next into main (#73)

Reviewed-on: #73

.dockerignore

@@ -4,6 +4,3 @@ tmp
 .DS_Store
 *.log
 .claude
-
-# .git is sent so the build can stamp the version, without its config.
-.git/config

Dockerfile

@@ -20,10 +20,7 @@ RUN make lint
 # golang:1.25-alpine (2026-02-27)
 FROM golang:1.25-alpine@sha256:f6751d823c26342f9506c03797d2527668d095b0a15f1862cddb4d927a7a4ced AS builder
 
-# gcc and musl-dev are for make test: its race detector needs cgo, which
-# Go turns on by itself once a C compiler is present. make build still
-# sets CGO_ENABLED=0, so the binary stays static.
-RUN apk add --no-cache gcc git make musl-dev
+RUN apk add --no-cache make
 
 WORKDIR /src
 
@@ -40,24 +37,11 @@ RUN make test
 
 # make build is a shim around backend/script/build, the one definition
 # of the build command:
-# CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X main.Version=..."
+# CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X main.Version=... -X main.Buildarch=..."
 # That script reads VERSION from the environment, so it is handed over
 # there rather than as a make variable.
-#
-# The version is the VERSION build argument when one is given, otherwise
-# `git describe --tags --always` of the repo's .git: the tag on a tagged
-# commit, tag-N-gHASH on a commit after one, the short commit when no
-# tag is reachable. A version that still comes out empty, dev or unknown
-# fails the build. .git goes to /git, not /src/.git, where go build would
-# find it and record VCS details of a work tree holding only backend/.
-COPY .git /git
-ARG VERSION
-RUN version="${VERSION:-$(git --git-dir=/git describe --tags --always)}"; \
-    case "$version" in ""|dev|unknown) \
-        echo "version is '$version' although .git is present" >&2; \
-        exit 1 ;; \
-    esac; \
-    VERSION="$version" make build
+ARG VERSION=dev
+RUN VERSION="${VERSION}" make build
 
 # Frontend stage
 # node:22-alpine as of 2026-02-22

README.md

@@ -45,8 +45,8 @@ halves, so the root `make check` fails if either one is broken. We provide:
 - `script/setup` — make a fresh clone ready for development: bootstrap plus the
   git pre-commit hook
 - `script/projectname` — print the project name (used for the Docker image tag)
-- `script/test` — run `script/frontend-test`, then the backend's Go tests, each
-  under its own 30-second timeout
+- `script/test` — run `script/frontend-test`, then the backend's Go tests, both
+  within one 30-second timeout
 - `script/lint` — run `script/frontend-lint`, then golangci-lint in Docker, by
   building the lint stage of `Dockerfile` without the cache
 - `script/fmt` — format all files (writes): prettier, then gofmt over `backend/`

TODO.md

@@ -23,16 +23,6 @@ latest run passes.
 
 # Completed Steps
 
-- 2026-10-03: the Go tests run with the race detector and coverage (issue #88):
-  `backend/script/test` runs `go test -timeout 30s -race -cover ./...` and, if
-  that fails, runs it again with `-v` and fails. Go's `-timeout` bounds the
-  tests, not their compile; the root `script/test` no longer puts one 30-second
-  timeout around both halves, which a cold Go build cache could use up on
-  compiling alone. The builder stage of `Dockerfile` has gcc and musl-dev for
-  the race detector; the binary is still built with `CGO_ENABLED=0`. New tests
-  cover the health check's answer, a valid report's answer, a report file's
-  exact contents, and the flush when the buffer reaches 10 MiB; the handlers'
-  `TestImport` stub is gone
 - 2026-09-29: the container sets up its own data directory (issue #75):
   `bin/entrypoint.sh`, still as root, creates `DATA_DIR` if missing and gives it
   and `/data` to the `netwatch` user with mode 750 before starting the backend

backend/README.md

@@ -32,13 +32,10 @@ pattern as the repo root: the targets in `backend/Makefile` are thin shims over
 `test`, `fmt` and `fmt-check`:
 
