TODO.md rewritten sentence by sentence

TODO.md is rewritten from scratch so that every sentence reads on the first pass: one idea each, under about 30 words, the verb early. Workflow, Next Step and Future Steps keep their substance. Each Completed Steps entry keeps its date, its issue link and what changed; entries describing a state since changed are in the past tense. Part of #189.

Model: fable-5-1 (rewrite, review); opus-5-5 (merge)
Co-authored-by: clawbot <clawbot@noreply.example.org>

.dockerignore

@@ -73,9 +73,12 @@
 
 # This repository's own entries, after the shared content above: the
 # frontend build, the viewport test's output, the binary `make build`
-# writes and the reports `make run` stores, and log files at the root.
+# writes and the reports `make run` stores, and Go test binaries,
+# coverage output and log files at the root.
 /dist
 /tmp
 /netwatch-server
 /data
+/*.test
+/*.out
 /*.log

.editorconfig

@@ -11,7 +11,8 @@ insert_final_newline = true
 [Makefile]
 indent_style = tab
 
-# This repository's own entries, after the shared content above.
-
 [*.go]
 indent_style = tab
+
+# This repository's own sections, such as one for another language it
+# uses, go below this comment, and a re-vendor keeps them.

.gitea/workflows/check.yml

@@ -1,9 +1,20 @@
 name: check
 on: [push]
+# Free the shared runner: a new push cancels only the same branch's older run.
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: true
 jobs:
     check:
         runs-on: ubuntu-latest
+        # Free the shared runner from a hung build.
+        timeout-minutes: 20
         steps:
             # actions/checkout v4.2.2, 2026-02-22
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+              # script/cibuild needs no token, so none is left in .git/config.
+              with:
+                  persist-credentials: false
+                  # All history and tags, so git describe finds the version tag.
+                  fetch-depth: 0
             - run: script/cibuild

.gitignore

@@ -27,7 +27,7 @@ node_modules/
 # Environment files. `*.env` covers bare `.env` and the `prod.env`
 # convention. Only the templates `example.env` and `sample.env` are
 # re-included below. A repository that commits any other template adds
-# its own negation after these lines, for example `!.env.example`.
+# its own negation at the end of this file, for example `!.env.example`.
 *.[eE][nN][vV]
 .[eE][nN][vV].*
 .[eE][nN][vV][rR][cC]
@@ -46,7 +46,9 @@ node_modules/
 [iI][dD]_[eE][dD]25519
 [iI][dD]_[eE][dD]25519_[sS][kK]
 
-# This repository's own entries, after the shared content above.
+# This repository's own entries, such as its build outputs, go below
+# this comment, and a re-vendor keeps them. Anchor a binary built at the
+# root: `/myapp`, never `myapp`, which also ignores `cmd/myapp/`.
 
 # Build output
 dist/

.golangci.yml

@@ -25,6 +25,8 @@ linters:
     # silenced by disabling that name, not by enabling the successor.
     - wsl              # Deprecated, replaced by wsl_v5
     - gomodguard       # Deprecated, replaced by gomodguard_v2
+    # Misses findings at random in v2.14.0; back once a pinned release fixes it
+    - canonicalheader
   settings:
     lll:
       line-length: 88

README.md

@@ -41,11 +41,13 @@ The scripts cover both the frontend and the Go backend, so `make check` fails if
 either one is broken. We provide:
 
