := liveFindAuthoritative(t, r, "google.com")
+
+	fromLookup, err := r.LookupNS(ctx, "google.com")
+	require.NoError(t, err)
+
+	fromFind, err := r.FindAuthoritativeNameservers(
+		ctx, "google.com",
+	)
+	require.NoError(t, err)
 
 	assert.Equal(t, fromFind, fromLookup)
 }
@@ -422,7 +512,11 @@ func TestResolveIPAddresses_ReturnsIPs(t *testing.T) {
 	t.Parallel()
 
 	r := newTestResolver(t)
-	ips := liveResolveIPs(t, r, "google.com")
+	ctx := testContext(t)
+
+	ips, err := r.ResolveIPAddresses(ctx, "google.com")
+	require.NoError(t, err)
+	require.NotEmpty(t, ips)
 
 	for _, ip := range ips {
 		parsed := net.ParseIP(ip)
@@ -436,7 +530,10 @@ func TestResolveIPAddresses_Deduplicated(t *testing.T) {
 	t.Parallel()
 
 	r := newTestResolver(t)
-	ips := liveResolveIPs(t, r, "google.com")
+	ctx := testContext(t)
+
+	ips, err := r.ResolveIPAddresses(ctx, "google.com")
+	require.NoError(t, err)
 
 	seen := make(map[string]bool)
 
@@ -450,7 +547,10 @@ func TestResolveIPAddresses_Sorted(t *testing.T) {
 	t.Parallel()
 
 	r := newTestResolver(t)
-	ips := liveResolveIPs(t, r, "google.com")
+	ctx := testContext(t)
+
+	ips, err := r.ResolveIPAddresses(ctx, "google.com")
+	require.NoError(t, err)
 
 	assert.True(t, sort.StringsAreSorted(ips))
 }
@@ -461,10 +561,13 @@ func TestResolveIPAddresses_NXDomainReturnsEmpty(
 	t.Parallel()
 
 	r := newTestResolver(t)
-	ips := liveResolveIPsAllowingEmpty(
+	ctx := testContext(t)
-		t, r, "this-surely-does-not-exist-xyz.google.com",
-	)
 
+	ips, err := r.ResolveIPAddresses(
+		ctx,
+		"this-surely-does-not-exist-xyz.google.com",
+	)
+	require.NoError(t, err)
 	assert.Empty(t, ips)
 }
 
@@ -472,9 +575,11 @@ func TestResolveIPAddresses_CloudflareDomain(t *testing.T) {
 	t.Parallel()
 
 	r := newTestResolver(t)
-	ips := liveResolveIPs(t, r, "cloudflare.com")
+	ctx := testContext(t)
 
-	assert.NotEmpty(t, ips)
+	ips, err := r.ResolveIPAddresses(ctx, "cloudflare.com")
+	require.NoError(t, err)
+	require.NotEmpty(t, ips)
 }
 
 // ----------------------------------------------------------------
@@ -525,18 +630,21 @@ func TestQueryAllNameservers_ContextCanceled(t *testing.T) {
 func TestQueryNameserverIP_Timeout(t *testing.T) {
 	t.Parallel()
 
-	r := newTestResolver(t)
+	log := slog.New(slog.NewTextHandler(
+		os.Stderr,
+		&slog.HandlerOptions{Level: slog.LevelDebug},
+	))
+
+	r := resolver.NewFromLoggerWithClient(
+		log, &timeoutClient{},
+	)
 
-	// Nothing answers at 192.0.2.1, a documentation address. The
-	// resolver tries each query twice, and the first try gives up
-	// after two seconds. A deadline that ends during the first try
-	// makes the status vary from run to run between nodata and
-	// timeout, so the deadline must outlast the first try.
 	ctx, cancel := context.WithTimeout(
-		context.Background(), 3*time.Second,
+		context.Background(), 10*time.Second,
 	)
 	t.Cleanup(cancel)
 
+	// Query any IP — the client always returns a timeout error.
 	resp, err := r.QueryNameserverIP(
 		ctx, "unreachable.test.", "192.0.2.1",
 		"example.com",
@@ -547,6 +655,27 @@ func TestQueryNameserverIP_Timeout(t *testing.T) {
 	assert.NotEmpty(t, resp.Error)
 }
 
+// timeoutClient simulates DNS timeout errors for testing.
+type timeoutClient struct{}
+
+func (c *timeoutClient) ExchangeContext(
+	_ context.Context,
+	_ *dns.Msg,
+	_ string,
+) (*dns.Msg, time.Duration, error) {
+	return nil, 0, &net.OpError{
+		Op:  "read",
+		Net: "udp",
+		Err: &timeoutError{},
+	}
+}
+
+type timeoutError struct{}
+
+func (e *timeoutError) Error() string   { return "i/o timeout" }
+func (e *timeoutError) Timeout() bool   { return true }
+func (e *timeoutError) Temporary() bool { return true }
+
 func TestResolveIPAddresses_ContextCanceled(t *testing.T) {
 	t.Parallel()
 

internal/server/export_test.go

@@ -1,24 +0,0 @@
-package server
-
-import (
-	"net/http"
-	"time"
-)
-
-// RequestTimeout exports the handler execution budget applied by
-// chimw.Timeout in SetupRoutes, so tests can assert the relationship
-// between it and the server's WriteTimeout.
-const RequestTimeout time.Duration = requestTimeout
-
-// SetListenPort overrides the port Run binds. A test uses it to hand
-// Run an unbindable port so ListenAndServe fails immediately and Run
-// returns after storing its http.Server.
-func SetListenPort(s *Server, port int) {
-	s.port = port
-}
-
-// HTTPServerOf returns the http.Server that Run built and stored, so a
-// test can inspect the timeouts the running server actually carries.
-func HTTPServerOf(s *Server) *http.Server {
-	return s.httpServer
-}

internal/server/routes.go

@@ -21,22 +21,15 @@ func (s *Server) SetupRoutes() {
 	// Global middleware
 	s.router.Use(chimw.Recoverer)
 	s.router.Use(chimw.RequestID)
-	s.router.Use(s.mw.SecurityHeaders())
 	s.router.Use(s.mw.Logging())
+	s.router.Use(s.mw.CORS())
 	s.router.Use(chimw.Timeout(requestTimeout))
 
-	// Public, unauthenticated, read-only routes, the only ones
-	// REPO_POLICIES.md allows wildcard CORS on. CORS is middleware of
-	// this whole router, not of a Group, so that it also answers
-	// OPTIONS preflight requests, which no route here registers.
-	public := chi.NewRouter()
-	public.Use(s.mw.CORS())
-
 	// Dashboard (read-only web UI)
-	public.Get("/", s.handlers.HandleDashboard())
+	s.router.Get("/", s.handlers.HandleDashboard())
 
 	// Static assets (embedded CSS/JS)
-	public.Mount(
+	s.router.Mount(
 		"/s",
 		http.StripPrefix(
 			"/s",
@@ -45,33 +38,27 @@ func (s *Server) SetupRoutes() {
 	)
 
 	// Health check (standard well-known path)
-	public.Get(
+	s.router.Get(
 		"/.well-known/healthcheck",
 		s.handlers.HandleHealthCheck(),
 	)
 
 	// Legacy health check (keep for backward compatibility)
-	public.Get("/health", s.handlers.HandleHealthCheck())
+	s.router.Get("/health", s.handlers.HandleHealthCheck())
 
 	// API v1 routes
-	public.Route("/api/v1", func(r chi.Router) {
+	s.router.Route("/api/v1", func(r chi.Router) {
 		r.Get("/status", s.handlers.HandleStatus())
 	})
 
-	s.router.Mount("/", public)
+	// Metrics endpoint (optional, with basic auth)
-
-	// Metrics endpoint (optional, with basic auth) and no CORS: a
-	// Prometheus scraper is not a browser. It is mounted rather than
-	// added with Get so that every method on /metrics, OPTIONS
-	// included, ends here instead of falling through to the public
-	// router and its CORS. The rate limit comes before Basic Auth, so
-	// failed logins count against it and a request over the limit
-	// never reaches the password check.
 	if s.params.Config.MetricsUsername != "" {
-		metrics := chi.NewRouter()
+		s.router.Group(func(r chi.Router) {
-		metrics.Use(s.mw.MetricsRateLimit())
+			r.Use(s.mw.MetricsAuth())
-		metrics.Use(s.mw.MetricsAuth())
+			r.Get(
-		metrics.Get("/", promhttp.Handler().ServeHTTP)
+				"/metrics",
-		s.router.Mount("/metrics", metrics)
+				promhttp.Handler().ServeHTTP,
+			)
+		})
 	}
 }