 - `script/build` — compile the static `netwatch-server` binary with its version
-  stamped in. The version is `VERSION` from the environment;
+  and architecture stamped in. The version is `VERSION` from the environment;
   when that is unset or empty, it falls back to `git describe` inside a git
   checkout, then to `dev`
-- `script/test` — run the Go tests with the race detector and coverage. Go's
-  `-timeout 30s` bounds the tests, not their compile. If they fail, they run
-  again with `-v` for the details, and the script fails. The race detector needs
-  a C compiler
+- `script/test` — run the Go tests under a 30-second timeout
 - `script/lint` — check `.golangci.yml` against its pinned sha256, then run
   golangci-lint. It runs inside the golangci-lint image of the lint stage of
   the root `Dockerfile`; from a checkout, run `make lint` at the repo root,

backend/cmd/netwatch-server/main.go

@@ -21,6 +21,7 @@ import (
 var (
 	Appname   = "netwatch-server"
 	Version   string
+	Buildarch string
 )
 
 func main() {
@@ -39,6 +40,7 @@ func main() {
 
 	globals.Appname = Appname
 	globals.Version = Version
+	globals.Buildarch = Buildarch
 
 	fx.New(
 		fx.Provide(

backend/internal/globals/globals.go

@@ -10,18 +10,22 @@ var (
 	Appname string
 	// Version is the git version tag.
 	Version string
+	// Buildarch is the build architecture.
+	Buildarch string
 )
 
 // Globals holds build-time metadata for the application.
 type Globals struct {
 	Appname   string
 	Version   string
+	Buildarch string
 }
 
 // New creates a Globals instance from package-level variables.
 func New(_ fx.Lifecycle) (*Globals, error) {
 	return &Globals{
 		Appname:   Appname,
+		Buildarch: Buildarch,
 		Version:   Version,
 	}, nil
 }

backend/internal/handlers/handlers_test.go

@@ -0,0 +1,13 @@
+package handlers_test
+
+import (
+	"testing"
+
+	_ "sneak.berlin/go/netwatch/internal/handlers"
+)
+
+func TestImport(t *testing.T) {
+	t.Parallel()
+	// Compilation check — verifies the package parses
+	// and all imports resolve.
+}

backend/internal/handlers/healthcheck_test.go

@@ -1,120 +0,0 @@
-package handlers_test
-
-import (
-	"encoding/json"
-	"maps"
-	"net/http"
-	"net/http/httptest"
-	"slices"
-	"testing"
-	"time"
-
-	"sneak.berlin/go/netwatch/internal/globals"
-	"sneak.berlin/go/netwatch/internal/handlers"
-	"sneak.berlin/go/netwatch/internal/healthcheck"
-	"sneak.berlin/go/netwatch/internal/logger"
-
-	"go.uber.org/fx/fxtest"
-)
-
-// newStartedHandlers builds Handlers with a real health check for the
-// server named in g, and starts them, which records the time the
-// uptime counts from.
-func newStartedHandlers(t *testing.T, g *globals.Globals) *handlers.Handlers {
-	t.Helper()
-
-	lc := fxtest.NewLifecycle(t)
-
-	log, err := logger.New(lc, logger.Params{Globals: g})
-	if err != nil {
-		t.Fatalf("logger: %v", err)
-	}
-
-	hc, err := healthcheck.New(lc,
-		healthcheck.Params{Globals: g, Logger: log})
-	if err != nil {
-		t.Fatalf("health check: %v", err)
-	}
-
-	h, err := handlers.New(lc,
-		handlers.Params{Globals: g, Healthcheck: hc, Logger: log})
-	if err != nil {
-		t.Fatalf("handlers: %v", err)
-	}
-
-	lc.RequireStart()
-	t.Cleanup(lc.RequireStop)
-
-	return h
-}
-
-// TestHandleHealthCheck checks the health check's answer: 200, a JSON
-// content type, and a JSON object with exactly the fields of
-// healthcheck.Response, carrying this server's name and version and
-// an uptime counted from its start.
-func TestHandleHealthCheck(t *testing.T) {
-	t.Parallel()
-
-	g := &globals.Globals{Appname: "netwatch-server", Version: "v1.2.3"}
-	h := newStartedHandlers(t, g)
-
-	rec := httptest.NewRecorder()
-	req := httptest.NewRequestWithContext(t.Context(),
-		http.MethodGet, "/.well-known/healthcheck", http.NoBody)
-
-	h.HandleHealthCheck().ServeHTTP(rec, req)
-
-	if rec.Code != http.StatusOK {
-		t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK)
-	}
-
-	contentType := rec.Header().Get("Content-Type")
-	if contentType != "application/json; charset=utf-8" {
-		t.Errorf("Content-Type = %q, want %q",
-			contentType, "application/json; charset=utf-8")
-	}
-
-	var body map[string]any
-
-	err := json.Unmarshal(rec.Body.Bytes(), &body)
-	if err != nil {
-		t.Fatalf("body not a JSON object: %v (%q)", err, rec.Body.String())
-	}
-
-	fields := []string{
-		"appname", "now", "status", "uptimeHuman", "uptimeSeconds", "version",
-	}
-	if got := slices.Sorted(maps.Keys(body)); !slices.Equal(got, fields) {
-		t.Fatalf("fields = %v, want %v", got, fields)
-	}
-
-	for field, want := range map[string]string{
-		"appname": g.Appname, "status": "ok", "version": g.Version,
-	} {
-		if body[field] != want {
-			t.Errorf("%s = %v, want %q", field, body[field], want)
-		}
-	}
-
-	now, _ := body["now"].(string)
-
-	at, err := time.Parse(time.RFC3339Nano, now)
-	if err != nil || time.Since(at).Abs() > time.Minute {
-		t.Errorf("now = %q, want the current time in RFC 3339 (%v)", now, err)
-	}
-
-	// Started just now, so the uptime is well under a minute.
-	human, _ := body["uptimeHuman"].(string)
-
-	uptime, err := time.ParseDuration(human)
-	if err != nil || uptime > time.Minute {
-		t.Errorf("uptimeHuman = %q, want a duration under a minute (%v)",
-			human, err)
-	}
-
-	seconds, ok := body["uptimeSeconds"].(float64)
-	if !ok || seconds < 0 || seconds > time.Minute.Seconds() {
-		t.Errorf("uptimeSeconds = %v, want a number of seconds under a minute",
-			body["uptimeSeconds"])
-	}
-}

