Compare commits
1 Commits
next
...
fix/67-rea
| Author | SHA1 | Date | |
|---|---|---|---|
| 83643f84ab |
@@ -6,4 +6,4 @@ jobs:
|
||||
steps:
|
||||
# actions/checkout v4.2.2, 2026-02-28
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
|
||||
- run: script/cibuild
|
||||
- run: docker build .
|
||||
|
||||
@@ -1,9 +1,5 @@
|
||||
version: "2"
|
||||
|
||||
# Config schema uses the golangci-lint v2 layout (settings live under
|
||||
# linters.settings, not top-level linters-settings) so that the
|
||||
# thresholds below are actually applied by golangci-lint >= v2.
|
||||
|
||||
run:
|
||||
timeout: 5m
|
||||
modules-download-mode: readonly
|
||||
@@ -18,17 +14,19 @@ linters:
|
||||
- wsl # Deprecated, replaced by wsl_v5
|
||||
- wrapcheck # Too verbose for internal packages
|
||||
- varnamelen # Short names like db, id are idiomatic Go
|
||||
settings:
|
||||
lll:
|
||||
line-length: 88
|
||||
funlen:
|
||||
lines: 80
|
||||
statements: 50
|
||||
cyclop:
|
||||
max-complexity: 15
|
||||
dupl:
|
||||
threshold: 100
|
||||
|
||||
linters-settings:
|
||||
lll:
|
||||
line-length: 88
|
||||
funlen:
|
||||
lines: 80
|
||||
statements: 50
|
||||
cyclop:
|
||||
max-complexity: 15
|
||||
dupl:
|
||||
threshold: 100
|
||||
|
||||
issues:
|
||||
exclude-use-default: false
|
||||
max-issues-per-linter: 0
|
||||
max-same-issues: 0
|
||||
|
||||
26
Dockerfile
26
Dockerfile
@@ -1,27 +1,13 @@
|
||||
# Lint stage - fast feedback on lint issues, before the build starts.
|
||||
# The linter is invoked directly rather than through `make lint`: that
|
||||
# target shells out to `docker build -f Dockerfile.lint`, and there is
|
||||
# no docker daemon inside a docker build.
|
||||
# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-10
|
||||
FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
|
||||
|
||||
WORKDIR /src
|
||||
COPY go.mod go.sum ./
|
||||
RUN go mod download
|
||||
|
||||
COPY . .
|
||||
|
||||
RUN make fmt-check
|
||||
RUN golangci-lint run --config .golangci.yml ./...
|
||||
|
||||
# Build stage
|
||||
# golang 1.25-alpine, 2026-02-28
|
||||
FROM golang@sha256:f6751d823c26342f9506c03797d2527668d095b0a15f1862cddb4d927a7a4ced AS builder
|
||||
|
||||
RUN apk add --no-cache git make gcc musl-dev binutils-gold
|
||||
|
||||
# Force BuildKit to run the lint stage before proceeding
|
||||
COPY --from=lint /src/go.sum /dev/null
|
||||
# golangci-lint v2.10.1
|
||||
RUN go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@5d1e709b7be35cb2025444e19de266b056b7b7ee
|
||||
# goimports v0.42.0
|
||||
RUN go install golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0
|
||||
|
||||
WORKDIR /src
|
||||
COPY go.mod go.sum ./
|
||||
@@ -29,8 +15,8 @@ RUN go mod download
|
||||
|
||||
COPY . .
|
||||
|
||||
# Run the tests - build fails if any test fails
|
||||
RUN make test
|
||||
# Run all checks - build fails if any check fails
|
||||
RUN make check
|
||||
|
||||
# Build the binary
|
||||
RUN make build
|
||||
|
||||
@@ -1,29 +0,0 @@
|
||||
# Lint-only image: used by script/lint. golangci-lint is never run on
|
||||
# the host — the repo is COPYed into the build context and the linter
|
||||
# runs as a build step, so a successful build IS a clean lint. This
|
||||
# also works where the docker daemon is remote and bind mounts are
|
||||
# impossible.
|
||||
#
|
||||
# `golangci-lint config verify` is deliberately NOT run here: it
|
||||
# fetches its JSON schema over a live, unpinned HTTPS call, which would
|
||||
# make linting network-dependent and defeat hash-pinning. The cost of
|
||||
# that: unknown top-level keys in .golangci.yml are silently ignored,
|
||||
# so a mistyped or wrong-schema key lints clean while applying nothing.
|
||||
#
|
||||
# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-10
|
||||
FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS deps
|
||||
|
||||
WORKDIR /src
|
||||
|
||||
# Dependencies first, so this stage stays cached across lint runs.
|
||||
COPY go.mod go.sum ./
|
||||
RUN go mod download
|
||||
|
||||
# Everything below is invalidated on every run by the
|
||||
# --no-cache-filter=lint that script/lint passes: caching is explicitly
|
||||
# waived for linting, and a cached build lints nothing.
|
||||
FROM deps AS lint
|
||||
|
||||
COPY . .
|
||||
|
||||
RUN golangci-lint run --config .golangci.yml ./...
|
||||
21
LICENSE
21
LICENSE
@@ -1,21 +0,0 @@
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2026 sneak
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
55
Makefile
55
Makefile
@@ -1,44 +1,49 @@
|
||||
.PHONY: all bootstrap setup build lint fmt fmt-check test check clean hooks docker
|
||||
.PHONY: all build lint fmt fmt-check test check clean hooks docker
|
||||
|
||||
BINARY := dnswatcher
|
||||
VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
|
||||
LDFLAGS := -X main.Version=$(VERSION)
|
||||
|
||||
# Standard targets are thin shims; the implementations live in script/
|
||||
# per the scripts-to-rule-them-all pattern (see the Entrypoints section
|
||||
# of README.md).
|
||||
BUILDARCH := $(shell go env GOARCH)
|
||||
LDFLAGS := -X main.Version=$(VERSION) -X main.Buildarch=$(BUILDARCH)
|
||||
|
||||
all: check build
|
||||
|
||||
bootstrap:
|
||||
@script/bootstrap
|
||||
|
||||
setup:
|
||||
@script/setup
|
||||
|
||||
build:
|
||||
go build -ldflags "$(LDFLAGS)" -o bin/$(BINARY) ./cmd/dnswatcher
|
||||
|
||||
test:
|
||||
@script/test
|
||||
|
||||
lint:
|
||||
@script/lint
|
||||
golangci-lint run --config .golangci.yml ./...
|
||||
|
||||
fmt:
|
||||
@script/fmt
|
||||
gofmt -s -w .
|
||||
goimports -w .
|
||||
|
||||
fmt-check:
|
||||
@script/fmt-check
|
||||
@test -z "$$(gofmt -l .)" || (echo "gofmt: files not formatted:" && gofmt -l . && exit 1)
|
||||
|
||||
test:
|
||||
go test -v -race -timeout 30s -cover ./...
|
||||
|
||||
# Check runs all validation without making changes
|
||||
# Used by CI and Docker build - fails if anything is wrong
|
||||
check:
|
||||
@script/check
|
||||
|
||||
docker:
|
||||
@script/docker
|
||||
|
||||
hooks:
|
||||
@script/install-precommit
|
||||
@echo "==> Checking formatting..."
|
||||
@test -z "$$(gofmt -l .)" || (echo "Files not formatted:" && gofmt -l . && exit 1)
|
||||
@echo "==> Running linter..."
|
||||
golangci-lint run --config .golangci.yml ./...
|
||||
@echo "==> Running tests..."
|
||||
go test -v -race -timeout 30s ./...
|
||||
@echo "==> Building..."
|
||||
go build -ldflags "$(LDFLAGS)" -o /dev/null ./cmd/dnswatcher
|
||||
@echo "==> All checks passed!"
|
||||
|
||||
clean:
|
||||
rm -rf bin/
|
||||
|
||||
hooks:
|
||||
@echo '#!/bin/sh' > .git/hooks/pre-commit
|
||||
@echo 'make check' >> .git/hooks/pre-commit
|
||||
@chmod +x .git/hooks/pre-commit
|
||||
@echo "Pre-commit hook installed."
|
||||
|
||||
docker:
|
||||
docker build .
|
||||
|
||||
126
README.md
126
README.md
@@ -1,6 +1,6 @@
|
||||
# dnswatcher
|
||||
|
||||
dnswatcher is an MIT-licensed, pre-1.0 Go daemon by [@sneak](https://sneak.berlin) that monitors DNS records, TCP port availability, and TLS certificates, delivering real-time change notifications via Slack, Mattermost, and ntfy webhooks.
|
||||
dnswatcher is a pre-1.0 Go daemon by [@sneak](https://sneak.berlin) that monitors DNS records, TCP port availability, and TLS certificates, delivering real-time change notifications via Slack, Mattermost, and ntfy webhooks.
|
||||
|
||||
> ⚠️ Pre-1.0 software. APIs, configuration, and behavior may change without notice.
|
||||
|
||||
@@ -17,26 +17,6 @@ without requiring an external database.
|
||||
|
||||
---
|
||||
|
||||
## No DNS mocking. Ever.
|
||||
|
||||
**DNS is never mocked in this project — not in tests, not anywhere else.**
|
||||
No mock resolvers, no fake DNS servers, no stubbed lookups.
|
||||
|
||||
dnswatcher's entire purpose is correct behavior against the real DNS.
|
||||
Tests exercise real iterative resolution against live nameservers by
|
||||
design; a test suite that passes against a mock proves nothing about the
|
||||
one thing this program exists to do.
|
||||
|
||||
When live tests are flaky, that is a robustness problem, and it gets
|
||||
fixed with robustness: retries with backoff, querying multiple
|
||||
independent nameservers, longer timeouts — or explicit opt-in gating
|
||||
decided by the project owner. Never with mocks.
|
||||
|
||||
Contributions that introduce mocked, faked, or stubbed DNS will be
|
||||
rejected.
|
||||
|
||||
---
|
||||
|
||||
## Features
|
||||
|
||||
### DNS Domain Monitoring (Apex Domains)
|
||||
@@ -72,6 +52,10 @@ rejected.
|
||||
responding again.
|
||||
- **Inconsistency detected**: Two nameservers that previously agreed
|
||||
now return different record sets for the same hostname.
|
||||
- **Inconsistency resolved**: Nameservers that previously disagreed
|
||||
are now back in agreement.
|
||||
- **Empty response**: A nameserver that previously returned records
|
||||
now returns an authoritative empty response (NODATA/NXDOMAIN).
|
||||
|
||||
### TCP Port Monitoring
|
||||
|
||||
@@ -144,42 +128,16 @@ includes:
|
||||
- State is written atomically (write to temp file, then rename) to prevent
|
||||
corruption.
|
||||
|
||||
### Web Dashboard
|
||||
|
||||
dnswatcher includes an unauthenticated, read-only web dashboard at the
|
||||
root URL (`/`). It displays:
|
||||
|
||||
- **Summary counts** for monitored domains, hostnames, ports, and
|
||||
certificates.
|
||||
- **Domains** with their discovered nameservers.
|
||||
- **Hostnames** with per-nameserver DNS records and status.
|
||||
- **Ports** with open/closed state and associated hostnames.
|
||||
- **TLS certificates** with CN, issuer, expiry, and status.
|
||||
- **Recent alerts** (last 100 notifications sent since the process
|
||||
started), displayed in reverse chronological order.
|
||||
|
||||
Every data point shows its age (e.g. "5m ago") so you can tell at a
|
||||
glance how fresh the information is. The page auto-refreshes every 30
|
||||
seconds.
|
||||
|
||||
The dashboard intentionally does not expose any configuration details
|
||||
such as webhook URLs, notification endpoints, or API tokens.
|
||||
|
||||
All assets (CSS) are embedded in the binary and served from the
|
||||
application itself. The dashboard makes zero external HTTP requests —
|
||||
no CDN dependencies or third-party resources are loaded at runtime.
|
||||
|
||||
### HTTP API
|
||||
|
||||
dnswatcher exposes a lightweight HTTP API for operational visibility:
|
||||
|
||||
| Endpoint | Description |
|
||||
|---------------------------------------|--------------------------------|
|
||||
| `GET /` | Web dashboard (HTML) |
|
||||
| `GET /s/...` | Static assets (embedded CSS) |
|
||||
| `GET /.well-known/healthcheck` | Health check (JSON) |
|
||||
| `GET /health` | Health check (JSON, legacy) |
|
||||
| `GET /health` | Health check (JSON) |
|
||||
| `GET /api/v1/status` | Current monitoring state |
|
||||
| `GET /api/v1/domains` | Configured domains and status |
|
||||
| `GET /api/v1/hostnames` | Configured hostnames and status|
|
||||
| `GET /metrics` | Prometheus metrics (optional) |
|
||||
|
||||
---
|
||||
@@ -191,7 +149,7 @@ cmd/dnswatcher/main.go Entry point (uber/fx bootstrap)
|
||||
|
||||
internal/
|
||||
config/config.go Viper-based configuration
|
||||
globals/globals.go Build-time variables (version)
|
||||
globals/globals.go Build-time variables (version, arch)
|
||||
logger/logger.go slog structured logging (TTY detection)
|
||||
healthcheck/healthcheck.go Health check service
|
||||
middleware/middleware.go HTTP middleware (logging, CORS, metrics auth)
|
||||
@@ -239,7 +197,7 @@ the following precedence (highest to lowest):
|
||||
|---------------------------------|--------------------------------------------|-------------|
|
||||
| `PORT` | HTTP listen port | `8080` |
|
||||
| `DNSWATCHER_DEBUG` | Enable debug logging | `false` |
|
||||
| `DNSWATCHER_DATA_DIR` | Directory for state file | `/var/lib/dnswatcher` |
|
||||
| `DNSWATCHER_DATA_DIR` | Directory for state file | `./data` |
|
||||
| `DNSWATCHER_TARGETS` | Comma-separated DNS names (auto-classified via PSL) | `""` |
|
||||
| `DNSWATCHER_SLACK_WEBHOOK` | Slack incoming webhook URL | `""` |
|
||||
| `DNSWATCHER_MATTERMOST_WEBHOOK` | Mattermost incoming webhook URL | `""` |
|
||||
@@ -251,25 +209,17 @@ the following precedence (highest to lowest):
|
||||
| `DNSWATCHER_MAINTENANCE_MODE` | Enable maintenance mode | `false` |
|
||||
| `DNSWATCHER_METRICS_USERNAME` | Basic auth username for /metrics | `""` |
|
||||
| `DNSWATCHER_METRICS_PASSWORD` | Basic auth password for /metrics | `""` |
|
||||
| `DNSWATCHER_SEND_TEST_NOTIFICATION` | Send a test notification after first scan completes | `false` |
|
||||
|
||||
**`DNSWATCHER_TARGETS` is required.** dnswatcher will refuse to start if no
|
||||
monitoring targets are configured. A monitoring daemon with nothing to monitor
|
||||
is a misconfiguration, so dnswatcher fails fast with a clear error message
|
||||
rather than running silently. Set `DNSWATCHER_TARGETS` to a comma-separated
|
||||
list of DNS names before starting.
|
||||
|
||||
### Example `.env`
|
||||
|
||||
```sh
|
||||
PORT=8080
|
||||
DNSWATCHER_DEBUG=false
|
||||
DNSWATCHER_DATA_DIR=/var/lib/dnswatcher
|
||||
DNSWATCHER_DATA_DIR=./data
|
||||
DNSWATCHER_TARGETS=example.com,example.org,www.example.com,api.example.com,mail.example.org
|
||||
DNSWATCHER_SLACK_WEBHOOK=https://hooks.slack.com/services/T.../B.../xxx
|
||||
DNSWATCHER_MATTERMOST_WEBHOOK=https://mattermost.example.com/hooks/xxx
|
||||
DNSWATCHER_NTFY_TOPIC=https://ntfy.sh/my-dns-alerts
|
||||
DNSWATCHER_SEND_TEST_NOTIFICATION=true
|
||||
```
|
||||
|
||||
---
|
||||
@@ -369,63 +319,29 @@ tracks reachability:
|
||||
|-------------|-------------------------------------------------|
|
||||
| `ok` | Query succeeded, records are current |
|
||||
| `error` | Query failed (timeout, SERVFAIL, network error) |
|
||||
| `nxdomain` | Authoritative NXDOMAIN response |
|
||||
| `nodata` | Authoritative empty response (NODATA) |
|
||||
|
||||
---
|
||||
|
||||
## Entrypoints
|
||||
|
||||
This repository adheres to the
|
||||
[Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
|
||||
standard: normalized scripts in `script/` are the entrypoints for the
|
||||
development workflow, and the Makefile targets are thin shims that call
|
||||
them. We provide:
|
||||
|
||||
- `script/bootstrap` — install all dependencies (go, pinned goimports,
|
||||
`go mod download`). It does not install golangci-lint: see
|
||||
`script/lint` below.
|
||||
- `script/setup` — make a fresh clone ready for development: bootstrap
|
||||
plus the git pre-commit hook
|
||||
- `script/projectname` — print the project name (used for the Docker
|
||||
image tag)
|
||||
- `script/test` — run the test suite (race detector, coverage). Caching
|
||||
is waived for testing, exactly as it is for linting: `-count=1`
|
||||
forces every invocation to execute, because the suite queries live
|
||||
DNS and a cached pass queries nothing. Failures are rerun with `-v`
|
||||
automatically, and the build fails even if that rerun passes.
|
||||
- `script/lint` — run golangci-lint, always inside Docker: it builds
|
||||
`Dockerfile.lint`, which COPYs the repo into the digest-pinned
|
||||
`golangci-lint` image and lints as a build step, so a successful
|
||||
build is a clean lint. The linter is never installed or run on the
|
||||
host, and Docker is the only prerequisite. Caching is waived for
|
||||
linting: the lint stage is forced to execute on every run with
|
||||
`--no-cache-filter`, because a cached build lints nothing.
|
||||
- `script/fmt` — format all code (gofmt -s, goimports)
|
||||
- `script/fmt-check` — check formatting (read-only)
|
||||
- `script/check` — run test, lint, and fmt-check
|
||||
- `script/docker` — build the Docker image tagged via
|
||||
`script/projectname`
|
||||
- `script/cibuild` — CI entrypoint: plain `docker build .`
|
||||
- `script/precommit` — run by the git pre-commit hook; `go mod tidy`
|
||||
guard, then `script/check`
|
||||
- `script/install-precommit` — install the git pre-commit hook
|
||||
|
||||
## Building
|
||||
|
||||
```sh
|
||||
make build # Build binary to bin/dnswatcher
|
||||
make test # Run tests with race detector
|
||||
make lint # Run golangci-lint in Docker (requires docker)
|
||||
make lint # Run golangci-lint
|
||||
make fmt # Format code
|
||||
make check # Run all checks (test, lint, fmt-check)
|
||||
make check # Run all checks (format, lint, test, build)
|
||||
make clean # Remove build artifacts
|
||||
```
|
||||
|
||||
### Build-Time Variables
|
||||
|
||||
Version is injected via `-ldflags`:
|
||||
Version and architecture are injected via `-ldflags`:
|
||||
|
||||
```sh
|
||||
go build -ldflags "-X main.Version=$(git describe --tags --always)" ./cmd/dnswatcher
|
||||
go build -ldflags "-X main.Version=$(git describe --tags --always) \
|
||||
-X main.Buildarch=$(go env GOARCH)" ./cmd/dnswatcher
|
||||
```
|
||||
|
||||
---
|
||||
@@ -439,7 +355,6 @@ docker run -d \
|
||||
-v dnswatcher-data:/var/lib/dnswatcher \
|
||||
-e DNSWATCHER_TARGETS=example.com,www.example.com \
|
||||
-e DNSWATCHER_NTFY_TOPIC=https://ntfy.sh/my-alerts \
|
||||
-e DNSWATCHER_SEND_TEST_NOTIFICATION=true \
|
||||
dnswatcher
|
||||
```
|
||||
|
||||
@@ -486,9 +401,8 @@ Viper for configuration.
|
||||
|
||||
## License
|
||||
|
||||
dnswatcher is released under the MIT License, Copyright (c) 2026
|
||||
[@sneak](https://sneak.berlin). See the [`LICENSE`](./LICENSE) file in the
|
||||
repository root for the full text.
|
||||
License has not yet been chosen for this project. Pending decision by the
|
||||
author (MIT, GPL, or WTFPL).
|
||||
|
||||
## Author
|
||||
|
||||
|
||||
270
REPO_POLICIES.md
270
REPO_POLICIES.md
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Repository Policies
|
||||
last_modified: 2026-08-07
|
||||
last_modified: 2026-02-22
|
||||
---
|
||||
|
||||
This document covers repository structure, tooling, and workflow standards. Code
|
||||
@@ -34,46 +34,10 @@ style conventions are in separate documents:
|
||||
every file before committing. There are zero exceptions to this rule.
|
||||
|
||||
- Every repo with software must have a root `Makefile` with these targets:
|
||||
`make bootstrap`, `make setup`, `make test`, `make lint`, `make fmt` (writes),
|
||||
`make fmt-check` (read-only), `make check` (runs `test`, `lint`, `fmt-check`),
|
||||
`make docker`, and `make hooks` (installs pre-commit hook). A model Makefile
|
||||
is at `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.
|
||||
|
||||
- Repos follow the
|
||||
[Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
|
||||
pattern: the implementation of each Makefile target lives in an executable
|
||||
script in `script/` (`script/bootstrap`, `script/setup`, `script/test`,
|
||||
`script/lint`, `script/fmt`, `script/fmt-check`, `script/check`,
|
||||
`script/docker`), and the Makefile targets are thin shims that call them. The
|
||||
scripts must be POSIX sh (`#!/bin/sh`, `set -eu`, no bashisms) so they run in
|
||||
minimal containers (e.g. alpine images have no bash); locate the repo root
|
||||
with `$(cd "$(dirname "$0")/.." && pwd -P)` and `cd` there before acting. From
|
||||
the standard's canonical set we use `bootstrap`, `setup` (make the repo ready
|
||||
for development after a fresh clone: runs `bootstrap`, then
|
||||
`install-precommit`, plus any repo-specific initialization), `test`, and
|
||||
`cibuild`. `script/bootstrap` installs all dependencies idempotently and
|
||||
assumes nothing is present: base tools come from nix, apt, brew, or apk
|
||||
(detected in that order; apt runs noninteractive). For node it uses the
|
||||
installed node if present; otherwise it installs a PINNED node version via
|
||||
nvm, first installing nvm itself if missing — from a hash-verified GitHub
|
||||
release archive (never `curl | sh`), with bash installed as an explicit
|
||||
prerequisite since nvm requires bash. yarn is then pinned via
|
||||
`corepack prepare yarn@<version> --activate`. Never install "latest" or "lts";
|
||||
always exact versions. `script/cibuild` runs the CI build: it changes to the
|
||||
repo root and runs `docker build .`; the Gitea workflow calls it. Four further
|
||||
scripts are our own extensions to the standard: `script/check` runs
|
||||
`script/test`, `script/lint`, and `script/fmt-check`; `script/precommit` is
|
||||
what the git pre-commit hook runs, and it calls `script/check`;
|
||||
`script/install-precommit` installs the git pre-commit hook (the `make hooks`
|
||||
target shims to it); and `script/projectname` (literally that filename) simply
|
||||
outputs the project's name. Scripts that need the name call
|
||||
`script/projectname` — e.g. `script/docker` assembles its image tag from it —
|
||||
so those scripts stay byte-identical across all repos. Repo-type-specific
|
||||
pre-commit extras (e.g. `go mod tidy` verification in Go repos) belong in
|
||||
`script/precommit`, not in the hook itself. Model scripts are at
|
||||
`https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`. The README
|
||||
must document the provided scripts in an **Entrypoints** section (see the
|
||||
README requirements below).
|
||||
`make test`, `make lint`, `make fmt` (writes), `make fmt-check` (read-only),
|
||||
`make check` (prereqs: `test`, `lint`, `fmt-check`), `make docker`, and
|
||||
`make hooks` (installs pre-commit hook). A model Makefile is at
|
||||
`https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.
|
||||
|
||||
- Always use Makefile targets (`make fmt`, `make test`, `make lint`, etc.)
|
||||
instead of invoking the underlying tools directly. The Makefile is the single
|
||||
@@ -93,83 +57,11 @@ style conventions are in separate documents:
|
||||
as a build step so the build fails if the branch is not green. For non-server
|
||||
repos, the Dockerfile should bring up a development environment and run
|
||||
`make check`. For server repos, `make check` should run as an early build
|
||||
stage before the final image is assembled. Dockerfiles install development
|
||||
prerequisites by running `script/bootstrap` rather than duplicating installs
|
||||
inline; COPY `script/` and the dependency manifests (`package.json` +
|
||||
`yarn.lock`, `go.mod` + `go.sum`, etc.) before running it so the bootstrap
|
||||
layer stays cached until dependencies change.
|
||||
|
||||
- **Dockerfiles must use a separate lint stage for fail-fast feedback.** Go
|
||||
repos use a multistage build where linting runs in an independent stage based
|
||||
on the `golangci/golangci-lint` image (pinned by hash). This stage runs
|
||||
`make fmt-check` and `make lint` before the full build begins. The build stage
|
||||
then declares an explicit dependency on the lint stage via
|
||||
`COPY --from=lint /src/go.sum /dev/null`, which forces BuildKit to complete
|
||||
linting before proceeding to compilation and tests. This ensures lint failures
|
||||
surface in seconds rather than minutes, without blocking on dependency
|
||||
download or compilation in the build stage.
|
||||
|
||||
The standard pattern for a Go repo Dockerfile is:
|
||||
|
||||
```dockerfile
|
||||
# Lint stage — fast feedback on formatting and lint issues
|
||||
# golangci/golangci-lint:v2.x.x, YYYY-MM-DD
|
||||
FROM golangci/golangci-lint@sha256:... AS lint
|
||||
WORKDIR /src
|
||||
COPY go.mod go.sum ./
|
||||
RUN go mod download
|
||||
COPY . .
|
||||
RUN make fmt-check
|
||||
RUN make lint
|
||||
|
||||
# Build stage
|
||||
# golang:1.x-alpine, YYYY-MM-DD
|
||||
FROM golang@sha256:... AS builder
|
||||
WORKDIR /src
|
||||
|
||||
# Force BuildKit to run the lint stage before proceeding
|
||||
COPY --from=lint /src/go.sum /dev/null
|
||||
|
||||
COPY go.mod go.sum ./
|
||||
RUN go mod download
|
||||
COPY . .
|
||||
RUN make test
|
||||
|
||||
ARG VERSION=dev
|
||||
RUN CGO_ENABLED=0 go build -trimpath \
|
||||
-ldflags="-s -w -X main.Version=${VERSION}" \
|
||||
-o /app ./cmd/app/
|
||||
|
||||
# Runtime stage
|
||||
FROM alpine@sha256:...
|
||||
COPY --from=builder /app /usr/local/bin/app
|
||||
ENTRYPOINT ["app"]
|
||||
```
|
||||
|
||||
Key points:
|
||||
- The lint stage uses the `golangci/golangci-lint` image directly (it
|
||||
includes both Go and the linter), so there is no need to install the
|
||||
linter separately.
|
||||
- `COPY --from=lint /src/go.sum /dev/null` is a no-op file copy that creates
|
||||
a stage dependency. BuildKit runs stages in parallel by default; without
|
||||
this line, the build stage would not wait for lint to finish and a lint
|
||||
failure might not fail the overall build.
|
||||
- If the project uses `//go:embed` directives that reference build artifacts
|
||||
(e.g. a web frontend compiled in a separate stage), the lint stage must
|
||||
create placeholder files so the embed directives resolve. Example:
|
||||
`RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css`.
|
||||
The lint stage should not depend on the actual build output — it exists to
|
||||
fail fast.
|
||||
- If the project requires CGO or system libraries for linting (e.g.
|
||||
`vips-dev`), install them in the lint stage with `apk add`.
|
||||
- The build stage runs `make test` after compilation setup. Tests run in the
|
||||
build stage, not the lint stage, because they may require compiled
|
||||
artifacts or heavier dependencies.
|
||||
stage before the final image is assembled.
|
||||
|
||||
- Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
|
||||
runs `script/cibuild` (which runs `docker build .`) on push. Since the
|
||||
Dockerfile already runs `make check`, a successful build implies all checks
|
||||
pass.
|
||||
runs `docker build .` on push. Since the Dockerfile already runs `make check`,
|
||||
a successful build implies all checks pass.
|
||||
|
||||
- Use platform-standard formatters: `black` for Python, `prettier` for
|
||||
JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with
|
||||
@@ -177,11 +69,9 @@ style conventions are in separate documents:
|
||||
Markdown (hard-wrap at 80 columns). Documentation and writing repos (Markdown,
|
||||
HTML, CSS) should also have `.prettierrc` and `.prettierignore`.
|
||||
|
||||
- Pre-commit hook: runs `script/precommit`, which calls `script/check`. If local
|
||||
testing is not possible in the repo, `script/precommit` may skip `script/test`
|
||||
and run only `script/lint` and `script/fmt-check`. The hook is installed by
|
||||
`script/install-precommit`; the Makefile must provide a `make hooks` target
|
||||
that shims to it.
|
||||
- Pre-commit hook: `make check` if local testing is possible, otherwise
|
||||
`make lint && make fmt-check`. The Makefile should provide a `make hooks`
|
||||
target to install the pre-commit hook.
|
||||
|
||||
- All repos with software must have tests that run via the platform-standard
|
||||
test framework (`go test`, `pytest`, `jest`/`vitest`, etc.). If no meaningful
|
||||
@@ -189,49 +79,8 @@ style conventions are in separate documents:
|
||||
module under test to verify it compiles/parses. There is no excuse for
|
||||
`make test` to be a no-op.
|
||||
|
||||
- `make test` must complete in under 60 seconds. That is the hard cap, and a
|
||||
suite that exceeds it fails. Under 20 seconds is the target. A suite between
|
||||
20 and 60 seconds is still green, but the overage must be filed as an
|
||||
improvement bug against that repo. Add a 90-second timeout to the test
|
||||
invocation in the Makefile (`go test -timeout 90s`). The backstop deliberately
|
||||
sits above the hard cap so that it catches a genuinely hung test rather than a
|
||||
merely slow one.