internal/server/routes_test.go

@@ -1,290 +0,0 @@
-package server_test
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/spf13/viper"
-
-	"sneak.berlin/go/dnswatcher/internal/server"
-)
-
-// Credentials for /metrics, which is only routed when a username is set.
-const (
-	metricsUsername = "scraper"
-	metricsPassword = "scrape-secret"
-)
-
-// The tests below set env vars and touch viper global state, so like
-// the config tests they cannot use t.Parallel.
-
-// routedServer builds the server with its routes set up, ready to serve
-// test requests. The caller must first configure viper.
-func routedServer(t *testing.T) *server.Server {
-	t.Helper()
-
-	srv := buildServer(t)
-	srv.SetupRoutes()
-
-	return srv
-}
-
-// crossOriginRequest builds a request as a browser sends it from a page
-// on another site.
-func crossOriginRequest(
-	t *testing.T,
-	method string,
-	target string,
-) *http.Request {
-	t.Helper()
-
-	req := httptest.NewRequestWithContext(t.Context(), method, target, nil)
-	req.Header.Set("Origin", "https://example.net")
-
-	return req
-}
-
-// preflightRequest builds the OPTIONS request a browser sends before a
-// cross-origin request with the given method and request headers.
-func preflightRequest(
-	t *testing.T,
-	target string,
-	method string,
-	headers string,
-) *http.Request {
-	t.Helper()
-
-	req := crossOriginRequest(t, http.MethodOptions, target)
-	req.Header.Set("Access-Control-Request-Method", method)
-
-	if headers != "" {
-		req.Header.Set("Access-Control-Request-Headers", headers)
-	}
-
-	return req
-}
-
-func serve(
-	srv *server.Server,
-	req *http.Request,
-) *httptest.ResponseRecorder {
-	rec := httptest.NewRecorder()
-	srv.ServeHTTP(rec, req)
-
-	return rec
-}
-
-// publicPaths returns one path on each public route.
-func publicPaths() []string {
-	return []string{
-		"/",
-		"/s/css/tailwind.min.css",
-		"/api/v1/status",
-		"/health",
-		"/.well-known/healthcheck",
-	}
-}
-
-// TestPublicRoutesAllowAnyOrigin checks that every public route answers
-// a cross-origin GET with the CORS wildcard.
-func TestPublicRoutesAllowAnyOrigin(t *testing.T) {
-	viper.Reset()
-	t.Setenv("DNSWATCHER_TARGETS", "example.com")
-	t.Setenv("DNSWATCHER_METRICS_USERNAME", metricsUsername)
-	t.Setenv("DNSWATCHER_METRICS_PASSWORD", metricsPassword)
-
-	srv := routedServer(t)
-
-	for _, path := range publicPaths() {
-		rec := serve(srv, crossOriginRequest(t, http.MethodGet, path))
-
-		if rec.Code != http.StatusOK {
-			t.Errorf("GET %s: status = %d, want 200", path, rec.Code)
-		}
-
-		got := rec.Header().Get("Access-Control-Allow-Origin")
-		if got != "*" {
-			t.Errorf(
-				"GET %s: Access-Control-Allow-Origin = %q, want %q",
-				path, got, "*",
-			)
-		}
-	}
-}
-
-// TestMetricsHasNoCORS checks that no request to the Basic-Auth
-// protected /metrics, preflight included, gets a CORS header.
-func TestMetricsHasNoCORS(t *testing.T) {
-	viper.Reset()
-	t.Setenv("DNSWATCHER_TARGETS", "example.com")
-	t.Setenv("DNSWATCHER_METRICS_USERNAME", metricsUsername)
-	t.Setenv("DNSWATCHER_METRICS_PASSWORD", metricsPassword)
-
-	srv := routedServer(t)
-
-	authenticated := crossOriginRequest(t, http.MethodGet, "/metrics")
-	authenticated.SetBasicAuth(metricsUsername, metricsPassword)
-
-	tests := []struct {
-		name       string
-		req        *http.Request
-		wantStatus int
-	}{
-		{
-			"authenticated GET",
-			authenticated,
-			http.StatusOK,
-		},
-		{
-			"unauthenticated GET",
-			crossOriginRequest(t, http.MethodGet, "/metrics"),
-			http.StatusUnauthorized,
-		},
-		{
-			"preflight",
-			preflightRequest(t, "/metrics", http.MethodGet, ""),
-			http.StatusUnauthorized,
-		},
-	}
-
-	for _, tt := range tests {
-		rec := serve(srv, tt.req)
-
-		if rec.Code != tt.wantStatus {
-			t.Errorf(
-				"%s: status = %d, want %d",
-				tt.name, rec.Code, tt.wantStatus,
-			)
-		}
-
-		got := rec.Header().Get("Access-Control-Allow-Origin")
-		if got != "" {
-			t.Errorf(
-				"%s: Access-Control-Allow-Origin = %q, want none",
-				tt.name, got,
-			)
-		}
-	}
-}
-
-// TestPreflightAllowsOnlyWhatPublicRoutesServe checks what each public
-// route agrees to in a CORS preflight: GET, but not POST, PUT or
-// DELETE, which no route serves, and not the Authorization or
-// X-CSRF-Token headers, which no public route reads. It checks every
-// public route because one added with Get, such as /health, answers a
-// preflight only while CORS is middleware of a whole router; in a
-// Group, chi would answer it with 405 and no CORS headers.
-func TestPreflightAllowsOnlyWhatPublicRoutesServe(t *testing.T) {
-	viper.Reset()
-	t.Setenv("DNSWATCHER_TARGETS", "example.com")
-	t.Setenv("DNSWATCHER_METRICS_USERNAME", metricsUsername)
-	t.Setenv("DNSWATCHER_METRICS_PASSWORD", metricsPassword)
-
-	srv := routedServer(t)
-
-	tests := []struct {
-		method  string
-		headers string
-		allowed bool
-	}{
-		{http.MethodGet, "", true},
-		{http.MethodGet, "Content-Type", true},
-		{http.MethodPost, "", false},
-		{http.MethodPut, "", false},
-		{http.MethodDelete, "", false},
-		{http.MethodGet, "Authorization", false},
-		{http.MethodGet, "X-CSRF-Token", false},
-	}
-
-	for _, path := range publicPaths() {
-		for _, tt := range tests {
-			rec := serve(srv, preflightRequest(
-				t, path, tt.method, tt.headers,
-			))
-
-			want := ""
-			if tt.allowed {
-				want = tt.method
-			}
-
-			got := rec.Header().Get("Access-Control-Allow-Methods")
-			if got != want {
-				t.Errorf(
-					"preflight to %s for %s with headers %q: "+
-						"Access-Control-Allow-Methods = %q, want %q",
-					path, tt.method, tt.headers, got, want,
-				)
-			}
-		}
-	}
-}
-
-// metricsRequest builds a GET for /metrics from remoteAddr that logs
-// in with the given password.
-func metricsRequest(
-	t *testing.T,
-	remoteAddr string,
-	password string,
-) *http.Request {
-	t.Helper()
-
-	req := httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, "/metrics", nil,
-	)
-	req.RemoteAddr = remoteAddr
-	req.SetBasicAuth(metricsUsername, password)
-
-	return req
-}
-
-// TestMetricsRateLimitComesBeforeAuth checks that failed logins to
-// /metrics count against the rate limit; that once an address is over
-// it, even the right password gets 429, with the same body as a wrong
-// one; and that another address still gets in.
-func TestMetricsRateLimitComesBeforeAuth(t *testing.T) {
-	viper.Reset()
-	t.Setenv("DNSWATCHER_TARGETS", "example.com")
-	t.Setenv("DNSWATCHER_METRICS_USERNAME", metricsUsername)
-	t.Setenv("DNSWATCHER_METRICS_PASSWORD", metricsPassword)
-
-	const (
-		guesser = "198.51.100.1:4000"
-		other   = "198.51.100.2:4000"
-
-		// Far more guesses than the rate limit allows.
-		maxGuesses = 1000
-	)
-
-	srv := routedServer(t)
-
-	var guess *httptest.ResponseRecorder
-
-	for range maxGuesses {
-		guess = serve(srv, metricsRequest(t, guesser, "wrong"))
-		if guess.Code != http.StatusUnauthorized {
-			break
-		}
-	}
-
-	if guess.Code != http.StatusTooManyRequests {
-		t.Fatalf("wrong password: status = %d, want 429", guess.Code)
-	}
-
-	right := serve(srv, metricsRequest(t, guesser, metricsPassword))
-	if right.Code != http.StatusTooManyRequests {
-		t.Errorf("right password: status = %d, want 429", right.Code)
-	}
-
-	if right.Body.String() != guess.Body.String() {
-		t.Errorf(
-			"429 body with right password = %q, with wrong one = %q",
-			right.Body.String(), guess.Body.String(),
-		)
-	}
-
-	rec := serve(srv, metricsRequest(t, other, metricsPassword))
-	if rec.Code != http.StatusOK {
-		t.Errorf("another address: status = %d, want 200", rec.Code)
-	}
-}

internal/server/server.go

@@ -33,52 +33,8 @@ type Params struct {
 // shutdownTimeout is how long to wait for graceful shutdown.
 const shutdownTimeout = 30 * time.Second
 
-// Socket-level timeouts for the HTTP server.
+// readHeaderTimeout is the max duration for reading request headers.
-//
+const readHeaderTimeout = 10 * time.Second
-// These bound time spent on the connection itself and are a distinct
-// control from the per-request handler budget enforced by
-// chimw.Timeout(requestTimeout) in routes.go: that one cancels the
-// request context after requestTimeout but never touches the socket,
-// so without the values below a peer can hold a connection open
-// forever (slowloris, unreaped keep-alives).
-//
-// The one hard constraint between the two controls is
-// writeTimeout > requestTimeout. net/http arms the write deadline
-// once the request headers have been read, so on a plaintext
-// connection it covers handler execution AND the response flush. If
-// writeTimeout were <= requestTimeout the server would sever the
-// connection before a handler that legitimately consumed its full
-// budget could emit anything, making the 60s budget unreachable in
-// practice. The margin between them is the response-flush allowance.
-//
-// The only clients of this service are browsers loading the dashboard
-// and a Prometheus scraper; the values are sized for those.
-const (
-	// readHeaderTimeout is the max duration for reading request
-	// headers.
-	readHeaderTimeout = 10 * time.Second
-
-	// readTimeout bounds reading the entire request, headers plus
-	// body. Every route here is a GET with no body, so this only
-	// ever needs to cover headers; the extra 5s over
-	// readHeaderTimeout is slack, not a real allowance, and keeps a
-	// body dribbled one byte at a time from holding the read side
-	// open indefinitely.
-	readTimeout = 15 * time.Second
-
-	// writeTimeout must exceed the requestTimeout handler budget
-	// (60s) per the note above. The 15s difference is the allowance
-	// for flushing a completed response to a slow client.
-	writeTimeout = 75 * time.Second
-
-	// idleTimeout reaps keep-alive connections between requests. It
-	// is deliberately longer than the common Prometheus scrape
-	// intervals (15s/30s/60s) so the scraper reuses its connection
-	// rather than reconnecting every cycle, while a browser tab
-	// left open on the dashboard stops occupying a connection
-	// within two minutes of going quiet.
-	idleTimeout = 120 * time.Second
-)
 
 // Server is the HTTP server.
 type Server struct {
@@ -120,29 +76,16 @@ func New(
 	return srv, nil
 }
 
-// newHTTPServer builds the listening http.Server with every
-// socket-level timeout set. All four are set deliberately: a zero
-// value in net/http means "no limit", not "some default".
-func newHTTPServer(
-	listenAddr string,
-	handler http.Handler,
-) *http.Server {
-	return &http.Server{
-		Addr:              listenAddr,
-		Handler:           handler,
-		ReadTimeout:       readTimeout,
-		ReadHeaderTimeout: readHeaderTimeout,
-		WriteTimeout:      writeTimeout,
-		IdleTimeout:       idleTimeout,
-	}
-}
-
 // Run starts the HTTP server.
 func (s *Server) Run() {
 	s.SetupRoutes()
 
 	listenAddr := fmt.Sprintf(":%d", s.port)
-	s.httpServer = newHTTPServer(listenAddr, s)
+	s.httpServer = &http.Server{
+		Addr:              listenAddr,
+		Handler:           s,
+		ReadHeaderTimeout: readHeaderTimeout,
+	}
 
 	s.log.Info("http server starting", "addr", listenAddr)
 