backend/internal/handlers/report_test.go

@@ -46,63 +46,6 @@ func decodeStatus(t *testing.T, body []byte) string {
 	return resp.Status
 }
 
-// TestHandleReportAcceptsValidReports checks the answer to a valid
-// report, one with no hosts and one shaped as the frontend sends them:
-// 200 and {"status":"ok"} as JSON.
-func TestHandleReportAcceptsValidReports(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name string
-		body string
-	}{
-		{
-			name: "no hosts",
-			body: `{"clientId":"c1","geo":null,"hosts":[],` +
-				`"timestamp":"2026-10-03T12:00:00.000Z"}`,
-		},
-		{
-			name: "a host with a latency and an error sample",
-			body: `{"clientId":"c1","geo":null,"hosts":[{` +
-				`"name":"Example","url":"https://example.com/",` +
-				`"status":"error","history":[` +
-				`{"t":1790000000000,"latency":42,"error":null},` +
-				`{"t":1790000003000,"latency":null,"error":"timeout"}]}],` +
-				`"timestamp":"2026-10-03T12:00:00.000Z"}`,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			h := newTestHandlers(stubAppender{}, io.Discard)
-
-			rec := httptest.NewRecorder()
-			req := httptest.NewRequestWithContext(t.Context(),
-				http.MethodPost, "/api/v1/reports",
-				strings.NewReader(tt.body),
-			)
-
-			h.HandleReport().ServeHTTP(rec, req)
-
-			if rec.Code != http.StatusOK {
-				t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK)
-			}
-
-			contentType := rec.Header().Get("Content-Type")
-			if contentType != "application/json; charset=utf-8" {
-				t.Errorf("Content-Type = %q, want %q",
-					contentType, "application/json; charset=utf-8")
-			}
-
-			if got := rec.Body.String(); got != "{\"status\":\"ok\"}\n" {
-				t.Errorf("body = %q, want %q", got, "{\"status\":\"ok\"}\n")
-			}
-		})
-	}
-}
-
 func TestHandleReportStorageFailureIsNon2xx(t *testing.T) {
 	t.Parallel()
 

backend/internal/logger/logger.go

@@ -5,7 +5,6 @@ package logger
 import (
 	"log/slog"
 	"os"
-	"runtime"
 
 	"sneak.berlin/go/netwatch/internal/globals"
 
@@ -96,6 +95,6 @@ func (l *Logger) Identify() {
 	l.log.Info("starting",
 		"appname", l.params.Globals.Appname,
 		"version", l.params.Globals.Version,
-		"arch", runtime.GOARCH,
+		"buildarch", l.params.Globals.Buildarch,
 	)
 }

backend/internal/reportbuf/export_test.go

@@ -2,10 +2,6 @@ package reportbuf
 
 import "time"
 