 - `script/bootstrap` — install all dependencies (the pinned node via nvm unless
-  one new enough for the frontend's dependencies is installed, yarn via
+  the `node` on `PATH` has the pinned major version and is new enough for the
-  corepack, `yarn install --frozen-lockfile`, Go `GO_VERSION` unless the `go` on
+  frontend's dependencies, yarn `YARN_VERSION` via corepack, or npm where there
-  `PATH` is exactly that version, and the Go modules), linking what it installs
+  is no corepack, unless the `yarn` on `PATH` is exactly that version,
-  itself into `~/.local/bin`, which has to be on `PATH`. It installs no Go
+  `yarn install --frozen-lockfile`, Go `GO_VERSION` unless the `go` on `PATH` is
-  linter and not Docker: `make test` and `make lint` run in Docker
+  exactly that version, and the Go modules), linking what it installs itself
+  into `~/.local/bin`, which has to be on `PATH`. It installs no Go linter and
+  not Docker: `make test` and `make lint` run in Docker
 - `script/setup` — make a fresh clone ready for development: bootstrap plus the
   git pre-commit hook
 - `script/dev` — run the Vite dev server, which proxies `/api` to a locally
@@ -53,11 +55,18 @@ either one is broken. We provide:
 - `script/build` — build the frontend for production into `dist/`, then the
   static `netwatch-server` binary into the repo root with its version stamped
   in: `VERSION` from the environment, or when that is unset or empty,
-  `git describe` inside a git checkout, then `dev`
+  `git describe --tags --always --dirty` inside a git checkout, as
+  `script/docker` does, then `dev`
 - `script/run` — build with `script/build`, then run `netwatch-server` with its
   defaults (see [Settings](#settings))
 - `script/clean` — remove what `script/build` writes
 - `script/projectname` — print the project name (used for the Docker image tag)
+- `script/yarn` — run yarn with the given arguments under the node
+  `script/bootstrap` would use: with `~/.local/bin` first on `PATH`, the first
+  `node` on that `PATH` when it has the pinned major version and is new enough
+  for the frontend's dependencies, and otherwise the pinned node in nvm. Every
+  script that runs yarn on the host runs it through this one, except
+  `script/bootstrap`, which picks its own node and yarn
 - `script/test` — build the `test` phase of `Dockerfile`, writing no image: the
   frontend's unit tests in its `frontend-test` stage, and the backend's Go tests
   with the race detector and coverage. The frontend's production build is left
@@ -209,6 +218,10 @@ stops. Its routes:
 It is an `fx`-wired Go application: `cmd/netwatch-server/` starts it, and its
 packages are in `internal/`:
 
+- **`cli`**: Runs `netwatch-server` from its command line: the `check-cidr` and
+  `prepare-data-dir` subcommands, which `bin/entrypoint.sh` runs before it
+  starts the server, and, given no arguments, the server, with the `fx` wiring.
+  It refuses any other arguments with a usage message and exit code 2.
 - **`config`**: Loads configuration from environment variables and config files
   via Viper.
 - **`handlers`**: HTTP request handlers for the API (health check, report
@@ -400,20 +413,36 @@ Local hosts are tracked separately from WAN stats.
 
 ### Latency measurement
 
-GET requests to each target's URL as written, with `mode: 'no-cors'` and
+Each check is a GET request to the target's URL as written, with
-`cache: 'no-store'`, timed with `performance.now()`. No query string is added:
+`mode: 'no-cors'`, `cache: 'no-store'` and `referrerPolicy: 'no-referrer'`. Its
-the Hetzner speed-test servers close the connection without an answer when the
+figure is the time from sending the request until the answer's headers arrive,
-URL has one, and `no-store` keeps the browser's cache out of the measurement.
+timed with `performance.now()`. Unlike ping, this includes the time the server
-Each check times out after 80% of the refresh interval (24 seconds at 30
+takes to answer. It also includes the DNS lookup, connection setup and TLS
-seconds) and is then recorded as a timeout, so a round's checks have all
+whenever the browser opens a new connection. Chrome opens one for every check of
-finished before the next round is due. When no WAN host answers, a recovery
+the Hetzner speed-test servers, and for more targets at longer intervals.
-probe checks 4 WAN hosts, picked at random when it starts, every half second,
+
-giving up the checks it started half a second before. As soon as one answers, a
+The S3 regions are checked with a HEAD request instead. Chrome keeps the
-new round starts at once, as it does after an interval change. A round started
+connection to an S3 region open after a HEAD request, but closes it after most
-early gives up the last round's checks if they are still waiting, and that round
+GET requests. The Hetzner speed-test servers do not answer a HEAD request.
-records nothing more, so rounds never overlap. The browser chooses between IPv4
+
-and IPv6 for each target, as for any request; the local targets are IPv4
+The browser follows every redirect, and the figure then includes the request to
-addresses.
+the new URL too. So a target whose home page answers with a redirect is checked
+at `/robots.txt` on the same host, which answers without one. An S3 region
+answers it with 403, and any answer counts as reachable.
+
+The Hetzner speed-test servers close the connection without an answer when the
+URL has a query string or the request has a `Referer` header. So no query string
+is added, and no `Referer` header is sent, wherever the page is served from.
+`no-store` keeps the browser's cache out of the measurement. Each check times
+out after 80% of the refresh interval (24 seconds at 30 seconds) and is then
+recorded as a timeout, so a round's checks have all finished before the next
+round is due. When no WAN host answers, a recovery probe checks 4 WAN hosts,
+picked at random when it starts, every half second, giving up the checks it
+started half a second before. As soon as one answers, a new round starts at
+once, as it does after an interval change. A round started early gives up the
+last round's checks if they are still waiting, and that round records nothing
+more, so rounds never overlap. The browser chooses between IPv4 and IPv6 for
+each target, as for any request; the local targets are IPv4 addresses.
 