internal/server/server_test.go

@@ -1,130 +0,0 @@
-package server_test
-
-import (
-	"testing"
-
-	"github.com/spf13/viper"
-	"go.uber.org/fx"
-
-	"sneak.berlin/go/dnswatcher/internal/config"
-	"sneak.berlin/go/dnswatcher/internal/globals"
-	"sneak.berlin/go/dnswatcher/internal/handlers"
-	"sneak.berlin/go/dnswatcher/internal/healthcheck"
-	"sneak.berlin/go/dnswatcher/internal/logger"
-	"sneak.berlin/go/dnswatcher/internal/middleware"
-	"sneak.berlin/go/dnswatcher/internal/notify"
-	"sneak.berlin/go/dnswatcher/internal/server"
-	"sneak.berlin/go/dnswatcher/internal/state"
-)
-
-// buildServer wires a *server.Server exactly as cmd/dnswatcher does,
-// minus the watcher/resolver subtree that would touch live DNS. fx
-// builds the object graph but the lifecycle is never started, so no
-// OnStart hook runs and nothing listens or resolves. The caller must
-// first configure viper (config.New reads it), which is also why the
-// caller cannot run in parallel.
-func buildServer(t *testing.T) *server.Server {
-	t.Helper()
-
-	var srv *server.Server
-
-	app := fx.New(
-		fx.NopLogger,
-		fx.Provide(
-			globals.New,
-			logger.New,
-			config.New,
-			state.New,
-			healthcheck.New,
-			notify.New,
-			middleware.New,
-			handlers.New,
-			server.New,
-		),
-		fx.Populate(&srv),
-	)
-
-	err := app.Err()
-	if err != nil {
-		t.Fatalf("building server graph: %v", err)
-	}
-
-	return srv
-}
-
-// TestRunWiresSocketTimeouts pins that the http.Server the running
-// server actually serves — the one Run builds and hands to
-// ListenAndServe — carries every socket-level timeout, plus the two
-// relationships the values must satisfy.
-//
-// Run is driven to completion with an unbindable port: it builds and
-// stores s.httpServer, then ListenAndServe fails at once and Run
-// returns without ever listening. The assertions run in the same
-// goroutine after Run returns, so reading s.httpServer is free of any
-// data race. Nothing here measures elapsed time.
-//
-// ReadTimeout must be at least ReadHeaderTimeout. net/http reads the
-// headers under ReadHeaderTimeout, then sets the read deadline for the
-// rest of the request to ReadTimeout, counted from when it started
-// reading the request. If ReadTimeout were smaller, a request whose
-// headers arrived after ReadTimeout but within ReadHeaderTimeout would
-// get a read deadline that had already passed, so reading its body
-// would fail at once.
-func TestRunWiresSocketTimeouts(t *testing.T) {
-	// Sets an env var and touches viper global state, so like the
-	// config tests it cannot use t.Parallel.
-	viper.Reset()
-	t.Setenv("DNSWATCHER_TARGETS", "example.com")
-
-	srv := buildServer(t)
-	server.SetListenPort(srv, -1)
-
-	srv.Run()
-
-	hs := server.HTTPServerOf(srv)
-	if hs == nil {
-		t.Fatal("Run did not build an http.Server")
-	}
-
-	if hs.ReadTimeout <= 0 {
-		t.Errorf("ReadTimeout must be non-zero, got %v", hs.ReadTimeout)
-	}
-
-	if hs.ReadHeaderTimeout <= 0 {
-		t.Errorf(
-			"ReadHeaderTimeout must be non-zero, got %v",
-			hs.ReadHeaderTimeout,
-		)
-	}
-
-	if hs.WriteTimeout <= 0 {
-		t.Errorf("WriteTimeout must be non-zero, got %v", hs.WriteTimeout)
-	}
-
-	if hs.IdleTimeout <= 0 {
-		t.Errorf("IdleTimeout must be non-zero, got %v", hs.IdleTimeout)
-	}
-
-	if hs.WriteTimeout <= server.RequestTimeout {
-		t.Errorf(
-			"WriteTimeout (%v) must exceed handler budget (%v)",
-			hs.WriteTimeout,
-			server.RequestTimeout,
-		)
-	}
-
-	if hs.ReadTimeout < hs.ReadHeaderTimeout {
-		t.Errorf(
-			"ReadTimeout (%v) must be >= ReadHeaderTimeout (%v)",
-			hs.ReadTimeout,
-			hs.ReadHeaderTimeout,
-		)
-	}
-
-	if hs.Handler != srv {
-		t.Errorf(
-			"Run wired handler %T, want the *server.Server",
-			hs.Handler,
-		)
-	}
-}

internal/state/export_test.go

@@ -1,23 +0,0 @@
-package state
-
-import (
-	"log/slog"
-
-	"sneak.berlin/go/dnswatcher/internal/config"
-)
-
-// NewForTestWithDataDir creates an empty State that saves to dataDir,
-// without the fx lifecycle.
-func NewForTestWithDataDir(dataDir string) *State {
-	return &State{
-		log: slog.Default(),
-		snapshot: &Snapshot{
-			Version:      stateVersion,
-			Domains:      make(map[string]*DomainState),
-			Hostnames:    make(map[string]*HostnameState),
-			Ports:        make(map[string]*PortState),
-			Certificates: make(map[string]*CertificateState),
-		},
-		config: &config.Config{DataDir: dataDir},
-	}
-}

internal/state/state.go

@@ -148,11 +148,6 @@ func New(
 
 	lifecycle.Append(fx.Hook{
 		OnStart: func(_ context.Context) error {
-			err := state.checkDataDirWritable()
-			if err != nil {
-				return err
-			}
-
 			return state.Load()
 		},
 		OnStop: func(_ context.Context) error {
@@ -350,27 +345,3 @@ func (s *State) GetCertificateState(
 
 	return cs, ok
 }
-
-// checkDataDirWritable creates the data directory if needed, then writes
-// and removes the temp file that Save uses. It runs at startup so that an
-// unwritable directory stops the process, instead of the process running
-// with every save failing and only logged.
-func (s *State) checkDataDirWritable() error {
-	dir := s.config.DataDir
-	tmpPath := s.config.StatePath() + ".tmp"
-
-	err := os.MkdirAll(dir, dirPermissions)
-	if err == nil {
-		err = os.WriteFile(tmpPath, nil, filePermissions)
-	}
-
-	if err == nil {
-		err = os.Remove(tmpPath)
-	}
-
-	if err != nil {
-		return fmt.Errorf("data directory %s is not writable: %w", dir, err)
-	}
-
-	return nil
-}

internal/state/state_test.go

@@ -4,16 +4,10 @@ import (
 	"encoding/json"
 	"os"
 	"path/filepath"
-	"strings"
 	"sync"
 	"testing"
 	"time"
 
-	"go.uber.org/fx/fxtest"
-
-	"sneak.berlin/go/dnswatcher/internal/config"
-	"sneak.berlin/go/dnswatcher/internal/globals"
-	"sneak.berlin/go/dnswatcher/internal/logger"
 	"sneak.berlin/go/dnswatcher/internal/state"
 )
 
@@ -499,107 +493,6 @@ func TestSaveWritePermissionError(t *testing.T) {
 	}
 }
 
-// startState builds a State through the real constructor and runs its
-// startup hook against dataDir, returning the startup error.
-func startState(t *testing.T, dataDir string) error {
-	t.Helper()
-
-	g, err := globals.New(nil)
-	if err != nil {
-		t.Fatalf("globals.New: %v", err)
-	}
-
-	log, err := logger.New(nil, logger.Params{Globals: g})
-	if err != nil {
-		t.Fatalf("logger.New: %v", err)
-	}
-
-	lifecycle := fxtest.NewLifecycle(t)
-
-	_, err = state.New(lifecycle, state.Params{
-		Logger: log,
-		Config: &config.Config{DataDir: dataDir},
-	})
-	if err != nil {
-		t.Fatalf("state.New: %v", err)
-	}
-
-	return lifecycle.Start(t.Context())
-}
-
-// TestStartupFailsWhenDataDirNotWritable verifies that startup stops
-// with an error naming the data directory when it cannot be written.
-// The directory's parent is a regular file, which also fails as root.
-func TestStartupFailsWhenDataDirNotWritable(t *testing.T) {
-	t.Parallel()
-
-	parent := filepath.Join(t.TempDir(), "file")
-
-	err := os.WriteFile(parent, nil, 0o600)
-	if err != nil {
-		t.Fatalf("writing file: %v", err)
-	}
-
-	dataDir := filepath.Join(parent, "data")
-
-	err = startState(t, dataDir)
-	if err == nil {
-		t.Fatal("startup should fail when the data directory is not writable")
-	}
-
-	want := "data directory " + dataDir + " is not writable"
-	if !strings.Contains(err.Error(), want) {
-		t.Errorf("startup error %q does not contain %q", err, want)
-	}
-}
-
-// TestStartupFailsWhenExistingDataDirNotWritable verifies that startup
-// stops when the data directory exists but the temp file that saving uses
-// cannot be written in it. A directory sitting at the temp file's path
-// makes that write fail, which also holds as root.
-func TestStartupFailsWhenExistingDataDirNotWritable(t *testing.T) {
-	t.Parallel()
-
-	dataDir := t.TempDir()
-
-	err := os.Mkdir(filepath.Join(dataDir, "state.json.tmp"), 0o700)
-	if err != nil {
-		t.Fatalf("creating directory: %v", err)
-	}
-
-	err = startState(t, dataDir)
-	if err == nil {
-		t.Fatal("startup should fail when the data directory is not writable")
-	}
-
-	want := "data directory " + dataDir + " is not writable"
-	if !strings.Contains(err.Error(), want) {
-		t.Errorf("startup error %q does not contain %q", err, want)
-	}
-}
-
-// TestStartupCreatesDataDir verifies that startup creates a missing
-// data directory and leaves nothing behind in it.
-func TestStartupCreatesDataDir(t *testing.T) {
-	t.Parallel()
-
-	dataDir := filepath.Join(t.TempDir(), "data")
-
-	err := startState(t, dataDir)
-	if err != nil {
-		t.Fatalf("startup error: %v", err)
-	}
-
-	entries, err := os.ReadDir(dataDir)
-	if err != nil {
-		t.Fatalf("reading data directory: %v", err)
-	}
-
-	if len(entries) != 0 {
-		t.Errorf("startup left %d entries in the data directory", len(entries))
-	}
-}
-
 // TestPortStateUnmarshalJSON_NewFormat verifies deserialization of the
 // current multi-hostname format.
 func TestPortStateUnmarshalJSON_NewFormat(t *testing.T) {
@@ -739,7 +632,7 @@ func TestPortStateUnmarshalJSON_BothFormats(t *testing.T) {
 func TestGetSnapshot_ReturnsCopy(t *testing.T) {
 	t.Parallel()
 
-	s := state.NewForTestWithDataDir(t.TempDir())
+	s := state.NewForTest()
 
 	populateState(t, s)
 
@@ -761,7 +654,7 @@ func TestGetSnapshot_ReturnsCopy(t *testing.T) {
 func TestDomainState_GetSet(t *testing.T) {
 	t.Parallel()
 
-	s := state.NewForTestWithDataDir(t.TempDir())
+	s := state.NewForTest()
 
 	// Get on missing key returns false.
 	_, ok := s.GetDomainState("nonexistent.com")
@@ -812,7 +705,7 @@ func TestDomainState_GetSet(t *testing.T) {
 func TestHostnameState_GetSet(t *testing.T) {
 	t.Parallel()
 