|
||||
|
||||
- **`make test` should use the conditional verbose rerun pattern.** Run tests
|
||||
without `-v` (verbose) first. If tests fail, automatically rerun with `-v` to
|
||||
show full output. This keeps CI logs and `docker build` output clean on
|
||||
success (just package/suite summaries) while providing full diagnostic detail
|
||||
on failure (every test case, every assertion). The general shell pattern:
|
||||
|
||||
```makefile
|
||||
test:
|
||||
@<test-command> || \
|
||||
{ echo "--- Rerunning with -v for details ---"; \
|
||||
<test-command-with-v>; exit 1; }
|
||||
```
|
||||
|
||||
Go example:
|
||||
|
||||
```makefile
|
||||
test:
|
||||
@go test -timeout 90s -race -cover ./... || \
|
||||
{ echo "--- Rerunning with -v for details ---"; \
|
||||
go test -timeout 90s -race -v ./...; exit 1; }
|
||||
```
|
||||
|
||||
Python example:
|
||||
|
||||
```makefile
|
||||
test:
|
||||
@python -m pytest || \
|
||||
{ echo "--- Rerunning with -v for details ---"; \
|
||||
python -m pytest -v; exit 1; }
|
||||
```
|
||||
|
||||
The `exit 1` ensures the target always fails after a rerun — the first run
|
||||
already proved the tests are broken, so the build must not pass even if a
|
||||
flaky test happens to succeed on the second attempt. The rerun exists solely
|
||||
for diagnostic output.
|
||||
- `make test` must complete in under 20 seconds. Add a 30-second timeout in the
|
||||
Makefile.
|
||||
|
||||
- Docker builds must complete in under 5 minutes.
|
||||
|
||||
@@ -249,13 +98,6 @@ style conventions are in separate documents:
|
||||
`https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up
|
||||
a new repo.
|
||||
|
||||
- **No build artifacts in version control.** Code-derived data (compiled
|
||||
bundles, minified output, generated assets) must never be committed to the
|
||||
repository if it can be avoided. The build process (e.g. Dockerfile, Makefile)
|
||||
should generate these at build time. Notable exception: Go protobuf generated
|
||||
files (`.pb.go`) ARE committed because repos need to work with `go get`, which
|
||||
downloads code but does not execute code generation.
|
||||
|
||||
- Never use `git add -A` or `git add .`. Always stage files explicitly by name.
|
||||
|
||||
- Never force-push to `main`.
|
||||
@@ -265,10 +107,7 @@ style conventions are in separate documents:
|
||||
|
||||
- `.golangci.yml` is standardized and must _NEVER_ be modified by an agent, only
|
||||
manually by the user. Fetch from
|
||||
`https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`. The
|
||||
canonical golangci-lint version is v2.12.2 (released 2026-05-06), installed
|
||||
commit-pinned via
|
||||
`go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@c0d3ddc9cf3faa61a4e378e879ece580256d76e5`.
|
||||
`https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`.
|
||||
|
||||
- When pinning images or packages by hash, add a comment above the reference
|
||||
with the version and date (YYYY-MM-DD).
|
||||
@@ -282,76 +121,12 @@ style conventions are in separate documents:
|
||||
- Dockerized web services listen on port 8080 by default, overridable with
|
||||
`PORT`.
|
||||
|
||||
- **HTTP/web services must be hardened for production internet exposure before
|
||||
tagging 1.0.** This means full compliance with security best practices
|
||||
including, without limitation, all of the following:
|
||||
- **Security headers** on every response:
|
||||
- `Strict-Transport-Security` (HSTS) with `max-age` of at least one year
|
||||
and `includeSubDomains`.
|
||||
- `Content-Security-Policy` (CSP) with a restrictive default policy
|
||||
(`default-src 'self'` as a baseline, tightened per-resource as
|
||||
needed). Never use `unsafe-inline` or `unsafe-eval` unless
|
||||
unavoidable, and document the reason.
|
||||
- `X-Frame-Options: DENY` (or `SAMEORIGIN` if framing is required).
|
||||
Prefer the `frame-ancestors` CSP directive as the primary control.
|
||||
- `X-Content-Type-Options: nosniff`.
|
||||
- `Referrer-Policy: strict-origin-when-cross-origin` (or stricter).
|
||||
- `Permissions-Policy` restricting access to browser features the
|
||||
application does not use (camera, microphone, geolocation, etc.).
|
||||
- **Request and response limits:**
|
||||
- Maximum request body size enforced on all endpoints (e.g. Go
|
||||
`http.MaxBytesReader`). Choose a sane default per-route; never accept
|
||||
unbounded input.
|
||||
- Maximum response body size where applicable (e.g. paginated APIs).
|
||||
- `ReadTimeout` and `ReadHeaderTimeout` on the `http.Server` to defend
|
||||
against slowloris attacks.
|
||||
- `WriteTimeout` on the `http.Server`.
|
||||
- `IdleTimeout` on the `http.Server`.
|
||||
- Per-handler execution time limits via `context.WithTimeout` or
|
||||
chi/stdlib `middleware.Timeout`.
|
||||
- **Authentication and session security:**
|
||||
- Rate limiting on password-based authentication endpoints. API keys are
|
||||
high-entropy and not susceptible to brute force, so they are exempt.
|
||||
- CSRF tokens on all state-mutating HTML forms. API endpoints
|
||||
authenticated via `Authorization` header (Bearer token, API key) are
|
||||
exempt because the browser does not attach these automatically.
|
||||
- Passwords stored using bcrypt, scrypt, or argon2 — never plain-text,
|
||||
MD5, or SHA.
|
||||
- Session cookies set with `HttpOnly`, `Secure`, and `SameSite=Lax` (or
|
||||
`Strict`) attributes.
|
||||
- **Reverse proxy awareness:**
|
||||
- True client IP detection when behind a reverse proxy
|
||||
(`X-Forwarded-For`, `X-Real-IP`). The application must accept
|
||||
forwarded headers only from a configured set of trusted proxy
|
||||
addresses — never trust `X-Forwarded-For` unconditionally.
|
||||
- **CORS:**
|
||||
- Authenticated endpoints must restrict `Access-Control-Allow-Origin` to
|
||||
an explicit allowlist of known origins. Wildcard (`*`) is acceptable
|
||||
only for public, unauthenticated read-only APIs.
|
||||
- **Error handling:**
|
||||
- Internal errors must never leak stack traces, SQL queries, file paths,
|
||||
or other implementation details to the client. Return generic error
|
||||
messages in production; detailed errors only when `DEBUG` is enabled.
|
||||
- **TLS:**
|
||||
- Services never terminate TLS directly. They are always deployed behind
|
||||
a TLS-terminating reverse proxy. The service itself listens on plain
|
||||
HTTP. However, HSTS headers and `Secure` cookie flags must still be
|
||||
set by the application so that the browser enforces HTTPS end-to-end.
|
||||
|
||||
This list is non-exhaustive. Apply defense-in-depth: if a standard security
|
||||
hardening measure exists for HTTP services and is not listed here, it is
|
||||
still expected. When in doubt, harden.
|
||||
|
||||
- `README.md` is the primary documentation. Required sections:
|
||||
- **Description**: First line must include the project name, purpose,
|
||||
category (web server, SPA, CLI tool, etc.), license, and author. Example:
|
||||
"µPaaS is an MIT-licensed Go web application by @sneak that receives
|
||||
git-frontend webhooks and deploys applications via Docker in realtime."
|
||||
- **Getting Started**: Copy-pasteable install/usage code block.
|
||||
- **Entrypoints**: Opens by stating that the repo adheres to the
|
||||
[Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
|
||||
standard (with that link), then documents each provided `script/`
|
||||
entrypoint and its purpose.
|
||||
- **Rationale**: Why does this exist?
|
||||
- **Design**: How is the program structured?
|
||||
- **TODO**: Update meticulously, even between commits. When planning, put
|
||||
@@ -370,13 +145,13 @@ style conventions are in separate documents:
|
||||
|
||||
- Database migrations live in `internal/db/migrations/` and must be embedded in
|
||||
the binary.
|
||||
- `000_migration.sql` — contains ONLY the creation of the migrations
|
||||
tracking table itself. Nothing else.
|
||||
- `001_schema.sql` — the full application schema.
|
||||
- **Pre-1.0.0:** never add additional migration files (002, 003, etc.).
|
||||
There is no installed base to migrate. Edit `001_schema.sql` directly.
|
||||
- **Post-1.0.0:** add new numbered migration files for each schema change.
|
||||
Never edit existing migrations after release.
|
||||
- `000_migration.sql` — contains ONLY the creation of the migrations tracking
|
||||
table itself. Nothing else.
|
||||
- `001_schema.sql` — the full application schema.
|
||||
- **Pre-1.0.0:** never add additional migration files (002, 003, etc.). There
|
||||
is no installed base to migrate. Edit `001_schema.sql` directly.
|
||||
- **Post-1.0.0:** add new numbered migration files for each schema change.
|
||||
Never edit existing migrations after release.
|
||||
|
||||
- All repos should have an `.editorconfig` enforcing the project's indentation
|
||||
settings.
|
||||
@@ -406,9 +181,6 @@ style conventions are in separate documents:
|
||||
- `README.md`, `.git`, `.gitignore`, `.editorconfig`
|
||||
- `LICENSE`, `REPO_POLICIES.md` (copy from the `prompts` repo)
|
||||
- `Makefile`
|
||||
- `script/` entrypoints (`bootstrap`, `setup`, `projectname`, `test`,
|
||||
`lint`, `fmt`, `fmt-check`, `check`, `docker`, `cibuild`, `precommit`,
|
||||
`install-precommit`)
|
||||
- `Dockerfile`, `.dockerignore`
|
||||
- `.gitea/workflows/check.yml`
|
||||
- Go: `go.mod`, `go.sum`, `.golangci.yml`
|
||||
|
||||
@@ -17,7 +17,7 @@ real servers ensures the resolver works correctly in production.
|
||||
|
||||
- Tests hit real DNS infrastructure and require network access
|
||||
- Test duration depends on network conditions; timeout tuning keeps
|
||||
the suite within the 60-second target
|
||||
the suite within the 30-second target
|
||||
- Query timeout is calibrated to 3× maximum antipodal RTT (~300ms)
|
||||
plus processing margin
|
||||
- Root server fan-out is limited to reduce parallel query load
|
||||
@@ -31,7 +31,4 @@ real servers ensures the resolver works correctly in production.
|
||||
exists for unit-testing other packages that consume the resolver)
|
||||
- **Do not add `-short` flags** to skip slow tests
|
||||
- **Do not increase `-timeout`** to hide hanging queries
|
||||
- **Do not remove `-count=1` from `script/test`** — Go's test cache
|
||||
replays a previous run's output without querying anything, so a
|
||||
cached pass is not evidence that live resolution works
|
||||
- **Do not modify linter configuration** to suppress findings
|
||||
|
||||
218
TODO.md
218
TODO.md
@@ -1,218 +0,0 @@
|
||||
# Workflow
|
||||
|
||||
* branch (from `main`)
|
||||
* do the work in Next Step
|
||||
* move Next Step to the top of Completed Steps
|
||||
* move the top item of Future Steps into Next Step
|
||||
* commit (`TODO.md` changes in the same commit as the work)
|
||||
* merge to `main` if the branch is not protected, otherwise open a PR
|
||||
* push
|
||||
|
||||
# Status
|
||||
|
||||
pre-1.0. No git tags. Core resolver work in flight on feature/resolver
|
||||
(dirty: internal/resolver/resolver_test.go). Local checkout has diverged
|
||||
from origin: origin/main is 8 commits ahead (watcher orchestrator,
|
||||
unified TARGETS) and origin/feature/resolver already contains the full
|
||||
iterative resolver implementation with hermetic mocked tests.
|
||||
|
||||
# Next Step
|
||||
|
||||
Add the README sections required by policy (Description, Getting Started,
|
||||
Rationale, Design, TODO, License, Author) if any are still missing.
|
||||
|
||||
# Completed Steps
|
||||
|
||||
- 2026-08-10: comment-only corrections to `script/bootstrap`,
|
||||
`script/cibuild`, and `Dockerfile.lint`. The `goimports` pin in
|
||||
`script/bootstrap` was justified by a claim that `script/fmt-check`
|
||||
runs it on the host; it does not (it runs `gofmt -l .` only), so the
|
||||
header now credits `script/fmt` alone. `script/cibuild` still claimed
|
||||
the `Dockerfile` runs `make check`, which stopped being true when
|
||||
linting moved to its own stage; it now describes the lint stage
|
||||
(`make fmt-check` plus `golangci-lint`) and the builder stage
|
||||
(`make test`, `make build`). The `docker`-missing warning in
|
||||
`script/bootstrap` reads as one sentence instead of three fragments
|
||||
each re-prefixed with `bootstrap:`. `Dockerfile.lint` now records the
|
||||
residual risk of omitting `golangci-lint config verify`: unknown
|
||||
top-level keys in `.golangci.yml` are silently ignored, so a mistyped
|
||||
key lints clean while applying nothing. No behaviour changed
|
||||
- 2026-08-10: MIT `LICENSE` added at the repository root, closing the
|
||||
last gap in `REPO_POLICIES.md`'s required-minimum file list and
|
||||
removing the all-rights-reserved default that would otherwise have
|
||||
shipped with a 1.0 tag. The licence choice is the standing org policy
|
||||
(any public repo lacking a licence gets MIT; a private repo with no
|
||||
licence is already all-rights-reserved), and this repo is public. The
|
||||
file holds the canonical MIT text byte-for-byte with only the
|
||||
copyright line filled in (`Copyright (c) 2026 sneak`); no clauses were
|
||||
added, removed, or reflowed. `README.md`'s first line now names the
|
||||
licence, as the Description requirement demands, and the License
|
||||
section states MIT and points at the file instead of saying the choice
|
||||
is pending. `make fmt` covers only Go sources (`gofmt -s`,
|
||||
`goimports`), so it cannot reflow `LICENSE`
|
||||
- 2026-08-10: the policy scaffold (`REPO_POLICIES.md`, `.editorconfig`,
|
||||
`.dockerignore`, `.gitea/workflows/check.yml`, and the `fmt-check`,
|
||||
`docker`, and hooks Makefile targets) is present; it landed piecemeal
|
||||
across the scripts-to-rule-them-all and policy commits rather than as
|
||||
the single commit this file once planned
|
||||
- 2026-08-10: Go's test cache disabled for `script/test` via `-count=1`,
|
||||
so every invocation actually executes. A cached pass replays an
|
||||
earlier run's output without querying DNS at all, which in this repo
|
||||
means the suite's entire premise goes unexercised while the run
|
||||
reports green in under a second. The conditional verbose rerun that
|
||||
`REPO_POLICIES.md` mandates was added at the same time (the primary
|
||||
run had been unconditionally `-v`): quiet first, `-v` only on
|
||||
failure, `-count=1` on both, and exit 1 forced regardless of the
|
||||
rerun's result so a flake passing the second time cannot turn the
|
||||
build green. `-timeout 90s` left alone as the deliberate backstop
|
||||
above the 60s hard cap. Uncached suite runs ~4s, well inside the 20s
|
||||
target
|
||||
- 2026-08-10: live-DNS test flakiness addressed by robustness rather
|
||||
than gating, per the owner's ruling on #93: new
|
||||
`internal/resolver/livedns_test.go` adds a package-wide concurrency
|
||||
gate (so parallel tests stop bursting at the first root server),
|
||||
retry with exponential backoff on transport failures only, and
|
||||
quorum instead of unanimity for multi-nameserver assertions. Quorum
|
||||
tolerates silence only: every per-nameserver status must be in a
|
||||
closed allowlist (`ok`/`timeout`/`error`, or
|
||||
`nxdomain`/`timeout`/`error`), so a wrong answer from a minority —
|
||||
`nodata` today, any status added later — fails the test instead of
|
||||
sliding through under the majority. The
|
||||
`make test` cap moved to the new org-wide 60s hard cap / 20s target
|
||||
with a 90s `-timeout` backstop; `REPO_POLICIES.md` re-vendored
|
||||
byte-identical from `sneak/prompts`. No mocks, no `-short`, no build
|
||||
tags, no skips, and no change to production resolver behaviour
|
||||
- 2026-08-10: all linting moved into Docker: new root `Dockerfile.lint`
|
||||
on the digest-pinned `golangci/golangci-lint:v2.12.2` image,
|
||||
`script/lint` reduced to a thin wrapper that builds it with
|
||||
`--no-cache-filter=lint` so the linter actually executes every run,
|
||||
golangci-lint install dropped from `script/bootstrap` (goimports
|
||||
stays, `script/fmt` needs it on the host), and the root `Dockerfile`
|
||||
given its own lint stage so its build no longer recurses through
|
||||
`make check` into `script/lint`. `golangci-lint config verify` is
|
||||
deliberately omitted: it fetches its schema over an unpinned live
|
||||
HTTPS call
|
||||
- 2026-08-07: golangci-lint bumped to v2.12.2 (commit-pinned installs
|
||||
in `Dockerfile` and `script/bootstrap`); `.golangci.yml` set to the
|
||||
org-standard v2-schema config used across the org's repos
|
||||
(owner-authorized; same file is being landed as canonical via prompts
|
||||
PR #24), with settings under `linters.settings` so the
|
||||
lll/funlen/cyclop/dupl thresholds apply; fixed the resulting
|
||||
`goconst`, `dupl`, and `lll` findings; the informational `gomodguard`
|
||||
deprecation warning under this config is accepted
|
||||
- 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
|
||||
Makefile shims, README Entrypoints section
|
||||
- 2026-02-20: iterative DNS resolver implemented; tests made hermetic
|
||||
with mocked DNS (origin/feature/resolver, unmerged)
|
||||
- 2026-02-20: CI actions and go install refs pinned to commit SHAs;
|
||||
Gitea Actions workflow for make check (origin/ci/make-check, unmerged)
|
||||
- 2026-02-20: watcher monitoring orchestrator merged to main (#8)
|
||||
- 2026-02-20: DOMAINS/HOSTNAMES unified into single TARGETS config (#11)
|
||||
- 2026-02-19: TCP port connectivity checker, made concurrent with port
|
||||
validation; gosec G704 SSRF findings fixed without suppression
|
||||
(feature branches, unmerged)
|
||||
- 2026-02-19: TLS certificate inspector with no-peer-certificates error
|
||||
path and IP SANs (feature branch, unmerged)
|
||||
- 2026-02-19: gosec SSRF and formatting fixes on main
|
||||
- 2026-02-19: initial scaffold with per-nameserver DNS monitoring model
|
||||
|
||||
# Future Steps
|
||||
|
||||
Compliance:
|
||||
|
||||
- Pin Dockerfile base images by sha256 and ensure the Docker build runs
|
||||
make check
|
||||
|
||||
Branch reconciliation:
|
||||
|
||||
- Sync local checkout with origin: local main is 8 commits behind
|
||||
origin/main; local feature/resolver has diverged from
|
||||
origin/feature/resolver, which already implements the resolver
|
||||
- Merge in-flight branches to main once green: feature/resolver,
|
||||
ci/make-check, feature/portcheck-implementation,
|
||||
feature/tlscheck-implementation
|
||||
|
||||
Resolver (plan from untracked TODO.md; largely implemented on
|
||||
origin/feature/resolver, verify each item before closing):
|
||||
|
||||
- Add github.com/miekg/dns dependency
|
||||
- roots.go: hardcoded IANA root server list (a through m, IPv4/IPv6),
|
||||
rootServers() returning ip:53 strings
|
||||
- query.go: low-level query(ctx, server, name, qtype): UDP with TCP
|
||||
fallback on truncation, RD=0, context respected, 5s per-query timeout,
|
||||
returns raw *dns.Msg
|
||||
- trace.go: iterative delegation chasing from roots: referral detection
|
||||
(NOERROR, empty answer, NS in authority), glue extraction with
|
||||
bailiwick check, out-of-bailiwick NS resolved with recursion guard,
|
||||
delegation depth limit (20), retry across nameservers on failure, do
|
||||
not chase CNAMEs inside trace
|
||||
- FindAuthoritativeNameservers: NS set via trace, sorted, FQDN
|
||||
normalized, trailing dot handled; must pass its 9 tests
|
||||
- QueryNameserver: resolve NS host to IPs, query A/AAAA/CNAME/MX/TXT/
|
||||
SRV/CAA/NS, build NameserverResponse with status mapping (OK,
|
||||
NXDomain, NoData, Error), documented record formatting, sorted values,
|
||||
lame delegation detection; must pass its 16 tests
|
||||
- QueryAllNameservers: find NS set for parent domain (public suffix
|
||||
list), query all NS in parallel with bounded concurrency, return map
|
||||
even when all fail, context cancellation; must pass its 4 tests
|
||||
- LookupNS: thin wrapper over FindAuthoritativeNameservers, sorted,
|
||||
identical results; must pass its 3 tests
|
||||
- ResolveIPAddresses: collect A/AAAA from all NS, follow CNAME chains
|
||||
with MaxCNAMEDepth, dedupe, sort, NXDOMAIN returns empty slice with
|
||||
nil error; must pass its 9 tests
|
||||
- All 39 resolver tests pass, make check green, merge to main
|
||||
|
||||
Watcher (internal/watcher/watcher.go):
|
||||
|
||||
- Scheduling loop in Run(ctx): initial check on startup, separate
|
||||
tickers for DNS/port and TLS intervals, persist state via state.Save()
|
||||
after each cycle, clean shutdown on context cancel
|
||||
- Domain check: LookupNS, compare to stored state, store silently on
|
||||
first run, notify with old/new NS lists on change
|
||||
- Hostname check: QueryAllNameservers, compare per-NS records; notify on
|
||||
record changes, NS failure, NS recovery, inconsistency detected,
|
||||
inconsistency resolved, empty response; store silently on first run
|
||||
- Port check: ResolveIPAddresses, check ports 80 and 443 per IP, notify
|
||||
on open/closed transitions, handle new and disappeared IPs
|
||||
- TLS check: for each open IP:443, CheckCertificate; notify on expiry
|
||||
warning, certificate change (CN/issuer/SANs), TLS failure/recovery
|
||||
|
||||
Port checker (internal/portcheck/portcheck.go):
|
||||
|
||||
- Tests against known-open ports and RFC documentation IPs
|
||||
- CheckPort: net.DialTimeout (5s), context respected; (true, nil) open,
|
||||
(false, nil) closed/timeout/refused, error only for unexpected
|
||||
failures
|
||||
|
||||
TLS checker (internal/tlscheck/tlscheck.go):
|
||||
|
||||
- Tests against known public HTTPS servers, verify fields populated
|
||||
- CheckCertificate: tls.Dial to specific IP:443 with hostname as SNI;
|
||||
extract subject CN, issuer CN and org, NotAfter, SANs; error on
|
||||
handshake failure
|
||||
|
||||
Notification service (internal/notify/notify.go, Slack/Mattermost/ntfy
|
||||
backends exist):
|
||||
|
||||
- Structured notification types: DNS change, port change, TLS expiry,
|
||||
TLS change, NS failure, NS recovery, NS inconsistency
|
||||
- Per-backend formatting: Slack/Mattermost attachment colors (red
|
||||
failures/expiry, yellow warnings, green recoveries, blue info); ntfy
|
||||
priorities (urgent failures, high warnings, default changes, low
|
||||
recoveries); include hostname, nameserver, old/new values, timestamps
|
||||
|
||||
HTTP API handlers:
|
||||
|
||||
- Wire *state.State and *watcher.Watcher into handler params
|
||||
- GET /api/v1/status: full state snapshot as JSON
|
||||
- GET /api/v1/domains: domain states with NS records and last-checked
|
||||
- GET /api/v1/hostnames: hostname states with per-NS record data
|
||||
|
||||
Infrastructure notes (from untracked TODO.md):
|
||||
|
||||
- Module path sneak.berlin/go/dnswatcher differs from the git.eeqj.de
|
||||
remote intentionally; do not "fix" it
|
||||
- Dependencies: github.com/miekg/dns, golang.org/x/net/publicsuffix
|
||||
- Resolver tests originally used live DNS against *.dns.sneak.cloud
|
||||
(required records documented in the test file header); origin now has
|
||||
mocked hermetic tests, keep them hermetic
|
||||
@@ -25,13 +25,15 @@ import (
|
||||
//
|
||||
//nolint:gochecknoglobals // build-time variables
|
||||
var (
|
||||
Appname = "dnswatcher"
|
||||
Version string
|
||||
Appname = "dnswatcher"
|
||||
Version string
|
||||
Buildarch string
|
||||
)
|
||||
|
||||
func main() {
|
||||
globals.SetAppname(Appname)
|
||||
globals.SetVersion(Version)
|
||||
globals.SetBuildarch(Buildarch)
|
||||
|
||||
fx.New(
|
||||
fx.Provide(
|
||||
|
||||
@@ -17,33 +17,13 @@ func TestClassifyDNSName(t *testing.T) {
|
||||
}{
|
||||
{name: "apex domain simple", input: "example.com", want: config.DNSNameTypeDomain},
|
||||
{name: "hostname simple", input: "www.example.com", want: config.DNSNameTypeHostname},
|
||||
{
|
||||
name: "apex domain multi-part TLD",
|
||||
input: "example.co.uk",
|
||||
want: config.DNSNameTypeDomain,
|
||||
},
|
||||
{
|
||||
name: "hostname multi-part TLD",
|
||||
input: "api.example.co.uk",
|
||||
want: config.DNSNameTypeHostname,
|
||||
},
|
||||
{name: "apex domain multi-part TLD", input: "example.co.uk", want: config.DNSNameTypeDomain},
|
||||
{name: "hostname multi-part TLD", input: "api.example.co.uk", want: config.DNSNameTypeHostname},
|
||||
{name: "public suffix itself", input: "co.uk", wantErr: true},
|
||||
{name: "empty string", input: "", wantErr: true},
|
||||
{
|
||||
name: "deeply nested hostname",
|
||||
input: "a.b.c.example.com",
|
||||
want: config.DNSNameTypeHostname,
|
||||
},
|
||||
{
|
||||
name: "trailing dot stripped",
|
||||
input: "example.com.",
|
||||
want: config.DNSNameTypeDomain,
|
||||
},
|
||||
{
|
||||
name: "uppercase normalized",
|
||||
input: "WWW.Example.COM",
|
||||
want: config.DNSNameTypeHostname,
|
||||
},
|
||||
{name: "deeply nested hostname", input: "a.b.c.example.com", want: config.DNSNameTypeHostname},
|
||||
{name: "trailing dot stripped", input: "example.com.", want: config.DNSNameTypeDomain},
|
||||
{name: "uppercase normalized", input: "WWW.Example.COM", want: config.DNSNameTypeHostname},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
|
||||
@@ -23,11 +23,6 @@ const (
|
||||
defaultTLSExpiryWarning = 7
|
||||
)
|
||||
|
||||
// ErrNoTargets is returned when no monitoring targets are configured.
|
||||
var ErrNoTargets = errors.New(
|
||||
"no monitoring targets configured: set DNSWATCHER_TARGETS environment variable",
|
||||
)
|
||||
|
||||
// Params contains dependencies for Config.
|
||||
type Params struct {
|
||||
fx.In
|
||||
@@ -38,24 +33,23 @@ type Params struct {
|
||||
|
||||
// Config holds application configuration.
|
||||
type Config struct {
|
||||
Port int
|
||||
Debug bool
|
||||
DataDir string
|
||||
Domains []string
|
||||
Hostnames []string
|
||||
SlackWebhook string
|
||||
MattermostWebhook string
|
||||
NtfyTopic string
|
||||
DNSInterval time.Duration
|
||||
TLSInterval time.Duration
|
||||
TLSExpiryWarning int
|
||||
SentryDSN string
|
||||
MaintenanceMode bool
|
||||
MetricsUsername string
|
||||
MetricsPassword string
|
||||
SendTestNotification bool
|
||||
params *Params
|
||||
log *slog.Logger
|
||||
Port int
|
||||
Debug bool
|
||||
DataDir string
|
||||
Domains []string
|
||||
Hostnames []string
|
||||
SlackWebhook string
|
||||
MattermostWebhook string
|
||||
NtfyTopic string
|
||||
DNSInterval time.Duration
|
||||
TLSInterval time.Duration
|
||||
TLSExpiryWarning int
|
||||
SentryDSN string
|
||||
MaintenanceMode bool
|
||||
MetricsUsername string
|
||||
MetricsPassword string
|
||||
params *Params
|
||||
log *slog.Logger
|
||||
}
|
||||
|
||||
// New creates a new Config instance from environment and config files.