 Each recorded check that fails writes one line to the browser console with
 `console.error`, and the same line to the debug log: the target's name and URL,

bin/entrypoint.sh

@@ -13,24 +13,27 @@ set -u
 # address and start anyway, and reports a bad port without naming
 # PORT, so a value that is not a usable port stops the container here,
 # before either process starts.
-export PORT="${PORT:-8080}"
+check_port() {
-case "$PORT" in
+    export PORT="${PORT:-8080}"
-    *[!0-9]*)
+    case "$PORT" in
-        echo "entrypoint: PORT must be a port number, not '$PORT'" >&2
+        *[!0-9]*)
+            echo "entrypoint: PORT must be a port number, not '$PORT'" >&2
+            exit 1
+            ;;
+    esac
+    # The length is checked first because, for a number too big for it,
+    # the shell's test prints an error and is false, so the range checks
+    # alone would let it through.
+    if [ "${#PORT}" -gt 5 ] || [ "$PORT" -lt 1 ] || [ "$PORT" -gt 65535 ]; then
+        echo "entrypoint: PORT must be from 1 to 65535, not '$PORT'" >&2
         exit 1
-        ;;
+    fi
-esac
+    if [ "$PORT" -eq 8081 ]; then
-# The length is checked first because, for a number too big for it,
+        echo "entrypoint: PORT cannot be 8081, netwatch-server" \
-# the shell's test prints an error and is false, so the range checks
+            "listens there" >&2
-# alone would let it through.
+        exit 1
-if [ "${#PORT}" -gt 5 ] || [ "$PORT" -lt 1 ] || [ "$PORT" -gt 65535 ]; then
+    fi
-    echo "entrypoint: PORT must be from 1 to 65535, not '$PORT'" >&2
+}
-    exit 1
-fi
-if [ "$PORT" -eq 8081 ]; then
-    echo "entrypoint: PORT cannot be 8081, netwatch-server listens there" >&2
-    exit 1
-fi
 
 # TRUSTED_PROXIES names the reverse proxies in front of the container,
 # as IP addresses or CIDRs separated by commas. nginx takes the client
@@ -47,21 +50,23 @@ fi
 # TRUSTED_PROXIES. Its error, naming the CIDR, is dropped for the one
 # below, naming the entry as written. set -f keeps a * in an entry from
 # becoming a list of file names.
-TRUSTED_PROXIES="${TRUSTED_PROXIES-10.0.0.0/8,172.16.0.0/12,192.168.0.0/16}"
+write_trusted_proxies() {
-set -f
+    TRUSTED_PROXIES="${TRUSTED_PROXIES-10.0.0.0/8,172.16.0.0/12,192.168.0.0/16}"
-for proxy in $(printf '%s' "$TRUSTED_PROXIES" | tr ',' ' '); do
+    set -f
-    case "$proxy" in
+    for proxy in $(printf '%s' "$TRUSTED_PROXIES" | tr ',' ' '); do
-        */*) cidr="$proxy" ;;
+        case "$proxy" in
-        *:*) cidr="$proxy/128" ;;
+            */*) cidr="$proxy" ;;
-        *) cidr="$proxy/32" ;;
+            *:*) cidr="$proxy/128" ;;
-    esac
+            *) cidr="$proxy/32" ;;
-    if ! netwatch-server check-cidr "$cidr" 2> /dev/null; then
+        esac
-        echo "entrypoint: TRUSTED_PROXIES must be IP addresses or CIDRs" \
+        if ! netwatch-server check-cidr "$cidr" 2> /dev/null; then
-            "separated by commas; '$proxy' is neither" >&2
+            echo "entrypoint: TRUSTED_PROXIES must be IP addresses or CIDRs" \
-        exit 1
+                "separated by commas; '$proxy' is neither" >&2
-    fi
+            exit 1
-    echo "set_real_ip_from $cidr;"
+        fi
-done > /etc/nginx/trusted-proxies.conf
+        echo "set_real_ip_from $cidr;"
+    done > /etc/nginx/trusted-proxies.conf
+}
 