-	s := state.NewForTestWithDataDir(t.TempDir())
+	s := state.NewForTest()
 
 	_, ok := s.GetHostnameState("missing.example.com")
 	if ok {
@@ -857,7 +750,7 @@ func TestHostnameState_GetSet(t *testing.T) {
 func TestPortState_GetSetDelete(t *testing.T) {
 	t.Parallel()
 
-	s := state.NewForTestWithDataDir(t.TempDir())
+	s := state.NewForTest()
 
 	_, ok := s.GetPortState("1.2.3.4:80")
 	if ok {
@@ -895,7 +788,7 @@ func TestPortState_GetSetDelete(t *testing.T) {
 func TestGetAllPortKeys(t *testing.T) {
 	t.Parallel()
 
-	s := state.NewForTestWithDataDir(t.TempDir())
+	s := state.NewForTest()
 
 	keys := s.GetAllPortKeys()
 	if len(keys) != 0 {
@@ -937,7 +830,7 @@ func TestGetAllPortKeys(t *testing.T) {
 func TestCertificateState_GetSet(t *testing.T) {
 	t.Parallel()
 
-	s := state.NewForTestWithDataDir(t.TempDir())
+	s := state.NewForTest()
 
 	_, ok := s.GetCertificateState("1.2.3.4:443:www.example.com")
 	if ok {
@@ -1158,7 +1051,7 @@ func TestLoadPreservesExistingStateOnMissingFile(t *testing.T) {
 func TestConcurrentGetSet(t *testing.T) {
 	t.Parallel()
 
-	s := state.NewForTestWithDataDir(t.TempDir())
+	s := state.NewForTest()
 
 	const goroutines = 20
 
@@ -1368,6 +1261,35 @@ func TestMultipleSavesOverwrite(t *testing.T) {
 	}
 }
 
+// TestNewForTest verifies the test helper creates a valid empty state.
+func TestNewForTest(t *testing.T) {
+	t.Parallel()
+
+	s := state.NewForTest()
+
+	snap := s.GetSnapshot()
+
+	if snap.Version != 1 {
+		t.Errorf("version: got %d, want 1", snap.Version)
+	}
+
+	if snap.Domains == nil {
+		t.Error("Domains map should be initialized")
+	}
+
+	if snap.Hostnames == nil {
+		t.Error("Hostnames map should be initialized")
+	}
+
+	if snap.Ports == nil {
+		t.Error("Ports map should be initialized")
+	}
+
+	if snap.Certificates == nil {
+		t.Error("Certificates map should be initialized")
+	}
+}
+
 // TestSaveFilePermissions verifies the saved file has restricted permissions.
 func TestSaveFilePermissions(t *testing.T) {
 	t.Parallel()

internal/state/state_test_helper.go

@@ -0,0 +1,38 @@
+package state
+
+import (
+	"log/slog"
+
+	"sneak.berlin/go/dnswatcher/internal/config"
+)
+
+// NewForTest creates a State for unit testing with no persistence.
+func NewForTest() *State {
+	return &State{
+		log: slog.Default(),
+		snapshot: &Snapshot{
+			Version:      stateVersion,
+			Domains:      make(map[string]*DomainState),
+			Hostnames:    make(map[string]*HostnameState),
+			Ports:        make(map[string]*PortState),
+			Certificates: make(map[string]*CertificateState),
+		},
+		config: &config.Config{DataDir: ""},
+	}
+}
+
+// NewForTestWithDataDir creates a State backed by the given directory
+// for tests that need file persistence.
+func NewForTestWithDataDir(dataDir string) *State {
+	return &State{
+		log: slog.Default(),
+		snapshot: &Snapshot{
+			Version:      stateVersion,
+			Domains:      make(map[string]*DomainState),
+			Hostnames:    make(map[string]*HostnameState),
+			Ports:        make(map[string]*PortState),
+			Certificates: make(map[string]*CertificateState),
+		},
+		config: &config.Config{DataDir: dataDir},
+	}
+}

internal/watcher/export_test.go

@@ -1,50 +0,0 @@
-package watcher
-
-import (
-	"context"
-	"log/slog"
-	"time"
-
-	"sneak.berlin/go/dnswatcher/internal/config"
-	"sneak.berlin/go/dnswatcher/internal/state"
-)
-
-// NewForTest creates a Watcher without fx for unit testing.
-func NewForTest(
-	cfg *config.Config,
-	st *state.State,
-	res DNSResolver,
-	pc PortChecker,
-	tc TLSChecker,
-	n Notifier,
-) *Watcher {
-	return &Watcher{
-		log:            slog.Default(),
-		config:         cfg,
-		state:          st,
-		resolver:       res,
-		portCheck:      pc,
-		tlsCheck:       tc,
-		notify:         n,
-		firstRun:       true,
-		expiryNotified: make(map[string]time.Time),
-	}
-}
-
-// NewlyDisagreeingPairs exports newlyDisagreeingPairs for testing.
-func NewlyDisagreeingPairs(
-	prev *state.HostnameState,
-	current map[string]map[string][]string,
-) [][2]string {
-	return newlyDisagreeingPairs(prev, current)
-}
-
-// DetectHostnameChanges exports detectHostnameChanges for testing.
-func (w *Watcher) DetectHostnameChanges(
-	ctx context.Context,
-	hostname string,
-	prev *state.HostnameState,
-	current map[string]map[string][]string,
-) {
-	w.detectHostnameChanges(ctx, hostname, prev, current)
-}

internal/watcher/inconsistency_test.go

@@ -1,182 +0,0 @@
-package watcher_test
-
-import (
-	"slices"
-	"testing"
-
-	"sneak.berlin/go/dnswatcher/internal/state"
-	"sneak.berlin/go/dnswatcher/internal/watcher"
-)
-
-const (
-	host = "www.example.net"
-	nsA  = "a.ns.example.net."
-	nsB  = "b.ns.example.net."
-	nsC  = "c.ns.example.net."
-	ip1  = "192.0.2.1"
-	ip2  = "192.0.2.2"
-	ip3  = "192.0.2.3"
-)
-
-// hostnameState builds the state a check with these records leaves behind.
-func hostnameState(
-	records map[string]map[string][]string,
-) *state.HostnameState {
-	hs := &state.HostnameState{
-		RecordsByNameserver: make(map[string]*state.NameserverRecordState),
-	}
-
-	for ns, recs := range records {
-		hs.RecordsByNameserver[ns] = &state.NameserverRecordState{
-			Records: recs,
-			Status:  "ok",
-		}
-	}
-
-	return hs
-}
-
-func TestNewlyDisagreeingPairs(t *testing.T) {
-	t.Parallel()
-
-	onlyA := map[string]map[string][]string{nsA: {"A": {ip1}}}
-	agree := map[string]map[string][]string{nsA: {"A": {ip1}}, nsB: {"A": {ip1}}}
-	disagree := map[string]map[string][]string{nsA: {"A": {ip1}}, nsB: {"A": {ip2}}}
-	alert := [][2]string{{nsA, nsB}}
-
-	// b already disagrees with a and c; then c changes, so a and c,
-	// which agreed, now differ.
-	bDiffers := map[string]map[string][]string{
-		nsA: {"A": {ip1}}, nsB: {"A": {ip2}}, nsC: {"A": {ip1}},
-	}
-	cChanges := map[string]map[string][]string{
-		nsA: {"A": {ip1}}, nsB: {"A": {ip2}}, nsC: {"A": {ip3}},
-	}
-
-	// Each case starts from the state loaded at startup and runs the
-	// checks in order; want[i] is what check i alerts for.
-	tests := []struct {
-		name   string
-		loaded map[string]map[string][]string
-		checks []map[string]map[string][]string
-		want   [][][2]string
-	}{
-		{
-			name:   "disagreement persisting across checks alerts once",
-			loaded: agree,
-			checks: []map[string]map[string][]string{disagree, disagree, disagree},
-			want:   [][][2]string{alert, nil, nil},
-		},
-		{
-			name:   "disagreement starting on a later check alerts on it",
-			loaded: agree,
-			checks: []map[string]map[string][]string{agree, agree, disagree},
-			want:   [][][2]string{nil, nil, alert},
-		},
-		{
-			name:   "disagreement in the loaded state does not alert",
-			loaded: disagree,
-			checks: []map[string]map[string][]string{disagree, disagree},
-			want:   [][][2]string{nil, nil},
-		},
-		{
-			name:   "nameserver new on the first check and disagreeing alerts once",
-			loaded: onlyA,
-			checks: []map[string]map[string][]string{disagree, disagree},
-			want:   [][][2]string{alert, nil},
-		},
-		{
-			name:   "disagreement after agreeing again alerts again",
-			loaded: agree,
-			checks: []map[string]map[string][]string{disagree, agree, disagree},
-			want:   [][][2]string{alert, nil, alert},
-		},
-		{
-			name:   "new disagreement while another nameserver differs alerts",
-			loaded: bDiffers,
-			checks: []map[string]map[string][]string{cChanges, cChanges},
-			want:   [][][2]string{{{nsA, nsC}}, nil},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			prev := hostnameState(tt.loaded)
-
-			for i, current := range tt.checks {
-				got := watcher.NewlyDisagreeingPairs(prev, current)
-				if !slices.Equal(got, tt.want[i]) {
-					t.Errorf(
-						"check %d: alerted for %v, want %v",
-						i, got, tt.want[i],
-					)
-				}
-
-				prev = hostnameState(current)
-			}
-		})
-	}
-}
-
-func TestInconsistencyAlert(t *testing.T) {
-	t.Parallel()
-
-	onlyA := map[string]map[string][]string{nsA: {"A": {ip1}}}
-	agree := map[string]map[string][]string{nsA: {"A": {ip1}}, nsB: {"A": {ip1}}}
-	disagree := map[string]map[string][]string{nsA: {"A": {ip1}}, nsB: {"A": {ip2}}}
-
-	// Each case starts from the state loaded at startup and then sees
-	// the nameservers disagree on three checks in a row.
-	tests := []struct {
-		name   string
-		loaded map[string]map[string][]string
-		want   int
-	}{
-		{
-			name:   "disagreement lasting several checks alerts once",
-			loaded: agree,
-			want:   1,
-		},
-		{
-			name:   "disagreement in the loaded state does not alert",
-			loaded: disagree,
-			want:   0,
-		},
-		{
-			name:   "nameserver new on the first check and disagreeing alerts once",
-			loaded: onlyA,
-			want:   1,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			// The hostname change detection uses only the notifier.
-			notifier := &mockNotifier{}
-			w := watcher.NewForTest(nil, nil, nil, nil, nil, notifier)
-
-			prev := hostnameState(tt.loaded)
-
-			for range 3 {
-				w.DetectHostnameChanges(t.Context(), host, prev, disagree)
-				prev = hostnameState(disagree)
-			}
-
-			got := 0
-
-			for _, n := range notifier.getNotifications() {
-				if n.Title == "Inconsistency: "+host {
-					got++
-				}
-			}
-
-			if got != tt.want {
-				t.Errorf("sent %d inconsistency alerts, want %d", got, tt.want)
-			}
-		})
-	}
-}