-// FlushSizeThreshold exposes the buffer size at which Append starts
-// writing a report file to the external tests.
-const FlushSizeThreshold = flushSizeThreshold
-
 // Flush writes the buffered reports to a file now, as the periodic
 // flush does, so tests need not wait a minute for it.
 func (b *Buffer) Flush() error {

backend/internal/reportbuf/reportbuf_test.go

@@ -334,11 +334,7 @@ func TestTwoFlushesInOneMillisecond(t *testing.T) {
 		}
 	}
 
-	files, err := readReportFiles(dir)
-	if err != nil {
-		t.Fatalf("read report files: %v", err)
-	}
-
+	files := readReportFiles(t, dir)
 	if len(files) != flushes {
 		t.Fatalf("%d report files after %d flushes", len(files), flushes)
 	}
@@ -351,88 +347,6 @@ func TestTwoFlushesInOneMillisecond(t *testing.T) {
 	}
 }
 
-// TestReportFileHoldsTheLinesAppended flushes three reports and reads
-// their file back: it must decompress to exactly their JSON lines, in
-// the order they were appended.
-func TestReportFileHoldsTheLinesAppended(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv("DATA_DIR", dir)
-
-	buf := startBuffer(t)
-
-	for _, id := range []int{1, 2, 3} {
-		err := buf.Append(map[string]int{"id": id})
-		if err != nil {
-			t.Fatalf("append report %d: %v", id, err)
-		}
-	}
-
-	err := buf.Flush()
-	if err != nil {
-		t.Fatalf("flush: %v", err)
-	}
-
-	files, err := readReportFiles(dir)
-	if err != nil {
-		t.Fatalf("read report files: %v", err)
-	}
-
-	want := `{"id":1}` + "\n" + `{"id":2}` + "\n" + `{"id":3}` + "\n"
-	if len(files) != 1 || files[0] != want {
-		t.Fatalf("report files = %q, want one holding %q", files, want)
-	}
-}
-
-// TestFlushAtSizeThreshold appends reports until the buffer holds
-// FlushSizeThreshold bytes. The append that gets it there must write
-// them all to one report file, with no call to Flush and the periodic
-// flush a minute away, and no earlier append may write one.
-func TestFlushAtSizeThreshold(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv("DATA_DIR", dir)
-
-	buf := startBuffer(t)
-
-	// Large reports, so the threshold takes a few hundred appends.
-	pad := strings.Repeat("a", 64<<10)
-
-	var appended strings.Builder
-
-	for id := 0; appended.Len() < reportbuf.FlushSizeThreshold; id++ {
-		report := map[string]any{"id": id, "pad": pad}
-
-		err := buf.Append(report)
-		if err != nil {
-			t.Fatalf("append report %d: %v", id, err)
-		}
-
-		line, err := json.Marshal(report)
-		if err != nil {
-			t.Fatalf("marshal report %d: %v", id, err)
-		}
-
-		appended.Write(line)
-		appended.WriteByte('\n')
-	}
-
-	// Append writes the file in the background, so wait for it.
-	deadline := time.Now().Add(10 * time.Second)
-
-	for {
-		files, err := readReportFiles(dir)
-		if err == nil && len(files) == 1 && files[0] == appended.String() {
-			return
-		}
-
-		if time.Now().After(deadline) {
-			t.Fatalf("%d report files (error: %v), want one holding the "+
-				"%d bytes appended", len(files), err, appended.Len())
-		}
-
-		time.Sleep(10 * time.Millisecond)
-	}
-}
-
 // reportFilesBytes returns the total size of the report files in dir.
 func reportFilesBytes(t *testing.T, dir string) int64 {
 	t.Helper()
@@ -457,19 +371,20 @@ func reportFilesBytes(t *testing.T, dir string) int64 {
 }
 
 // readReportFiles returns the decompressed contents of each report
-// file in dir. A file still being written does not decompress, so it
-// gives an error.
-func readReportFiles(dir string) ([]string, error) {
+// file in dir.
+func readReportFiles(t *testing.T, dir string) []string {
+	t.Helper()
+
 	files := os.DirFS(dir)
 
 	names, err := fs.Glob(files, "reports-*.jsonl.zst")
 	if err != nil {
-		return nil, fmt.Errorf("list report files: %w", err)
+		t.Fatalf("list report files: %v", err)
 	}
 
 	dec, err := zstd.NewReader(nil)
 	if err != nil {
-		return nil, fmt.Errorf("create zstd decoder: %w", err)
+		t.Fatalf("create zstd decoder: %v", err)
 	}
 	defer dec.Close()
 