 # netwatch-server keeps its report files in DATA_DIR, on the /data
 # volume, which may be a host directory owned by root or by another
@@ -73,12 +78,10 @@ done > /etc/nginx/trusted-proxies.conf
 # naming DATA_DIR, unless DATA_DIR is /data or a path below it, and it
 # acts on nothing outside /data, whatever symbolic or hard links it
 # meets there.
-export DATA_DIR="${DATA_DIR:-/data/reports}"
+prepare_data_dir() {
-netwatch-server prepare-data-dir "$DATA_DIR" || exit 1
+    export DATA_DIR="${DATA_DIR:-/data/reports}"
-
+    netwatch-server prepare-data-dir "$DATA_DIR" || exit 1
-# A stop signal is only noted here; the loop below acts on it.
+}
-stop_requested=""
-trap 'stop_requested=yes' TERM INT
 
 # netwatch-server runs as the netwatch user and listens on loopback
 # only, on a port other than the public one; configs/nginx.conf proxies
@@ -87,9 +90,11 @@ trap 'stop_requested=yes' TERM INT
 # the container has. The netwatch user has no login shell, hence -s
 # /bin/sh. busybox su replaces itself with the command instead of
 # staying on as its parent, so $! is the server's own PID.
-BIND_ADDRESS=127.0.0.1 PORT=8081 TRUSTED_PROXIES=127.0.0.1/32 \
+start_backend() {
-    su -s /bin/sh netwatch -c 'exec netwatch-server' &
+    BIND_ADDRESS=127.0.0.1 PORT=8081 TRUSTED_PROXIES=127.0.0.1/32 \
-backend=$!
+        su -s /bin/sh netwatch -c 'exec netwatch-server' &
+    backend=$!
+}
 
 # nginx starts through the nginx image's own entrypoint, which applies
 # the image's start-up configuration and then replaces itself with
@@ -98,9 +103,11 @@ backend=$!
 # that rendering to PORT: a variable nginx itself uses, such as $uri,
 # would otherwise be replaced by an environment variable of the same
 # name.
-NGINX_ENVSUBST_FILTER='^PORT$' \
+start_nginx() {
-    /docker-entrypoint.sh nginx -g 'daemon off;' &
+    NGINX_ENVSUBST_FILTER='^PORT$' \
-nginx=$!
+        /docker-entrypoint.sh nginx -g 'daemon off;' &
+    nginx=$!
+}
 
 running() {
     kill -0 "$1" 2>/dev/null
@@ -109,26 +116,47 @@ running() {
 # POSIX sh cannot wait for whichever of two children exits first, so
 # look once a second. The shell collects a child that has exited while
 # it runs sleep, and running() is false for that child from then on.
-while [ -z "$stop_requested" ] && running "$backend" && running "$nginx"; do
+wait_for_stop_or_exit() {
-    sleep 1
+    while [ -z "$stop_requested" ] && running "$backend" && running "$nginx"; do
-done
+        sleep 1
+    done
+}
 
 # Stop both, then wait until neither is left.
-kill -TERM "$backend" "$nginx" 2>/dev/null
+stop_both() {
-while running "$backend" || running "$nginx"; do
+    kill -TERM "$backend" "$nginx" 2>/dev/null
-    sleep 1
+    while running "$backend" || running "$nginx"; do
-done
+        sleep 1
-
+    done
-wait "$backend"
+}
-backend_status=$?
-wait "$nginx"
-nginx_status=$?
-echo "entrypoint: netwatch-server exited $backend_status," \
-    "nginx exited $nginx_status"
 
 # Success is a requested stop that both processes exited cleanly from.
-if [ -n "$stop_requested" ] && [ "$backend_status" -eq 0 ] &&
+exit_with_status() {
-    [ "$nginx_status" -eq 0 ]; then
+    wait "$backend"
-    exit 0
+    backend_status=$?
-fi
+    wait "$nginx"
-exit 1
+    nginx_status=$?
+    echo "entrypoint: netwatch-server exited $backend_status," \
+        "nginx exited $nginx_status"
+    if [ -n "$stop_requested" ] && [ "$backend_status" -eq 0 ] &&
+        [ "$nginx_status" -eq 0 ]; then
+        exit 0
+    fi
+    exit 1
+}
+
+main() {
+    check_port
+    write_trusted_proxies
+    prepare_data_dir
+    # A stop signal is only noted here; wait_for_stop_or_exit acts on it.
+    stop_requested=""
+    trap 'stop_requested=yes' TERM INT
+    start_backend
+    start_nginx
+    wait_for_stop_or_exit
+    stop_both
+    exit_with_status
+}
+
+main "$@"

cmd/netwatch-server/main.go

@@ -1,22 +1,11 @@
-// Package main is the entry point for netwatch-server.
+// Package main is the entry point for netwatch-server; package cli
+// does the work.
 package main
 
 import (
-	"fmt"
 	"os"
-	"os/user"
 