internal/watcher/watcher.go

@@ -102,6 +102,28 @@ func New(
 	return w, nil
 }
 
+// NewForTest creates a Watcher without fx for unit testing.
+func NewForTest(
+	cfg *config.Config,
+	st *state.State,
+	res DNSResolver,
+	pc PortChecker,
+	tc TLSChecker,
+	n Notifier,
+) *Watcher {
+	return &Watcher{
+		log:            slog.Default(),
+		config:         cfg,
+		state:          st,
+		resolver:       res,
+		portCheck:      pc,
+		tlsCheck:       tc,
+		notify:         n,
+		firstRun:       true,
+		expiryNotified: make(map[string]time.Time),
+	}
+}
+
 // Run starts the monitoring loop with periodic scheduling.
 func (w *Watcher) Run(ctx context.Context) {
 	w.log.Info(
@@ -344,7 +366,7 @@ func (w *Watcher) detectHostnameChanges(
 ) {
 	w.detectRecordChanges(ctx, hostname, prev, current)
 	w.detectNSDisappearances(ctx, hostname, prev, current)
-	w.detectInconsistencies(ctx, hostname, prev, current)
+	w.detectInconsistencies(ctx, hostname, current)
 }
 
 func (w *Watcher) detectRecordChanges(
@@ -426,11 +448,22 @@ func (w *Watcher) detectNSDisappearances(
 func (w *Watcher) detectInconsistencies(
 	ctx context.Context,
 	hostname string,
-	prev *state.HostnameState,
 	current map[string]map[string][]string,
 ) {
-	for _, pair := range newlyDisagreeingPairs(prev, current) {
+	nameservers := make([]string, 0, len(current))
-		ns1, ns2 := pair[0], pair[1]
+	for ns := range current {
+		nameservers = append(nameservers, ns)
+	}
+
+	sort.Strings(nameservers)
+
+	for i := range len(nameservers) - 1 {
+		ns1 := nameservers[i]
+		ns2 := nameservers[i+1]
+
+		if recordsEqual(current[ns1], current[ns2]) {
+			continue
+		}
 
 		msg := fmt.Sprintf(
 			"Hostname: %s\n%s: %v\n%s: %v",
@@ -448,43 +481,6 @@ func (w *Watcher) detectInconsistencies(
 	}
 }
 
-// newlyDisagreeingPairs returns every pair of nameservers whose records
-// differ in current, in sorted order of name, except pairs where both
-// nameservers were in prev and already differed there. A nameserver
-// missing from prev is paired with every nameserver it differs from.
-func newlyDisagreeingPairs(
-	prev *state.HostnameState,
-	current map[string]map[string][]string,
-) [][2]string {
-	nameservers := make([]string, 0, len(current))
-	for ns := range current {
-		nameservers = append(nameservers, ns)
-	}
-
-	sort.Strings(nameservers)
-
-	var pairs [][2]string
-
-	for i, ns1 := range nameservers {
-		for _, ns2 := range nameservers[i+1:] {
-			if recordsEqual(current[ns1], current[ns2]) {
-				continue
-			}
-
-			prev1, ok1 := prev.RecordsByNameserver[ns1]
-			prev2, ok2 := prev.RecordsByNameserver[ns2]
-
-			if ok1 && ok2 && !recordsEqual(prev1.Records, prev2.Records) {
-				continue
-			}
-
-			pairs = append(pairs, [2]string{ns1, ns2})
-		}
-	}
-
-	return pairs
-}
-
 func (w *Watcher) checkAllPorts(ctx context.Context) {
 	// Phase 1: Build current IP:port → hostname associations
 	// from fresh DNS data.

internal/watcher/watcher_test.go

@@ -2,81 +2,151 @@ package watcher_test
 
 import (
 	"context"
+	"errors"
 	"fmt"
-	"log/slog"
-	"slices"
 	"sync"
 	"testing"
 	"time"
 
-	"go.uber.org/fx/fxtest"
-
 	"sneak.berlin/go/dnswatcher/internal/config"
-	"sneak.berlin/go/dnswatcher/internal/globals"
-	"sneak.berlin/go/dnswatcher/internal/livednstest"
-	"sneak.berlin/go/dnswatcher/internal/logger"
 	"sneak.berlin/go/dnswatcher/internal/portcheck"
-	"sneak.berlin/go/dnswatcher/internal/resolver"
 	"sneak.berlin/go/dnswatcher/internal/state"
 	"sneak.berlin/go/dnswatcher/internal/tlscheck"
 	"sneak.berlin/go/dnswatcher/internal/watcher"
 )
 
-// The watcher looks these names up in live DNS with the real resolver,
+// errNotFound is returned when mock data is missing.
-// so tests assert on what the watcher does with the answers, never on
+var errNotFound = errors.New("not found")
-// the records these zones publish. testHost's nameservers and addresses
+
-// stay the same from one check to the next, which the tests that check
+// Fixture values shared across tests.
-// it twice rely on.
 const (
-	testDomain = "google.com"
+	testDomain = "example.com"
-	testHost   = "cloudflare.com"
+	testHost   = "www.example.com"
+	testNS1    = "ns1.example.com."
+	testNS2    = "ns2.example.com."
+	testIPv4   = "93.184.216.34"
+	testIP     = "1.2.3.4"
 	testIssuer = "DigiCert"
 )
 
-// Saved-state values that live DNS never returns: nameserver names
+// --- Mock implementations ---
-// under .invalid and a documentation address.
+
-const (
+type mockResolver struct {
-	oldNS1 = "ns1.example.invalid."
+	mu             sync.Mutex
-	oldNS2 = "ns2.example.invalid."
+	nsRecords      map[string][]string
-	oldIP  = "192.0.2.1"
+	allRecords     map[string]map[string]map[string][]string
+	ipAddresses    map[string][]string
+	lookupNSErr    error
+	allRecordsErr  error
+	resolveIPErr   error
+	lookupNSCalls  int
+	allRecordCalls int
+}
+
+func (m *mockResolver) LookupNS(
+	_ context.Context,
+	domain string,
+) ([]string, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	m.lookupNSCalls++
+
+	if m.lookupNSErr != nil {
+		return nil, m.lookupNSErr
+	}
+
+	ns, ok := m.nsRecords[domain]
+	if !ok {
+		return nil, fmt.Errorf(
+			"%w: NS for %s", errNotFound, domain,
 		)
+	}
 
-// --- Stand-ins for the port checker, TLS checker and notifier ---
+	return ns, nil
-//
+}
-// DNS has none: the watchers built here use the real resolver (see
+
-// TESTING.md).
+func (m *mockResolver) LookupAllRecords(
+	_ context.Context,
+	hostname string,
+) (map[string]map[string][]string, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	m.allRecordCalls++
+
+	if m.allRecordsErr != nil {
+		return nil, m.allRecordsErr
+	}
+
+	recs, ok := m.allRecords[hostname]
+	if !ok {
+		return nil, fmt.Errorf(
+			"%w: records for %s", errNotFound, hostname,
+		)
+	}
+
+	return recs, nil
+}
+
+func (m *mockResolver) ResolveIPAddresses(
+	_ context.Context,
+	hostname string,
+) ([]string, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	if m.resolveIPErr != nil {
+		return nil, m.resolveIPErr
+	}
+
+	ips, ok := m.ipAddresses[hostname]
+	if !ok {
+		return nil, fmt.Errorf(
+			"%w: IPs for %s", errNotFound, hostname,
+		)
+	}
+
+	return ips, nil
+}
 
-// mockPortChecker reports every port open until closed is set.
 type mockPortChecker struct {
 	mu      sync.Mutex
-	closed bool
+	results map[string]bool
+	err     error
 	calls   int
 }
 
 func (m *mockPortChecker) CheckPort(
 	_ context.Context,
-	_ string,
+	address string,
-	_ int,
+	port int,
 ) (*portcheck.PortResult, error) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 
 	m.calls++
 
-	return &portcheck.PortResult{Open: !m.closed}, nil
+	if m.err != nil {
+		return nil, m.err
+	}
+
+	key := fmt.Sprintf("%s:%d", address, port)
+	open := m.results[key]
+
+	return &portcheck.PortResult{Open: open}, nil
 }
 
-// mockTLSChecker returns a certificate for the requested hostname that
-// expires at notAfter.
 type mockTLSChecker struct {
 	mu    sync.Mutex
-	notAfter time.Time
+	certs map[string]*tlscheck.CertificateInfo
+	err   error
 	calls int
 }
 
 func (m *mockTLSChecker) CheckCertificate(
 	_ context.Context,
-	_ string,
+	ip string,
 	hostname string,
 ) (*tlscheck.CertificateInfo, error) {
 	m.mu.Lock()
@@ -84,12 +154,20 @@ func (m *mockTLSChecker) CheckCertificate(
 
 	m.calls++
 
-	return &tlscheck.CertificateInfo{
+	if m.err != nil {
-		CommonName:              hostname,
+		return nil, m.err
-		Issuer:                  testIssuer,
+	}
-		NotAfter:                m.notAfter,
+
-		SubjectAlternativeNames: []string{hostname},
+	key := fmt.Sprintf("%s:%s", ip, hostname)
-	}, nil
+	cert, ok := m.certs[key]
+
+	if !ok {
+		return nil, fmt.Errorf(
+			"%w: cert for %s", errNotFound, key,
+		)
+	}
+
+	return cert, nil
 }
 
 type notification struct {
@@ -127,9 +205,10 @@ func (m *mockNotifier) getNotifications() []notification {
 	return result
 }
 
-// --- Helpers to build a Watcher and run its checks against live DNS ---
+// --- Helper to build a Watcher for testing ---
 
 type testDeps struct {
+	resolver    *mockResolver
 	portChecker *mockPortChecker
 	tlsChecker  *mockTLSChecker
 	notifier    *mockNotifier
@@ -144,37 +223,27 @@ func newTestWatcher(
 	t.Helper()
 
 	deps := &testDeps{
-		portChecker: &mockPortChecker{},
+		resolver: &mockResolver{
+			nsRecords:   make(map[string][]string),
+			allRecords:  make(map[string]map[string]map[string][]string),
+			ipAddresses: make(map[string][]string),
+		},
+		portChecker: &mockPortChecker{
+			results: make(map[string]bool),
+		},
 		tlsChecker: &mockTLSChecker{
-			notAfter: time.Now().Add(90 * 24 * time.Hour),
+			certs: make(map[string]*tlscheck.CertificateInfo),
 		},
 		notifier: &mockNotifier{},
 		config:   cfg,
 	}
 