|
||||
@@ -94,7 +88,7 @@ func setupViper(name string) {
|
||||
|
||||
viper.SetDefault("PORT", defaultPort)
|
||||
viper.SetDefault("DEBUG", false)
|
||||
viper.SetDefault("DATA_DIR", "/var/lib/"+name)
|
||||
viper.SetDefault("DATA_DIR", "./data")
|
||||
viper.SetDefault("TARGETS", "")
|
||||
viper.SetDefault("SLACK_WEBHOOK", "")
|
||||
viper.SetDefault("MATTERMOST_WEBHOOK", "")
|
||||
@@ -106,7 +100,6 @@ func setupViper(name string) {
|
||||
viper.SetDefault("MAINTENANCE_MODE", false)
|
||||
viper.SetDefault("METRICS_USERNAME", "")
|
||||
viper.SetDefault("METRICS_PASSWORD", "")
|
||||
viper.SetDefault("SEND_TEST_NOTIFICATION", false)
|
||||
}
|
||||
|
||||
func buildConfig(
|
||||
@@ -139,50 +132,34 @@ func buildConfig(
|
||||
tlsInterval = defaultTLSInterval
|
||||
}
|
||||
|
||||
domains, hostnames, err := parseAndValidateTargets()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
cfg := &Config{
|
||||
Port: viper.GetInt("PORT"),
|
||||
Debug: viper.GetBool("DEBUG"),
|
||||
DataDir: viper.GetString("DATA_DIR"),
|
||||
Domains: domains,
|
||||
Hostnames: hostnames,
|
||||
SlackWebhook: viper.GetString("SLACK_WEBHOOK"),
|
||||
MattermostWebhook: viper.GetString("MATTERMOST_WEBHOOK"),
|
||||
NtfyTopic: viper.GetString("NTFY_TOPIC"),
|
||||
DNSInterval: dnsInterval,
|
||||
TLSInterval: tlsInterval,
|
||||
TLSExpiryWarning: viper.GetInt("TLS_EXPIRY_WARNING"),
|
||||
SentryDSN: viper.GetString("SENTRY_DSN"),
|
||||
MaintenanceMode: viper.GetBool("MAINTENANCE_MODE"),
|
||||
MetricsUsername: viper.GetString("METRICS_USERNAME"),
|
||||
MetricsPassword: viper.GetString("METRICS_PASSWORD"),
|
||||
SendTestNotification: viper.GetBool("SEND_TEST_NOTIFICATION"),
|
||||
params: params,
|
||||
log: log,
|
||||
}
|
||||
|
||||
return cfg, nil
|
||||
}
|
||||
|
||||
func parseAndValidateTargets() ([]string, []string, error) {
|
||||
domains, hostnames, err := ClassifyTargets(
|
||||
parseCSV(viper.GetString("TARGETS")),
|
||||
)
|
||||
if err != nil {
|
||||
return nil, nil, fmt.Errorf(
|
||||
"invalid targets configuration: %w", err,
|
||||
)
|
||||
return nil, fmt.Errorf("invalid targets configuration: %w", err)
|
||||
}
|
||||
|
||||
if len(domains) == 0 && len(hostnames) == 0 {
|
||||
return nil, nil, ErrNoTargets
|
||||
cfg := &Config{
|
||||
Port: viper.GetInt("PORT"),
|
||||
Debug: viper.GetBool("DEBUG"),
|
||||
DataDir: viper.GetString("DATA_DIR"),
|
||||
Domains: domains,
|
||||
Hostnames: hostnames,
|
||||
SlackWebhook: viper.GetString("SLACK_WEBHOOK"),
|
||||
MattermostWebhook: viper.GetString("MATTERMOST_WEBHOOK"),
|
||||
NtfyTopic: viper.GetString("NTFY_TOPIC"),
|
||||
DNSInterval: dnsInterval,
|
||||
TLSInterval: tlsInterval,
|
||||
TLSExpiryWarning: viper.GetInt("TLS_EXPIRY_WARNING"),
|
||||
SentryDSN: viper.GetString("SENTRY_DSN"),
|
||||
MaintenanceMode: viper.GetBool("MAINTENANCE_MODE"),
|
||||
MetricsUsername: viper.GetString("METRICS_USERNAME"),
|
||||
MetricsPassword: viper.GetString("METRICS_PASSWORD"),
|
||||
params: params,
|
||||
log: log,
|
||||
}
|
||||
|
||||
return domains, hostnames, nil
|
||||
return cfg, nil
|
||||
}
|
||||
|
||||
func parseCSV(input string) []string {
|
||||
|
||||
@@ -1,262 +0,0 @@
|
||||
package config_test
|
||||
|
||||
import (
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/spf13/viper"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"sneak.berlin/go/dnswatcher/internal/config"
|
||||
"sneak.berlin/go/dnswatcher/internal/globals"
|
||||
"sneak.berlin/go/dnswatcher/internal/logger"
|
||||
)
|
||||
|
||||
// newTestParams creates config.Params suitable for testing
|
||||
// without requiring the fx dependency injection framework.
|
||||
func newTestParams(t *testing.T) config.Params {
|
||||
t.Helper()
|
||||
|
||||
g := &globals.Globals{
|
||||
Appname: "dnswatcher",
|
||||
Version: "test",
|
||||
}
|
||||
|
||||
l, err := logger.New(nil, logger.Params{Globals: g})
|
||||
require.NoError(t, err, "failed to create logger")
|
||||
|
||||
return config.Params{
|
||||
Globals: g,
|
||||
Logger: l,
|
||||
}
|
||||
}
|
||||
|
||||
// These tests exercise viper global state and MUST NOT use
|
||||
// t.Parallel(). Each test resets viper for isolation.
|
||||
|
||||
func TestNew_DefaultValues(t *testing.T) {
|
||||
viper.Reset()
|
||||
t.Setenv("DNSWATCHER_TARGETS", "example.com,www.example.com")
|
||||
|
||||
cfg, err := config.New(nil, newTestParams(t))
|
||||
require.NoError(t, err)
|
||||
|
||||
assert.Equal(t, 8080, cfg.Port)
|
||||
assert.False(t, cfg.Debug)
|
||||
assert.Equal(t, "/var/lib/dnswatcher", cfg.DataDir)
|
||||
assert.Equal(t, time.Hour, cfg.DNSInterval)
|
||||
assert.Equal(t, 12*time.Hour, cfg.TLSInterval)
|
||||
assert.Equal(t, 7, cfg.TLSExpiryWarning)
|
||||
assert.False(t, cfg.MaintenanceMode)
|
||||
assert.Empty(t, cfg.SlackWebhook)
|
||||
assert.Empty(t, cfg.MattermostWebhook)
|
||||
assert.Empty(t, cfg.NtfyTopic)
|
||||
assert.Empty(t, cfg.SentryDSN)
|
||||
assert.Empty(t, cfg.MetricsUsername)
|
||||
assert.Empty(t, cfg.MetricsPassword)
|
||||
assert.False(t, cfg.SendTestNotification)
|
||||
}
|
||||
|
||||
func TestNew_EnvironmentOverrides(t *testing.T) {
|
||||
viper.Reset()
|
||||
t.Setenv("DNSWATCHER_TARGETS", "example.com")
|
||||
t.Setenv("PORT", "9090")
|
||||
t.Setenv("DNSWATCHER_DEBUG", "true")
|
||||
t.Setenv("DNSWATCHER_DATA_DIR", "/tmp/test-data")
|
||||
t.Setenv("DNSWATCHER_DNS_INTERVAL", "30m")
|
||||
t.Setenv("DNSWATCHER_TLS_INTERVAL", "6h")
|
||||
t.Setenv("DNSWATCHER_TLS_EXPIRY_WARNING", "14")
|
||||
t.Setenv("DNSWATCHER_SLACK_WEBHOOK", "https://hooks.slack.com/t")
|
||||
t.Setenv("DNSWATCHER_MATTERMOST_WEBHOOK", "https://mm.test/hooks/t")
|
||||
t.Setenv("DNSWATCHER_NTFY_TOPIC", "https://ntfy.sh/test")
|
||||
t.Setenv("DNSWATCHER_SENTRY_DSN", "https://sentry.test/1")
|
||||
t.Setenv("DNSWATCHER_MAINTENANCE_MODE", "true")
|
||||
t.Setenv("DNSWATCHER_METRICS_USERNAME", "admin")
|
||||
t.Setenv("DNSWATCHER_METRICS_PASSWORD", "secret")
|
||||
t.Setenv("DNSWATCHER_SEND_TEST_NOTIFICATION", "true")
|
||||
|
||||
cfg, err := config.New(nil, newTestParams(t))
|
||||
require.NoError(t, err)
|
||||
|
||||
assert.Equal(t, 9090, cfg.Port)
|
||||
assert.True(t, cfg.Debug)
|
||||
assert.Equal(t, "/tmp/test-data", cfg.DataDir)
|
||||
assert.Equal(t, 30*time.Minute, cfg.DNSInterval)
|
||||
assert.Equal(t, 6*time.Hour, cfg.TLSInterval)
|
||||
assert.Equal(t, 14, cfg.TLSExpiryWarning)
|
||||
assert.Equal(t, "https://hooks.slack.com/t", cfg.SlackWebhook)
|
||||
assert.Equal(t, "https://mm.test/hooks/t", cfg.MattermostWebhook)
|
||||
assert.Equal(t, "https://ntfy.sh/test", cfg.NtfyTopic)
|
||||
assert.Equal(t, "https://sentry.test/1", cfg.SentryDSN)
|
||||
assert.True(t, cfg.MaintenanceMode)
|
||||
assert.Equal(t, "admin", cfg.MetricsUsername)
|
||||
assert.Equal(t, "secret", cfg.MetricsPassword)
|
||||
assert.True(t, cfg.SendTestNotification)
|
||||
}
|
||||
|
||||
func TestNew_NoTargetsError(t *testing.T) {
|
||||
viper.Reset()
|
||||
t.Setenv("DNSWATCHER_TARGETS", "")
|
||||
|
||||
_, err := config.New(nil, newTestParams(t))
|
||||
require.Error(t, err)
|
||||
assert.ErrorIs(t, err, config.ErrNoTargets)
|
||||
}
|
||||
|
||||
func TestNew_OnlyEmptyCSVSegments(t *testing.T) {
|
||||
viper.Reset()
|
||||
t.Setenv("DNSWATCHER_TARGETS", " , , ")
|
||||
|
||||
_, err := config.New(nil, newTestParams(t))
|
||||
require.Error(t, err)
|
||||
assert.ErrorIs(t, err, config.ErrNoTargets)
|
||||
}
|
||||
|
||||
func TestNew_InvalidDNSInterval_FallsBackToDefault(t *testing.T) {
|
||||
viper.Reset()
|
||||
t.Setenv("DNSWATCHER_TARGETS", "example.com")
|
||||
t.Setenv("DNSWATCHER_DNS_INTERVAL", "banana")
|
||||
|
||||
cfg, err := config.New(nil, newTestParams(t))
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, time.Hour, cfg.DNSInterval,
|
||||
"invalid DNS interval should fall back to 1h default")
|
||||
}
|
||||
|
||||
func TestNew_InvalidTLSInterval_FallsBackToDefault(t *testing.T) {
|
||||
viper.Reset()
|
||||
t.Setenv("DNSWATCHER_TARGETS", "example.com")
|
||||
t.Setenv("DNSWATCHER_TLS_INTERVAL", "notaduration")
|
||||
|
||||
cfg, err := config.New(nil, newTestParams(t))
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, 12*time.Hour, cfg.TLSInterval,
|
||||
"invalid TLS interval should fall back to 12h default")
|
||||
}
|
||||
|
||||
func TestNew_BothIntervalsInvalid(t *testing.T) {
|
||||
viper.Reset()
|
||||
t.Setenv("DNSWATCHER_TARGETS", "example.com")
|
||||
t.Setenv("DNSWATCHER_DNS_INTERVAL", "xyz")
|
||||
t.Setenv("DNSWATCHER_TLS_INTERVAL", "abc")
|
||||
|
||||
cfg, err := config.New(nil, newTestParams(t))
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, time.Hour, cfg.DNSInterval)
|
||||
assert.Equal(t, 12*time.Hour, cfg.TLSInterval)
|
||||
}
|
||||
|
||||
func TestNew_DebugEnablesDebugLogging(t *testing.T) {
|
||||
viper.Reset()
|
||||
t.Setenv("DNSWATCHER_TARGETS", "example.com")
|
||||
t.Setenv("DNSWATCHER_DEBUG", "true")
|
||||
|
||||
cfg, err := config.New(nil, newTestParams(t))
|
||||
require.NoError(t, err)
|
||||
assert.True(t, cfg.Debug)
|
||||
}
|
||||
|
||||
func TestNew_PortEnvNotPrefixed(t *testing.T) {
|
||||
viper.Reset()
|
||||
t.Setenv("DNSWATCHER_TARGETS", "example.com")
|
||||
t.Setenv("PORT", "3000")
|
||||
|
||||
cfg, err := config.New(nil, newTestParams(t))
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, 3000, cfg.Port,
|
||||
"PORT env should work without DNSWATCHER_ prefix")
|
||||
}
|
||||
|
||||
func TestNew_TargetClassification(t *testing.T) {
|
||||
viper.Reset()
|
||||
t.Setenv("DNSWATCHER_TARGETS",
|
||||
"example.com,www.example.com,api.example.com,example.org")
|
||||
|
||||
cfg, err := config.New(nil, newTestParams(t))
|
||||
require.NoError(t, err)
|
||||
|
||||
// example.com and example.org are apex domains
|
||||
assert.Len(t, cfg.Domains, 2)
|
||||
// www.example.com and api.example.com are hostnames
|
||||
assert.Len(t, cfg.Hostnames, 2)
|
||||
}
|
||||
|
||||
func TestNew_InvalidTargetPublicSuffix(t *testing.T) {
|
||||
viper.Reset()
|
||||
t.Setenv("DNSWATCHER_TARGETS", "co.uk")
|
||||
|
||||
_, err := config.New(nil, newTestParams(t))
|
||||
require.Error(t, err, "public suffix should be rejected")
|
||||
}
|
||||
|
||||
func TestNew_EmptyAppnameDefaultsToDnswatcher(t *testing.T) {
|
||||
viper.Reset()
|
||||
t.Setenv("DNSWATCHER_TARGETS", "example.com")
|
||||
|
||||
g := &globals.Globals{Appname: "", Version: "test"}
|
||||
|
||||
l, err := logger.New(nil, logger.Params{Globals: g})
|
||||
require.NoError(t, err)
|
||||
|
||||
cfg, err := config.New(
|
||||
nil, config.Params{Globals: g, Logger: l},
|
||||
)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, 8080, cfg.Port,
|
||||
"defaults should load when appname is empty")
|
||||
}
|
||||
|
||||
func TestNew_TargetsWithWhitespace(t *testing.T) {
|
||||
viper.Reset()
|
||||
t.Setenv("DNSWATCHER_TARGETS", " example.com , www.example.com ")
|
||||
|
||||
cfg, err := config.New(nil, newTestParams(t))
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, 2, len(cfg.Domains)+len(cfg.Hostnames),
|
||||
"whitespace around targets should be trimmed")
|
||||
}
|
||||
|
||||
func TestNew_TargetsWithTrailingComma(t *testing.T) {
|
||||
viper.Reset()
|
||||
t.Setenv("DNSWATCHER_TARGETS", "example.com,www.example.com,")
|
||||
|
||||
cfg, err := config.New(nil, newTestParams(t))
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, 2, len(cfg.Domains)+len(cfg.Hostnames),
|
||||
"trailing comma should be ignored")
|
||||
}
|
||||
|
||||
func TestNew_CustomDNSIntervalDuration(t *testing.T) {
|
||||
viper.Reset()
|
||||
t.Setenv("DNSWATCHER_TARGETS", "example.com")
|
||||
t.Setenv("DNSWATCHER_DNS_INTERVAL", "5s")
|
||||
|
||||
cfg, err := config.New(nil, newTestParams(t))
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, 5*time.Second, cfg.DNSInterval)
|
||||
}
|
||||
|
||||
func TestStatePath(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
dataDir string
|
||||
want string
|
||||
}{
|
||||
{"default", "/var/lib/dnswatcher", "/var/lib/dnswatcher/state.json"},
|
||||
{"absolute", "/var/lib/dw", "/var/lib/dw/state.json"},
|
||||
{"nested", "/opt/app/data", "/opt/app/data/state.json"},
|
||||
{"empty", "", "/state.json"},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
cfg := &config.Config{DataDir: tt.dataDir}
|
||||
assert.Equal(t, tt.want, cfg.StatePath())
|
||||
})
|
||||
}
|
||||
}
|
||||
@@ -1,6 +0,0 @@
|
||||
package config
|
||||
|
||||
// ParseCSVForTest exports parseCSV for use in external tests.
|
||||
func ParseCSVForTest(input string) []string {
|
||||
return parseCSV(input)
|
||||
}
|
||||
@@ -1,44 +0,0 @@
|
||||
package config_test
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"sneak.berlin/go/dnswatcher/internal/config"
|
||||
)
|
||||
|
||||
func TestParseCSV(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
input string
|
||||
want []string
|
||||
}{
|
||||
{"empty string", "", nil},
|
||||
{"single value", "a", []string{"a"}},
|
||||
{"multiple values", "a,b,c", []string{"a", "b", "c"}},
|
||||
{"whitespace trimmed", " a , b ", []string{"a", "b"}},
|
||||
{"trailing comma", "a,b,", []string{"a", "b"}},
|
||||
{"leading comma", ",a,b", []string{"a", "b"}},
|
||||
{"consecutive commas", "a,,b", []string{"a", "b"}},
|
||||
{"all empty segments", ",,,", nil},
|
||||
{"whitespace only", " , , ", nil},
|
||||
{"tabs", "\ta\t,\tb\t", []string{"a", "b"}},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
got := config.ParseCSVForTest(tt.input)
|
||||
require.Len(t, got, len(tt.want))
|
||||
|
||||
for i, w := range tt.want {
|
||||
assert.Equal(t, w, got[i])
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
@@ -12,15 +12,17 @@ import (
|
||||
//
|
||||
//nolint:gochecknoglobals // Required for ldflags injection at build time
|
||||
var (
|
||||
mu sync.RWMutex
|
||||
appname string
|
||||
version string
|
||||
mu sync.RWMutex
|
||||
appname string
|
||||
version string
|
||||
buildarch string
|
||||
)
|
||||
|
||||
// Globals holds build-time variables for dependency injection.
|
||||
type Globals struct {
|
||||
Appname string
|
||||
Version string
|
||||
Appname string
|
||||
Version string
|
||||
Buildarch string
|
||||
}
|
||||
|
||||
// New creates a new Globals instance from package-level variables.
|
||||
@@ -29,8 +31,9 @@ func New(_ fx.Lifecycle) (*Globals, error) {
|
||||
defer mu.RUnlock()
|
||||
|
||||
return &Globals{
|
||||
Appname: appname,
|
||||
Version: version,
|
||||
Appname: appname,
|
||||
Version: version,
|
||||
Buildarch: buildarch,
|
||||
}, nil
|
||||
}
|
||||
|
||||
@@ -49,3 +52,11 @@ func SetVersion(ver string) {
|
||||
|
||||
version = ver
|
||||
}
|
||||
|
||||
// SetBuildarch sets the build architecture.
|
||||
func SetBuildarch(arch string) {
|
||||
mu.Lock()
|
||||
defer mu.Unlock()
|
||||
|
||||
buildarch = arch
|
||||
}
|
||||
|
||||
@@ -1,151 +0,0 @@
|
||||
package handlers
|
||||
|
||||
import (
|
||||
"embed"
|
||||
"fmt"
|
||||
"html/template"
|
||||
"math"
|
||||
"net/http"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"sneak.berlin/go/dnswatcher/internal/notify"
|
||||
"sneak.berlin/go/dnswatcher/internal/state"
|
||||
)
|
||||
|
||||
//go:embed templates/dashboard.html
|
||||
var dashboardFS embed.FS
|
||||
|
||||
// Time unit constants for relative time calculations.
|
||||
const (
|
||||
secondsPerMinute = 60
|
||||
minutesPerHour = 60
|
||||
hoursPerDay = 24
|
||||
)
|
||||
|
||||
// newDashboardTemplate parses the embedded dashboard HTML
|
||||
// template with helper functions.
|
||||
func newDashboardTemplate() *template.Template {
|
||||
funcs := template.FuncMap{
|
||||
"relTime": relTime,
|
||||
"joinStrings": joinStrings,
|
||||
"formatRecords": formatRecords,
|
||||
"expiryDays": expiryDays,
|
||||
}
|
||||
|
||||
return template.Must(
|
||||
template.New("dashboard.html").
|
||||
Funcs(funcs).
|
||||
ParseFS(dashboardFS, "templates/dashboard.html"),
|
||||
)
|
||||
}
|
||||
|
||||
// dashboardData is the data passed to the dashboard template.
|
||||
type dashboardData struct {
|
||||
Snapshot state.Snapshot
|
||||
Alerts []notify.AlertEntry
|
||||
StateAge string
|
||||
GeneratedAt string
|
||||
}
|
||||
|
||||
// HandleDashboard returns the dashboard page handler.
|
||||
func (h *Handlers) HandleDashboard() http.HandlerFunc {
|
||||
tmpl := newDashboardTemplate()
|
||||
|
||||
return func(
|
||||
writer http.ResponseWriter,
|
||||
_ *http.Request,
|
||||
) {
|
||||
snap := h.state.GetSnapshot()
|
||||
alerts := h.notifyHistory.Recent()
|
||||
|
||||
data := dashboardData{
|
||||
Snapshot: snap,
|
||||
Alerts: alerts,
|
||||
StateAge: relTime(snap.LastUpdated),
|
||||
GeneratedAt: time.Now().UTC().Format("2006-01-02 15:04:05"),
|
||||
}
|
||||
|
||||
writer.Header().Set(
|
||||
"Content-Type", "text/html; charset=utf-8",
|
||||
)
|
||||
|
||||
err := tmpl.Execute(writer, data)
|
||||
if err != nil {
|
||||
h.log.Error(
|
||||
"dashboard template error",
|
||||
"error", err,
|
||||
)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// relTime returns a human-readable relative time string such
|
||||
// as "2 minutes ago" or "never" for zero times.
|
||||
func relTime(t time.Time) string {
|
||||
if t.IsZero() {
|
||||
return "never"
|
||||
}
|
||||
|
||||
d := time.Since(t)
|
||||
if d < 0 {
|
||||
return "just now"
|
||||
}
|
||||
|
||||
seconds := int(math.Round(d.Seconds()))
|
||||
if seconds < secondsPerMinute {
|
||||
return fmt.Sprintf("%ds ago", seconds)
|
||||
}
|
||||
|
||||
minutes := seconds / secondsPerMinute
|
||||
if minutes < minutesPerHour {
|
||||
return fmt.Sprintf("%dm ago", minutes)
|
||||
}
|
||||
|
||||
hours := minutes / minutesPerHour
|
||||
if hours < hoursPerDay {
|
||||
return fmt.Sprintf(
|
||||
"%dh %dm ago", hours, minutes%minutesPerHour,
|
||||
)
|
||||
}
|
||||
|
||||
days := hours / hoursPerDay
|
||||
|
||||
return fmt.Sprintf(
|
||||
"%dd %dh ago", days, hours%hoursPerDay,
|
||||
)
|
||||
}
|
||||
|
||||
// joinStrings joins a string slice with a separator.
|
||||
func joinStrings(items []string, sep string) string {
|
||||
return strings.Join(items, sep)
|
||||
}
|
||||
|
||||
// formatRecords formats a map of record type → values into a
|
||||
// compact display string.
|
||||
func formatRecords(records map[string][]string) string {
|
||||
if len(records) == 0 {
|
||||
return "-"
|
||||
}
|
||||
|
||||
var parts []string
|
||||
|
||||
for rtype, values := range records {
|
||||
for _, v := range values {
|
||||
parts = append(parts, rtype+": "+v)
|
||||
}
|
||||
}
|
||||
|
||||
return strings.Join(parts, ", ")
|
||||
}
|
||||
|
||||
// expiryDays returns the number of days until the given time,
|
||||
// rounded down. Returns 0 if already expired.
|
||||
func expiryDays(t time.Time) int {
|
||||
d := time.Until(t).Hours() / hoursPerDay
|
||||
if d < 0 {
|
||||
return 0
|
||||
}
|
||||
|
||||
return int(d)
|
||||
}
|
||||
@@ -1,80 +0,0 @@
|
||||
package handlers_test
|
||||
|
||||
import (
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"sneak.berlin/go/dnswatcher/internal/handlers"
|
||||
)
|
||||
|
||||
func TestRelTime(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
dur time.Duration
|
||||
want string
|
||||
}{
|
||||
{"zero", 0, "never"},
|
||||
{"seconds", 30 * time.Second, "30s ago"},
|
||||
{"minutes", 5 * time.Minute, "5m ago"},
|
||||
{"hours", 2*time.Hour + 15*time.Minute, "2h 15m ago"},
|
||||
{"days", 48*time.Hour + 3*time.Hour, "2d 3h ago"},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
var input time.Time
|
||||
if tt.dur > 0 {
|
||||
input = time.Now().Add(-tt.dur)
|
||||
}
|
||||
|
||||
got := handlers.RelTime(input)
|
||||
if got != tt.want {
|
||||
t.Errorf(
|
||||
"RelTime(%v) = %q, want %q",
|
||||
tt.dur, got, tt.want,
|
||||
)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestExpiryDays(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
// 10 days from now.
|
||||
future := time.Now().Add(10 * 24 * time.Hour)
|
||||
|
||||
days := handlers.ExpiryDays(future)
|
||||
if days < 9 || days > 10 {
|
||||
t.Errorf("expected ~10 days, got %d", days)
|
||||
}
|
||||
|
||||
// Already expired.
|
||||
past := time.Now().Add(-24 * time.Hour)
|
||||
|
||||
days = handlers.ExpiryDays(past)
|
||||
if days != 0 {
|
||||
t.Errorf("expected 0 for expired, got %d", days)
|
||||
}
|
||||
}
|
||||
|
||||
func TestFormatRecords(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
got := handlers.FormatRecords(nil)
|
||||
if got != "-" {
|
||||
t.Errorf("expected -, got %q", got)
|
||||
}
|
||||
|
||||
got = handlers.FormatRecords(map[string][]string{
|
||||
"A": {"1.2.3.4"},
|
||||
})
|
||||
|
||||
if got != "A: 1.2.3.4" {
|
||||
t.Errorf("unexpected format: %q", got)
|
||||
}
|
||||
}
|
||||
60
internal/handlers/domains.go
Normal file
60
internal/handlers/domains.go
Normal file
@@ -0,0 +1,60 @@
|
||||
package handlers
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"time"
|
||||
)
|
||||
|
||||
// domainResponse represents a single domain in the API response.
|
||||
type domainResponse struct {
|
||||
Domain string `json:"domain"`
|
||||
Nameservers []string `json:"nameservers,omitempty"`
|
||||
LastChecked string `json:"lastChecked,omitempty"`
|
||||
Status string `json:"status"`
|
||||
}
|
||||
|
||||
// domainsResponse is the top-level response for GET /api/v1/domains.
|
||||
type domainsResponse struct {
|
||||
Domains []domainResponse `json:"domains"`
|
||||
}
|
||||
|
||||
// HandleDomains returns the configured domains and their status.
|
||||
func (h *Handlers) HandleDomains() http.HandlerFunc {
|
||||
return func(
|
||||
writer http.ResponseWriter,
|
||||
request *http.Request,
|
||||
) {
|
||||
configured := h.config.Domains
|
||||
snapshot := h.state.GetSnapshot()
|
||||
|
||||
domains := make(
|
||||
[]domainResponse, 0, len(configured),
|
||||
)
|
||||
|
||||
for _, domain := range configured {
|
||||
dr := domainResponse{
|
||||
Domain: domain,
|
||||
Status: "pending",
|
||||
}
|
||||
|
||||
ds, ok := snapshot.Domains[domain]
|
||||
if ok {
|
||||
dr.Nameservers = ds.Nameservers
|
||||
dr.Status = "ok"
|
||||
|
||||
if !ds.LastChecked.IsZero() {
|
||||
dr.LastChecked = ds.LastChecked.
|
||||
Format(time.RFC3339)
|
||||
}
|
||||
}
|
||||
|
||||
domains = append(domains, dr)
|
||||
}
|
||||
|
||||
h.respondJSON(
|
||||
writer, request,
|
||||
&domainsResponse{Domains: domains},
|
||||
http.StatusOK,
|
||||
)
|
||||
}
|
||||
}
|
||||
@@ -1,18 +0,0 @@
|
||||
package handlers
|
||||
|
||||
import "time"
|
||||
|
||||
// RelTime exports relTime for testing.
|
||||
func RelTime(t time.Time) string {
|
||||
return relTime(t)
|
||||
}
|
||||
|
||||
// ExpiryDays exports expiryDays for testing.
|
||||
func ExpiryDays(t time.Time) int {
|
||||
return expiryDays(t)
|
||||
}
|
||||
|
||||
// FormatRecords exports formatRecords for testing.
|
||||
func FormatRecords(records map[string][]string) string {
|
||||
return formatRecords(records)
|
||||
}
|
||||
@@ -8,10 +8,10 @@ import (
|
||||
|
||||
"go.uber.org/fx"
|
||||
|
||||
"sneak.berlin/go/dnswatcher/internal/config"
|
||||
"sneak.berlin/go/dnswatcher/internal/globals"
|
||||
"sneak.berlin/go/dnswatcher/internal/healthcheck"
|
||||
"sneak.berlin/go/dnswatcher/internal/logger"
|
||||
"sneak.berlin/go/dnswatcher/internal/notify"
|
||||
"sneak.berlin/go/dnswatcher/internal/state"
|
||||
)
|
||||
|
||||
@@ -23,28 +23,28 @@ type Params struct {
|
||||
Globals *globals.Globals
|
||||
Healthcheck *healthcheck.Healthcheck
|
||||
State *state.State
|
||||
Notify *notify.Service
|
||||
Config *config.Config
|
||||
}
|
||||
|
||||
// Handlers provides HTTP request handlers.
|
||||
type Handlers struct {
|
||||
log *slog.Logger
|
||||
params *Params
|
||||
globals *globals.Globals
|
||||
hc *healthcheck.Healthcheck
|
||||
state *state.State
|
||||
notifyHistory *notify.AlertHistory
|
||||
log *slog.Logger
|
||||
params *Params
|
||||
globals *globals.Globals
|
||||
hc *healthcheck.Healthcheck
|
||||
state *state.State
|
||||
config *config.Config
|
||||
}
|
||||
|
||||
// New creates a new Handlers instance.
|
||||
func New(_ fx.Lifecycle, params Params) (*Handlers, error) {
|
||||
return &Handlers{
|
||||
log: params.Logger.Get(),
|
||||
params: ¶ms,
|
||||
globals: params.Globals,
|
||||
hc: params.Healthcheck,
|
||||
state: params.State,
|
||||
notifyHistory: params.Notify.History(),
|
||||
log: params.Logger.Get(),
|
||||
params: ¶ms,
|
||||
globals: params.Globals,
|
||||
hc: params.Healthcheck,
|
||||
state: params.State,
|
||||
config: params.Config,
|
||||
}, nil
|
||||
}
|
||||
|
||||
@@ -52,7 +52,7 @@ func (h *Handlers) respondJSON(
|
||||
writer http.ResponseWriter,
|
||||
_ *http.Request,
|
||||
data any,
|
||||
status int,
|
||||
status int, //nolint:unparam // general-purpose utility; status varies in future use
|
||||
) {
|
||||
writer.Header().Set("Content-Type", "application/json")
|
||||
writer.WriteHeader(status)
|
||||
|
||||
120
internal/handlers/hostnames.go
Normal file
120
internal/handlers/hostnames.go
Normal file
@@ -0,0 +1,120 @@
|
||||
package handlers
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"sort"
|
||||
"time"
|
||||
|
||||
"sneak.berlin/go/dnswatcher/internal/state"
|
||||
)
|
||||
|
||||
// nameserverRecordResponse represents one nameserver's records
|
||||
// in the API response.