-	"sneak.berlin/go/netwatch/internal/config"
+	"sneak.berlin/go/netwatch/internal/cli"
-	"sneak.berlin/go/netwatch/internal/globals"
-	"sneak.berlin/go/netwatch/internal/handlers"
-	"sneak.berlin/go/netwatch/internal/healthcheck"
-	"sneak.berlin/go/netwatch/internal/logger"
-	"sneak.berlin/go/netwatch/internal/middleware"
-	"sneak.berlin/go/netwatch/internal/reportbuf"
-	"sneak.berlin/go/netwatch/internal/server"
-
-	"go.uber.org/fx"
-	"go.uber.org/fx/fxevent"
 )
 
 //nolint:gochecknoglobals // set via ldflags at build time
@@ -26,64 +15,5 @@ var (
 )
 
 func main() {
-	// "netwatch-server check-cidr CIDR" exits 1, with the error, if
+	os.Exit(cli.Main(os.Stderr, Appname, Version, os.Args[1:], cli.RunServer))
-	// this server would refuse CIDR in its TRUSTED_PROXIES.
-	// bin/entrypoint.sh runs it on each entry it gives nginx.
-	if len(os.Args) == 3 && os.Args[1] == "check-cidr" {
-		_, err := middleware.ParseTrustedProxies(os.Args[2:])
-		if err != nil {
-			fmt.Fprintln(os.Stderr, err)
-			os.Exit(1)
-		}
-
-		return
-	}
-
-	// "netwatch-server prepare-data-dir DATA_DIR" gets DATA_DIR ready
-	// for the netwatch user, or exits 1 with the error; see
-	// reportbuf.PrepareDataDir. bin/entrypoint.sh runs it as root
-	// before it starts this server as that user.
-	if len(os.Args) == 3 && os.Args[1] == "prepare-data-dir" {
-		netwatch, err := user.Lookup("netwatch")
-		if err != nil {
-			fmt.Fprintln(os.Stderr, err)
-			os.Exit(1)
-		}
-
-		err = reportbuf.PrepareDataDir("/data", os.Args[2], netwatch)
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "DATA_DIR '%s': %v\n", os.Args[2], err)
-			os.Exit(1)
-		}
-
-		return
-	}
-
-	globals.Appname = Appname
-	globals.Version = Version
-
-	fx.New(
-		// fx logs each step of starting and stopping through the
-		// server's own logger, so off a terminal those lines are
-		// JSON like every other line.
-		fx.WithLogger(func(log *logger.Logger) fxevent.Logger {
-			return &fxevent.SlogLogger{Logger: log.Get()}
-		}),
-		fx.Provide(
-			config.New,
-			globals.New,
-			handlers.New,
-			healthcheck.New,
-			logger.New,
-			middleware.New,
-			reportbuf.New,
-			server.New,
-		),
-		fx.Invoke(
-			// First, so the name and version are logged even when
-			// a setting stops the start.
-			func(log *logger.Logger) { log.Identify() },
-			func(*server.Server) {},
-		),
-	).Run()
 }

configs/security-headers.conf

@@ -8,10 +8,9 @@ add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" alway
 # Scripts and styles load only from the page's own origin. Inline ones
 # are blocked, style attributes in markup included, so style elements
 # through classes or element.style. data: images are for the favicon
-# in web/index.html. connect-src is * because the browser checks each
+# in web/index.html. connect-src is * because the page checks every
-# probe in web/src/main.js against it, and also every redirect the probe
+# target in web/src/main.js. A list of hosts here would have to change
-# follows, and several of those hosts redirect to others; a list of
+# with every change to those targets. It also covers the reports the
-# hosts here would block those probes. It also covers the reports the
 # page sends to its own origin.
 add_header Content-Security-Policy "default-src 'self'; connect-src *; img-src 'self' data:; object-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'" always;
 