-	g, err := globals.New(nil)
+	deps.state = state.NewForTest()
-	if err != nil {
-		t.Fatalf("globals.New: %v", err)
-	}
-
-	log, err := logger.New(nil, logger.Params{Globals: g})
-	if err != nil {
-		t.Fatalf("logger.New: %v", err)
-	}
-
-	// The watcher saves state after every check, into cfg.DataDir.
-	deps.state, err = state.New(fxtest.NewLifecycle(t), state.Params{
-		Logger: log,
-		Config: cfg,
-	})
-	if err != nil {
-		t.Fatalf("state.New: %v", err)
-	}
 
 	w := watcher.NewForTest(
 		deps.config,
 		deps.state,
-		resolver.NewFromLogger(slog.Default()),
+		deps.resolver,
 		deps.portChecker,
 		deps.tlsChecker,
 		deps.notifier,
@@ -194,122 +263,6 @@ func defaultTestConfig(t *testing.T) *config.Config {
 	}
 }
 
-// checkOnce runs the watcher's checks once and returns an error when a
-// configured name has no hostname state saved by this check, or that
-// state holds no address. Either live DNS gave no answer for the name,
-// or the watcher saved no fresh result for it.
-func checkOnce(
-	ctx context.Context,
-	w *watcher.Watcher,
-	deps *testDeps,
-) error {
-	started := time.Now()
-
-	w.RunOnce(ctx)
-
-	names := slices.Concat(deps.config.Domains, deps.config.Hostnames)
-
-	for _, name := range names {
-		hs, ok := deps.state.GetHostnameState(name)
-		if !ok || hs.LastChecked.Before(started) ||
-			len(addresses(hs)) == 0 {
-			return fmt.Errorf(
-				"%s: %w, or the watcher saved no fresh "+
-					"result for it",
-				name, livednstest.ErrNoAnswer,
-			)
-		}
-	}
-
-	return nil
-}
-
-// runChecks builds a watcher, lets prepare set up the saved state and
-// stand-ins it starts from, and runs its checks once against live DNS.
-// If change is not nil, change then alters the saved state or stand-ins
-// and the checks run a second time. When either check finds no fresh
-// address for a name (see checkOnce), the watcher is thrown away and
-// all of this runs again on a new one, so a failed attempt leaves
-// nothing behind in the saved state, the stand-ins or the notifications.
-func runChecks(
-	t *testing.T,
-	cfg *config.Config,
-	prepare, change func(deps *testDeps),
-) *testDeps {
-	t.Helper()
-
-	var deps *testDeps
-
-	livednstest.Retry(t, "watcher checks", func(ctx context.Context) error {
-		var w *watcher.Watcher
-
-		w, deps = newTestWatcher(t, cfg)
-
-		if prepare != nil {
-			prepare(deps)
-		}
-
-		err := checkOnce(ctx, w, deps)
-		if err != nil || change == nil {
-			return err
-		}
-
-		change(deps)
-
-		return checkOnce(ctx, w, deps)
-	})
-
-	return deps
-}
-
-// addresses returns the A and AAAA values saved for a hostname.
-func addresses(hs *state.HostnameState) []string {
-	var ips []string
-
-	for _, nsState := range hs.RecordsByNameserver {
-		ips = append(ips, nsState.Records["A"]...)
-		ips = append(ips, nsState.Records["AAAA"]...)
-	}
-
-	return ips
-}
-
-// assertNotified checks that a notification with this title and
-// priority was sent.
-func assertNotified(
-	t *testing.T,
-	deps *testDeps,
-	title, priority string,
-) {
-	t.Helper()
-
-	notifications := deps.notifier.getNotifications()
-
-	for _, n := range notifications {
-		if n.Title == title && n.Priority == priority {
-			return
-		}
-	}
-
-	t.Errorf(
-		"expected %s notification %q, got: %v",
-		priority, title, notifications,
-	)
-}
-
-// countNotifications counts the notifications sent with this title.
-func countNotifications(deps *testDeps, title string) int {
-	count := 0
-
-	for _, n := range deps.notifier.getNotifications() {
-		if n.Title == title {
-			count++
-		}
-	}
-
-	return count
-}
-
 func TestFirstRunBaseline(t *testing.T) {
 	t.Parallel()
 
@@ -317,12 +270,51 @@ func TestFirstRunBaseline(t *testing.T) {
 	cfg.Domains = []string{testDomain}
 	cfg.Hostnames = []string{testHost}
 
-	deps := runChecks(t, cfg, nil, nil)
+	w, deps := newTestWatcher(t, cfg)
+	setupBaselineMocks(deps)
+
+	w.RunOnce(t.Context())
 
 	assertNoNotifications(t, deps)
 	assertStatePopulated(t, deps)
 }
 
+func setupBaselineMocks(deps *testDeps) {
+	deps.resolver.nsRecords[testDomain] = []string{
+		testNS1,
+		testNS2,
+	}
+	deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
+		testNS1: {"A": {testIPv4}},
+		testNS2: {"A": {testIPv4}},
+	}
+	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
+		testNS1: {"A": {testIPv4}},
+		testNS2: {"A": {testIPv4}},
+	}
+	deps.resolver.ipAddresses[testHost] = []string{
+		testIPv4,
+	}
+	deps.portChecker.results["93.184.216.34:80"] = true
+	deps.portChecker.results["93.184.216.34:443"] = true
+	deps.tlsChecker.certs["93.184.216.34:www.example.com"] = &tlscheck.CertificateInfo{
+		CommonName: testHost,
+		Issuer:     testIssuer,
+		NotAfter:   time.Now().Add(90 * 24 * time.Hour),
+		SubjectAlternativeNames: []string{
+			testHost,
+		},
+	}
+	deps.tlsChecker.certs["93.184.216.34:example.com"] = &tlscheck.CertificateInfo{
+		CommonName: testDomain,
+		Issuer:     testIssuer,
+		NotAfter:   time.Now().Add(90 * 24 * time.Hour),
+		SubjectAlternativeNames: []string{
+			testDomain,
+		},
+	}
+}
+
 func assertNoNotifications(
 	t *testing.T,
 	deps *testDeps,
@@ -369,7 +361,26 @@ func TestDomainPortAndTLSChecks(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Domains = []string{testDomain}
 
-	deps := runChecks(t, cfg, nil, nil)
+	w, deps := newTestWatcher(t, cfg)
+
+	deps.resolver.nsRecords[testDomain] = []string{
+		testNS1,
+	}
+	deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
+		testNS1: {"A": {testIPv4}},
+	}
+	deps.portChecker.results["93.184.216.34:80"] = true
+	deps.portChecker.results["93.184.216.34:443"] = true
+	deps.tlsChecker.certs["93.184.216.34:example.com"] = &tlscheck.CertificateInfo{
+		CommonName: testDomain,
+		Issuer:     testIssuer,
+		NotAfter:   time.Now().Add(90 * 24 * time.Hour),
+		SubjectAlternativeNames: []string{
+			testDomain,
+		},
+	}
+
+	w.RunOnce(t.Context())
 
 	snap := deps.state.GetSnapshot()
 
@@ -408,18 +419,50 @@ func TestNSChangeDetection(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Domains = []string{testDomain}
 
-	// The saved state lists nameservers that live DNS does not.
+	w, deps := newTestWatcher(t, cfg)
-	deps := runChecks(t, cfg, func(deps *testDeps) {
-		deps.state.SetDomainState(testDomain, &state.DomainState{
-			Nameservers: []string{oldNS1, oldNS2},
-		})
-	}, nil)
 
-	assertNotified(t, deps, "NS Change: "+testDomain, "warning")
+	deps.resolver.nsRecords[testDomain] = []string{
+		testNS1,
+		testNS2,
+	}
+	deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
+		testNS1: {"A": {testIP}},
+		testNS2: {"A": {testIP}},
+	}
+	deps.portChecker.results["1.2.3.4:80"] = false
+	deps.portChecker.results["1.2.3.4:443"] = false
 
-	ds, _ := deps.state.GetDomainState(testDomain)
+	ctx := t.Context()
-	if slices.Contains(ds.Nameservers, oldNS1) {
+	w.RunOnce(ctx)
-		t.Errorf("saved nameservers not updated: %v", ds.Nameservers)
+
+	deps.resolver.mu.Lock()
+	deps.resolver.nsRecords[testDomain] = []string{
+		testNS1,
+		"ns3.example.com.",
+	}
+	deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
+		testNS1:            {"A": {testIP}},
+		"ns3.example.com.": {"A": {testIP}},
+	}
+	deps.resolver.mu.Unlock()
+
+	w.RunOnce(ctx)
+
+	notifications := deps.notifier.getNotifications()
+	if len(notifications) == 0 {
+		t.Error("expected notification for NS change")
+	}
+
+	found := false
+
+	for _, n := range notifications {
+		if n.Priority == "warning" {
+			found = true
+		}
+	}
+
+	if !found {
+		t.Error("expected warning-priority NS change notification")
 	}
 }
 
@@ -429,18 +472,40 @@ func TestRecordChangeDetection(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Hostnames = []string{testHost}
 
-	// Between the checks, save for every nameserver an address live DNS
+	w, deps := newTestWatcher(t, cfg)
-	// never returns.
+
-	deps := runChecks(t, cfg, nil, func(deps *testDeps) {
+	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
-		hs, _ := deps.state.GetHostnameState(testHost)
+		testNS1: {"A": {testIPv4}},
-		for _, nsState := range hs.RecordsByNameserver {
-			nsState.Records = map[string][]string{"A": {oldIP}}
 	}
+	deps.resolver.ipAddresses[testHost] = []string{
+		testIPv4,
+	}
+	deps.portChecker.results["93.184.216.34:80"] = false
+	deps.portChecker.results["93.184.216.34:443"] = false
 
-		deps.state.SetHostnameState(testHost, hs)
+	ctx := t.Context()
-	})
+	w.RunOnce(ctx)
 
-	assertNotified(t, deps, "Record Change: "+testHost, "warning")
+	deps.resolver.mu.Lock()
+	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
+		testNS1: {"A": {"93.184.216.35"}},
+	}
+	deps.resolver.ipAddresses[testHost] = []string{
+		"93.184.216.35",
+	}
+	deps.resolver.mu.Unlock()
+
+	deps.portChecker.mu.Lock()
+	deps.portChecker.results["93.184.216.35:80"] = false
+	deps.portChecker.results["93.184.216.35:443"] = false
+	deps.portChecker.mu.Unlock()
+
+	w.RunOnce(ctx)
+
+	notifications := deps.notifier.getNotifications()
+	if len(notifications) == 0 {
+		t.Error("expected notification for record change")
+	}
 }
 
 func TestPortStateChange(t *testing.T) {
@@ -449,23 +514,38 @@ func TestPortStateChange(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Hostnames = []string{testHost}
 