|
||||
type nameserverRecordResponse struct {
|
||||
Nameserver string `json:"nameserver"`
|
||||
Records map[string][]string `json:"records"`
|
||||
Status string `json:"status"`
|
||||
Error string `json:"error,omitempty"`
|
||||
LastChecked string `json:"lastChecked,omitempty"`
|
||||
}
|
||||
|
||||
// hostnameResponse represents a single hostname in the API response.
|
||||
type hostnameResponse struct {
|
||||
Hostname string `json:"hostname"`
|
||||
Nameservers []nameserverRecordResponse `json:"nameservers,omitempty"`
|
||||
LastChecked string `json:"lastChecked,omitempty"`
|
||||
Status string `json:"status"`
|
||||
}
|
||||
|
||||
// hostnamesResponse is the top-level response for
|
||||
// GET /api/v1/hostnames.
|
||||
type hostnamesResponse struct {
|
||||
Hostnames []hostnameResponse `json:"hostnames"`
|
||||
}
|
||||
|
||||
// HandleHostnames returns the configured hostnames and their status.
|
||||
func (h *Handlers) HandleHostnames() http.HandlerFunc {
|
||||
return func(
|
||||
writer http.ResponseWriter,
|
||||
request *http.Request,
|
||||
) {
|
||||
configured := h.config.Hostnames
|
||||
snapshot := h.state.GetSnapshot()
|
||||
|
||||
hostnames := make(
|
||||
[]hostnameResponse, 0, len(configured),
|
||||
)
|
||||
|
||||
for _, hostname := range configured {
|
||||
hr := hostnameResponse{
|
||||
Hostname: hostname,
|
||||
Status: "pending",
|
||||
}
|
||||
|
||||
hs, ok := snapshot.Hostnames[hostname]
|
||||
if ok {
|
||||
hr.Status = "ok"
|
||||
|
||||
if !hs.LastChecked.IsZero() {
|
||||
hr.LastChecked = hs.LastChecked.
|
||||
Format(time.RFC3339)
|
||||
}
|
||||
|
||||
hr.Nameservers = buildNameserverRecords(
|
||||
hs,
|
||||
)
|
||||
}
|
||||
|
||||
hostnames = append(hostnames, hr)
|
||||
}
|
||||
|
||||
h.respondJSON(
|
||||
writer, request,
|
||||
&hostnamesResponse{Hostnames: hostnames},
|
||||
http.StatusOK,
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
// buildNameserverRecords converts the per-nameserver state map
|
||||
// into a sorted slice for deterministic JSON output.
|
||||
func buildNameserverRecords(
|
||||
hs *state.HostnameState,
|
||||
) []nameserverRecordResponse {
|
||||
if hs.RecordsByNameserver == nil {
|
||||
return nil
|
||||
}
|
||||
|
||||
nsNames := make(
|
||||
[]string, 0, len(hs.RecordsByNameserver),
|
||||
)
|
||||
for ns := range hs.RecordsByNameserver {
|
||||
nsNames = append(nsNames, ns)
|
||||
}
|
||||
|
||||
sort.Strings(nsNames)
|
||||
|
||||
records := make(
|
||||
[]nameserverRecordResponse, 0, len(nsNames),
|
||||
)
|
||||
|
||||
for _, ns := range nsNames {
|
||||
nsr := hs.RecordsByNameserver[ns]
|
||||
|
||||
entry := nameserverRecordResponse{
|
||||
Nameserver: ns,
|
||||
Records: nsr.Records,
|
||||
Status: nsr.Status,
|
||||
Error: nsr.Error,
|
||||
}
|
||||
|
||||
if !nsr.LastChecked.IsZero() {
|
||||
entry.LastChecked = nsr.LastChecked.
|
||||
Format(time.RFC3339)
|
||||
}
|
||||
|
||||
records = append(records, entry)
|
||||
}
|
||||
|
||||
return records
|
||||
}
|
||||
@@ -2,217 +2,22 @@ package handlers
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"sort"
|
||||
"time"
|
||||
|
||||
"sneak.berlin/go/dnswatcher/internal/state"
|
||||
)
|
||||
|
||||
// statusDomainInfo holds status information for a monitored domain.
|
||||
type statusDomainInfo struct {
|
||||
Nameservers []string `json:"nameservers"`
|
||||
LastChecked time.Time `json:"lastChecked"`
|
||||
}
|
||||
|
||||
// statusHostnameNSInfo holds per-nameserver status for a hostname.
|
||||
type statusHostnameNSInfo struct {
|
||||
Records map[string][]string `json:"records"`
|
||||
Status string `json:"status"`
|
||||
LastChecked time.Time `json:"lastChecked"`
|
||||
}
|
||||
|
||||
// statusHostnameInfo holds status information for a monitored hostname.
|
||||
type statusHostnameInfo struct {
|
||||
Nameservers map[string]*statusHostnameNSInfo `json:"nameservers"`
|
||||
LastChecked time.Time `json:"lastChecked"`
|
||||
}
|
||||
|
||||
// statusPortInfo holds status information for a monitored port.
|
||||
type statusPortInfo struct {
|
||||
Open bool `json:"open"`
|
||||
Hostnames []string `json:"hostnames"`
|
||||
LastChecked time.Time `json:"lastChecked"`
|
||||
}
|
||||
|
||||
// statusCertificateInfo holds status information for a TLS certificate.
|
||||
type statusCertificateInfo struct {
|
||||
CommonName string `json:"commonName"`
|
||||
Issuer string `json:"issuer"`
|
||||
NotAfter time.Time `json:"notAfter"`
|
||||
SubjectAlternativeNames []string `json:"subjectAlternativeNames"`
|
||||
Status string `json:"status"`
|
||||
LastChecked time.Time `json:"lastChecked"`
|
||||
}
|
||||
|
||||
// statusCounts holds summary counts of monitored resources.
|
||||
type statusCounts struct {
|
||||
Domains int `json:"domains"`
|
||||
Hostnames int `json:"hostnames"`
|
||||
Ports int `json:"ports"`
|
||||
PortsOpen int `json:"portsOpen"`
|
||||
Certificates int `json:"certificates"`
|
||||
CertsOK int `json:"certificatesOk"`
|
||||
CertsError int `json:"certificatesError"`
|
||||
}
|
||||
|
||||
// statusResponse is the full /api/v1/status response.
|
||||
type statusResponse struct {
|
||||
Status string `json:"status"`
|
||||
LastUpdated time.Time `json:"lastUpdated"`
|
||||
Counts statusCounts `json:"counts"`
|
||||
Domains map[string]*statusDomainInfo `json:"domains"`
|
||||
Hostnames map[string]*statusHostnameInfo `json:"hostnames"`
|
||||
Ports map[string]*statusPortInfo `json:"ports"`
|
||||
Certificates map[string]*statusCertificateInfo `json:"certificates"`
|
||||
}
|
||||
|
||||
// HandleStatus returns the monitoring status handler.
|
||||
func (h *Handlers) HandleStatus() http.HandlerFunc {
|
||||
type response struct {
|
||||
Status string `json:"status"`
|
||||
}
|
||||
|
||||
return func(
|
||||
writer http.ResponseWriter,
|
||||
request *http.Request,
|
||||
) {
|
||||
snap := h.state.GetSnapshot()
|
||||
|
||||
resp := buildStatusResponse(snap)
|
||||
|
||||
h.respondJSON(
|
||||
writer, request,
|
||||
resp,
|
||||
&response{Status: "ok"},
|
||||
http.StatusOK,
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
// buildStatusResponse constructs the full status response from
|
||||
// the current monitoring snapshot.
|
||||
func buildStatusResponse(
|
||||
snap state.Snapshot,
|
||||
) *statusResponse {
|
||||
resp := &statusResponse{
|
||||
Status: "ok",
|
||||
LastUpdated: snap.LastUpdated,
|
||||
Domains: make(map[string]*statusDomainInfo),
|
||||
Hostnames: make(map[string]*statusHostnameInfo),
|
||||
Ports: make(map[string]*statusPortInfo),
|
||||
Certificates: make(map[string]*statusCertificateInfo),
|
||||
}
|
||||
|
||||
buildDomains(snap, resp)
|
||||
buildHostnames(snap, resp)
|
||||
buildPorts(snap, resp)
|
||||
buildCertificates(snap, resp)
|
||||
buildCounts(resp)
|
||||
|
||||
return resp
|
||||
}
|
||||
|
||||
func buildDomains(
|
||||
snap state.Snapshot,
|
||||
resp *statusResponse,
|
||||
) {
|
||||
for name, ds := range snap.Domains {
|
||||
ns := make([]string, len(ds.Nameservers))
|
||||
copy(ns, ds.Nameservers)
|
||||
sort.Strings(ns)
|
||||
|
||||
resp.Domains[name] = &statusDomainInfo{
|
||||
Nameservers: ns,
|
||||
LastChecked: ds.LastChecked,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func buildHostnames(
|
||||
snap state.Snapshot,
|
||||
resp *statusResponse,
|
||||
) {
|
||||
for name, hs := range snap.Hostnames {
|
||||
info := &statusHostnameInfo{
|
||||
Nameservers: make(map[string]*statusHostnameNSInfo),
|
||||
LastChecked: hs.LastChecked,
|
||||
}
|
||||
|
||||
for ns, nsState := range hs.RecordsByNameserver {
|
||||
recs := make(map[string][]string, len(nsState.Records))
|
||||
for rtype, vals := range nsState.Records {
|
||||
copied := make([]string, len(vals))
|
||||
copy(copied, vals)
|
||||
recs[rtype] = copied
|
||||
}
|
||||
|
||||
info.Nameservers[ns] = &statusHostnameNSInfo{
|
||||
Records: recs,
|
||||
Status: nsState.Status,
|
||||
LastChecked: nsState.LastChecked,
|
||||
}
|
||||
}
|
||||
|
||||
resp.Hostnames[name] = info
|
||||
}
|
||||
}
|
||||
|
||||
func buildPorts(
|
||||
snap state.Snapshot,
|
||||
resp *statusResponse,
|
||||
) {
|
||||
for key, ps := range snap.Ports {
|
||||
hostnames := make([]string, len(ps.Hostnames))
|
||||
copy(hostnames, ps.Hostnames)
|
||||
sort.Strings(hostnames)
|
||||
|
||||
resp.Ports[key] = &statusPortInfo{
|
||||
Open: ps.Open,
|
||||
Hostnames: hostnames,
|
||||
LastChecked: ps.LastChecked,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func buildCertificates(
|
||||
snap state.Snapshot,
|
||||
resp *statusResponse,
|
||||
) {
|
||||
for key, cs := range snap.Certificates {
|
||||
sans := make([]string, len(cs.SubjectAlternativeNames))
|
||||
copy(sans, cs.SubjectAlternativeNames)
|
||||
|
||||
resp.Certificates[key] = &statusCertificateInfo{
|
||||
CommonName: cs.CommonName,
|
||||
Issuer: cs.Issuer,
|
||||
NotAfter: cs.NotAfter,
|
||||
SubjectAlternativeNames: sans,
|
||||
Status: cs.Status,
|
||||
LastChecked: cs.LastChecked,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func buildCounts(resp *statusResponse) {
|
||||
var portsOpen, certsOK, certsError int
|
||||
|
||||
for _, ps := range resp.Ports {
|
||||
if ps.Open {
|
||||
portsOpen++
|
||||
}
|
||||
}
|
||||
|
||||
for _, cs := range resp.Certificates {
|
||||
switch cs.Status {
|
||||
case "ok":
|
||||
certsOK++
|
||||
case "error":
|
||||
certsError++
|
||||
}
|
||||
}
|
||||
|
||||
resp.Counts = statusCounts{
|
||||
Domains: len(resp.Domains),
|
||||
Hostnames: len(resp.Hostnames),
|
||||
Ports: len(resp.Ports),
|
||||
PortsOpen: portsOpen,
|
||||
Certificates: len(resp.Certificates),
|
||||
CertsOK: certsOK,
|
||||
CertsError: certsError,
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,370 +0,0 @@
|
||||
<!doctype html>
|
||||
<html lang="en" class="bg-slate-950">
|
||||
<head>
|
||||
<meta charset="utf-8" />
|
||||
<meta http-equiv="refresh" content="30" />
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
||||
<title>dnswatcher</title>
|
||||
<link rel="stylesheet" href="/s/css/tailwind.min.css" />
|
||||
</head>
|
||||
<body
|
||||
class="bg-surface-950 text-slate-300 font-mono text-sm min-h-screen antialiased"
|
||||
>
|
||||
<div class="max-w-6xl mx-auto px-4 py-8">
|
||||
{{/* ---- Header ---- */}}
|
||||
<div class="mb-8">
|
||||
<h1 class="text-2xl font-bold text-teal-400 tracking-tight">
|
||||
dnswatcher
|
||||
</h1>
|
||||
<p class="text-xs text-slate-500 mt-1">
|
||||
state updated {{ .StateAge }} · page generated
|
||||
{{ .GeneratedAt }} UTC · auto-refresh 30s
|
||||
</p>
|
||||
</div>
|
||||
|
||||
{{/* ---- Summary bar ---- */}}
|
||||
<div
|
||||
class="grid grid-cols-2 sm:grid-cols-4 gap-3 mb-8"
|
||||
>
|
||||
<div class="bg-surface-800 border border-slate-700/50 rounded-lg p-4">
|
||||
<div class="text-xs text-slate-500 uppercase tracking-wider">
|
||||
Domains
|
||||
</div>
|
||||
<div class="text-2xl font-bold text-teal-400 mt-1">
|
||||
{{ len .Snapshot.Domains }}
|
||||
</div>
|
||||
</div>
|
||||
<div class="bg-surface-800 border border-slate-700/50 rounded-lg p-4">
|
||||
<div class="text-xs text-slate-500 uppercase tracking-wider">
|
||||
Hostnames
|
||||
</div>
|
||||
<div class="text-2xl font-bold text-teal-400 mt-1">
|
||||
{{ len .Snapshot.Hostnames }}
|
||||
</div>
|
||||
</div>
|
||||
<div class="bg-surface-800 border border-slate-700/50 rounded-lg p-4">
|
||||
<div class="text-xs text-slate-500 uppercase tracking-wider">
|
||||
Ports
|
||||
</div>
|
||||
<div class="text-2xl font-bold text-teal-400 mt-1">
|
||||
{{ len .Snapshot.Ports }}
|
||||
</div>
|
||||
</div>
|
||||
<div class="bg-surface-800 border border-slate-700/50 rounded-lg p-4">
|
||||
<div class="text-xs text-slate-500 uppercase tracking-wider">
|
||||
Certificates
|
||||
</div>
|
||||
<div class="text-2xl font-bold text-teal-400 mt-1">
|
||||
{{ len .Snapshot.Certificates }}
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{{/* ---- Domains ---- */}}
|
||||
<section class="mb-8">
|
||||
<h2
|
||||
class="text-sm font-semibold text-teal-300 uppercase tracking-wider mb-3 border-b border-slate-700/50 pb-2"
|
||||
>
|
||||
Domains
|
||||
</h2>
|
||||
{{ if .Snapshot.Domains }}
|
||||
<div class="overflow-x-auto">
|
||||
<table class="w-full text-left text-xs">
|
||||
<thead>
|
||||
<tr class="text-slate-500 uppercase tracking-wider">
|
||||
<th class="py-2 px-3">Domain</th>
|
||||
<th class="py-2 px-3">Nameservers</th>
|
||||
<th class="py-2 px-3">Checked</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody class="divide-y divide-slate-800">
|
||||
{{ range $name, $ds := .Snapshot.Domains }}
|
||||
<tr class="hover:bg-surface-800/50">
|
||||
<td class="py-2 px-3 text-slate-200 font-medium">
|
||||
{{ $name }}
|
||||
</td>
|
||||
<td class="py-2 px-3 text-slate-400 break-all">
|
||||
{{ joinStrings $ds.Nameservers ", " }}
|
||||
</td>
|
||||
<td class="py-2 px-3 text-slate-500 whitespace-nowrap">
|
||||
{{ relTime $ds.LastChecked }}
|
||||
</td>
|
||||
</tr>
|
||||
{{ end }}
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
{{ else }}
|
||||
<p class="text-slate-600 italic text-xs">
|
||||
No domains configured.
|
||||
</p>
|
||||
{{ end }}
|
||||
</section>
|
||||
|
||||
{{/* ---- Hostnames ---- */}}
|
||||
<section class="mb-8">
|
||||
<h2
|
||||
class="text-sm font-semibold text-teal-300 uppercase tracking-wider mb-3 border-b border-slate-700/50 pb-2"
|
||||
>
|
||||
Hostnames
|
||||
</h2>
|
||||
{{ if .Snapshot.Hostnames }}
|
||||
<div class="overflow-x-auto">
|
||||
<table class="w-full text-left text-xs">
|
||||
<thead>
|
||||
<tr class="text-slate-500 uppercase tracking-wider">
|
||||
<th class="py-2 px-3">Hostname</th>
|
||||
<th class="py-2 px-3">NS</th>
|
||||
<th class="py-2 px-3">Status</th>
|
||||
<th class="py-2 px-3">Records</th>
|
||||
<th class="py-2 px-3">Checked</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody class="divide-y divide-slate-800">
|
||||
{{ range $name, $hs := .Snapshot.Hostnames }}
|
||||
{{ range $ns, $nsr := $hs.RecordsByNameserver }}
|
||||
<tr class="hover:bg-surface-800/50">
|
||||
<td class="py-2 px-3 text-slate-200 font-medium">
|
||||
{{ $name }}
|
||||
</td>
|
||||
<td class="py-2 px-3 text-slate-400 break-all">
|
||||
{{ $ns }}
|
||||
</td>
|
||||
<td class="py-2 px-3">
|
||||
{{ if eq $nsr.Status "ok" }}
|
||||
<span
|
||||
class="inline-block px-1.5 py-0.5 rounded text-[10px] font-bold uppercase bg-teal-900/50 text-teal-400 border border-teal-700/30"
|
||||
>ok</span
|
||||
>
|
||||
{{ else }}
|
||||
<span
|
||||
class="inline-block px-1.5 py-0.5 rounded text-[10px] font-bold uppercase bg-red-900/50 text-red-400 border border-red-700/30"
|
||||
>{{ $nsr.Status }}</span
|
||||
>
|
||||
{{ end }}
|
||||
</td>
|
||||
<td
|
||||
class="py-2 px-3 text-slate-400 break-all max-w-xs"
|
||||
>
|
||||
{{ formatRecords $nsr.Records }}
|
||||
</td>
|
||||
<td class="py-2 px-3 text-slate-500 whitespace-nowrap">
|
||||
{{ relTime $nsr.LastChecked }}
|
||||
</td>
|
||||
</tr>
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
{{ else }}
|
||||
<p class="text-slate-600 italic text-xs">
|
||||
No hostnames configured.
|
||||
</p>
|
||||
{{ end }}
|
||||
</section>
|
||||
|
||||
{{/* ---- Ports ---- */}}
|
||||
<section class="mb-8">
|
||||
<h2
|
||||
class="text-sm font-semibold text-teal-300 uppercase tracking-wider mb-3 border-b border-slate-700/50 pb-2"
|
||||
>
|
||||
Ports
|
||||
</h2>
|
||||
{{ if .Snapshot.Ports }}
|
||||
<div class="overflow-x-auto">
|
||||
<table class="w-full text-left text-xs">
|
||||
<thead>
|
||||
<tr class="text-slate-500 uppercase tracking-wider">
|
||||
<th class="py-2 px-3">Address</th>
|
||||
<th class="py-2 px-3">State</th>
|
||||
<th class="py-2 px-3">Hostnames</th>
|
||||
<th class="py-2 px-3">Checked</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody class="divide-y divide-slate-800">
|
||||
{{ range $key, $ps := .Snapshot.Ports }}
|
||||
<tr class="hover:bg-surface-800/50">
|
||||
<td class="py-2 px-3 text-slate-200 font-medium">
|
||||
{{ $key }}
|
||||
</td>
|
||||
<td class="py-2 px-3">
|
||||
{{ if $ps.Open }}
|
||||
<span
|
||||
class="inline-block px-1.5 py-0.5 rounded text-[10px] font-bold uppercase bg-teal-900/50 text-teal-400 border border-teal-700/30"
|
||||
>open</span
|
||||
>
|
||||
{{ else }}
|
||||
<span
|
||||
class="inline-block px-1.5 py-0.5 rounded text-[10px] font-bold uppercase bg-red-900/50 text-red-400 border border-red-700/30"
|
||||
>closed</span
|
||||
>
|
||||
{{ end }}
|
||||
</td>
|
||||
<td class="py-2 px-3 text-slate-400 break-all">
|
||||
{{ joinStrings $ps.Hostnames ", " }}
|
||||
</td>
|
||||
<td class="py-2 px-3 text-slate-500 whitespace-nowrap">
|
||||
{{ relTime $ps.LastChecked }}
|
||||
</td>
|
||||
</tr>
|
||||
{{ end }}
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
{{ else }}
|
||||
<p class="text-slate-600 italic text-xs">
|
||||
No port data yet.
|
||||
</p>
|
||||
{{ end }}
|
||||
</section>
|
||||
|
||||
{{/* ---- Certificates ---- */}}
|
||||
<section class="mb-8">
|
||||
<h2
|
||||
class="text-sm font-semibold text-teal-300 uppercase tracking-wider mb-3 border-b border-slate-700/50 pb-2"
|
||||
>
|
||||
Certificates
|
||||
</h2>
|
||||
{{ if .Snapshot.Certificates }}
|
||||
<div class="overflow-x-auto">
|
||||
<table class="w-full text-left text-xs">
|
||||
<thead>
|
||||
<tr class="text-slate-500 uppercase tracking-wider">
|
||||
<th class="py-2 px-3">Endpoint</th>
|
||||
<th class="py-2 px-3">Status</th>
|
||||
<th class="py-2 px-3">CN</th>
|
||||
<th class="py-2 px-3">Issuer</th>
|
||||
<th class="py-2 px-3">Expires</th>
|
||||
<th class="py-2 px-3">Checked</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody class="divide-y divide-slate-800">
|
||||
{{ range $key, $cs := .Snapshot.Certificates }}
|
||||
<tr class="hover:bg-surface-800/50">
|
||||
<td class="py-2 px-3 text-slate-400 break-all">
|
||||
{{ $key }}
|
||||
</td>
|
||||
<td class="py-2 px-3">
|
||||
{{ if eq $cs.Status "ok" }}
|
||||
<span
|
||||
class="inline-block px-1.5 py-0.5 rounded text-[10px] font-bold uppercase bg-teal-900/50 text-teal-400 border border-teal-700/30"
|
||||
>ok</span
|
||||
>
|
||||
{{ else }}
|
||||
<span
|
||||
class="inline-block px-1.5 py-0.5 rounded text-[10px] font-bold uppercase bg-red-900/50 text-red-400 border border-red-700/30"
|
||||
>{{ $cs.Status }}</span
|
||||
>
|
||||
{{ end }}
|
||||
</td>
|
||||
<td class="py-2 px-3 text-slate-200">
|
||||
{{ $cs.CommonName }}
|
||||
</td>
|
||||
<td class="py-2 px-3 text-slate-400 break-all">
|
||||
{{ $cs.Issuer }}
|
||||
</td>
|
||||
<td class="py-2 px-3 whitespace-nowrap">
|
||||
{{ if not $cs.NotAfter.IsZero }}
|
||||
{{ $days := expiryDays $cs.NotAfter }}
|
||||
{{ if lt $days 7 }}
|
||||
<span class="text-red-400 font-medium"
|
||||
>{{ $cs.NotAfter.Format "2006-01-02" }}
|
||||
({{ $days }}d)</span
|
||||
>
|
||||
{{ else if lt $days 30 }}
|
||||
<span class="text-amber-400"
|
||||
>{{ $cs.NotAfter.Format "2006-01-02" }}
|
||||
({{ $days }}d)</span
|
||||
>
|
||||
{{ else }}
|
||||
<span class="text-slate-400"
|
||||
>{{ $cs.NotAfter.Format "2006-01-02" }}
|
||||
({{ $days }}d)</span
|
||||
>
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
</td>
|
||||
<td class="py-2 px-3 text-slate-500 whitespace-nowrap">
|
||||
{{ relTime $cs.LastChecked }}
|
||||
</td>
|
||||
</tr>
|
||||
{{ end }}
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
{{ else }}
|
||||
<p class="text-slate-600 italic text-xs">
|
||||
No certificate data yet.
|
||||
</p>
|
||||
{{ end }}
|
||||
</section>
|
||||
|
||||
{{/* ---- Recent Alerts ---- */}}
|
||||
<section class="mb-8">
|
||||
<h2
|
||||
class="text-sm font-semibold text-teal-300 uppercase tracking-wider mb-3 border-b border-slate-700/50 pb-2"
|
||||
>
|
||||
Recent Alerts ({{ len .Alerts }})
|
||||
</h2>
|
||||
{{ if .Alerts }}
|
||||
<div class="space-y-2">
|
||||
{{ range .Alerts }}
|
||||
<div
|
||||
class="bg-surface-800 border rounded-lg px-4 py-3 {{ if eq .Priority "error" }}border-red-700/40{{ else if eq .Priority "warning" }}border-amber-700/40{{ else if eq .Priority "success" }}border-teal-700/40{{ else }}border-blue-700/40{{ end }}"
|
||||
>
|
||||
<div class="flex items-center gap-3 mb-1">
|
||||
{{ if eq .Priority "error" }}
|
||||
<span
|
||||
class="inline-block px-1.5 py-0.5 rounded text-[10px] font-bold uppercase bg-red-900/50 text-red-400 border border-red-700/30"
|
||||
>error</span
|
||||
>
|
||||
{{ else if eq .Priority "warning" }}
|
||||
<span
|
||||
class="inline-block px-1.5 py-0.5 rounded text-[10px] font-bold uppercase bg-amber-900/50 text-amber-400 border border-amber-700/30"
|
||||
>warning</span
|
||||
>
|
||||
{{ else if eq .Priority "success" }}
|
||||
<span
|
||||
class="inline-block px-1.5 py-0.5 rounded text-[10px] font-bold uppercase bg-teal-900/50 text-teal-400 border border-teal-700/30"
|
||||
>success</span
|
||||
>
|
||||
{{ else }}
|
||||
<span
|
||||
class="inline-block px-1.5 py-0.5 rounded text-[10px] font-bold uppercase bg-blue-900/50 text-blue-400 border border-blue-700/30"
|
||||
>info</span
|
||||
>
|
||||
{{ end }}
|
||||
<span class="text-slate-200 text-xs font-medium">
|
||||
{{ .Title }}
|
||||
</span>
|
||||
<span class="text-slate-600 text-[11px] ml-auto whitespace-nowrap">
|
||||
{{ .Timestamp.Format "2006-01-02 15:04:05" }} UTC
|
||||
({{ relTime .Timestamp }})
|
||||
</span>
|
||||
</div>
|
||||
<p
|
||||
class="text-slate-400 text-xs whitespace-pre-line pl-0.5"
|
||||
>
|
||||
{{ .Message }}
|
||||
</p>
|
||||
</div>
|
||||
{{ end }}
|
||||
</div>
|
||||
{{ else }}
|
||||
<p class="text-slate-600 italic text-xs">
|
||||
No alerts recorded since last restart.
|
||||
</p>
|
||||
{{ end }}
|
||||
</section>
|
||||
|
||||
{{/* ---- Footer ---- */}}
|
||||
<div
|
||||
class="text-[11px] text-slate-700 border-t border-slate-800 pt-4 mt-8"
|
||||
>
|
||||
dnswatcher · monitoring {{ len .Snapshot.Domains }} domains +
|
||||
{{ len .Snapshot.Hostnames }} hostnames
|
||||
</div>
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
@@ -78,5 +78,6 @@ func (l *Logger) Identify() {
|
||||
l.log.Info("starting",
|
||||
"appname", l.params.Globals.Appname,
|
||||
"version", l.params.Globals.Version,
|
||||
"buildarch", l.params.Globals.Buildarch,
|
||||
)
|
||||
}
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,105 +0,0 @@
|
||||
package notify
|
||||
|
||||
import (
|
||||
"context"
|
||||
"io"
|
||||
"log/slog"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"time"
|
||||
)
|
||||
|
||||
// NtfyPriority exports ntfyPriority for testing.
|
||||
func NtfyPriority(priority string) string {
|
||||
return ntfyPriority(priority)
|
||||
}
|
||||
|
||||
// SlackColor exports slackColor for testing.
|
||||
func SlackColor(priority string) string {
|
||||
return slackColor(priority)
|
||||
}
|
||||
|
||||
// NewRequestForTest exports newRequest for testing.
|
||||
func NewRequestForTest(
|
||||
ctx context.Context,
|
||||
method string,
|
||||
target *url.URL,
|
||||
body io.Reader,
|
||||
) *http.Request {
|
||||
return newRequest(ctx, method, target, body)
|
||||
}
|
||||
|
||||
// NewTestService creates a Service suitable for unit testing.
|
||||
// It discards log output and uses the given transport.
|
||||
func NewTestService(transport http.RoundTripper) *Service {
|
||||
return &Service{
|
||||
log: slog.New(slog.DiscardHandler),
|
||||
transport: transport,
|
||||
history: NewAlertHistory(),
|
||||
}
|
||||
}
|
||||
|
||||
// SetNtfyURL sets the ntfy URL on a Service for testing.
|
||||
func (svc *Service) SetNtfyURL(u *url.URL) {
|
||||
svc.ntfyURL = u
|
||||
}
|
||||
|
||||
// SetSlackWebhookURL sets the Slack webhook URL on a
|
||||
// Service for testing.