internal/cli/cli.go

@@ -0,0 +1,143 @@
+// Package cli runs netwatch-server from its command line: the
+// check-cidr and prepare-data-dir subcommands, which bin/entrypoint.sh
+// runs before it starts the server, and, given no arguments, the
+// server, with the fx wiring.
+package cli
+
+import (
+	"fmt"
+	"io"
+	"os/user"
+
+	"sneak.berlin/go/netwatch/internal/config"
+	"sneak.berlin/go/netwatch/internal/globals"
+	"sneak.berlin/go/netwatch/internal/handlers"
+	"sneak.berlin/go/netwatch/internal/healthcheck"
+	"sneak.berlin/go/netwatch/internal/logger"
+	"sneak.berlin/go/netwatch/internal/middleware"
+	"sneak.berlin/go/netwatch/internal/reportbuf"
+	"sneak.berlin/go/netwatch/internal/server"
+
+	"go.uber.org/fx"
+	"go.uber.org/fx/fxevent"
+)
+
+// usageExitCode is what Main returns for a command line it does not
+// understand, the usual exit code for a usage error.
+const usageExitCode = 2
+
+// Main runs netwatch-server with args, its command line after the
+// program's name, and returns the exit code. With no args, Main runs
+// the server by calling serve with appname and version, the name and
+// version the server logs and reports. With "check-cidr CIDR" or
+// "prepare-data-dir DATA_DIR" it runs that subcommand, which writes its
+// errors to stderr. Any other args get a one-line usage message on
+// stderr and exit code 2. main passes os.Stderr and RunServer; the
+// tests pass a buffer and a function of their own, so that no test
+// starts the server. When serve is RunServer and the server fails to
+// start, to listen or to stop, fx's Run exits the process with status 1
+// and Main never returns.
+func Main(
+	stderr io.Writer,
+	appname, version string,
+	args []string,
+	serve func(appname, version string),
+) int {
+	// "netwatch-server check-cidr CIDR" exits 1, with the error, if
+	// this server would refuse CIDR in its TRUSTED_PROXIES.
+	// bin/entrypoint.sh runs it on each entry it gives nginx.
+	if len(args) == 2 && args[0] == "check-cidr" {
+		return checkCIDR(stderr, args[1])
+	}
+
+	// "netwatch-server prepare-data-dir DATA_DIR" gets DATA_DIR ready
+	// for the netwatch user, or exits 1 with the error; see
+	// reportbuf.PrepareDataDir. bin/entrypoint.sh runs it as root
+	// before it starts this server as that user.
+	if len(args) == 2 && args[0] == "prepare-data-dir" {
+		return prepareDataDir(stderr, "/data", args[1], "netwatch")
+	}
+
+	// Any other command line is refused, so that a mistyped one does
+	// not start the server.
+	if len(args) > 0 {
+		_, _ = fmt.Fprintln(stderr,
+			"usage: netwatch-server [check-cidr CIDR | prepare-data-dir DATA_DIR]")
+
+		return usageExitCode
+	}
+
+	serve(appname, version)
+
+	return 0
+}
+
+// checkCIDR returns 0 if the server would take cidr in its
+// TRUSTED_PROXIES, and otherwise writes the error to stderr and
+// returns 1.
+func checkCIDR(stderr io.Writer, cidr string) int {
+	_, err := middleware.ParseTrustedProxies([]string{cidr})
+	if err != nil {
+		_, _ = fmt.Fprintln(stderr, err)
+
+		return 1
+	}
+
+	return 0
+}
+
+// prepareDataDir gets dataDir ready for the user named username with
+// reportbuf.PrepareDataDir, volume being where the data volume is
+// mounted, and returns 0. Otherwise it writes the error to stderr and
+// returns 1.
+func prepareDataDir(stderr io.Writer, volume, dataDir, username string) int {
+	owner, err := user.Lookup(username)
+	if err != nil {
+		_, _ = fmt.Fprintln(stderr, err)
+
+		return 1
+	}
+
+	err = reportbuf.PrepareDataDir(volume, dataDir, owner)
+	if err != nil {
+		_, _ = fmt.Fprintf(stderr, "DATA_DIR '%s': %v\n", dataDir, err)
+
+		return 1
+	}
+
+	return 0
+}
+
+// RunServer runs the server until it is told to stop, with appname and
+// version as the name and version it logs and reports. If the server
+// fails to start, to listen or to stop, fx's Run exits the process
+// with status 1 itself.
+func RunServer(appname, version string) {
+	globals.Appname = appname
+	globals.Version = version
+
+	fx.New(
+		// fx logs each step of starting and stopping through the
+		// server's own logger, so off a terminal those lines are
+		// JSON like every other line.
+		fx.WithLogger(func(log *logger.Logger) fxevent.Logger {
+			return &fxevent.SlogLogger{Logger: log.Get()}
+		}),
+		fx.Provide(
+			config.New,
+			globals.New,
+			handlers.New,
+			healthcheck.New,
+			logger.New,
+			middleware.New,
+			reportbuf.New,
+			server.New,
+		),
+		fx.Invoke(
+			// First, so the name and version are logged even when
+			// a setting stops the start.
+			func(log *logger.Logger) { log.Identify() },
+			func(*server.Server) {},
+		),
+	).Run()
+}