-	// Between the checks, every port closes.
+	w, deps := newTestWatcher(t, cfg)
-	deps := runChecks(t, cfg, nil, func(deps *testDeps) {
-		deps.portChecker.mu.Lock()
-		deps.portChecker.closed = true
-		deps.portChecker.mu.Unlock()
-	})
 
-	hs, _ := deps.state.GetHostnameState(testHost)
+	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
-	assertNotified(
+		testNS1: {"A": {testIP}},
-		t, deps, "Port Change: "+addresses(hs)[0]+":443", "warning",
+	}
-	)
+	deps.resolver.ipAddresses[testHost] = []string{
+		testIP,
+	}
+	deps.portChecker.results["1.2.3.4:80"] = true
+	deps.portChecker.results["1.2.3.4:443"] = true
+	deps.tlsChecker.certs["1.2.3.4:www.example.com"] = &tlscheck.CertificateInfo{
+		CommonName: testHost,
+		Issuer:     testIssuer,
+		NotAfter:   time.Now().Add(90 * 24 * time.Hour),
+		SubjectAlternativeNames: []string{
+			testHost,
+		},
 	}
 
-// expiresInThreeDays makes the TLS checker return certificates that
+	ctx := t.Context()
-// expire within the seven-day warning period.
+	w.RunOnce(ctx)
-func expiresInThreeDays(deps *testDeps) {
+
-	deps.tlsChecker.notAfter = time.Now().Add(3 * 24 * time.Hour)
+	deps.portChecker.mu.Lock()
+	deps.portChecker.results["1.2.3.4:443"] = false
+	deps.portChecker.mu.Unlock()
+
+	w.RunOnce(ctx)
+
+	notifications := deps.notifier.getNotifications()
+	if len(notifications) == 0 {
+		t.Error("expected notification for port state change")
+	}
 }
 
 func TestTLSExpiryWarning(t *testing.T) {
@@ -474,9 +554,49 @@ func TestTLSExpiryWarning(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Hostnames = []string{testHost}
 
-	deps := runChecks(t, cfg, expiresInThreeDays, nil)
+	w, deps := newTestWatcher(t, cfg)
 
-	assertNotified(t, deps, "TLS Expiry Warning: "+testHost, "warning")
+	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
+		testNS1: {"A": {testIP}},
+	}
+	deps.resolver.ipAddresses[testHost] = []string{
+		testIP,
+	}
+	deps.portChecker.results["1.2.3.4:80"] = true
+	deps.portChecker.results["1.2.3.4:443"] = true
+	deps.tlsChecker.certs["1.2.3.4:www.example.com"] = &tlscheck.CertificateInfo{
+		CommonName: testHost,
+		Issuer:     testIssuer,
+		NotAfter:   time.Now().Add(3 * 24 * time.Hour),
+		SubjectAlternativeNames: []string{
+			testHost,
+		},
+	}
+
+	ctx := t.Context()
+
+	// First run = baseline
+	w.RunOnce(ctx)
+
+	// Second run should warn about expiry
+	w.RunOnce(ctx)
+
+	notifications := deps.notifier.getNotifications()
+
+	found := false
+
+	for _, n := range notifications {
+		if n.Priority == "warning" {
+			found = true
+		}
+	}
+
+	if !found {
+		t.Errorf(
+			"expected expiry warning, got: %v",
+			notifications,
+		)
+	}
 }
 
 func TestTLSExpiryWarningDedup(t *testing.T) {
@@ -486,25 +606,50 @@ func TestTLSExpiryWarningDedup(t *testing.T) {
 	cfg.Hostnames = []string{testHost}
 	cfg.TLSInterval = 24 * time.Hour
 
-	title := "TLS Expiry Warning: " + testHost
+	w, deps := newTestWatcher(t, cfg)
 
-	// The second check comes within the TLS interval of the first,
+	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
-	// so it must not warn again.
+		testNS1: {"A": {testIP}},
-	var warnings int
+	}
-
+	deps.resolver.ipAddresses[testHost] = []string{
-	deps := runChecks(t, cfg, expiresInThreeDays, func(deps *testDeps) {
+		testIP,
-		warnings = countNotifications(deps, title)
+	}
-	})
+	deps.portChecker.results["1.2.3.4:80"] = true
-
+	deps.portChecker.results["1.2.3.4:443"] = true
-	if warnings == 0 {
+	deps.tlsChecker.certs["1.2.3.4:www.example.com"] = &tlscheck.CertificateInfo{
-		t.Fatal("expected expiry warnings from the first check")
+		CommonName: testHost,
+		Issuer:     testIssuer,
+		NotAfter:   time.Now().Add(3 * 24 * time.Hour),
+		SubjectAlternativeNames: []string{
+			testHost,
+		},
 	}
 
-	got := countNotifications(deps, title)
+	ctx := t.Context()
-	if got != warnings {
+
+	// First run = baseline, no notifications
+	w.RunOnce(ctx)
+
+	// Second run should fire one expiry warning
+	w.RunOnce(ctx)
+
+	// Third run should NOT fire another warning (dedup)
+	w.RunOnce(ctx)
+
+	notifications := deps.notifier.getNotifications()
+
+	expiryCount := 0
+
+	for _, n := range notifications {
+		if n.Title == "TLS Expiry Warning: www.example.com" {
+			expiryCount++
+		}
+	}
+
+	if expiryCount != 1 {
 		t.Errorf(
-			"expected %d expiry warnings (dedup), got %d",
+			"expected exactly 1 expiry warning (dedup), got %d",
-			warnings, got,
+			expiryCount,
 		)
 	}
 }
@@ -512,12 +657,21 @@ func TestTLSExpiryWarningDedup(t *testing.T) {
 func TestGracefulShutdown(t *testing.T) {
 	t.Parallel()
 
-	// No domains or hostnames: stopping does not involve DNS.
 	cfg := defaultTestConfig(t)
+	cfg.Domains = []string{testDomain}
 	cfg.DNSInterval = 100 * time.Millisecond
 	cfg.TLSInterval = 100 * time.Millisecond
 
-	w, _ := newTestWatcher(t, cfg)
+	w, deps := newTestWatcher(t, cfg)
+
+	deps.resolver.nsRecords[testDomain] = []string{
+		testNS1,
+	}
+	deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
+		testNS1: {"A": {testIP}},
+	}
+	deps.portChecker.results["1.2.3.4:80"] = false
+	deps.portChecker.results["1.2.3.4:443"] = false
 
 	ctx, cancel := context.WithCancel(t.Context())
 
@@ -539,52 +693,90 @@ func TestGracefulShutdown(t *testing.T) {
 	}
 }
 
+func setupHostnameIP(
+	deps *testDeps,
+	hostname, ip string,
+) {
+	deps.resolver.allRecords[hostname] = map[string]map[string][]string{
+		testNS1: {"A": {ip}},
+	}
+	deps.portChecker.results[ip+":80"] = true
+	deps.portChecker.results[ip+":443"] = true
+	deps.tlsChecker.certs[ip+":"+hostname] = &tlscheck.CertificateInfo{
+		CommonName:              hostname,
+		Issuer:                  testIssuer,
+		NotAfter:                time.Now().Add(90 * 24 * time.Hour),
+		SubjectAlternativeNames: []string{hostname},
+	}
+}
+
+func updateHostnameIP(deps *testDeps, hostname, ip string) {
+	deps.resolver.mu.Lock()
+	deps.resolver.allRecords[hostname] = map[string]map[string][]string{
+		testNS1: {"A": {ip}},
+	}
+	deps.resolver.mu.Unlock()
+
+	deps.portChecker.mu.Lock()
+	deps.portChecker.results[ip+":80"] = true
+	deps.portChecker.results[ip+":443"] = true
+	deps.portChecker.mu.Unlock()
+
+	deps.tlsChecker.mu.Lock()
+	deps.tlsChecker.certs[ip+":"+hostname] = &tlscheck.CertificateInfo{
+		CommonName:              hostname,
+		Issuer:                  testIssuer,
+		NotAfter:                time.Now().Add(90 * 24 * time.Hour),
+		SubjectAlternativeNames: []string{hostname},
+	}
+	deps.tlsChecker.mu.Unlock()
+}
+
 func TestDNSRunsBeforePortAndTLSChecks(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
 	cfg.Hostnames = []string{testHost}
 
-	// The saved state says the last check found testHost at oldIP.
+	w, deps := newTestWatcher(t, cfg)
-	deps := runChecks(t, cfg, func(deps *testDeps) {
+
-		deps.state.SetHostnameState(testHost, &state.HostnameState{
+	setupHostnameIP(deps, testHost, "10.0.0.1")
-			RecordsByNameserver: map[string]*state.NameserverRecordState{
+
-				oldNS1: {
+	ctx := t.Context()
-					Records: map[string][]string{"A": {oldIP}},
+	w.RunOnce(ctx)
-					Status:  "ok",
-				},
-			},
-		})
-	}, nil)
 
 	snap := deps.state.GetSnapshot()
-
+	if _, ok := snap.Ports["10.0.0.1:80"]; !ok {
-	if _, ok := snap.Ports[oldIP+":80"]; ok {
+		t.Fatal("expected port state for 10.0.0.1:80")
-		t.Error("port check used stale DNS: found " + oldIP + ":80")
 	}
 
-	// Port and TLS checks must use the addresses this check found.
+	// DNS changes to a new IP; port and TLS must pick it up.
-	for _, ip := range addresses(snap.Hostnames[testHost]) {
+	updateHostnameIP(deps, testHost, "10.0.0.2")
-		if _, ok := snap.Ports[ip+":80"]; !ok {
+
-			t.Error("port check used stale DNS: missing " + ip + ":80")
+	w.RunOnce(ctx)
+
+	snap = deps.state.GetSnapshot()
+
+	if _, ok := snap.Ports["10.0.0.2:80"]; !ok {
+		t.Error("port check used stale DNS: missing 10.0.0.2:80")
 	}
 
-		certKey := ip + ":443:" + testHost
+	certKey := "10.0.0.2:443:www.example.com"
 	if _, ok := snap.Certificates[certKey]; !ok {
 		t.Error("TLS check used stale DNS: missing " + certKey)
 	}
 }
-}
 
 func TestSendTestNotification_Enabled(t *testing.T) {
 	t.Parallel()
 
-	// No domains or hostnames: the startup notification does not
-	// involve DNS.
 	cfg := defaultTestConfig(t)
+	cfg.Domains = []string{testDomain}
+	cfg.Hostnames = []string{testHost}
 	cfg.SendTestNotification = true
 
 	w, deps := newTestWatcher(t, cfg)
+	setupBaselineMocks(deps)
 
 	w.RunOnce(t.Context())
 
@@ -605,11 +797,14 @@ func TestSendTestNotification_ViaRun(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
+	cfg.Domains = []string{testDomain}
+	cfg.Hostnames = []string{testHost}
 	cfg.SendTestNotification = true
 	cfg.DNSInterval = 24 * time.Hour
 	cfg.TLSInterval = 24 * time.Hour
 
 	w, deps := newTestWatcher(t, cfg)
+	setupBaselineMocks(deps)
 
 	ctx, cancel := context.WithCancel(t.Context())
 