|
||||
func (svc *Service) SetSlackWebhookURL(u *url.URL) {
|
||||
svc.slackWebhookURL = u
|
||||
}
|
||||
|
||||
// SetMattermostWebhookURL sets the Mattermost webhook URL on
|
||||
// a Service for testing.
|
||||
func (svc *Service) SetMattermostWebhookURL(u *url.URL) {
|
||||
svc.mattermostWebhookURL = u
|
||||
}
|
||||
|
||||
// SendNtfy exports sendNtfy for testing.
|
||||
func (svc *Service) SendNtfy(
|
||||
ctx context.Context,
|
||||
topicURL *url.URL,
|
||||
title, message, priority string,
|
||||
) error {
|
||||
return svc.sendNtfy(ctx, topicURL, title, message, priority)
|
||||
}
|
||||
|
||||
// SendSlack exports sendSlack for testing.
|
||||
func (svc *Service) SendSlack(
|
||||
ctx context.Context,
|
||||
webhookURL *url.URL,
|
||||
title, message, priority string,
|
||||
) error {
|
||||
return svc.sendSlack(
|
||||
ctx, webhookURL, title, message, priority,
|
||||
)
|
||||
}
|
||||
|
||||
// SetRetryConfig overrides the retry configuration for
|
||||
// testing.
|
||||
func (svc *Service) SetRetryConfig(cfg RetryConfig) {
|
||||
svc.retryConfig = cfg
|
||||
}
|
||||
|
||||
// SetSleepFunc overrides the sleep function so tests can
|
||||
// eliminate real delays.
|
||||
func (svc *Service) SetSleepFunc(
|
||||
fn func(time.Duration) <-chan time.Time,
|
||||
) {
|
||||
svc.sleepFn = fn
|
||||
}
|
||||
|
||||
// DeliverWithRetry exports deliverWithRetry for testing.
|
||||
func (svc *Service) DeliverWithRetry(
|
||||
ctx context.Context,
|
||||
endpoint string,
|
||||
fn func(context.Context) error,
|
||||
) error {
|
||||
return svc.deliverWithRetry(ctx, endpoint, fn)
|
||||
}
|
||||
|
||||
// BackoffDuration exports RetryConfig.backoff for testing.
|
||||
func (rc RetryConfig) BackoffDuration(attempt int) time.Duration {
|
||||
return rc.defaults().backoff(attempt)
|
||||
}
|
||||
@@ -1,62 +0,0 @@
|
||||
package notify
|
||||
|
||||
import (
|
||||
"sync"
|
||||
"time"
|
||||
)
|
||||
|
||||
// maxAlertHistory is the maximum number of alerts to retain.
|
||||
const maxAlertHistory = 100
|
||||
|
||||
// AlertEntry represents a single notification that was sent.
|
||||
type AlertEntry struct {
|
||||
Timestamp time.Time
|
||||
Title string
|
||||
Message string
|
||||
Priority string
|
||||
}
|
||||
|
||||
// AlertHistory is a thread-safe ring buffer that stores
|
||||
// the most recent alerts.
|
||||
type AlertHistory struct {
|
||||
mu sync.RWMutex
|
||||
entries [maxAlertHistory]AlertEntry
|
||||
count int
|
||||
index int
|
||||
}
|
||||
|
||||
// NewAlertHistory creates a new empty AlertHistory.
|
||||
func NewAlertHistory() *AlertHistory {
|
||||
return &AlertHistory{}
|
||||
}
|
||||
|
||||
// Add records a new alert entry in the ring buffer.
|
||||
func (h *AlertHistory) Add(entry AlertEntry) {
|
||||
h.mu.Lock()
|
||||
defer h.mu.Unlock()
|
||||
|
||||
h.entries[h.index] = entry
|
||||
h.index = (h.index + 1) % maxAlertHistory
|
||||
|
||||
if h.count < maxAlertHistory {
|
||||
h.count++
|
||||
}
|
||||
}
|
||||
|
||||
// Recent returns the stored alerts in reverse chronological
|
||||
// order (newest first). Returns at most maxAlertHistory entries.
|
||||
func (h *AlertHistory) Recent() []AlertEntry {
|
||||
h.mu.RLock()
|
||||
defer h.mu.RUnlock()
|
||||
|
||||
result := make([]AlertEntry, h.count)
|
||||
|
||||
for i := range h.count {
|
||||
// Walk backwards from the most recent entry.
|
||||
idx := (h.index - 1 - i + maxAlertHistory) %
|
||||
maxAlertHistory
|
||||
result[i] = h.entries[idx]
|
||||
}
|
||||
|
||||
return result
|
||||
}
|
||||
@@ -1,88 +0,0 @@
|
||||
package notify_test
|
||||
|
||||
import (
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"sneak.berlin/go/dnswatcher/internal/notify"
|
||||
)
|
||||
|
||||
func TestAlertHistoryEmpty(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
h := notify.NewAlertHistory()
|
||||
|
||||
entries := h.Recent()
|
||||
if len(entries) != 0 {
|
||||
t.Fatalf("expected 0 entries, got %d", len(entries))
|
||||
}
|
||||
}
|
||||
|
||||
func TestAlertHistoryAddAndRecent(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
h := notify.NewAlertHistory()
|
||||
|
||||
now := time.Now().UTC()
|
||||
|
||||
h.Add(notify.AlertEntry{
|
||||
Timestamp: now.Add(-2 * time.Minute),
|
||||
Title: "first",
|
||||
Message: "msg1",
|
||||
Priority: prioInfo,
|
||||
})
|
||||
|
||||
h.Add(notify.AlertEntry{
|
||||
Timestamp: now.Add(-1 * time.Minute),
|
||||
Title: "second",
|
||||
Message: "msg2",
|
||||
Priority: prioWarning,
|
||||
})
|
||||
|
||||
entries := h.Recent()
|
||||
if len(entries) != 2 {
|
||||
t.Fatalf("expected 2 entries, got %d", len(entries))
|
||||
}
|
||||
|
||||
// Newest first.
|
||||
if entries[0].Title != "second" {
|
||||
t.Errorf(
|
||||
"expected newest first, got %q", entries[0].Title,
|
||||
)
|
||||
}
|
||||
|
||||
if entries[1].Title != "first" {
|
||||
t.Errorf(
|
||||
"expected oldest second, got %q", entries[1].Title,
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
func TestAlertHistoryOverflow(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
h := notify.NewAlertHistory()
|
||||
|
||||
const totalEntries = 110
|
||||
|
||||
// Fill beyond capacity.
|
||||
for i := range totalEntries {
|
||||
h.Add(notify.AlertEntry{
|
||||
Timestamp: time.Now().UTC(),
|
||||
Title: "alert",
|
||||
Message: "msg",
|
||||
Priority: string(rune('0' + i%10)),
|
||||
})
|
||||
}
|
||||
|
||||
entries := h.Recent()
|
||||
|
||||
const maxHistory = 100
|
||||
|
||||
if len(entries) != maxHistory {
|
||||
t.Fatalf(
|
||||
"expected %d entries, got %d",
|
||||
maxHistory, len(entries),
|
||||
)
|
||||
}
|
||||
}
|
||||
@@ -112,9 +112,6 @@ type Service struct {
|
||||
ntfyURL *url.URL
|
||||
slackWebhookURL *url.URL
|
||||
mattermostWebhookURL *url.URL
|
||||
history *AlertHistory
|
||||
retryConfig RetryConfig
|
||||
sleepFn func(time.Duration) <-chan time.Time
|
||||
}
|
||||
|
||||
// New creates a new notify Service.
|
||||
@@ -126,7 +123,6 @@ func New(
|
||||
log: params.Logger.Get(),
|
||||
transport: http.DefaultTransport,
|
||||
config: params.Config,
|
||||
history: NewAlertHistory(),
|
||||
}
|
||||
|
||||
if params.Config.NtfyTopic != "" {
|
||||
@@ -171,117 +167,65 @@ func New(
|
||||
return svc, nil
|
||||
}
|
||||
|
||||
// History returns the alert history for reading recent alerts.
|
||||
func (svc *Service) History() *AlertHistory {
|
||||
return svc.history
|
||||
}
|
||||
|
||||
// SendNotification sends a notification to all configured
|
||||
// endpoints and records it in the alert history.
|
||||
// endpoints.
|
||||
func (svc *Service) SendNotification(
|
||||
ctx context.Context,
|
||||
title, message, priority string,
|
||||
) {
|
||||
svc.history.Add(AlertEntry{
|
||||
Timestamp: time.Now().UTC(),
|
||||
Title: title,
|
||||
Message: message,
|
||||
Priority: priority,
|
||||
})
|
||||
if svc.ntfyURL != nil {
|
||||
go func() {
|
||||
notifyCtx := context.WithoutCancel(ctx)
|
||||
|
||||
svc.dispatchNtfy(ctx, title, message, priority)
|
||||
svc.dispatchSlack(ctx, title, message, priority)
|
||||
svc.dispatchMattermost(ctx, title, message, priority)
|
||||
}
|
||||
|
||||
func (svc *Service) dispatchNtfy(
|
||||
ctx context.Context,
|
||||
title, message, priority string,
|
||||
) {
|
||||
if svc.ntfyURL == nil {
|
||||
return
|
||||
err := svc.sendNtfy(
|
||||
notifyCtx,
|
||||
svc.ntfyURL,
|
||||
title, message, priority,
|
||||
)
|
||||
if err != nil {
|
||||
svc.log.Error(
|
||||
"failed to send ntfy notification",
|
||||
"error", err,
|
||||
)
|
||||
}
|
||||
}()
|
||||
}
|
||||
|
||||
go func() {
|
||||
notifyCtx := context.WithoutCancel(ctx)
|
||||
if svc.slackWebhookURL != nil {
|
||||
go func() {
|
||||
notifyCtx := context.WithoutCancel(ctx)
|
||||
|
||||
err := svc.deliverWithRetry(
|
||||
notifyCtx, "ntfy",
|
||||
func(c context.Context) error {
|
||||
return svc.sendNtfy(
|
||||
c, svc.ntfyURL,
|
||||
title, message, priority,
|
||||
)
|
||||
},
|
||||
)
|
||||
if err != nil {
|
||||
svc.log.Error(
|
||||
"failed to send ntfy notification "+
|
||||
"after retries",
|
||||
"error", err,
|
||||
err := svc.sendSlack(
|
||||
notifyCtx,
|
||||
svc.slackWebhookURL,
|
||||
title, message, priority,
|
||||
)
|
||||
}
|
||||
}()
|
||||
}
|
||||
|
||||
func (svc *Service) dispatchSlack(
|
||||
ctx context.Context,
|
||||
title, message, priority string,
|
||||
) {
|
||||
if svc.slackWebhookURL == nil {
|
||||
return
|
||||
if err != nil {
|
||||
svc.log.Error(
|
||||
"failed to send slack notification",
|
||||
"error", err,
|
||||
)
|
||||
}
|
||||
}()
|
||||
}
|
||||
|
||||
go func() {
|
||||
notifyCtx := context.WithoutCancel(ctx)
|
||||
if svc.mattermostWebhookURL != nil {
|
||||
go func() {
|
||||
notifyCtx := context.WithoutCancel(ctx)
|
||||
|
||||
err := svc.deliverWithRetry(
|
||||
notifyCtx, "slack",
|
||||
func(c context.Context) error {
|
||||
return svc.sendSlack(
|
||||
c, svc.slackWebhookURL,
|
||||
title, message, priority,
|
||||
)
|
||||
},
|
||||
)
|
||||
if err != nil {
|
||||
svc.log.Error(
|
||||
"failed to send slack notification "+
|
||||
"after retries",
|
||||
"error", err,
|
||||
err := svc.sendSlack(
|
||||
notifyCtx,
|
||||
svc.mattermostWebhookURL,
|
||||
title, message, priority,
|
||||
)
|
||||
}
|
||||
}()
|
||||
}
|
||||
|
||||
func (svc *Service) dispatchMattermost(
|
||||
ctx context.Context,
|
||||
title, message, priority string,
|
||||
) {
|
||||
if svc.mattermostWebhookURL == nil {
|
||||
return
|
||||
if err != nil {
|
||||
svc.log.Error(
|
||||
"failed to send mattermost notification",
|
||||
"error", err,
|
||||
)
|
||||
}
|
||||
}()
|
||||
}
|
||||
|
||||
go func() {
|
||||
notifyCtx := context.WithoutCancel(ctx)
|
||||
|
||||
err := svc.deliverWithRetry(
|
||||
notifyCtx, "mattermost",
|
||||
func(c context.Context) error {
|
||||
return svc.sendSlack(
|
||||
c, svc.mattermostWebhookURL,
|
||||
title, message, priority,
|
||||
)
|
||||
},
|
||||
)
|
||||
if err != nil {
|
||||
svc.log.Error(
|
||||
"failed to send mattermost notification "+
|
||||
"after retries",
|
||||
"error", err,
|
||||
)
|
||||
}
|
||||
}()
|
||||
}
|
||||
|
||||
func (svc *Service) sendNtfy(
|
||||
|
||||
@@ -1,139 +0,0 @@
|
||||
package notify
|
||||
|
||||
import (
|
||||
"context"
|
||||
"math"
|
||||
"math/rand/v2"
|
||||
"time"
|
||||
)
|
||||
|
||||
// Retry defaults.
|
||||
const (
|
||||
// DefaultMaxRetries is the number of additional attempts
|
||||
// after the first failure.
|
||||
DefaultMaxRetries = 5
|
||||
|
||||
// DefaultBaseDelay is the initial delay before the first
|
||||
// retry attempt.
|
||||
DefaultBaseDelay = 1 * time.Second
|
||||
|
||||
// DefaultMaxDelay caps the computed backoff delay.
|
||||
DefaultMaxDelay = 60 * time.Second
|
||||
|
||||
// backoffMultiplier is the exponential growth factor.
|
||||
backoffMultiplier = 2
|
||||
|
||||
// jitterFraction controls the ±random spread applied
|
||||
// to each delay (0.25 = ±25%).
|
||||
jitterFraction = 0.25
|
||||
)
|
||||
|
||||
// RetryConfig holds tuning knobs for the retry loop.
|
||||
// Zero values fall back to the package defaults above.
|
||||
type RetryConfig struct {
|
||||
MaxRetries int
|
||||
BaseDelay time.Duration
|
||||
MaxDelay time.Duration
|
||||
}
|
||||
|
||||
// defaults returns a copy with zero fields replaced by
|
||||
// package defaults.
|
||||
func (rc RetryConfig) defaults() RetryConfig {
|
||||
if rc.MaxRetries <= 0 {
|
||||
rc.MaxRetries = DefaultMaxRetries
|
||||
}
|
||||
|
||||
if rc.BaseDelay <= 0 {
|
||||
rc.BaseDelay = DefaultBaseDelay
|
||||
}
|
||||
|
||||
if rc.MaxDelay <= 0 {
|
||||
rc.MaxDelay = DefaultMaxDelay
|
||||
}
|
||||
|
||||
return rc
|
||||
}
|
||||
|
||||
// backoff computes the delay for attempt n (0-indexed) with
|
||||
// jitter. The raw delay is BaseDelay * 2^n, capped at
|
||||
// MaxDelay, then randomised by ±jitterFraction.
|
||||
func (rc RetryConfig) backoff(attempt int) time.Duration {
|
||||
raw := float64(rc.BaseDelay) *
|
||||
math.Pow(backoffMultiplier, float64(attempt))
|
||||
|
||||
if raw > float64(rc.MaxDelay) {
|
||||
raw = float64(rc.MaxDelay)
|
||||
}
|
||||
|
||||
// Apply jitter: uniform in [raw*(1-j), raw*(1+j)].
|
||||
lo := raw * (1 - jitterFraction)
|
||||
hi := raw * (1 + jitterFraction)
|
||||
|
||||
jittered := lo + rand.Float64()*(hi-lo) //nolint:gosec // jitter needs no crypto/rand
|
||||
|
||||
return time.Duration(jittered)
|
||||
}
|
||||
|
||||
// deliverWithRetry calls fn, retrying on error with
|
||||
// exponential backoff. It logs every failed attempt and
|
||||
// returns the last error if all attempts are exhausted.
|
||||
func (svc *Service) deliverWithRetry(
|
||||
ctx context.Context,
|
||||
endpoint string,
|
||||
fn func(context.Context) error,
|
||||
) error {
|
||||
cfg := svc.retryConfig.defaults()
|
||||
|
||||
var lastErr error
|
||||
|
||||
// attempt 0 is the initial call; attempts 1..MaxRetries
|
||||
// are retries.
|
||||
for attempt := range cfg.MaxRetries + 1 {
|
||||
lastErr = fn(ctx)
|
||||
if lastErr == nil {
|
||||
if attempt > 0 {
|
||||
svc.log.Info(
|
||||
"notification delivered after retry",
|
||||
"endpoint", endpoint,
|
||||
"attempt", attempt+1,
|
||||
)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// Last attempt — don't sleep, just return.
|
||||
if attempt == cfg.MaxRetries {
|
||||
break
|
||||
}
|
||||
|
||||
delay := cfg.backoff(attempt)
|
||||
|
||||
svc.log.Warn(
|
||||
"notification delivery failed, retrying",
|
||||
"endpoint", endpoint,
|
||||
"attempt", attempt+1,
|
||||
"maxAttempts", cfg.MaxRetries+1,
|
||||
"retryIn", delay,
|
||||
"error", lastErr,
|
||||
)
|
||||
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
return ctx.Err()
|
||||
case <-svc.sleepFunc(delay):
|
||||
}
|
||||
}
|
||||
|
||||
return lastErr
|
||||
}
|
||||
|
||||
// sleepFunc returns a channel that closes after d.
|
||||
// It is a field-level indirection so tests can override it.
|
||||
func (svc *Service) sleepFunc(d time.Duration) <-chan time.Time {
|
||||
if svc.sleepFn != nil {
|
||||
return svc.sleepFn(d)
|
||||
}
|
||||
|
||||
return time.After(d)
|
||||
}
|
||||
@@ -1,493 +0,0 @@
|
||||
package notify_test
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"net/url"
|
||||
"sync"
|
||||
"sync/atomic"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"sneak.berlin/go/dnswatcher/internal/notify"
|
||||
)
|
||||
|
||||
// Static test errors (err113).
|
||||
var (
|
||||
errTransient = errors.New("transient failure")
|
||||
errPermanent = errors.New("permanent failure")
|
||||
errFail = errors.New("fail")
|
||||
)
|
||||
|
||||
// instantSleep returns a closed channel immediately, removing
|
||||
// real delays from tests.
|
||||
func instantSleep(_ time.Duration) <-chan time.Time {
|
||||
ch := make(chan time.Time, 1)
|
||||
ch <- time.Now()
|
||||
|
||||
return ch
|
||||
}
|
||||
|
||||
// ── backoff calculation ───────────────────────────────────
|
||||
|
||||
func TestBackoffDurationIncreases(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
cfg := notify.RetryConfig{
|
||||
MaxRetries: 5,
|
||||
BaseDelay: 1 * time.Second,
|
||||
MaxDelay: 30 * time.Second,
|
||||
}
|
||||
|
||||
prev := time.Duration(0)
|
||||
|
||||
// With jitter the exact value varies, but the trend
|
||||
// should be increasing for the first few attempts.
|
||||
for attempt := range 4 {
|
||||
d := cfg.BackoffDuration(attempt)
|
||||
if d <= 0 {
|
||||
t.Fatalf(
|
||||
"attempt %d: backoff must be positive, got %v",
|
||||
attempt, d,
|
||||
)
|
||||
}
|
||||
|
||||
// Allow jitter to occasionally flatten a step, but
|
||||
// the midpoint (no-jitter) should be strictly higher.
|
||||
midpoint := cfg.BaseDelay * (1 << attempt)
|
||||
if attempt > 0 && midpoint <= prev {
|
||||
t.Fatalf(
|
||||
"midpoint should grow: attempt %d midpoint=%v prev=%v",
|
||||
attempt, midpoint, prev,
|
||||
)
|
||||
}
|
||||
|
||||
prev = midpoint
|
||||
}
|
||||
}
|
||||
|
||||
func TestBackoffDurationCappedAtMax(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
cfg := notify.RetryConfig{
|
||||
MaxRetries: 5,
|
||||
BaseDelay: 1 * time.Second,
|
||||
MaxDelay: 5 * time.Second,
|
||||
}
|
||||
|
||||
// Attempt 10 would be 1024s without capping.
|
||||
d := cfg.BackoffDuration(10)
|
||||
|
||||
// With ±25% jitter on a 5s cap: max is 6.25s.
|
||||
const maxWithJitter = 5*time.Second +
|
||||
5*time.Second/4 +
|
||||
time.Millisecond // rounding margin
|
||||
|
||||
if d > maxWithJitter {
|
||||
t.Errorf(
|
||||
"backoff %v exceeds max+jitter %v",
|
||||
d, maxWithJitter,
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
// ── deliverWithRetry ──────────────────────────────────────
|
||||
|
||||
func TestDeliverWithRetrySucceedsFirstAttempt(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
svc := notify.NewTestService(http.DefaultTransport)
|
||||
svc.SetSleepFunc(instantSleep)
|
||||
|
||||
var calls atomic.Int32
|
||||
|
||||
err := svc.DeliverWithRetry(
|
||||
context.Background(), "test",
|
||||
func(_ context.Context) error {
|
||||
calls.Add(1)
|
||||
|
||||
return nil
|
||||
},
|
||||
)
|
||||
if err != nil {
|
||||
t.Fatalf("unexpected error: %v", err)
|
||||
}
|
||||
|
||||
if calls.Load() != 1 {
|
||||
t.Errorf("expected 1 call, got %d", calls.Load())
|
||||
}
|
||||
}
|
||||
|
||||
func TestDeliverWithRetryRetriesOnFailure(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
svc := notify.NewTestService(http.DefaultTransport)
|
||||
svc.SetSleepFunc(instantSleep)
|
||||
svc.SetRetryConfig(notify.RetryConfig{
|
||||
MaxRetries: 3,
|
||||
BaseDelay: time.Millisecond,
|
||||
MaxDelay: 10 * time.Millisecond,
|
||||
})
|
||||
|
||||
var calls atomic.Int32
|
||||
|
||||
// Fail twice, then succeed on the third attempt.
|
||||
err := svc.DeliverWithRetry(
|
||||
context.Background(), "test",
|
||||
func(_ context.Context) error {
|
||||
n := calls.Add(1)
|
||||
if n <= 2 {
|
||||
return errTransient
|
||||
}
|
||||
|
||||
return nil
|
||||
},
|
||||
)
|
||||
if err != nil {
|
||||
t.Fatalf("expected success after retries: %v", err)
|
||||
}
|
||||
|
||||
if calls.Load() != 3 {
|
||||
t.Errorf("expected 3 calls, got %d", calls.Load())
|
||||
}
|
||||
}
|
||||
|
||||
func TestDeliverWithRetryExhaustsAttempts(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
svc := notify.NewTestService(http.DefaultTransport)
|
||||
svc.SetSleepFunc(instantSleep)
|
||||
svc.SetRetryConfig(notify.RetryConfig{
|
||||
MaxRetries: 2,
|
||||
BaseDelay: time.Millisecond,
|
||||
MaxDelay: 10 * time.Millisecond,
|
||||
})
|
||||
|
||||
var calls atomic.Int32
|
||||
|
||||
err := svc.DeliverWithRetry(
|
||||
context.Background(), "test",
|
||||
func(_ context.Context) error {
|
||||
calls.Add(1)
|
||||
|
||||
return errPermanent
|
||||
},
|
||||
)
|
||||
if err == nil {
|
||||
t.Fatal("expected error when all retries exhausted")
|
||||
}
|
||||
|
||||
if !errors.Is(err, errPermanent) {
|
||||
t.Errorf("expected permanent failure, got: %v", err)
|
||||
}
|
||||
|
||||
// 1 initial + 2 retries = 3 total.
|
||||
if calls.Load() != 3 {
|
||||
t.Errorf("expected 3 calls, got %d", calls.Load())
|
||||
}
|
||||
}
|
||||
|
||||
func TestDeliverWithRetryRespectsContextCancellation(
|
||||
t *testing.T,
|
||||
) {
|
||||
t.Parallel()
|
||||
|
||||
svc := notify.NewTestService(http.DefaultTransport)
|
||||
svc.SetRetryConfig(notify.RetryConfig{
|
||||
MaxRetries: 5,
|
||||
BaseDelay: time.Millisecond,
|
||||
MaxDelay: 10 * time.Millisecond,
|
||||
})
|
||||
|
||||
// Use a blocking sleep so the context cancellation is
|
||||
// the only way out.
|
||||
svc.SetSleepFunc(func(_ time.Duration) <-chan time.Time {
|
||||
return make(chan time.Time) // never fires
|
||||
})
|
||||
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
|
||||
done := make(chan error, 1)
|
||||
|
||||
go func() {
|
||||
done <- svc.DeliverWithRetry(
|
||||
ctx, "test",
|
||||
func(_ context.Context) error {
|
||||
return errFail
|
||||
},
|
||||
)
|
||||
}()
|
||||
|
||||
// Wait for the first failure + retry sleep to be
|
||||
// entered, then cancel.
|
||||
time.Sleep(50 * time.Millisecond)
|
||||
cancel()
|
||||
|
||||
select {
|
||||
case err := <-done:
|
||||
if !errors.Is(err, context.Canceled) {
|
||||
t.Errorf(
|
||||
"expected context.Canceled, got: %v", err,
|
||||
)
|
||||
}
|
||||
case <-time.After(2 * time.Second):
|
||||
t.Fatal("deliverWithRetry did not return after cancel")
|
||||
}
|
||||
}
|
||||
|
||||
// ── integration: SendNotification with retry ──────────────
|
||||
|
||||
func TestSendNotificationRetriesTransientFailure(
|
||||
t *testing.T,
|
||||
) {
|
||||
t.Parallel()
|
||||
|
||||
var (
|
||||
mu sync.Mutex
|
||||
attempts int
|
||||
)
|
||||
|
||||
srv := httptest.NewServer(
|
||||
http.HandlerFunc(
|
||||
func(w http.ResponseWriter, _ *http.Request) {
|
||||
mu.Lock()
|
||||
attempts++
|
||||
n := attempts
|
||||
mu.Unlock()
|
||||
|
||||
if n <= 2 {
|
||||
w.WriteHeader(
|
||||
http.StatusInternalServerError,
|
||||
)
|
||||
|
||||
return
|
||||
}
|
||||
|
||||
w.WriteHeader(http.StatusOK)
|
||||
}),
|
||||
)
|
||||
defer srv.Close()
|
||||
|
||||
svc := newRetryTestService(srv.URL, "ntfy")
|
||||
|
||||
svc.SendNotification(
|
||||
context.Background(),
|
||||
"Retry Test", "body", "warning",
|
||||
)
|
||||
|
||||
waitForCondition(t, func() bool {
|
||||
mu.Lock()
|
||||
defer mu.Unlock()
|
||||
|
||||
return attempts >= 3
|
||||
})
|
||||
}
|
||||
|
||||
// newRetryTestService creates a test service with instant
|
||||
// sleep and low retry delays for the named endpoint.
|
||||
func newRetryTestService(
|
||||
rawURL, endpoint string,
|
||||
) *notify.Service {
|
||||
svc := notify.NewTestService(http.DefaultTransport)
|
||||
svc.SetSleepFunc(instantSleep)
|
||||
svc.SetRetryConfig(notify.RetryConfig{
|
||||
MaxRetries: 3,
|
||||
BaseDelay: time.Millisecond,
|
||||
MaxDelay: 10 * time.Millisecond,
|
||||
})
|
||||
|
||||
u, _ := url.Parse(rawURL)
|
||||
|
||||
switch endpoint {
|
||||
case "ntfy":
|
||||
svc.SetNtfyURL(u)
|
||||
case "slack":
|
||||
svc.SetSlackWebhookURL(u)
|
||||
case "mattermost":
|
||||
svc.SetMattermostWebhookURL(u)
|
||||
}
|
||||
|
||||
return svc
|
||||
}
|
||||
|
||||
func TestSendNotificationAllEndpointsRetrySetup(
|
||||
t *testing.T,
|
||||
) {
|
||||
t.Parallel()
|
||||
|
||||
result := newEndpointRetryResult()
|
||||
ntfySrv, slackSrv, mmSrv := newRetryServers(result)
|
||||
|
||||
defer ntfySrv.Close()
|
||||
defer slackSrv.Close()
|
||||
defer mmSrv.Close()
|
||||
|
||||
svc := buildAllEndpointRetryService(
|
||||
ntfySrv.URL, slackSrv.URL, mmSrv.URL,
|
||||
)
|
||||
|
||||
svc.SendNotification(
|
||||
context.Background(),
|
||||
"Multi-Retry", "testing", "error",
|
||||
)
|
||||
|
||||
assertAllEndpointsRetried(t, result)
|
||||
}
|
||||
|
||||
// endpointRetryResult tracks per-endpoint retry state.