internal/cli/cli_test.go

@@ -0,0 +1,219 @@
+package cli_test
+
+import (
+	"bytes"
+	"os"
+	"os/user"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+
+	"sneak.berlin/go/netwatch/internal/cli"
+	"sneak.berlin/go/netwatch/internal/reportbuf"
+)
+
+// TestMainRunsCheckCIDR: Main given check-cidr returns 0, writing
+// nothing, for a CIDR the server takes in its TRUSTED_PROXIES, and 1,
+// with an error naming TRUSTED_PROXIES and the CIDR, for one it
+// refuses, and does not start the server.
+func TestMainRunsCheckCIDR(t *testing.T) {
+	t.Parallel()
+
+	var stderr bytes.Buffer
+
+	code := cli.Main(&stderr, "netwatch", "test",
+		[]string{"check-cidr", "10.0.0.0/8"}, failIfServerStarts(t))
+	if code != 0 || stderr.Len() != 0 {
+		t.Errorf("check-cidr 10.0.0.0/8: exit %d, stderr %q; want exit 0 and no output",
+			code, stderr.String())
+	}
+
+	stderr.Reset()
+
+	code = cli.Main(&stderr, "netwatch", "test",
+		[]string{"check-cidr", "1.2.3/32"}, failIfServerStarts(t))
+
+	want := `TRUSTED_PROXIES "1.2.3/32": `
+	if code != 1 || !strings.HasPrefix(stderr.String(), want) {
+		t.Errorf("check-cidr 1.2.3/32: exit %d, stderr %q; want exit 1 and %q...",
+			code, stderr.String(), want)
+	}
+}
+
+// TestMainRunsPrepareDataDir: Main given prepare-data-dir runs the
+// prepare-data-dir subcommand for the netwatch user, and does not start
+// the server. The test image has no netwatch user, so that subcommand
+// exits 1 with the error from looking the user up;
+// TestPrepareDataDirRefusesPathOutsideVolume checks the path.
+func TestMainRunsPrepareDataDir(t *testing.T) {
+	t.Parallel()
+
+	var stderr bytes.Buffer
+
+	code := cli.Main(&stderr, "netwatch", "test",
+		[]string{"prepare-data-dir", "/etc"}, failIfServerStarts(t))
+
+	want := user.UnknownUserError("netwatch").Error() + "\n"
+	if code != 1 || stderr.String() != want {
+		t.Errorf("prepare-data-dir /etc: exit %d, stderr %q; want exit 1 and %q",
+			code, stderr.String(), want)
+	}
+}
+
+// TestMainRunsServerWithNoArguments: Main given no arguments starts the
+// server with the name and version it was given, writes nothing and
+// returns 0.
+func TestMainRunsServerWithNoArguments(t *testing.T) {
+	t.Parallel()
+
+	var (
+		stderr                 bytes.Buffer
+		gotAppname, gotVersion string
+	)
+
+	code := cli.Main(&stderr, "netwatch", "test", []string{},
+		func(appname, version string) {
+			gotAppname, gotVersion = appname, version
+		})
+	if code != 0 || stderr.Len() != 0 {
+		t.Errorf("exit %d, stderr %q; want exit 0 and no output",
+			code, stderr.String())
+	}
+
+	if gotAppname != "netwatch" || gotVersion != "test" {
+		t.Errorf("server started with %q %q; want %q %q",
+			gotAppname, gotVersion, "netwatch", "test")
+	}
+}
+
+// TestMainRefusesOtherCommandLines: Main given a subcommand with too
+// few or too many values, or a misspelt subcommand, writes the usage
+// message to stderr, returns 2 and does not start the server.
+func TestMainRefusesOtherCommandLines(t *testing.T) {
+	t.Parallel()
+
+	want := "usage: netwatch-server " +
+		"[check-cidr CIDR | prepare-data-dir DATA_DIR]\n"
+
+	for _, commandLine := range []string{
+		"netwatch-server check-cidr",
+		"netwatch-server check-cidr 192.0.2.0/24 198.51.100.0/24",
+		"netwatch-server prepare-data-dir",
+		"netwatch-server prepare-data-dir /data/reports /data/other",
+		"netwatch-server check-cdir 192.0.2.0/24",
+	} {
+		var stderr bytes.Buffer
+
+		// Main takes the command line after the program's name.
+		args := strings.Fields(commandLine)[1:]
+
+		code := cli.Main(&stderr, "netwatch", "test", args, failIfServerStarts(t))
+		if code != 2 || stderr.String() != want {
+			t.Errorf("%q: exit %d, stderr %q; want exit 2 and %q",