@@ -649,11 +844,14 @@ func TestSendTestNotification_Disabled(t *testing.T) {
 	t.Parallel()
 
 	cfg := defaultTestConfig(t)
+	cfg.Domains = []string{testDomain}
+	cfg.Hostnames = []string{testHost}
 	cfg.SendTestNotification = false
 	cfg.DNSInterval = 24 * time.Hour
 	cfg.TLSInterval = 24 * time.Hour
 
 	w, deps := newTestWatcher(t, cfg)
+	setupBaselineMocks(deps)
 
 	ctx, cancel := context.WithCancel(t.Context())
 
@@ -686,22 +884,32 @@ func TestNSFailureAndRecovery(t *testing.T) {
 	cfg := defaultTestConfig(t)
 	cfg.Hostnames = []string{testHost}
 
-	// Between the checks, save every nameserver the first check found
+	w, deps := newTestWatcher(t, cfg)
-	// as failed, and add, as answering, one that live DNS does not list.
-	deps := runChecks(t, cfg, nil, func(deps *testDeps) {
-		hs, _ := deps.state.GetHostnameState(testHost)
-		for _, nsState := range hs.RecordsByNameserver {
-			nsState.Status = "error"
-		}
 
-		hs.RecordsByNameserver[oldNS1] = &state.NameserverRecordState{
+	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
-			Records: map[string][]string{"A": {oldIP}},
+		testNS1: {"A": {testIP}},
-			Status:  "ok",
+		testNS2: {"A": {testIP}},
+	}
+	deps.resolver.ipAddresses[testHost] = []string{
+		testIP,
+	}
+	deps.portChecker.results["1.2.3.4:80"] = false
+	deps.portChecker.results["1.2.3.4:443"] = false
+
+	ctx := t.Context()
+
+	w.RunOnce(ctx)
+
+	deps.resolver.mu.Lock()
+	deps.resolver.allRecords[testHost] = map[string]map[string][]string{
+		testNS1: {"A": {testIP}},
+	}
+	deps.resolver.mu.Unlock()
+
+	w.RunOnce(ctx)
+
+	notifications := deps.notifier.getNotifications()
+	if len(notifications) == 0 {
+		t.Error("expected notification for NS disappearance")
 	}
-
-		deps.state.SetHostnameState(testHost, hs)
-	})
-
-	assertNotified(t, deps, "NS Failure: "+testHost, "error")
-	assertNotified(t, deps, "NS Recovery: "+testHost, "success")
 }

script/bootstrap

@@ -3,17 +3,15 @@
 # this repo. Idempotent: every install is guarded by a check so already
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
 # or apk (detected in that order); assumes nothing is present.
-# goimports is installed via `go install` at a pinned commit (never
+# golangci-lint and goimports are installed via `go install` at the same
-# "latest") because script/fmt runs it on the host; script/fmt-check
+# pinned commits the Dockerfile uses (never "latest").
-# does not (it runs gofmt only).
-# The linter is NOT installed here: golangci-lint runs via docker only
-# (script/lint), pinned by image digest, so its only prerequisite is a
-# working docker.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# Pinned version, 2026-08-07 (same pin as the Dockerfile)
+# Pinned versions, 2026-08-07 (same pins as the Dockerfile)
+# golangci-lint v2.12.2
+GOLANGCI_LINT_REF="github.com/golangci/golangci-lint/v2/cmd/golangci-lint@c0d3ddc9cf3faa61a4e378e879ece580256d76e5"
 # goimports v0.42.0
 GOIMPORTS_REF="golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0"
 
@@ -71,17 +69,11 @@ main() {
     if missing make; then pkg_install gnumake make make make; fi
     if missing go; then pkg_install go golang go go; fi
 
-    # Format tools, pinned via go install (installs into
+    # Lint/format tools, pinned via go install (installs into
     # "$(go env GOPATH)/bin"; ensure that is on your PATH).
+    if missing golangci-lint; then go install "$GOLANGCI_LINT_REF"; fi
     if missing goimports; then go install "$GOIMPORTS_REF"; fi
 
-    # Linting runs via docker only (script/lint). Warn, don't fail:
-    # everything except `make lint` works without it.
-    if missing docker; then
-        echo "bootstrap: WARNING: docker not found; install it to" \
-            "run make lint and make docker." >&2
-    fi
-
     go mod download
 
     echo "bootstrap complete"

script/cibuild

@@ -1,18 +1,13 @@
 #!/bin/sh
-# script/cibuild: run the CI build. The Dockerfile's lint stage runs
+# script/cibuild: run the CI build. The Dockerfile runs make check, so
-# make fmt-check and golangci-lint; its builder stage runs make test
+# a successful build implies all checks pass.
-# and make build.
-#
-# --no-cache-filter=lint,builder runs both stages on every invocation;
-# otherwise an unchanged tree is served from the layer cache and passes
-# without linting or querying live DNS.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build --no-cache-filter=lint,builder .
+    docker build .
 }
 
 main "$@"

script/docker

@@ -1,10 +1,6 @@
 #!/bin/sh
 # script/docker: build the Docker image tagged with the project name.
-# The tag comes from script/projectname.
+# Identical in all repos; the tag comes from script/projectname.
-#
-# --no-cache-filter=lint,builder runs the lint stage and the builder
-# stage (make test) on every invocation; otherwise an unchanged tree is
-# served from the layer cache without linting or querying live DNS.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -12,15 +8,7 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    # Own line: a failing command substitution inside an argument does
+    docker build -t "$("$SCRIPT_DIR/projectname")" .
-    # not trip `set -e`, so the inline form degrades silently to an
-    # empty constant. VERSION is computed here because .dockerignore
-    # excludes .git, so `git describe` in a build stage cannot find it.
-    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
-    [ -n "$version" ] || version="unknown"
-    docker build --no-cache-filter=lint,builder \
-        --build-arg VERSION="$version" \
-        -t "$("$SCRIPT_DIR/projectname")" .
 }
 
 main "$@"

script/install-precommit

@@ -7,20 +7,7 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    # Stop if this directory is not the top of its own git checkout, for
+    hook=".git/hooks/pre-commit"
-    # example a copy inside another repository, whose hook must not be
-    # replaced.
-    if [ "$(git rev-parse --show-toplevel)" != "$ROOT" ]; then
-        echo "install-precommit: $ROOT is not the top of a git checkout" >&2
-        exit 1
-    fi
-    # Ask git for the repository's own git directory: .git is a file, not
-    # a directory, in some checkouts (for example a clone made with
-    # --separate-git-dir). core.hooksPath is deliberately not followed, so
-    # the hook is never written outside this repository.
-    hooks="$(git rev-parse --git-common-dir)/hooks"
-    mkdir -p "$hooks"
-    hook="$hooks/pre-commit"
     printf '#!/bin/sh\nset -e\nscript/precommit\n' > "$hook"
     chmod +x "$hook"
     echo "pre-commit hook installed: runs script/precommit"

script/lint

@@ -1,28 +1,41 @@
 #!/bin/sh
-# script/lint: run the linter. golangci-lint is never installed or run
+# script/lint: run the linter.
-# on the host: it runs via docker only, one way, everywhere. This
-# builds Dockerfile.lint, which COPYs the repo into the digest-pinned
-# golangci-lint image and lints as a build step, so a successful build
-# means a clean lint.
 #
-# --no-cache-filter=lint forces the lint stage (source copy + linter
+# golangci-lint keeps two pieces of per-user global state, and both of
-# run) to execute on every invocation. Without it an unchanged tree
+# them break when several checkouts on one host lint concurrently:
-# returns success in well under a second having linted nothing. The
+#
-# deps stage (base image + go mod download) stays cached, and no global
+#   1. Its analysis cache (GOLANGCI_LINT_CACHE, default
-# cache invalidation is performed. --progress=plain keeps the linter's
+#      ~/.cache/golangci-lint). Entries are keyed by content, not by
-# own output visible.
+#      checkout, so a hit written by another checkout is replayed
+#      verbatim - including that checkout's file paths. The run then
+#      reports findings for files it never linted.
+#
+#   2. Its "one runner at a time" lock, which does NOT live in the
+#      cache directory: golangci-lint locks
+#      $(os.TempDir())/golangci-lint.lock, i.e.
+#      "$TMPDIR"/golangci-lint.lock (pkg/commands/run.go,
+#      acquireFileLock). It waits 5s, then aborts with "parallel
+#      golangci-lint is running" - a non-result that looks like a lint
+#      failure. Setting GOLANGCI_LINT_CACHE alone does not move it.
+#
+# So both are pinned under the checkout root. The cache is never shared,
+# and TMPDIR makes the lock file per-checkout, which keeps the lock
+# doing its actual job (serialising runs that share one cache) at the
+# right scope. .lint-cache/ is git-ignored and Docker-ignored, and
+# caching still works: it persists across runs in this checkout.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build \
+
-        --progress=plain \
+    GOLANGCI_LINT_CACHE="$ROOT/.lint-cache/cache"
-        --no-cache-filter=lint \
+    TMPDIR="$ROOT/.lint-cache/tmp"
-        --target lint \
+    export GOLANGCI_LINT_CACHE TMPDIR
-        -f Dockerfile.lint \
+    mkdir -p "$GOLANGCI_LINT_CACHE" "$TMPDIR"
-        .
+
+    golangci-lint run --config .golangci.yml ./...
 }
 
 main "$@"

script/test

@@ -1,35 +1,12 @@
 #!/bin/sh
 # script/test: run the test suite.
-#
-# -count=1 disables Go's test cache, and is load-bearing here. This
-# suite queries live DNS on every run by policy (TESTING.md); a cached
-# result is a replay of an earlier run's output with no query made at
-# all. On an unchanged tree the whole suite would return success in
-# under a second having resolved nothing, which makes the repeated-run
-# green that is used as evidence for flakiness fixes worthless. Do not
-# remove it.
-#
-# Conditional verbose rerun per REPO_POLICIES.md: run quiet first so
-# CI and docker build logs stay readable, and rerun with -v only on
-# failure. The rerun also carries -count=1 (a cached replay of the
-# failure would show nothing new), and the exit status is forced to 1
-# no matter how the rerun ends: the first failure already proved the
-# suite broken, so a flaky test that passes the second time must not
-# turn the build green.
-#
-# -timeout 90s is a deliberate backstop above the 60s hard cap on
-# suite duration. Do not lower it.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    go test -count=1 -race -timeout 90s -cover ./... || {
+    go test -v -race -timeout 30s -cover ./...
-        echo "--- Rerunning with -v for details ---" >&2
-        go test -count=1 -race -timeout 90s -v ./... || true
-        exit 1
-    }
 }
 
 main "$@"