|
||||
type endpointRetryResult struct {
|
||||
mu sync.Mutex
|
||||
ntfyAttempts int
|
||||
slackAttempts int
|
||||
mmAttempts int
|
||||
ntfyOK bool
|
||||
slackOK bool
|
||||
mmOK bool
|
||||
}
|
||||
|
||||
func newEndpointRetryResult() *endpointRetryResult {
|
||||
return &endpointRetryResult{}
|
||||
}
|
||||
|
||||
func newRetryServers(
|
||||
r *endpointRetryResult,
|
||||
) (*httptest.Server, *httptest.Server, *httptest.Server) {
|
||||
mk := func(
|
||||
attempts *int, ok *bool,
|
||||
) *httptest.Server {
|
||||
return httptest.NewServer(
|
||||
http.HandlerFunc(
|
||||
func(w http.ResponseWriter, _ *http.Request) {
|
||||
r.mu.Lock()
|
||||
*attempts++
|
||||
n := *attempts
|
||||
r.mu.Unlock()
|
||||
|
||||
if n == 1 {
|
||||
w.WriteHeader(
|
||||
http.StatusServiceUnavailable,
|
||||
)
|
||||
|
||||
return
|
||||
}
|
||||
|
||||
r.mu.Lock()
|
||||
*ok = true
|
||||
r.mu.Unlock()
|
||||
|
||||
w.WriteHeader(http.StatusOK)
|
||||
}),
|
||||
)
|
||||
}
|
||||
|
||||
return mk(&r.ntfyAttempts, &r.ntfyOK),
|
||||
mk(&r.slackAttempts, &r.slackOK),
|
||||
mk(&r.mmAttempts, &r.mmOK)
|
||||
}
|
||||
|
||||
func buildAllEndpointRetryService(
|
||||
ntfyURL, slackURL, mmURL string,
|
||||
) *notify.Service {
|
||||
svc := notify.NewTestService(http.DefaultTransport)
|
||||
svc.SetSleepFunc(instantSleep)
|
||||
svc.SetRetryConfig(notify.RetryConfig{
|
||||
MaxRetries: 3,
|
||||
BaseDelay: time.Millisecond,
|
||||
MaxDelay: 10 * time.Millisecond,
|
||||
})
|
||||
|
||||
nu, _ := url.Parse(ntfyURL)
|
||||
su, _ := url.Parse(slackURL)
|
||||
mu, _ := url.Parse(mmURL)
|
||||
|
||||
svc.SetNtfyURL(nu)
|
||||
svc.SetSlackWebhookURL(su)
|
||||
svc.SetMattermostWebhookURL(mu)
|
||||
|
||||
return svc
|
||||
}
|
||||
|
||||
func assertAllEndpointsRetried(
|
||||
t *testing.T,
|
||||
r *endpointRetryResult,
|
||||
) {
|
||||
t.Helper()
|
||||
|
||||
waitForCondition(t, func() bool {
|
||||
r.mu.Lock()
|
||||
defer r.mu.Unlock()
|
||||
|
||||
return r.ntfyOK && r.slackOK && r.mmOK
|
||||
})
|
||||
|
||||
r.mu.Lock()
|
||||
defer r.mu.Unlock()
|
||||
|
||||
if r.ntfyAttempts < 2 {
|
||||
t.Errorf(
|
||||
"ntfy: expected >= 2 attempts, got %d",
|
||||
r.ntfyAttempts,
|
||||
)
|
||||
}
|
||||
|
||||
if r.slackAttempts < 2 {
|
||||
t.Errorf(
|
||||
"slack: expected >= 2 attempts, got %d",
|
||||
r.slackAttempts,
|
||||
)
|
||||
}
|
||||
|
||||
if r.mmAttempts < 2 {
|
||||
t.Errorf(
|
||||
"mattermost: expected >= 2 attempts, got %d",
|
||||
r.mmAttempts,
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSendNotificationPermanentFailureLogsError(
|
||||
t *testing.T,
|
||||
) {
|
||||
t.Parallel()
|
||||
|
||||
var (
|
||||
mu sync.Mutex
|
||||
attempts int
|
||||
)
|
||||
|
||||
srv := httptest.NewServer(
|
||||
http.HandlerFunc(
|
||||
func(w http.ResponseWriter, _ *http.Request) {
|
||||
mu.Lock()
|
||||
attempts++
|
||||
mu.Unlock()
|
||||
|
||||
w.WriteHeader(
|
||||
http.StatusInternalServerError,
|
||||
)
|
||||
}),
|
||||
)
|
||||
defer srv.Close()
|
||||
|
||||
svc := newRetryTestService(srv.URL, "slack")
|
||||
svc.SetRetryConfig(notify.RetryConfig{
|
||||
MaxRetries: 2,
|
||||
BaseDelay: time.Millisecond,
|
||||
MaxDelay: 10 * time.Millisecond,
|
||||
})
|
||||
|
||||
svc.SendNotification(
|
||||
context.Background(),
|
||||
"Permanent Fail", "body", "error",
|
||||
)
|
||||
|
||||
// 1 initial + 2 retries = 3 total.
|
||||
waitForCondition(t, func() bool {
|
||||
mu.Lock()
|
||||
defer mu.Unlock()
|
||||
|
||||
return attempts >= 3
|
||||
})
|
||||
}
|
||||
@@ -1,284 +0,0 @@
|
||||
package resolver_test
|
||||
|
||||
import (
|
||||
"context"
|
||||
"sync"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
|
||||
"sneak.berlin/go/dnswatcher/internal/resolver"
|
||||
)
|
||||
|
||||
// Tests for the live-DNS harness in livedns_test.go itself. These
|
||||
// exercise pure logic and the retry/concurrency plumbing; they
|
||||
// perform no DNS resolution of any kind, so they neither mock DNS
|
||||
// nor depend on it.
|
||||
|
||||
// Names for the synthetic status maps below. Nothing is ever queried
|
||||
// at them: they are map keys handed to the package's pure counting
|
||||
// helpers, not a stand-in for a nameserver.
|
||||
const (
|
||||
nsExample1 = "ns1.example."
|
||||
nsExample2 = "ns2.example."
|
||||
nsExample3 = "ns3.example."
|
||||
nsExample4 = "ns4.example."
|
||||
)
|
||||
|
||||
func TestLiveQuorumIsStrictMajority(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
cases := map[int]int{
|
||||
0: 1,
|
||||
1: 1,
|
||||
2: 2,
|
||||
3: 2,
|
||||
4: 3,
|
||||
5: 3,
|
||||
13: 7,
|
||||
}
|
||||
|
||||
for total, want := range cases {
|
||||
assert.Equal(
|
||||
t, want, liveQuorum(total),
|
||||
"liveQuorum(%d)", total,
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
func TestStatusCountingIgnoresSilentNameservers(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
results := map[string]*resolver.NameserverResponse{
|
||||
nsExample1: {
|
||||
Nameserver: nsExample1,
|
||||
Status: resolver.StatusOK,
|
||||
},
|
||||
nsExample2: {
|
||||
Nameserver: nsExample2,
|
||||
Status: resolver.StatusOK,
|
||||
},
|
||||
nsExample3: {
|
||||
Nameserver: nsExample3,
|
||||
Status: resolver.StatusTimeout,
|
||||
},
|
||||
nsExample4: {
|
||||
Nameserver: nsExample4,
|
||||
Status: resolver.StatusError,
|
||||
},
|
||||
}
|
||||
|
||||
assert.Equal(
|
||||
t, 2, countStatus(results, resolver.StatusOK),
|
||||
)
|
||||
assert.Equal(
|
||||
t, 0, countStatus(results, resolver.StatusNXDomain),
|
||||
)
|
||||
|
||||
// Two of four answered, which is short of the quorum of
|
||||
// three: this is the state that triggers a retry rather
|
||||
// than an assertion failure.
|
||||
assert.Equal(t, 2, answeredCount(results))
|
||||
assert.Less(t, answeredCount(results), liveQuorum(len(results)))
|
||||
|
||||
assert.Equal(
|
||||
t,
|
||||
"ns1.example.=ok ns2.example.=ok "+
|
||||
"ns3.example.=timeout ns4.example.=error",
|
||||
describeStatuses(results),
|
||||
)
|
||||
}
|
||||
|
||||
func TestRetryLiveRecoversFromTransientFailure(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
const wantAttempts = 2
|
||||
|
||||
attempts := 0
|
||||
|
||||
retryLive(t, "transient", func(_ context.Context) error {
|
||||
attempts++
|
||||
|
||||
if attempts < wantAttempts {
|
||||
return errLiveNoAnswer
|
||||
}
|
||||
|
||||
return nil
|
||||
})
|
||||
|
||||
assert.Equal(t, wantAttempts, attempts)
|
||||
}
|
||||
|
||||
func TestRetryLiveGivesEachAttemptADeadline(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
retryLive(t, "deadline", func(ctx context.Context) error {
|
||||
deadline, ok := ctx.Deadline()
|
||||
assert.True(t, ok, "attempt should carry a deadline")
|
||||
|
||||
remaining := time.Until(deadline)
|
||||
|
||||
assert.LessOrEqual(t, remaining, liveAttemptTimeout)
|
||||
|
||||
// Lower bound too: without one this passes for a
|
||||
// deadline far shorter than intended, which would
|
||||
// silently turn every live attempt into an instant
|
||||
// timeout.
|
||||
assert.Greater(t, remaining, liveAttemptTimeout/2)
|
||||
|
||||
return nil
|
||||
})
|
||||
}
|
||||
|
||||
// TestUnsanctionedStatusesRejectsWrongAnswers is the regression test
|
||||
// for the defect this allowlist exists to prevent: a minority of
|
||||
// nameservers answering WRONGLY while quorum keeps the suite green.
|
||||
// nodata is the case that motivated it — it is a wrong answer, not
|
||||
// silence, and it was previously banned by neither test.
|
||||
func TestUnsanctionedStatusesRejectsWrongAnswers(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
// Four nameservers, three OK and one answering nodata: a
|
||||
// quorum of three is satisfied and no NXDOMAIN is present, so
|
||||
// the old blocklist assertions both passed on this input.
|
||||
results := map[string]*resolver.NameserverResponse{
|
||||
nsExample1: {
|
||||
Nameserver: nsExample1,
|
||||
Status: resolver.StatusOK,
|
||||
},
|
||||
nsExample2: {
|
||||
Nameserver: nsExample2,
|
||||
Status: resolver.StatusOK,
|
||||
},
|
||||
nsExample3: {
|
||||
Nameserver: nsExample3,
|
||||
Status: resolver.StatusOK,
|
||||
},
|
||||
nsExample4: {
|
||||
Nameserver: nsExample4,
|
||||
Status: resolver.StatusNoData,
|
||||
},
|
||||
}
|
||||
|
||||
assert.GreaterOrEqual(
|
||||
t,
|
||||
countStatus(results, resolver.StatusOK),
|
||||
liveQuorum(len(results)),
|
||||
)
|
||||
assert.Zero(t, countStatus(results, resolver.StatusNXDomain))
|
||||
|
||||
// nodata is an ANSWER, so it never triggers a retry: nothing
|
||||
// but the allowlist stands between it and a false green.
|
||||
assert.Equal(t, len(results), answeredCount(results))
|
||||
|
||||
assert.Equal(
|
||||
t,
|
||||
[]string{nsExample4 + "=nodata"},
|
||||
unsanctionedStatuses(
|
||||
results,
|
||||
resolver.StatusOK,
|
||||
resolver.StatusTimeout,
|
||||
resolver.StatusError,
|
||||
),
|
||||
"nodata must be reported as an unsanctioned status",
|
||||
)
|
||||
}
|
||||
|
||||
func TestUnsanctionedStatusesToleratesSilenceOnly(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
results := map[string]*resolver.NameserverResponse{
|
||||
nsExample1: {
|
||||
Nameserver: nsExample1,
|
||||
Status: resolver.StatusNXDomain,
|
||||
},
|
||||
nsExample2: {
|
||||
Nameserver: nsExample2,
|
||||
Status: resolver.StatusTimeout,
|
||||
},
|
||||
nsExample3: {
|
||||
Nameserver: nsExample3,
|
||||
Status: resolver.StatusError,
|
||||
},
|
||||
}
|
||||
|
||||
allowed := []string{
|
||||
resolver.StatusNXDomain,
|
||||
resolver.StatusTimeout,
|
||||
resolver.StatusError,
|
||||
}
|
||||
|
||||
assert.Empty(
|
||||
t,
|
||||
unsanctionedStatuses(results, allowed...),
|
||||
"timeout and error are non-answers and are tolerated",
|
||||
)
|
||||
|
||||
// The same silent nameservers do not count towards a quorum.
|
||||
assert.Equal(t, 1, answeredCount(results))
|
||||
|
||||
// An unknown status is treated as silence by answeredCount —
|
||||
// so it retries and fails loudly — and is unsanctioned by the
|
||||
// allowlist rather than quietly permitted.
|
||||
const laterStatus = "some-status-added-later"
|
||||
|
||||
results[nsExample4] = &resolver.NameserverResponse{
|
||||
Nameserver: nsExample4,
|
||||
Status: laterStatus,
|
||||
}
|
||||
|
||||
assert.Equal(t, 1, answeredCount(results))
|
||||
assert.Equal(
|
||||
t,
|
||||
[]string{nsExample4 + "=" + laterStatus},
|
||||
unsanctionedStatuses(results, allowed...),
|
||||
)
|
||||
}
|
||||
|
||||
func TestRunLiveBoundsConcurrency(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
const workers = 24
|
||||
|
||||
var (
|
||||
mu sync.Mutex
|
||||
wg sync.WaitGroup
|
||||
inFlight int
|
||||
maxSeen int
|
||||
)
|
||||
|
||||
wg.Add(workers)
|
||||
|
||||
for range workers {
|
||||
go func() {
|
||||
defer wg.Done()
|
||||
|
||||
_ = runLive(func(_ context.Context) error {
|
||||
mu.Lock()
|
||||
inFlight++
|
||||
|
||||
if inFlight > maxSeen {
|
||||
maxSeen = inFlight
|
||||
}
|
||||
mu.Unlock()
|
||||
|
||||
time.Sleep(time.Millisecond)
|
||||
|
||||
mu.Lock()
|
||||
inFlight--
|
||||
mu.Unlock()
|
||||
|
||||
return nil
|
||||
})
|
||||
}()
|
||||
}
|
||||
|
||||
wg.Wait()
|
||||
|
||||
assert.Positive(t, maxSeen)
|
||||
assert.LessOrEqual(
|
||||
t, maxSeen, liveConcurrency,
|
||||
"live queries must stay under the package-wide gate",
|
||||
)
|
||||
}
|
||||
@@ -1,495 +0,0 @@
|
||||
package resolver_test
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"slices"
|
||||
"sort"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"sneak.berlin/go/dnswatcher/internal/resolver"
|
||||
)
|
||||
|
||||
// ----------------------------------------------------------------
|
||||
// Live DNS test support
|
||||
// ----------------------------------------------------------------
|
||||
//
|
||||
// Every test in this package resolves against the real, live DNS —
|
||||
// see TESTING.md. Nothing here mocks, fakes, stubs, records or
|
||||
// replays DNS, and nothing here skips or gates a test: the helpers
|
||||
// below only change *how* the live queries are issued, so that a
|
||||
// single dropped UDP packet or one slow authoritative server does
|
||||
// not turn a correct resolver into a red build.
|
||||
//
|
||||
// Three mechanisms, all test-side:
|
||||
//
|
||||
// 1. Bounded concurrency. The package's tests are parallel and the
|
||||
// build hosts have many cores, so without a limit every test
|
||||
// starts its own iterative resolution at the same instant and
|
||||
// they all hit the first root server in rootServerList() within
|
||||
// a few milliseconds of each other. Root servers rate-limit
|
||||
// that, which shows up as a different arbitrary subset of tests
|
||||
// failing on each run. liveGate caps how many resolutions are
|
||||
// in flight at once.
|
||||
//
|
||||
// 2. Retry with exponential backoff. Each live operation gets
|
||||
// several attempts with its own timeout. The retry predicate is
|
||||
// strictly transport-level — "did a nameserver answer at all" —
|
||||
// never the assertion the test is making. A resolver that
|
||||
// answers incorrectly still fails on the first attempt.
|
||||
//
|
||||
// 3. Quorum. Where an assertion spans several independent
|
||||
// nameservers, a strict majority answering as expected is
|
||||
// enough; a server that fails to answer is tolerated, while a
|
||||
// server that answers *wrongly* still fails the test.
|
||||
//
|
||||
// The tolerance in (3) is expressed as an ALLOWLIST of sanctioned
|
||||
// statuses, never as a blocklist of known-bad ones. A blocklist bans
|
||||
// the one wrong answer its author thought of and silently admits
|
||||
// every other status, including any added to the resolver later; an
|
||||
// allowlist fails on anything nobody explicitly sanctioned. Silence
|
||||
// (timeout, error) is the only thing quorum exists to tolerate. A
|
||||
// *wrong answer* — nxdomain for a name that exists, ok for one that
|
||||
// does not, nodata for either — is never tolerated at any count.
|
||||
|
||||
const (
|
||||
// liveAttempts is how many times a live DNS operation is
|
||||
// attempted before the test fails.
|
||||
liveAttempts = 3
|
||||
|
||||
// liveAttemptTimeout bounds one attempt. Worst case for an
|
||||
// operation is liveAttempts * liveAttemptTimeout plus the
|
||||
// backoff — about 26 seconds, well inside the 90-second
|
||||
// `go test -timeout` backstop even when several operations
|
||||
// exhaust their attempts.
|
||||
liveAttemptTimeout = 8 * time.Second
|
||||
|
||||
// liveBackoffBase is the delay after the first failed
|
||||
// attempt; it is multiplied by liveBackoffFactor each time.
|
||||
liveBackoffBase = 500 * time.Millisecond
|
||||
|
||||
// liveBackoffFactor is the exponential backoff multiplier.
|
||||
liveBackoffFactor = 2
|
||||
|
||||
// liveConcurrency caps how many live resolutions may be in
|
||||
// flight across the whole package at once.
|
||||
liveConcurrency = 6
|
||||
|
||||
// minNameservers is the smallest nameserver count a
|
||||
// well-run zone is expected to publish.
|
||||
minNameservers = 2
|
||||
)
|
||||
|
||||
// liveGate bounds concurrent live resolutions package-wide. It has
|
||||
// to be package scoped: the whole point is that it is shared by
|
||||
// every parallel test in the package.
|
||||
//
|
||||
//nolint:gochecknoglobals // package-wide live query rate limit
|
||||
var liveGate = make(chan struct{}, liveConcurrency)
|
||||
|
||||
var (
|
||||
// errLiveNoAnswer reports that a live operation produced no
|
||||
// usable answer, which is retried rather than asserted on.
|
||||
errLiveNoAnswer = errors.New("no answer from live DNS")
|
||||
|
||||
// errLiveNoQuorum reports that too few of a domain's
|
||||
// nameservers answered for a quorum assertion to be made.
|
||||
errLiveNoQuorum = errors.New("no nameserver quorum")
|
||||
)
|
||||
|
||||
// runLive executes one attempt of a live operation, holding a slot
|
||||
// in liveGate for its duration and bounding it with its own
|
||||
// timeout.
|
||||
func runLive(op func(ctx context.Context) error) error {
|
||||
liveGate <- struct{}{}
|
||||
defer func() { <-liveGate }()
|
||||
|
||||
ctx, cancel := context.WithTimeout(
|
||||
context.Background(), liveAttemptTimeout,
|
||||
)
|
||||
defer cancel()
|
||||
|
||||
return op(ctx)
|
||||
}
|
||||
|
||||
// retryLive runs op until it reports success, retrying transport
|
||||
// failures with exponential backoff, and fails the test if every
|
||||
// attempt fails. op returns an error only for a failure to obtain
|
||||
// an answer — never for an answer the test disagrees with, which
|
||||
// belongs in an assertion so that it fails immediately. op stores
|
||||
// whatever it obtained where its caller can find it.
|
||||
func retryLive(
|
||||
t *testing.T,
|
||||
what string,
|
||||
op func(ctx context.Context) error,
|
||||
) {
|
||||
t.Helper()
|
||||
|
||||
var last error
|
||||
|
||||
backoff := liveBackoffBase
|
||||
|
||||
for attempt := range liveAttempts {
|
||||
if attempt > 0 {
|
||||
t.Logf(
|
||||
"%s: attempt %d of %d failed (%v), "+
|
||||
"retrying in %s",
|
||||
what, attempt, liveAttempts, last, backoff,
|
||||
)
|
||||
time.Sleep(backoff)
|
||||
|
||||
backoff *= liveBackoffFactor
|
||||
}
|
||||
|
||||
last = runLive(op)
|
||||
if last == nil {
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
t.Fatalf(
|
||||
"%s: no answer after %d live attempts: %v",
|
||||
what, liveAttempts, last,
|
||||
)
|
||||
}
|
||||
|
||||
// liveQuorum is how many of total nameservers must agree for a
|
||||
// multi-nameserver assertion to hold: a strict majority.
|
||||
func liveQuorum(total int) int {
|
||||
if total < 1 {
|
||||
return 1
|
||||
}
|
||||
|
||||
return total/2 + 1
|
||||
}
|
||||
|
||||
// countStatus counts the responses carrying the given status.
|
||||
func countStatus(
|
||||
results map[string]*resolver.NameserverResponse,
|
||||
status string,
|
||||
) int {
|
||||
n := 0
|
||||
|
||||
for _, resp := range results {
|
||||
if resp.Status == status {
|
||||
n++
|
||||
}
|
||||
}
|
||||
|
||||
return n
|
||||
}
|
||||
|
||||
// liveAnswerStatuses is the closed set of statuses that count as a
|
||||
// nameserver having ANSWERED at all, whether or not the test agrees
|
||||
// with the answer. It is deliberately an allowlist: a status added
|
||||
// to the resolver later is treated as silence, so it can only ever
|
||||
// cause a retry and then a loud failure, never a quiet pass.
|
||||
func liveAnswerStatuses() []string {
|
||||
return []string{
|
||||
resolver.StatusOK,
|
||||
resolver.StatusNXDomain,
|
||||
resolver.StatusNoData,
|
||||
}
|
||||
}
|
||||
|
||||
// answeredCount counts the nameservers that produced an answer of
|
||||
// any kind, as opposed to failing or timing out.
|
||||
func answeredCount(
|
||||
results map[string]*resolver.NameserverResponse,
|
||||
) int {
|
||||
answers := liveAnswerStatuses()
|
||||
|
||||
n := 0
|
||||
|
||||
for _, resp := range results {
|
||||
if slices.Contains(answers, resp.Status) {
|
||||
n++
|
||||
}
|
||||
}
|
||||
|
||||
return n
|
||||
}
|
||||
|
||||
// unsanctionedStatuses returns "nameserver=status" for every result
|
||||
// whose status the caller did not explicitly sanction, sorted for a
|
||||
// stable failure message. Callers pass the full closed set they will
|
||||
// accept — the expected answer plus whichever non-answers (timeout,
|
||||
// error) quorum is allowed to tolerate — so that any status outside
|
||||
// it fails the test by name.
|
||||
func unsanctionedStatuses(
|
||||
results map[string]*resolver.NameserverResponse,
|
||||
allowed ...string,
|
||||
) []string {
|
||||
offenders := make([]string, 0, len(results))
|
||||
|
||||
for ns, resp := range results {
|
||||
if slices.Contains(allowed, resp.Status) {
|
||||
continue
|
||||
}
|
||||
|
||||
offenders = append(
|
||||
offenders, fmt.Sprintf("%s=%s", ns, resp.Status),
|
||||
)
|
||||
}
|
||||
|
||||
sort.Strings(offenders)
|
||||
|
||||
return offenders
|
||||
}
|
||||
|
||||
// describeStatuses renders per-nameserver statuses for use in
|
||||
// assertion failure messages.
|
||||
func describeStatuses(
|
||||
results map[string]*resolver.NameserverResponse,
|
||||
) string {
|
||||
parts := make([]string, 0, len(results))
|
||||
for ns, resp := range results {
|
||||
parts = append(
|
||||
parts, fmt.Sprintf("%s=%s", ns, resp.Status),
|
||||
)
|
||||
}
|
||||
|
||||
sort.Strings(parts)
|
||||
|
||||
return strings.Join(parts, " ")
|
||||
}
|
||||
|
||||
// ----------------------------------------------------------------
|
||||
// Live operation wrappers
|
||||
// ----------------------------------------------------------------
|
||||
|
||||
// liveFindAuthoritative resolves a domain's authoritative
|
||||
// nameservers, retrying until the delegation chain can be walked.
|
||||
func liveFindAuthoritative(
|
||||
t *testing.T,
|
||||
r *resolver.Resolver,
|
||||
domain string,
|
||||
) []string {
|
||||
t.Helper()
|
||||
|
||||
var out []string
|
||||
|
||||
retryLive(
|
||||
t,
|
||||
"FindAuthoritativeNameservers("+domain+")",
|
||||
func(ctx context.Context) error {
|
||||
ns, err := r.FindAuthoritativeNameservers(ctx, domain)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if len(ns) == 0 {
|
||||
return fmt.Errorf(
|
||||
"%w: %s has no nameservers",
|
||||
errLiveNoAnswer, domain,
|
||||
)
|
||||
}
|
||||
|
||||
out = ns
|
||||
|
||||
return nil
|
||||
},
|
||||
)
|
||||
|
||||
return out
|
||||
}
|
||||
|
||||
// liveLookupNS is liveFindAuthoritative through the LookupNS entry
|
||||
// point, so that both entry points stay independently exercised.
|
||||
func liveLookupNS(
|
||||
t *testing.T,
|
||||
r *resolver.Resolver,
|
||||
domain string,
|
||||
) []string {
|
||||
t.Helper()
|
||||
|
||||
var out []string
|
||||
|
||||
retryLive(
|
||||
t,
|
||||
"LookupNS("+domain+")",
|
||||
func(ctx context.Context) error {
|
||||
ns, err := r.LookupNS(ctx, domain)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if len(ns) == 0 {
|
||||
return fmt.Errorf(
|
||||
"%w: %s has no nameservers",
|
||||
errLiveNoAnswer, domain,
|
||||
)
|
||||
}
|
||||
|
||||
out = ns
|
||||
|
||||
return nil
|
||||
},
|
||||
)
|
||||
|
||||
return out
|
||||
}
|
||||
|
||||
// liveQueryNameserver queries one nameserver, retrying while that
|
||||
// nameserver fails to answer. NXDOMAIN and NODATA are answers and
|
||||
// are returned to the caller to assert on.
|
||||
func liveQueryNameserver(
|
||||
t *testing.T,
|
||||
r *resolver.Resolver,
|
||||
nameserver string,
|
||||
hostname string,
|
||||
) *resolver.NameserverResponse {
|
||||
t.Helper()
|
||||
|
||||
what := fmt.Sprintf(
|
||||
"QueryNameserver(%s, %s)", nameserver, hostname,
|
||||
)
|
||||
|
||||
var out *resolver.NameserverResponse
|
||||
|
||||
retryLive(
|
||||
t,
|
||||
what,
|
||||
func(ctx context.Context) error {
|
||||
resp, err := r.QueryNameserver(
|
||||
ctx, nameserver, hostname,
|
||||
)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if resp.Status == resolver.StatusTimeout ||
|
||||
resp.Status == resolver.StatusError {
|
||||
return fmt.Errorf(
|
||||
"%w: %s returned %s: %s",
|
||||
errLiveNoAnswer, nameserver,
|
||||
resp.Status, resp.Error,
|
||||
)
|
||||
}
|
||||
|
||||
out = resp
|
||||
|
||||
return nil
|
||||
},
|
||||
)
|
||||
|
||||
return out
|
||||
}
|
||||
|
||||
// liveQueryAllNameservers queries every authoritative nameserver
|
||||
// for a hostname, retrying until a quorum of them has answered.
|
||||
// Individual nameservers that stay silent are left in the result
|
||||
// for the caller to account for.
|
||||
func liveQueryAllNameservers(
|
||||
t *testing.T,
|
||||
r *resolver.Resolver,
|
||||
hostname string,
|
||||
) map[string]*resolver.NameserverResponse {
|
||||
t.Helper()
|
||||
|
||||
var out map[string]*resolver.NameserverResponse
|
||||
|
||||
retryLive(
|
||||
t,
|
||||
"QueryAllNameservers("+hostname+")",
|
||||
func(ctx context.Context) error {
|
||||
results, err := r.QueryAllNameservers(ctx, hostname)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if len(results) == 0 {
|
||||
return fmt.Errorf(
|
||||
"%w: no nameservers queried for %s",
|
||||
errLiveNoAnswer, hostname,
|
||||
)
|
||||
}
|
||||
|
||||
answered := answeredCount(results)
|
||||
if answered < liveQuorum(len(results)) {
|
||||
return fmt.Errorf(
|
||||
"%w: %d of %d answered: %s",
|
||||
errLiveNoQuorum, answered,
|
||||
len(results), describeStatuses(results),
|
||||
)
|
||||
}
|
||||
|
||||
out = results
|
||||
|
||||
return nil
|
||||
},
|
||||
)
|
||||
|
||||
return out
|
||||
}
|
||||
|
||||
// liveResolveIPs resolves a hostname that is expected to have
|
||||
// addresses, retrying until at least one is returned.
|
||||
func liveResolveIPs(
|
||||
t *testing.T,
|
||||
r *resolver.Resolver,
|
||||
hostname string,
|
||||
) []string {
|
||||
t.Helper()
|
||||
|
||||
var out []string
|
||||
|
||||
retryLive(
|
||||
t,
|
||||
"ResolveIPAddresses("+hostname+")",
|
||||
func(ctx context.Context) error {
|
||||
ips, err := r.ResolveIPAddresses(ctx, hostname)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if len(ips) == 0 {
|
||||
return fmt.Errorf(
|
||||
"%w: no addresses for %s",
|
||||
errLiveNoAnswer, hostname,
|
||||
)
|
||||
}
|
||||
|
||||
out = ips
|
||||
|
||||
return nil
|
||||
},
|
||||
)
|
||||
|
||||
return out
|
||||
}
|
||||
|
||||
// liveResolveIPsAllowingEmpty resolves a hostname that may legitimately
|
||||
// have no addresses, so the empty result is returned rather than
|
||||
// retried. Used for names that must not exist; the corresponding
|
||||
// QueryAllNameservers test is what proves the nameservers actively
|
||||
// said NXDOMAIN rather than merely staying silent.
|
||||
func liveResolveIPsAllowingEmpty(
|
||||
t *testing.T,
|
||||
r *resolver.Resolver,
|
||||
hostname string,
|
||||
) []string {
|
||||
t.Helper()
|
||||
|
||||
var out []string
|
||||
|
||||
retryLive(
|
||||
t,
|
||||
"ResolveIPAddresses("+hostname+")",
|
||||
func(ctx context.Context) error {
|
||||
ips, err := r.ResolveIPAddresses(ctx, hostname)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
out = ips
|
||||
|
||||
return nil
|
||||
},
|
||||
)
|
||||
|
||||
return out
|
||||
}
|
||||
@@ -32,17 +32,32 @@ func newTestResolver(t *testing.T) *resolver.Resolver {
|
||||
return resolver.NewFromLogger(log)
|
||||
}
|
||||
|
||||
// findOneNSForDomain picks one authoritative nameserver to aim a
|
||||
// test at. Live-DNS retry, concurrency and quorum handling live in
|
||||
// livedns_test.go.