@@ -478,18 +393,18 @@ func readReportFiles(dir string) ([]string, error) {
 	for _, name := range names {
 		compressed, readErr := fs.ReadFile(files, name)
 		if readErr != nil {
-			return nil, fmt.Errorf("read %s: %w", name, readErr)
+			t.Fatalf("read %s: %v", name, readErr)
 		}
 
 		data, decErr := dec.DecodeAll(compressed, nil)
 		if decErr != nil {
-			return nil, fmt.Errorf("decompress %s: %w", name, decErr)
+			t.Fatalf("decompress %s: %v", name, decErr)
 		}
 
 		contents = append(contents, string(data))
 	}
 
-	return contents, nil
+	return contents
 }
 
 func writeBytes(t *testing.T, path string, n int) {

backend/internal/server/http.go

@@ -4,7 +4,6 @@ import (
 	"errors"
 	"net"
 	"net/http"
-	"runtime"
 	"strconv"
 	"time"
 
@@ -54,7 +53,7 @@ func (s *Server) listenAndServe() {
 	s.log.Info("http begin listen",
 		"listenaddr", s.httpServer.Addr,
 		"version", s.params.Globals.Version,
-		"arch", runtime.GOARCH,
+		"buildarch", s.params.Globals.Buildarch,
 	)
 
 	err := s.httpServer.ListenAndServe()

backend/script/build

@@ -1,6 +1,6 @@
 #!/bin/sh
 # script/build: compile the static netwatch-server binary into the
-# backend project root, with its version stamped in.
+# backend project root, with its version and architecture stamped in.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -14,7 +14,7 @@ main() {
     version="${VERSION:-$(git describe --always --dirty 2>/dev/null || echo dev)}"
 
     CGO_ENABLED=0 go build -trimpath \
-        -ldflags "-s -w -X main.Version=$version" \
+        -ldflags "-s -w -X main.Version=$version -X main.Buildarch=$(uname -m)" \
         -o netwatch-server ./cmd/netwatch-server/
 }
 

backend/script/test

@@ -1,20 +1,12 @@
 #!/bin/sh
-# script/test: run the backend test suite with the race detector and
-# coverage. Go's own -timeout bounds the tests and not their compile,
-# so a cold build cache cannot fail it. The race detector needs cgo,
-# and so a C compiler. If the tests fail, they run again with -v for
-# the details, and the script fails even if that run passes.
+# script/test: run the backend test suite.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    go test -timeout 30s -race -cover ./... || {
-        echo "--- Rerunning with -v for details ---"
-        go test -timeout 30s -race -v ./...
-        exit 1
-    }
+    timeout 30 go test ./...
 }
 
 main "$@"

script/cibuild

@@ -16,8 +16,9 @@ main() {
     "$SCRIPT_DIR/check"
     # Own line: a failing command substitution inside an argument does
     # not trip `set -e`, so the inline form degrades silently to an
-    # empty constant. The VERSION build argument takes precedence over
-    # the version a build stage derives from the .git in the context.
+    # empty constant. VERSION is computed here because .dockerignore
+    # excludes .git, so `git describe` in a build stage yields an empty
+    # version without failing.
     version="$(git describe --tags --always --dirty 2>/dev/null || true)"
     [ -n "$version" ] || version="unknown"
     docker build --no-cache \

script/docker

@@ -12,8 +12,9 @@ main() {
     cd "$ROOT"
     # Own line: a failing command substitution inside an argument does
     # not trip `set -e`, so the inline form degrades silently to an
-    # empty constant. The VERSION build argument takes precedence over
-    # the version a build stage derives from the .git in the context.
+    # empty constant. VERSION is computed here because .dockerignore
+    # excludes .git, so `git describe` in a build stage yields an empty
+    # version without failing.
     version="$(git describe --tags --always --dirty 2>/dev/null || true)"
     [ -n "$version" ] || version="unknown"
     docker build --no-cache \

script/test

@@ -1,17 +1,14 @@
 #!/bin/sh
 # script/test: run the test suite for the whole repo: the frontend at
-# the repo root, then the Go backend in backend/. Each half has its own
-# 30-second limit, and there is none around both: from a cold Go build
-# cache, compiling the backend's tests with the race detector can take
-# 30 seconds on its own, and Go's -timeout leaves the compile out.
+# the repo root, then the Go backend in backend/. Both halves together
+# get 30 seconds; each also keeps its own limit for the Dockerfiles.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    script/frontend-test
-    backend/script/test
+    timeout 30 sh -c 'script/frontend-test && backend/script/test'
 }
 
 main "$@"