|
||||
func testContext(t *testing.T) context.Context {
|
||||
t.Helper()
|
||||
|
||||
ctx, cancel := context.WithTimeout(
|
||||
context.Background(), 60*time.Second,
|
||||
)
|
||||
t.Cleanup(cancel)
|
||||
|
||||
return ctx
|
||||
}
|
||||
|
||||
func findOneNSForDomain(
|
||||
t *testing.T,
|
||||
r *resolver.Resolver,
|
||||
ctx context.Context, //nolint:revive // test helper
|
||||
domain string,
|
||||
) string {
|
||||
t.Helper()
|
||||
|
||||
return liveFindAuthoritative(t, r, domain)[0]
|
||||
nameservers, err := r.FindAuthoritativeNameservers(
|
||||
ctx, domain,
|
||||
)
|
||||
require.NoError(t, err)
|
||||
require.NotEmpty(t, nameservers)
|
||||
|
||||
return nameservers[0]
|
||||
}
|
||||
|
||||
// ----------------------------------------------------------------
|
||||
@@ -55,7 +70,13 @@ func TestFindAuthoritativeNameservers_ValidDomain(
|
||||
t.Parallel()
|
||||
|
||||
r := newTestResolver(t)
|
||||
nameservers := liveFindAuthoritative(t, r, "google.com")
|
||||
ctx := testContext(t)
|
||||
|
||||
nameservers, err := r.FindAuthoritativeNameservers(
|
||||
ctx, "google.com",
|
||||
)
|
||||
require.NoError(t, err)
|
||||
require.NotEmpty(t, nameservers)
|
||||
|
||||
hasGoogleNS := false
|
||||
|
||||
@@ -78,9 +99,13 @@ func TestFindAuthoritativeNameservers_Subdomain(
|
||||
t.Parallel()
|
||||
|
||||
r := newTestResolver(t)
|
||||
nameservers := liveFindAuthoritative(t, r, "www.google.com")
|
||||
ctx := testContext(t)
|
||||
|
||||
assert.NotEmpty(t, nameservers)
|
||||
nameservers, err := r.FindAuthoritativeNameservers(
|
||||
ctx, "www.google.com",
|
||||
)
|
||||
require.NoError(t, err)
|
||||
require.NotEmpty(t, nameservers)
|
||||
}
|
||||
|
||||
func TestFindAuthoritativeNameservers_ReturnsSorted(
|
||||
@@ -89,7 +114,12 @@ func TestFindAuthoritativeNameservers_ReturnsSorted(
|
||||
t.Parallel()
|
||||
|
||||
r := newTestResolver(t)
|
||||
nameservers := liveFindAuthoritative(t, r, "google.com")
|
||||
ctx := testContext(t)
|
||||
|
||||
nameservers, err := r.FindAuthoritativeNameservers(
|
||||
ctx, "google.com",
|
||||
)
|
||||
require.NoError(t, err)
|
||||
|
||||
assert.True(
|
||||
t,
|
||||
@@ -104,8 +134,17 @@ func TestFindAuthoritativeNameservers_Deterministic(
|
||||
t.Parallel()
|
||||
|
||||
r := newTestResolver(t)
|
||||
first := liveFindAuthoritative(t, r, "google.com")
|
||||
second := liveFindAuthoritative(t, r, "google.com")
|
||||
ctx := testContext(t)
|
||||
|
||||
first, err := r.FindAuthoritativeNameservers(
|
||||
ctx, "google.com",
|
||||
)
|
||||
require.NoError(t, err)
|
||||
|
||||
second, err := r.FindAuthoritativeNameservers(
|
||||
ctx, "google.com",
|
||||
)
|
||||
require.NoError(t, err)
|
||||
|
||||
assert.Equal(t, first, second)
|
||||
}
|
||||
@@ -116,8 +155,17 @@ func TestFindAuthoritativeNameservers_TrailingDot(
|
||||
t.Parallel()
|
||||
|
||||
r := newTestResolver(t)
|
||||
ns1 := liveFindAuthoritative(t, r, "google.com")
|
||||
ns2 := liveFindAuthoritative(t, r, "google.com.")
|
||||
ctx := testContext(t)
|
||||
|
||||
ns1, err := r.FindAuthoritativeNameservers(
|
||||
ctx, "google.com",
|
||||
)
|
||||
require.NoError(t, err)
|
||||
|
||||
ns2, err := r.FindAuthoritativeNameservers(
|
||||
ctx, "google.com.",
|
||||
)
|
||||
require.NoError(t, err)
|
||||
|
||||
assert.Equal(t, ns1, ns2)
|
||||
}
|
||||
@@ -128,7 +176,13 @@ func TestFindAuthoritativeNameservers_CloudflareDomain(
|
||||
t.Parallel()
|
||||
|
||||
r := newTestResolver(t)
|
||||
nameservers := liveFindAuthoritative(t, r, "cloudflare.com")
|
||||
ctx := testContext(t)
|
||||
|
||||
nameservers, err := r.FindAuthoritativeNameservers(
|
||||
ctx, "cloudflare.com",
|
||||
)
|
||||
require.NoError(t, err)
|
||||
require.NotEmpty(t, nameservers)
|
||||
|
||||
for _, ns := range nameservers {
|
||||
assert.True(t, strings.HasSuffix(ns, "."),
|
||||
@@ -145,9 +199,13 @@ func TestQueryNameserver_BasicA(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
r := newTestResolver(t)
|
||||
ns := findOneNSForDomain(t, r, "google.com")
|
||||
resp := liveQueryNameserver(t, r, ns, "www.google.com")
|
||||
ctx := testContext(t)
|
||||
ns := findOneNSForDomain(t, r, ctx, "google.com")
|
||||
|
||||
resp, err := r.QueryNameserver(
|
||||
ctx, ns, "www.google.com",
|
||||
)
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, resp)
|
||||
|
||||
assert.Equal(t, resolver.StatusOK, resp.Status)
|
||||
@@ -164,8 +222,13 @@ func TestQueryNameserver_AAAA(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
r := newTestResolver(t)
|
||||
ns := findOneNSForDomain(t, r, "cloudflare.com")
|
||||
resp := liveQueryNameserver(t, r, ns, "cloudflare.com")
|
||||
ctx := testContext(t)
|
||||
ns := findOneNSForDomain(t, r, ctx, "cloudflare.com")
|
||||
|
||||
resp, err := r.QueryNameserver(
|
||||
ctx, ns, "cloudflare.com",
|
||||
)
|
||||
require.NoError(t, err)
|
||||
|
||||
aaaaRecords := resp.Records["AAAA"]
|
||||
require.NotEmpty(t, aaaaRecords,
|
||||
@@ -184,8 +247,13 @@ func TestQueryNameserver_MX(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
r := newTestResolver(t)
|
||||
ns := findOneNSForDomain(t, r, "google.com")
|
||||
resp := liveQueryNameserver(t, r, ns, "google.com")
|
||||
ctx := testContext(t)
|
||||
ns := findOneNSForDomain(t, r, ctx, "google.com")
|
||||
|
||||
resp, err := r.QueryNameserver(
|
||||
ctx, ns, "google.com",
|
||||
)
|
||||
require.NoError(t, err)
|
||||
|
||||
mxRecords := resp.Records["MX"]
|
||||
require.NotEmpty(t, mxRecords,
|
||||
@@ -197,8 +265,13 @@ func TestQueryNameserver_TXT(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
r := newTestResolver(t)
|
||||
ns := findOneNSForDomain(t, r, "google.com")
|
||||
resp := liveQueryNameserver(t, r, ns, "google.com")
|
||||
ctx := testContext(t)
|
||||
ns := findOneNSForDomain(t, r, ctx, "google.com")
|
||||
|
||||
resp, err := r.QueryNameserver(
|
||||
ctx, ns, "google.com",
|
||||
)
|
||||
require.NoError(t, err)
|
||||
|
||||
txtRecords := resp.Records["TXT"]
|
||||
require.NotEmpty(t, txtRecords,
|
||||
@@ -224,10 +297,14 @@ func TestQueryNameserver_NXDomain(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
r := newTestResolver(t)
|
||||
ns := findOneNSForDomain(t, r, "google.com")
|
||||
resp := liveQueryNameserver(
|
||||
t, r, ns, "this-surely-does-not-exist-xyz.google.com",
|
||||
ctx := testContext(t)
|
||||
ns := findOneNSForDomain(t, r, ctx, "google.com")
|
||||
|
||||
resp, err := r.QueryNameserver(
|
||||
ctx, ns,
|
||||
"this-surely-does-not-exist-xyz.google.com",
|
||||
)
|
||||
require.NoError(t, err)
|
||||
|
||||
assert.Equal(t, resolver.StatusNXDomain, resp.Status)
|
||||
}
|
||||
@@ -236,8 +313,13 @@ func TestQueryNameserver_RecordsSorted(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
r := newTestResolver(t)
|
||||
ns := findOneNSForDomain(t, r, "google.com")
|
||||
resp := liveQueryNameserver(t, r, ns, "google.com")
|
||||
ctx := testContext(t)
|
||||
ns := findOneNSForDomain(t, r, ctx, "google.com")
|
||||
|
||||
resp, err := r.QueryNameserver(
|
||||
ctx, ns, "google.com",
|
||||
)
|
||||
require.NoError(t, err)
|
||||
|
||||
for recordType, values := range resp.Records {
|
||||
assert.True(
|
||||
@@ -254,8 +336,13 @@ func TestQueryNameserver_ResponseIncludesNameserver(
|
||||
t.Parallel()
|
||||
|
||||
r := newTestResolver(t)
|
||||
ns := findOneNSForDomain(t, r, "cloudflare.com")
|
||||
resp := liveQueryNameserver(t, r, ns, "cloudflare.com")
|
||||
ctx := testContext(t)
|
||||
ns := findOneNSForDomain(t, r, ctx, "cloudflare.com")
|
||||
|
||||
resp, err := r.QueryNameserver(
|
||||
ctx, ns, "cloudflare.com",
|
||||
)
|
||||
require.NoError(t, err)
|
||||
|
||||
assert.Equal(t, ns, resp.Nameserver)
|
||||
}
|
||||
@@ -266,10 +353,14 @@ func TestQueryNameserver_EmptyRecordsOnNXDomain(
|
||||
t.Parallel()
|
||||
|
||||
r := newTestResolver(t)
|
||||
ns := findOneNSForDomain(t, r, "google.com")
|
||||
resp := liveQueryNameserver(
|
||||
t, r, ns, "this-surely-does-not-exist-xyz.google.com",
|
||||
ctx := testContext(t)
|
||||
ns := findOneNSForDomain(t, r, ctx, "google.com")
|
||||
|
||||
resp, err := r.QueryNameserver(
|
||||
ctx, ns,
|
||||
"this-surely-does-not-exist-xyz.google.com",
|
||||
)
|
||||
require.NoError(t, err)
|
||||
|
||||
totalRecords := 0
|
||||
for _, values := range resp.Records {
|
||||
@@ -283,9 +374,18 @@ func TestQueryNameserver_TrailingDotHandling(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
r := newTestResolver(t)
|
||||
ns := findOneNSForDomain(t, r, "google.com")
|
||||
resp1 := liveQueryNameserver(t, r, ns, "google.com")
|
||||
resp2 := liveQueryNameserver(t, r, ns, "google.com.")
|
||||
ctx := testContext(t)
|
||||
ns := findOneNSForDomain(t, r, ctx, "google.com")
|
||||
|
||||
resp1, err := r.QueryNameserver(
|
||||
ctx, ns, "google.com",
|
||||
)
|
||||
require.NoError(t, err)
|
||||
|
||||
resp2, err := r.QueryNameserver(
|
||||
ctx, ns, "google.com.",
|
||||
)
|
||||
require.NoError(t, err)
|
||||
|
||||
assert.Equal(t, resp1.Status, resp2.Status)
|
||||
}
|
||||
@@ -298,9 +398,15 @@ func TestQueryAllNameservers_ReturnsAllNS(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
r := newTestResolver(t)
|
||||
results := liveQueryAllNameservers(t, r, "google.com")
|
||||
ctx := testContext(t)
|
||||
|
||||
assert.GreaterOrEqual(t, len(results), minNameservers)
|
||||
results, err := r.QueryAllNameservers(
|
||||
ctx, "google.com",
|
||||
)
|
||||
require.NoError(t, err)
|
||||
require.NotEmpty(t, results)
|
||||
|
||||
assert.GreaterOrEqual(t, len(results), 2)
|
||||
|
||||
for ns, resp := range results {
|
||||
assert.Equal(t, ns, resp.Nameserver)
|
||||
@@ -311,36 +417,19 @@ func TestQueryAllNameservers_AllReturnOK(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
r := newTestResolver(t)
|
||||
results := liveQueryAllNameservers(t, r, "google.com")
|
||||
ctx := testContext(t)
|
||||
|
||||
// A quorum, not unanimity: one authoritative server being
|
||||
// slow or rate-limiting us is a property of the live
|
||||
// internet, not a resolver defect.
|
||||
assert.GreaterOrEqual(
|
||||
t,
|
||||
countStatus(results, resolver.StatusOK),
|
||||
liveQuorum(len(results)),
|
||||
"a quorum of nameservers should answer OK: %s",
|
||||
describeStatuses(results),
|
||||
results, err := r.QueryAllNameservers(
|
||||
ctx, "google.com",
|
||||
)
|
||||
require.NoError(t, err)
|
||||
|
||||
// Quorum tolerates SILENCE only. Every individual result must
|
||||
// be either the expected answer or a non-answer: ok, timeout
|
||||
// or error, and nothing else. Stated as a closed allowlist so
|
||||
// that a wrong answer no one thought to ban — nxdomain and
|
||||
// nodata today, any status added later — fails here rather
|
||||
// than sliding through under the quorum.
|
||||
assert.Empty(
|
||||
t,
|
||||
unsanctionedStatuses(
|
||||
results,
|
||||
resolver.StatusOK,
|
||||
resolver.StatusTimeout,
|
||||
resolver.StatusError,
|
||||
),
|
||||
"every nameserver must answer OK or not answer at all: %s",
|
||||
describeStatuses(results),
|
||||
)
|
||||
for ns, resp := range results {
|
||||
assert.Equal(
|
||||
t, resolver.StatusOK, resp.Status,
|
||||
"NS %s should return OK", ns,
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
func TestQueryAllNameservers_NXDomainFromAllNS(
|
||||
@@ -349,34 +438,20 @@ func TestQueryAllNameservers_NXDomainFromAllNS(
|
||||
t.Parallel()
|
||||
|
||||
r := newTestResolver(t)
|
||||
results := liveQueryAllNameservers(
|
||||
t, r, "this-surely-does-not-exist-xyz.google.com",
|
||||
)
|
||||
ctx := testContext(t)
|
||||
|
||||
assert.GreaterOrEqual(
|
||||
t,
|
||||
countStatus(results, resolver.StatusNXDomain),
|
||||
liveQuorum(len(results)),
|
||||
"a quorum of nameservers should report NXDOMAIN: %s",
|
||||
describeStatuses(results),
|
||||
results, err := r.QueryAllNameservers(
|
||||
ctx,
|
||||
"this-surely-does-not-exist-xyz.google.com",
|
||||
)
|
||||
require.NoError(t, err)
|
||||
|
||||
// Silence is tolerated; any actual answer other than NXDOMAIN
|
||||
// is not. Closed allowlist for the same reason as above: a
|
||||
// server answering `ok` or `nodata` for a name that must not
|
||||
// exist is a wrong answer, not a slow one.
|
||||
assert.Empty(
|
||||
t,
|
||||
unsanctionedStatuses(
|
||||
results,
|
||||
resolver.StatusNXDomain,
|
||||
resolver.StatusTimeout,
|
||||
resolver.StatusError,
|
||||
),
|
||||
"every nameserver must report NXDOMAIN or not answer "+
|
||||
"at all: %s",
|
||||
describeStatuses(results),
|
||||
)
|
||||
for ns, resp := range results {
|
||||
assert.Equal(
|
||||
t, resolver.StatusNXDomain, resp.Status,
|
||||
"NS %s should return nxdomain", ns,
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
// ----------------------------------------------------------------
|
||||
@@ -387,7 +462,11 @@ func TestLookupNS_ValidDomain(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
r := newTestResolver(t)
|
||||
nameservers := liveLookupNS(t, r, "google.com")
|
||||
ctx := testContext(t)
|
||||
|
||||
nameservers, err := r.LookupNS(ctx, "google.com")
|
||||
require.NoError(t, err)
|
||||
require.NotEmpty(t, nameservers)
|
||||
|
||||
for _, ns := range nameservers {
|
||||
assert.True(t, strings.HasSuffix(ns, "."),
|
||||
@@ -400,7 +479,10 @@ func TestLookupNS_Sorted(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
r := newTestResolver(t)
|
||||
nameservers := liveLookupNS(t, r, "google.com")
|
||||
ctx := testContext(t)
|
||||
|
||||
nameservers, err := r.LookupNS(ctx, "google.com")
|
||||
require.NoError(t, err)
|
||||
|
||||
assert.True(t, sort.StringsAreSorted(nameservers))
|
||||
}
|
||||
@@ -409,8 +491,15 @@ func TestLookupNS_MatchesFindAuthoritative(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
r := newTestResolver(t)
|
||||
fromLookup := liveLookupNS(t, r, "google.com")
|
||||
fromFind := liveFindAuthoritative(t, r, "google.com")
|
||||
ctx := testContext(t)
|
||||
|
||||
fromLookup, err := r.LookupNS(ctx, "google.com")
|
||||
require.NoError(t, err)
|
||||
|
||||
fromFind, err := r.FindAuthoritativeNameservers(
|
||||
ctx, "google.com",
|
||||
)
|
||||
require.NoError(t, err)
|
||||
|
||||
assert.Equal(t, fromFind, fromLookup)
|
||||
}
|
||||
@@ -423,7 +512,11 @@ func TestResolveIPAddresses_ReturnsIPs(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
r := newTestResolver(t)
|
||||
ips := liveResolveIPs(t, r, "google.com")
|
||||
ctx := testContext(t)
|
||||
|
||||
ips, err := r.ResolveIPAddresses(ctx, "google.com")
|
||||
require.NoError(t, err)
|
||||
require.NotEmpty(t, ips)
|
||||
|
||||
for _, ip := range ips {
|
||||
parsed := net.ParseIP(ip)
|
||||
@@ -437,7 +530,10 @@ func TestResolveIPAddresses_Deduplicated(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
r := newTestResolver(t)
|
||||
ips := liveResolveIPs(t, r, "google.com")
|
||||
ctx := testContext(t)
|
||||
|
||||
ips, err := r.ResolveIPAddresses(ctx, "google.com")
|
||||
require.NoError(t, err)
|
||||
|
||||
seen := make(map[string]bool)
|
||||
|
||||
@@ -451,7 +547,10 @@ func TestResolveIPAddresses_Sorted(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
r := newTestResolver(t)
|
||||
ips := liveResolveIPs(t, r, "google.com")
|
||||
ctx := testContext(t)
|
||||
|
||||
ips, err := r.ResolveIPAddresses(ctx, "google.com")
|
||||
require.NoError(t, err)
|
||||
|
||||
assert.True(t, sort.StringsAreSorted(ips))
|
||||
}
|
||||
@@ -462,10 +561,13 @@ func TestResolveIPAddresses_NXDomainReturnsEmpty(
|
||||
t.Parallel()
|
||||
|
||||
r := newTestResolver(t)
|
||||
ips := liveResolveIPsAllowingEmpty(
|
||||
t, r, "this-surely-does-not-exist-xyz.google.com",
|
||||
)
|
||||
ctx := testContext(t)
|
||||
|
||||
ips, err := r.ResolveIPAddresses(
|
||||
ctx,
|
||||
"this-surely-does-not-exist-xyz.google.com",
|
||||
)
|
||||
require.NoError(t, err)
|
||||
assert.Empty(t, ips)
|
||||
}
|
||||
|
||||
@@ -473,9 +575,11 @@ func TestResolveIPAddresses_CloudflareDomain(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
r := newTestResolver(t)
|
||||
ips := liveResolveIPs(t, r, "cloudflare.com")
|
||||
ctx := testContext(t)
|
||||
|
||||
assert.NotEmpty(t, ips)
|
||||
ips, err := r.ResolveIPAddresses(ctx, "cloudflare.com")
|
||||
require.NoError(t, err)
|
||||
require.NotEmpty(t, ips)
|
||||
}
|
||||
|
||||
// ----------------------------------------------------------------
|
||||
|
||||
@@ -1,14 +1,11 @@
|
||||
package server
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"time"
|
||||
|
||||
"github.com/go-chi/chi/v5"
|
||||
chimw "github.com/go-chi/chi/v5/middleware"
|
||||
"github.com/prometheus/client_golang/prometheus/promhttp"
|
||||
|
||||
"sneak.berlin/go/dnswatcher/static"
|
||||
)
|
||||
|
||||
// requestTimeout is the maximum duration for handling a request.
|
||||
@@ -25,30 +22,14 @@ func (s *Server) SetupRoutes() {
|
||||
s.router.Use(s.mw.CORS())
|
||||
s.router.Use(chimw.Timeout(requestTimeout))
|
||||
|
||||
// Dashboard (read-only web UI)
|
||||
s.router.Get("/", s.handlers.HandleDashboard())
|
||||
|
||||
// Static assets (embedded CSS/JS)
|
||||
s.router.Mount(
|
||||
"/s",
|
||||
http.StripPrefix(
|
||||
"/s",
|
||||
http.FileServer(http.FS(static.Static)),
|
||||
),
|
||||
)
|
||||
|
||||
// Health check (standard well-known path)
|
||||
s.router.Get(
|
||||
"/.well-known/healthcheck",
|
||||
s.handlers.HandleHealthCheck(),
|
||||
)
|
||||
|
||||
// Legacy health check (keep for backward compatibility)
|
||||
// Health check
|
||||
s.router.Get("/health", s.handlers.HandleHealthCheck())
|
||||
|
||||
// API v1 routes
|
||||
s.router.Route("/api/v1", func(r chi.Router) {
|
||||
r.Get("/status", s.handlers.HandleStatus())
|
||||
r.Get("/domains", s.handlers.HandleDomains())
|
||||
r.Get("/hostnames", s.handlers.HandleHostnames())
|
||||
})
|
||||
|
||||
// Metrics endpoint (optional, with basic auth)
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -20,19 +20,3 @@ func NewForTest() *State {
|
||||
config: &config.Config{DataDir: ""},
|
||||
}
|
||||
}
|
||||
|
||||
// NewForTestWithDataDir creates a State backed by the given directory
|
||||
// for tests that need file persistence.
|
||||
func NewForTestWithDataDir(dataDir string) *State {
|
||||
return &State{
|
||||
log: slog.Default(),
|
||||
snapshot: &Snapshot{
|
||||
Version: stateVersion,
|
||||
Domains: make(map[string]*DomainState),
|
||||
Hostnames: make(map[string]*HostnameState),
|
||||
Ports: make(map[string]*PortState),
|
||||
Certificates: make(map[string]*CertificateState),
|
||||
},
|
||||
config: &config.Config{DataDir: dataDir},
|
||||
}
|
||||
}
|
||||
|
||||
@@ -26,12 +26,6 @@ const tlsPort = 443
|
||||
// hoursPerDay converts days to hours for duration calculations.
|
||||
const hoursPerDay = 24
|
||||
|
||||
// Status values recorded for nameserver and certificate checks.
|
||||
const (
|
||||
statusOK = "ok"
|
||||
statusError = "error"
|
||||
)
|
||||
|
||||
// Params contains dependencies for Watcher.
|
||||
type Params struct {
|
||||
fx.In
|
||||
@@ -135,7 +129,6 @@ func (w *Watcher) Run(ctx context.Context) {
|
||||
)
|
||||
|
||||
w.RunOnce(ctx)
|
||||
w.maybeSendTestNotification(ctx)
|
||||
|
||||
dnsTicker := time.NewTicker(w.config.DNSInterval)
|
||||
tlsTicker := time.NewTicker(w.config.TLSInterval)
|
||||
@@ -350,7 +343,7 @@ func buildHostnameState(
|
||||
for ns, recs := range records {
|
||||
hs.RecordsByNameserver[ns] = &state.NameserverRecordState{
|
||||
Records: recs,
|
||||
Status: statusOK,
|
||||
Status: "ok",
|
||||
LastChecked: now,
|
||||
}
|
||||
}
|
||||
@@ -408,7 +401,7 @@ func (w *Watcher) detectNSDisappearances(
|
||||
current map[string]map[string][]string,
|
||||
) {
|
||||
for ns, prevNS := range prev.RecordsByNameserver {
|
||||
if _, ok := current[ns]; ok || prevNS.Status != statusOK {
|
||||
if _, ok := current[ns]; ok || prevNS.Status != "ok" {
|
||||
continue
|
||||
}
|
||||
|
||||
@@ -427,7 +420,7 @@ func (w *Watcher) detectNSDisappearances(
|
||||
|
||||
for ns := range current {
|
||||
prevNS, ok := prev.RecordsByNameserver[ns]
|
||||
if !ok || prevNS.Status != statusError {
|
||||
if !ok || prevNS.Status != "error" {
|
||||
continue
|
||||
}
|
||||
|
||||
@@ -711,7 +704,7 @@ func (w *Watcher) handleTLSError(
|
||||
now time.Time,
|
||||
err error,
|
||||
) {
|
||||
if hasPrev && !w.firstRun && prev.Status == statusOK {
|
||||
if hasPrev && !w.firstRun && prev.Status == "ok" {
|
||||
msg := fmt.Sprintf(
|
||||
"Host: %s\nIP: %s\nError: %s",
|
||||
hostname, ip, err,
|
||||
@@ -727,7 +720,7 @@ func (w *Watcher) handleTLSError(
|
||||
|
||||
w.state.SetCertificateState(
|
||||
certKey, &state.CertificateState{
|
||||
Status: statusError,
|
||||
Status: "error",
|
||||
Error: err.Error(),
|
||||
LastChecked: now,
|
||||
},
|
||||
@@ -754,7 +747,7 @@ func (w *Watcher) handleTLSSuccess(
|
||||
Issuer: cert.Issuer,
|
||||
NotAfter: cert.NotAfter,
|
||||
SubjectAlternativeNames: cert.SubjectAlternativeNames,
|
||||
Status: statusOK,
|
||||
Status: "ok",
|
||||
LastChecked: now,
|
||||
},
|
||||
)
|
||||
@@ -766,7 +759,7 @@ func (w *Watcher) detectTLSChanges(
|
||||
prev *state.CertificateState,
|
||||
cert *tlscheck.CertificateInfo,
|
||||
) {
|
||||
if prev.Status == statusError {
|
||||
if prev.Status == "error" {
|
||||
msg := fmt.Sprintf(
|
||||
"Host: %s\nIP: %s\nTLS recovered",
|
||||
hostname, ip,
|
||||
@@ -861,38 +854,6 @@ func (w *Watcher) saveState() {
|
||||
}
|
||||
}
|
||||
|
||||
// maybeSendTestNotification sends a startup status notification
|
||||
// after the first full scan completes, if SEND_TEST_NOTIFICATION
|
||||
// is enabled. The message is clearly informational ("all ok")
|
||||
// and not an error or anomaly alert.
|
||||
func (w *Watcher) maybeSendTestNotification(ctx context.Context) {
|
||||
if !w.config.SendTestNotification {
|
||||
return
|
||||
}
|
||||
|
||||
snap := w.state.GetSnapshot()
|
||||
|
||||
msg := fmt.Sprintf(
|
||||
"dnswatcher has started and completed its initial scan.\n"+
|
||||
"Monitoring %d domain(s) and %d hostname(s).\n"+
|
||||
"Tracking %d port endpoint(s) and %d TLS certificate(s).\n"+
|
||||
"All notification channels are working.",
|
||||
len(snap.Domains),
|
||||
len(snap.Hostnames),
|
||||
len(snap.Ports),
|
||||
len(snap.Certificates),
|
||||
)
|
||||
|
||||
w.log.Info("sending startup test notification")
|
||||
|
||||
w.notify.SendNotification(
|
||||
ctx,
|
||||
"✅ dnswatcher startup complete",
|
||||
msg,
|
||||
"success",
|
||||
)
|
||||
}
|
||||
|
||||
// --- Utility functions ---
|
||||
|
||||
func toSet(items []string) map[string]bool {
|
||||
|
||||
@@ -18,17 +18,6 @@ import (
|
||||
// errNotFound is returned when mock data is missing.
|
||||
var errNotFound = errors.New("not found")
|
||||
|
||||
// Fixture values shared across tests.
|
||||
const (
|
||||
testDomain = "example.com"
|
||||
testHost = "www.example.com"
|
||||
testNS1 = "ns1.example.com."
|
||||
testNS2 = "ns2.example.com."
|
||||
testIPv4 = "93.184.216.34"
|
||||
testIP = "1.2.3.4"
|
||||
testIssuer = "DigiCert"
|
||||
)
|
||||
|
||||
// --- Mock implementations ---
|
||||
|
||||
type mockResolver struct {
|
||||
@@ -267,8 +256,8 @@ func TestFirstRunBaseline(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
cfg := defaultTestConfig(t)
|
||||
cfg.Domains = []string{testDomain}
|
||||
cfg.Hostnames = []string{testHost}
|
||||
cfg.Domains = []string{"example.com"}
|
||||
cfg.Hostnames = []string{"www.example.com"}
|
||||
|
||||
w, deps := newTestWatcher(t, cfg)
|
||||
setupBaselineMocks(deps)
|
||||
@@ -280,37 +269,37 @@ func TestFirstRunBaseline(t *testing.T) {
|
||||
}
|
||||
|
||||
func setupBaselineMocks(deps *testDeps) {
|
||||
deps.resolver.nsRecords[testDomain] = []string{
|
||||
testNS1,
|
||||
testNS2,
|
||||
deps.resolver.nsRecords["example.com"] = []string{
|
||||
"ns1.example.com.",
|
||||
"ns2.example.com.",
|
||||
}
|
||||
deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
|
||||
testNS1: {"A": {testIPv4}},
|
||||
testNS2: {"A": {testIPv4}},
|
||||
deps.resolver.allRecords["example.com"] = map[string]map[string][]string{
|
||||
"ns1.example.com.": {"A": {"93.184.216.34"}},
|
||||
"ns2.example.com.": {"A": {"93.184.216.34"}},
|
||||
}
|
||||
deps.resolver.allRecords[testHost] = map[string]map[string][]string{
|
||||
testNS1: {"A": {testIPv4}},
|
||||
testNS2: {"A": {testIPv4}},
|
||||
deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
|
||||
"ns1.example.com.": {"A": {"93.184.216.34"}},
|
||||
"ns2.example.com.": {"A": {"93.184.216.34"}},
|
||||
}
|
||||
deps.resolver.ipAddresses[testHost] = []string{
|
||||
testIPv4,
|
||||
deps.resolver.ipAddresses["www.example.com"] = []string{
|
||||
"93.184.216.34",
|
||||
}
|
||||
deps.portChecker.results["93.184.216.34:80"] = true
|
||||
deps.portChecker.results["93.184.216.34:443"] = true
|
||||
deps.tlsChecker.certs["93.184.216.34:www.example.com"] = &tlscheck.CertificateInfo{
|
||||
CommonName: testHost,
|
||||
Issuer: testIssuer,
|
||||
CommonName: "www.example.com",
|
||||
Issuer: "DigiCert",
|
||||
NotAfter: time.Now().Add(90 * 24 * time.Hour),
|
||||
SubjectAlternativeNames: []string{
|
||||
testHost,
|
||||
"www.example.com",
|
||||
},
|
||||
}
|
||||
deps.tlsChecker.certs["93.184.216.34:example.com"] = &tlscheck.CertificateInfo{
|
||||
CommonName: testDomain,
|
||||
Issuer: testIssuer,
|
||||
CommonName: "example.com",
|
||||
Issuer: "DigiCert",
|
||||
NotAfter: time.Now().Add(90 * 24 * time.Hour),
|
||||
SubjectAlternativeNames: []string{
|
||||
testDomain,
|
||||
"example.com",
|
||||
},
|
||||
}
|
||||
}
|
||||
@@ -359,24 +348,24 @@ func TestDomainPortAndTLSChecks(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
cfg := defaultTestConfig(t)
|
||||
cfg.Domains = []string{testDomain}
|
||||
cfg.Domains = []string{"example.com"}
|
||||
|
||||
w, deps := newTestWatcher(t, cfg)
|
||||
|
||||
deps.resolver.nsRecords[testDomain] = []string{
|
||||
testNS1,
|
||||
deps.resolver.nsRecords["example.com"] = []string{
|
||||
"ns1.example.com.",
|
||||
}
|
||||
deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
|
||||
testNS1: {"A": {testIPv4}},
|
||||
deps.resolver.allRecords["example.com"] = map[string]map[string][]string{
|
||||
"ns1.example.com.": {"A": {"93.184.216.34"}},
|
||||
}
|
||||
deps.portChecker.results["93.184.216.34:80"] = true
|
||||
deps.portChecker.results["93.184.216.34:443"] = true
|
||||
deps.tlsChecker.certs["93.184.216.34:example.com"] = &tlscheck.CertificateInfo{
|
||||
CommonName: testDomain,
|
||||
Issuer: testIssuer,
|
||||
CommonName: "example.com",
|
||||
Issuer: "DigiCert",
|
||||
NotAfter: time.Now().Add(90 * 24 * time.Hour),
|
||||
SubjectAlternativeNames: []string{
|
||||
testDomain,
|
||||
"example.com",
|
||||
},
|
||||
}
|
||||
|
||||
@@ -417,17 +406,17 @@ func TestNSChangeDetection(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
cfg := defaultTestConfig(t)
|
||||
cfg.Domains = []string{testDomain}
|
||||
cfg.Domains = []string{"example.com"}
|
||||
|
||||
w, deps := newTestWatcher(t, cfg)
|
||||
|
||||
deps.resolver.nsRecords[testDomain] = []string{
|
||||
testNS1,
|
||||
testNS2,
|
||||
deps.resolver.nsRecords["example.com"] = []string{
|
||||
"ns1.example.com.",
|
||||
"ns2.example.com.",
|
||||
}
|
||||
deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
|
||||
testNS1: {"A": {testIP}},
|
||||
testNS2: {"A": {testIP}},
|
||||
deps.resolver.allRecords["example.com"] = map[string]map[string][]string{
|
||||
"ns1.example.com.": {"A": {"1.2.3.4"}},
|
||||
"ns2.example.com.": {"A": {"1.2.3.4"}},
|
||||
}
|
||||
deps.portChecker.results["1.2.3.4:80"] = false
|
||||
deps.portChecker.results["1.2.3.4:443"] = false
|
||||
@@ -436,13 +425,13 @@ func TestNSChangeDetection(t *testing.T) {
|
||||
w.RunOnce(ctx)
|
||||
|
||||
deps.resolver.mu.Lock()
|
||||
deps.resolver.nsRecords[testDomain] = []string{
|
||||
testNS1,
|
||||
deps.resolver.nsRecords["example.com"] = []string{
|
||||
"ns1.example.com.",
|
||||
"ns3.example.com.",
|
||||
}
|
||||
deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
|
||||
testNS1: {"A": {testIP}},
|
||||
"ns3.example.com.": {"A": {testIP}},
|
||||
deps.resolver.allRecords["example.com"] = map[string]map[string][]string{
|
||||
"ns1.example.com.": {"A": {"1.2.3.4"}},
|
||||
"ns3.example.com.": {"A": {"1.2.3.4"}},
|
||||
}
|
||||
deps.resolver.mu.Unlock()
|
||||
|
||||
@@ -470,15 +459,15 @@ func TestRecordChangeDetection(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
cfg := defaultTestConfig(t)
|
||||
cfg.Hostnames = []string{testHost}
|
||||
cfg.Hostnames = []string{"www.example.com"}
|
||||
|
||||
w, deps := newTestWatcher(t, cfg)
|
||||
|
||||
deps.resolver.allRecords[testHost] = map[string]map[string][]string{
|
||||
testNS1: {"A": {testIPv4}},
|
||||
deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
|
||||
"ns1.example.com.": {"A": {"93.184.216.34"}},
|
||||
}
|
||||
deps.resolver.ipAddresses[testHost] = []string{
|
||||
testIPv4,
|
||||
deps.resolver.ipAddresses["www.example.com"] = []string{
|
||||
"93.184.216.34",
|
||||
}
|
||||
deps.portChecker.results["93.184.216.34:80"] = false
|
||||
deps.portChecker.results["93.184.216.34:443"] = false
|
||||
@@ -487,10 +476,10 @@ func TestRecordChangeDetection(t *testing.T) {
|
||||
w.RunOnce(ctx)
|
||||
|
||||
deps.resolver.mu.Lock()
|
||||
deps.resolver.allRecords[testHost] = map[string]map[string][]string{
|
||||
testNS1: {"A": {"93.184.216.35"}},
|
||||
deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
|
||||
"ns1.example.com.": {"A": {"93.184.216.35"}},
|
||||
}
|
||||
deps.resolver.ipAddresses[testHost] = []string{
|
||||
deps.resolver.ipAddresses["www.example.com"] = []string{
|
||||
"93.184.216.35",
|
||||
}
|
||||
deps.resolver.mu.Unlock()
|
||||
@@ -512,24 +501,24 @@ func TestPortStateChange(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
cfg := defaultTestConfig(t)
|
||||
cfg.Hostnames = []string{testHost}
|
||||
cfg.Hostnames = []string{"www.example.com"}
|
||||
|
||||
w, deps := newTestWatcher(t, cfg)
|
||||
|
||||
deps.resolver.allRecords[testHost] = map[string]map[string][]string{
|
||||
testNS1: {"A": {testIP}},
|
||||
deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
|
||||
"ns1.example.com.": {"A": {"1.2.3.4"}},
|
||||
}
|
||||
deps.resolver.ipAddresses[testHost] = []string{
|
||||
testIP,
|
||||
deps.resolver.ipAddresses["www.example.com"] = []string{
|
||||
"1.2.3.4",
|
||||
}
|
||||
deps.portChecker.results["1.2.3.4:80"] = true
|
||||
deps.portChecker.results["1.2.3.4:443"] = true
|
||||
deps.tlsChecker.certs["1.2.3.4:www.example.com"] = &tlscheck.CertificateInfo{
|
||||
CommonName: testHost,
|
||||
Issuer: testIssuer,
|
||||
CommonName: "www.example.com",
|
||||
Issuer: "DigiCert",
|
||||
NotAfter: time.Now().Add(90 * 24 * time.Hour),
|
||||
SubjectAlternativeNames: []string{
|
||||
testHost,
|
||||
"www.example.com",
|
||||
},
|
||||
}
|
||||
|
||||
@@ -552,24 +541,24 @@ func TestTLSExpiryWarning(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
cfg := defaultTestConfig(t)
|
||||
cfg.Hostnames = []string{testHost}
|
||||
cfg.Hostnames = []string{"www.example.com"}
|
||||
|
||||
w, deps := newTestWatcher(t, cfg)
|
||||
|
||||
deps.resolver.allRecords[testHost] = map[string]map[string][]string{
|
||||
testNS1: {"A": {testIP}},
|
||||
deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
|
||||
"ns1.example.com.": {"A": {"1.2.3.4"}},
|
||||
}
|
||||
deps.resolver.ipAddresses[testHost] = []string{
|
||||
testIP,
|
||||
deps.resolver.ipAddresses["www.example.com"] = []string{
|
||||
"1.2.3.4",
|
||||
}
|
||||
deps.portChecker.results["1.2.3.4:80"] = true
|
||||
deps.portChecker.results["1.2.3.4:443"] = true
|
||||
deps.tlsChecker.certs["1.2.3.4:www.example.com"] = &tlscheck.CertificateInfo{
|
||||
CommonName: testHost,
|
||||
Issuer: testIssuer,
|
||||
CommonName: "www.example.com",
|
||||
Issuer: "DigiCert",
|
||||
NotAfter: time.Now().Add(3 * 24 * time.Hour),
|
||||
SubjectAlternativeNames: []string{
|
||||
testHost,
|
||||
"www.example.com",
|
||||
},
|
||||
}
|
||||
|
||||
@@ -603,25 +592,25 @@ func TestTLSExpiryWarningDedup(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
cfg := defaultTestConfig(t)
|
||||
cfg.Hostnames = []string{testHost}
|
||||
cfg.Hostnames = []string{"www.example.com"}
|
||||
cfg.TLSInterval = 24 * time.Hour
|
||||
|
||||
w, deps := newTestWatcher(t, cfg)
|
||||
|
||||
deps.resolver.allRecords[testHost] = map[string]map[string][]string{
|
||||
testNS1: {"A": {testIP}},
|
||||
deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
|
||||
"ns1.example.com.": {"A": {"1.2.3.4"}},
|
||||
}
|
||||
deps.resolver.ipAddresses[testHost] = []string{
|
||||
testIP,
|
||||
deps.resolver.ipAddresses["www.example.com"] = []string{
|
||||
"1.2.3.4",
|
||||
}
|
||||
deps.portChecker.results["1.2.3.4:80"] = true
|
||||
deps.portChecker.results["1.2.3.4:443"] = true
|
||||
deps.tlsChecker.certs["1.2.3.4:www.example.com"] = &tlscheck.CertificateInfo{
|
||||
CommonName: testHost,
|
||||
Issuer: testIssuer,
|
||||
CommonName: "www.example.com",
|
||||
Issuer: "DigiCert",
|
||||
NotAfter: time.Now().Add(3 * 24 * time.Hour),
|
||||
SubjectAlternativeNames: []string{
|
||||
testHost,
|
||||
"www.example.com",
|
||||
},
|
||||
}
|
||||
|
||||
@@ -658,17 +647,17 @@ func TestGracefulShutdown(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
cfg := defaultTestConfig(t)
|
||||
cfg.Domains = []string{testDomain}
|
||||
cfg.Domains = []string{"example.com"}
|
||||
cfg.DNSInterval = 100 * time.Millisecond
|
||||
cfg.TLSInterval = 100 * time.Millisecond
|
||||
|
||||
w, deps := newTestWatcher(t, cfg)
|
||||
|
||||
deps.resolver.nsRecords[testDomain] = []string{
|
||||
testNS1,
|
||||
deps.resolver.nsRecords["example.com"] = []string{
|
||||
"ns1.example.com.",
|
||||
}
|
||||
deps.resolver.allRecords[testDomain] = map[string]map[string][]string{
|
||||
testNS1: {"A": {testIP}},
|
||||
deps.resolver.allRecords["example.com"] = map[string]map[string][]string{
|
||||
"ns1.example.com.": {"A": {"1.2.3.4"}},
|
||||
}
|
||||
deps.portChecker.results["1.2.3.4:80"] = false
|
||||
deps.portChecker.results["1.2.3.4:443"] = false
|
||||
@@ -698,13 +687,13 @@ func setupHostnameIP(
|
||||
hostname, ip string,
|
||||
) {
|
||||
deps.resolver.allRecords[hostname] = map[string]map[string][]string{
|
||||
testNS1: {"A": {ip}},
|
||||
"ns1.example.com.": {"A": {ip}},
|
||||
}
|
||||
deps.portChecker.results[ip+":80"] = true
|
||||
deps.portChecker.results[ip+":443"] = true
|
||||
deps.tlsChecker.certs[ip+":"+hostname] = &tlscheck.CertificateInfo{
|
||||
CommonName: hostname,
|
||||
Issuer: testIssuer,
|
||||
Issuer: "DigiCert",
|
||||
NotAfter: time.Now().Add(90 * 24 * time.Hour),
|
||||
SubjectAlternativeNames: []string{hostname},
|
||||
}
|
||||
@@ -713,7 +702,7 @@ func setupHostnameIP(
|
||||
func updateHostnameIP(deps *testDeps, hostname, ip string) {
|
||||
deps.resolver.mu.Lock()
|
||||
deps.resolver.allRecords[hostname] = map[string]map[string][]string{
|
||||
testNS1: {"A": {ip}},
|
||||
"ns1.example.com.": {"A": {ip}},
|
||||
}
|
||||
deps.resolver.mu.Unlock()
|
||||
|
||||
@@ -725,7 +714,7 @@ func updateHostnameIP(deps *testDeps, hostname, ip string) {
|
||||
deps.tlsChecker.mu.Lock()
|
||||
deps.tlsChecker.certs[ip+":"+hostname] = &tlscheck.CertificateInfo{
|
||||
CommonName: hostname,
|
||||
Issuer: testIssuer,
|
||||
Issuer: "DigiCert",
|
||||
NotAfter: time.Now().Add(90 * 24 * time.Hour),
|
||||
SubjectAlternativeNames: []string{hostname},
|
||||
}
|
||||
@@ -736,11 +725,11 @@ func TestDNSRunsBeforePortAndTLSChecks(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
cfg := defaultTestConfig(t)
|
||||
cfg.Hostnames = []string{testHost}
|
||||
cfg.Hostnames = []string{"www.example.com"}
|
||||
|
||||
w, deps := newTestWatcher(t, cfg)
|
||||
|
||||
setupHostnameIP(deps, testHost, "10.0.0.1")
|
||||
setupHostnameIP(deps, "www.example.com", "10.0.0.1")
|
||||
|
||||
ctx := t.Context()
|
||||
w.RunOnce(ctx)
|
||||
@@ -751,7 +740,7 @@ func TestDNSRunsBeforePortAndTLSChecks(t *testing.T) {
|
||||
}
|
||||
|
||||
// DNS changes to a new IP; port and TLS must pick it up.
|
||||
updateHostnameIP(deps, testHost, "10.0.0.2")
|
||||
updateHostnameIP(deps, "www.example.com", "10.0.0.2")
|
||||
|
||||
w.RunOnce(ctx)
|
||||
|
||||
@@ -767,131 +756,20 @@ func TestDNSRunsBeforePortAndTLSChecks(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
func TestSendTestNotification_Enabled(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
cfg := defaultTestConfig(t)
|
||||
cfg.Domains = []string{testDomain}
|
||||
cfg.Hostnames = []string{testHost}
|
||||
cfg.SendTestNotification = true
|
||||
|
||||
w, deps := newTestWatcher(t, cfg)
|
||||
setupBaselineMocks(deps)
|
||||
|
||||
w.RunOnce(t.Context())
|
||||
|
||||
// RunOnce does not send the test notification — it is
|
||||
// sent by Run after RunOnce completes. Call the exported
|
||||
// RunOnce then check that no test notification was sent
|
||||
// (only Run triggers it). We test the full path via Run.
|
||||
notifications := deps.notifier.getNotifications()
|
||||
if len(notifications) != 0 {
|
||||
t.Errorf(
|
||||
"RunOnce should not send test notification, got %d",
|
||||
len(notifications),
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSendTestNotification_ViaRun(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
cfg := defaultTestConfig(t)
|
||||
cfg.Domains = []string{testDomain}
|
||||
cfg.Hostnames = []string{testHost}
|
||||
cfg.SendTestNotification = true
|
||||
cfg.DNSInterval = 24 * time.Hour
|
||||
cfg.TLSInterval = 24 * time.Hour
|
||||
|
||||
w, deps := newTestWatcher(t, cfg)
|
||||
setupBaselineMocks(deps)
|
||||
|
||||
ctx, cancel := context.WithCancel(t.Context())
|
||||
|
||||
done := make(chan struct{})
|
||||
|
||||
go func() {
|
||||
w.Run(ctx)
|
||||
close(done)
|
||||
}()
|
||||
|
||||
// Wait for the initial scan and test notification.
|
||||
time.Sleep(500 * time.Millisecond)
|
||||
cancel()
|
||||
|
||||
<-done
|
||||
|
||||
notifications := deps.notifier.getNotifications()
|
||||
|
||||
found := false
|
||||
|
||||
for _, n := range notifications {
|
||||
if n.Priority == "success" &&
|
||||
n.Title == "✅ dnswatcher startup complete" {
|
||||
found = true
|
||||
}
|
||||
}
|
||||
|
||||
if !found {
|
||||
t.Errorf(
|
||||
"expected startup test notification, got: %v",
|
||||
notifications,
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSendTestNotification_Disabled(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
cfg := defaultTestConfig(t)
|
||||
cfg.Domains = []string{testDomain}
|
||||
cfg.Hostnames = []string{testHost}
|
||||
cfg.SendTestNotification = false
|
||||
cfg.DNSInterval = 24 * time.Hour
|
||||
cfg.TLSInterval = 24 * time.Hour
|
||||
|
||||
w, deps := newTestWatcher(t, cfg)
|
||||
setupBaselineMocks(deps)
|
||||
|
||||
ctx, cancel := context.WithCancel(t.Context())
|
||||
|
||||
done := make(chan struct{})
|
||||
|
||||
go func() {
|
||||
w.Run(ctx)
|
||||
close(done)
|
||||
}()
|
||||
|
||||
time.Sleep(500 * time.Millisecond)
|
||||
cancel()
|
||||
|
||||
<-done
|
||||
|
||||
notifications := deps.notifier.getNotifications()
|
||||
|
||||
for _, n := range notifications {
|
||||
if n.Title == "✅ dnswatcher startup complete" {
|
||||
t.Error(
|
||||
"test notification should not be sent when disabled",
|
||||
)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestNSFailureAndRecovery(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
cfg := defaultTestConfig(t)
|
||||
cfg.Hostnames = []string{testHost}
|
||||
cfg.Hostnames = []string{"www.example.com"}
|
||||
|
||||
w, deps := newTestWatcher(t, cfg)
|
||||
|
||||
deps.resolver.allRecords[testHost] = map[string]map[string][]string{
|
||||
testNS1: {"A": {testIP}},
|
||||
testNS2: {"A": {testIP}},
|
||||
deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
|
||||
"ns1.example.com.": {"A": {"1.2.3.4"}},
|
||||
"ns2.example.com.": {"A": {"1.2.3.4"}},
|
||||
}
|
||||
deps.resolver.ipAddresses[testHost] = []string{
|
||||
testIP,
|
||||
deps.resolver.ipAddresses["www.example.com"] = []string{
|
||||
"1.2.3.4",
|
||||
}
|
||||
deps.portChecker.results["1.2.3.4:80"] = false
|
||||
deps.portChecker.results["1.2.3.4:443"] = false
|
||||
@@ -901,8 +779,8 @@ func TestNSFailureAndRecovery(t *testing.T) {
|
||||
w.RunOnce(ctx)
|
||||
|
||||
deps.resolver.mu.Lock()
|
||||
deps.resolver.allRecords[testHost] = map[string]map[string][]string{
|
||||
testNS1: {"A": {testIP}},
|
||||
deps.resolver.allRecords["www.example.com"] = map[string]map[string][]string{
|
||||
"ns1.example.com.": {"A": {"1.2.3.4"}},
|
||||
}
|
||||
deps.resolver.mu.Unlock()
|
||||
|
||||
|
||||
@@ -1,90 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/bootstrap: install all dependencies needed to build and develop
|
||||
# this repo. Idempotent: every install is guarded by a check so already
|
||||
# installed tools are skipped. Base tooling comes from nix, apt, brew,
|
||||
# or apk (detected in that order); assumes nothing is present.
|
||||
# goimports is installed via `go install` at a pinned commit (never
|
||||
# "latest") because script/fmt runs it on the host; script/fmt-check
|
||||
# does not (it runs gofmt only).
|
||||
# The linter is NOT installed here: golangci-lint runs via docker only
|
||||
# (script/lint), pinned by image digest, so its only prerequisite is a
|
||||
# working docker.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
# Pinned version, 2026-08-07 (same pin as the Dockerfile)
|
||||
# goimports v0.42.0
|
||||
GOIMPORTS_REF="golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0"
|
||||
|
||||
PKGMGR=""
|
||||
SUDO=""
|
||||
APT_UPDATED=""
|
||||
|
||||
detect_pkgmgr() {
|
||||
[ -n "$PKGMGR" ] && return 0
|
||||
if command -v nix-env >/dev/null 2>&1; then
|
||||
PKGMGR="nix"
|
||||
elif command -v apt-get >/dev/null 2>&1; then
|
||||
PKGMGR="apt"
|
||||
elif command -v brew >/dev/null 2>&1; then
|
||||
PKGMGR="brew"
|
||||
elif command -v apk >/dev/null 2>&1; then
|
||||
PKGMGR="apk"
|
||||
else
|
||||
echo "bootstrap: no supported package manager (nix, apt, brew, apk)" >&2
|
||||
exit 1
|
||||
fi
|
||||
if [ "$PKGMGR" = "apt" ]; then
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
if [ "$(id -u)" != "0" ]; then
|
||||
SUDO="sudo"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# pkg_install <nix-attr> <apt-pkg> <brew-formula> <apk-pkg>
|
||||
pkg_install() {
|
||||
detect_pkgmgr
|
||||
case "$PKGMGR" in
|
||||
nix) nix-env -iA "nixpkgs.$1" ;;
|
||||
apt)
|
||||
if [ -z "$APT_UPDATED" ]; then
|
||||
$SUDO env DEBIAN_FRONTEND=noninteractive apt-get update
|
||||
APT_UPDATED=1
|
||||
fi
|
||||
$SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2"
|
||||
;;
|
||||
brew) brew install "$3" ;;
|
||||
apk) apk add --no-cache "$4" ;;
|
||||
esac
|
||||
}
|
||||
|
||||
missing() {
|
||||
! command -v "$1" >/dev/null 2>&1
|
||||
}
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
|
||||
if missing git; then pkg_install git git git git; fi
|
||||
if missing make; then pkg_install gnumake make make make; fi
|
||||
if missing go; then pkg_install go golang go go; fi
|
||||
|
||||
# Format tools, pinned via go install (installs into
|
||||
# "$(go env GOPATH)/bin"; ensure that is on your PATH).
|
||||
if missing goimports; then go install "$GOIMPORTS_REF"; fi
|
||||
|
||||
# Linting runs via docker only (script/lint). Warn, don't fail:
|
||||
# everything except `make lint` works without it.
|
||||
if missing docker; then
|
||||
echo "bootstrap: WARNING: docker not found; install it to" \
|
||||
"run make lint and make docker." >&2
|
||||
fi
|
||||
|
||||
go mod download
|
||||
|
||||
echo "bootstrap complete"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
14
script/check
14
script/check
@@ -1,14 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/check: run all checks (test, lint, fmt-check). Our own
|
||||
# extension to scripts-to-rule-them-all. Must not modify any files.
|
||||
set -eu
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
||||
|
||||
main() {
|
||||
"$SCRIPT_DIR/test"
|
||||
"$SCRIPT_DIR/lint"
|
||||
"$SCRIPT_DIR/fmt-check"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,14 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/cibuild: run the CI build. The Dockerfile's lint stage runs
|
||||
# make fmt-check and golangci-lint; its builder stage runs make test
|
||||
# and make build. A successful build implies all of those passed.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
docker build .
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,14 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/docker: build the Docker image tagged with the project name.
|
||||
# Identical in all repos; the tag comes from script/projectname.
|
||||
set -eu
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
||||
ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
docker build -t "$("$SCRIPT_DIR/projectname")" .
|
||||
}
|
||||
|
||||
main "$@"
|
||||
13
script/fmt
13
script/fmt
@@ -1,13 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/fmt: format all files (writes).
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
gofmt -s -w .
|
||||
goimports -w .
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,18 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/fmt-check: check formatting (read-only). Same scope as
|
||||
# script/fmt, but fails instead of writing.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
files="$(gofmt -l .)"
|
||||
if [ -n "$files" ]; then
|
||||
echo "gofmt: files not formatted:" >&2
|
||||
echo "$files" >&2
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,16 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/install-precommit: install the git pre-commit hook that runs
|
||||
# script/precommit. Our own extension to scripts-to-rule-them-all.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
hook=".git/hooks/pre-commit"
|
||||
printf '#!/bin/sh\nset -e\nscript/precommit\n' > "$hook"
|
||||
chmod +x "$hook"
|
||||
echo "pre-commit hook installed: runs script/precommit"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
28
script/lint
28
script/lint
@@ -1,28 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/lint: run the linter. golangci-lint is never installed or run
|
||||
# on the host: it runs via docker only, one way, everywhere. This
|
||||
# builds Dockerfile.lint, which COPYs the repo into the digest-pinned
|
||||
# golangci-lint image and lints as a build step, so a successful build
|
||||
# means a clean lint.
|
||||
#
|
||||
# --no-cache-filter=lint forces the lint stage (source copy + linter
|
||||
# run) to execute on every invocation. Without it an unchanged tree
|
||||
# returns success in well under a second having linted nothing. The
|
||||
# deps stage (base image + go mod download) stays cached, and no global
|
||||
# cache invalidation is performed. --progress=plain keeps the linter's
|
||||
# own output visible.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
docker build \
|
||||
--progress=plain \
|
||||
--no-cache-filter=lint \
|
||||
--target lint \
|
||||
-f Dockerfile.lint \
|
||||
.
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,21 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/precommit: run by the git pre-commit hook; fails the commit if
|
||||
# checks fail. Our own extension to scripts-to-rule-them-all. Go extra:
|
||||
# go mod tidy must be a no-op before the checks run.
|
||||
set -eu
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
||||
ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
go mod tidy
|
||||
if ! git diff --exit-code -- go.mod go.sum; then
|
||||
echo "precommit: go mod tidy changed go.mod/go.sum;" \
|
||||
"stage the changes and retry" >&2
|
||||
exit 1
|
||||
fi
|
||||
"$SCRIPT_DIR/check"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,12 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/projectname: output the name of this project. Our own
|
||||
# extension to scripts-to-rule-them-all. Other scripts that need the
|
||||
# name (e.g. script/docker) call this, so they can stay identical
|
||||
# across all repos.
|
||||
set -eu
|
||||
|
||||
main() {
|
||||
echo "dnswatcher"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
13
script/setup
13
script/setup
@@ -1,13 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/setup: set up the repo for development after a fresh clone:
|
||||
# installs dependencies and the git pre-commit hook.
|
||||
set -eu
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
||||
|
||||
main() {
|
||||
"$SCRIPT_DIR/bootstrap"
|
||||
"$SCRIPT_DIR/install-precommit"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
35
script/test
35
script/test
@@ -1,35 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/test: run the test suite.
|
||||
#
|
||||
# -count=1 disables Go's test cache, and is load-bearing here. This
|
||||
# suite queries live DNS on every run by policy (TESTING.md); a cached
|
||||
# result is a replay of an earlier run's output with no query made at
|
||||
# all. On an unchanged tree the whole suite would return success in
|
||||
# under a second having resolved nothing, which makes the repeated-run
|
||||
# green that is used as evidence for flakiness fixes worthless. Do not
|
||||
# remove it.
|
||||
#
|
||||
# Conditional verbose rerun per REPO_POLICIES.md: run quiet first so
|
||||
# CI and docker build logs stay readable, and rerun with -v only on
|
||||
# failure. The rerun also carries -count=1 (a cached replay of the
|
||||
# failure would show nothing new), and the exit status is forced to 1
|
||||
# no matter how the rerun ends: the first failure already proved the
|
||||
# suite broken, so a flaky test that passes the second time must not
|
||||
# turn the build green.
|
||||
#
|
||||
# -timeout 90s is a deliberate backstop above the 60s hard cap on
|
||||
# suite duration. Do not lower it.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
go test -count=1 -race -timeout 90s -cover ./... || {
|
||||
echo "--- Rerunning with -v for details ---" >&2
|
||||
go test -count=1 -race -timeout 90s -v ./... || true
|
||||
exit 1
|
||||
}
|
||||
}
|
||||
|
||||
main "$@"
|
||||
1
static/css/tailwind.min.css
vendored
1
static/css/tailwind.min.css
vendored
File diff suppressed because one or more lines are too long
@@ -1,10 +0,0 @@
|
||||
// Package static provides embedded static assets.
|
||||
package static
|
||||
|
||||
import "embed"
|
||||
|
||||
// Static contains the embedded static assets (CSS, JS) served
|
||||
// at the /s/ URL prefix.
|
||||
//
|
||||
//go:embed css
|
||||
var Static embed.FS
|
||||
Reference in New Issue
Block a user