+				commandLine, code, stderr.String(), want)
+		}
+	}
+}
+
+// TestCheckCIDRTakesCIDR: check-cidr exits 0, writing nothing, for a
+// CIDR the server takes in its TRUSTED_PROXIES.
+func TestCheckCIDRTakesCIDR(t *testing.T) {
+	t.Parallel()
+
+	for _, cidr := range []string{"10.0.0.0/8", "192.0.2.1/32", "2001:db8::/32"} {
+		var stderr bytes.Buffer
+
+		code := cli.CheckCIDR(&stderr, cidr)
+		if code != 0 || stderr.Len() != 0 {
+			t.Errorf("%q: exit %d, stderr %q; want exit 0 and no output",
+				cidr, code, stderr.String())
+		}
+	}
+}
+
+// TestCheckCIDRRefusesOtherInput: check-cidr exits 1, with an error
+// naming TRUSTED_PROXIES and the input, for anything the server would
+// refuse in its TRUSTED_PROXIES, such as 1.2.3/32, which nginx would
+// look up as a hostname.
+func TestCheckCIDRRefusesOtherInput(t *testing.T) {
+	t.Parallel()
+
+	for _, cidr := range []string{
+		"1.2.3/32", "example.com/32", "10.0.0.0/33", "10.0.0.1", "",
+	} {
+		var stderr bytes.Buffer
+
+		code := cli.CheckCIDR(&stderr, cidr)
+
+		want := "TRUSTED_PROXIES " + strconv.Quote(cidr) + ": "
+		if code != 1 || !strings.HasPrefix(stderr.String(), want) {
+			t.Errorf("%q: exit %d, stderr %q; want exit 1 and %q...",
+				cidr, code, stderr.String(), want)
+		}
+	}
+}
+
+// TestPrepareDataDirTakesPathInVolume: prepare-data-dir exits 0,
+// writing nothing, for a DATA_DIR below the volume, and creates it.
+func TestPrepareDataDirTakesPathInVolume(t *testing.T) {
+	t.Parallel()
+
+	volume := t.TempDir()
+	dataDir := filepath.Join(volume, "reports")
+
+	var stderr bytes.Buffer
+
+	code := cli.PrepareDataDir(&stderr, volume, dataDir, currentUsername(t))
+	if code != 0 || stderr.Len() != 0 {
+		t.Errorf("exit %d, stderr %q; want exit 0 and no output",
+			code, stderr.String())
+	}
+
+	info, err := os.Stat(dataDir)
+	if err != nil || !info.IsDir() {
+		t.Errorf("DATA_DIR not created: %v", err)
+	}
+}
+
+// TestPrepareDataDirRefusesPathOutsideVolume: prepare-data-dir exits
+// 1, with an error naming DATA_DIR and its value, for a DATA_DIR
+// outside the volume.
+func TestPrepareDataDirRefusesPathOutsideVolume(t *testing.T) {
+	t.Parallel()
+
+	volume := t.TempDir()
+
+	var stderr bytes.Buffer
+
+	code := cli.PrepareDataDir(&stderr, volume, "/etc", currentUsername(t))
+
+	want := "DATA_DIR '/etc': " + reportbuf.ErrDataDirOutsideVolume.Error() + "\n"
+	if code != 1 || stderr.String() != want {
+		t.Errorf("exit %d, stderr %q; want exit 1 and %q",
+			code, stderr.String(), want)
+	}
+}
+
+// currentUsername is the name of the user the test runs as, the only
+// owner a test not run as root can give files to.
+func currentUsername(t *testing.T) string {
+	t.Helper()
+
+	current, err := user.Current()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	return current.Username
+}
+
+// failIfServerStarts is what the tests give Main in place of
+// cli.RunServer: it fails the test instead of starting the server.
+func failIfServerStarts(t *testing.T) func(appname, version string) {
+	t.Helper()
+
+	return func(string, string) {
+		t.Error("Main started the server")
+	}
+}

internal/cli/export_test.go

@@ -0,0 +1,16 @@
+package cli
+
+import "io"
+
+// CheckCIDR exposes the check-cidr subcommand to the external tests,
+// which read what it writes to stderr.
+func CheckCIDR(stderr io.Writer, cidr string) int {
+	return checkCIDR(stderr, cidr)
+}
+
+// PrepareDataDir exposes the prepare-data-dir subcommand to the
+// external tests, which give it a volume and a user of their own in
+// place of /data and netwatch.
+func PrepareDataDir(stderr io.Writer, volume, dataDir, username string) int {
+	return prepareDataDir(stderr, volume, dataDir, username)
+}

internal/config/config_test.go

@@ -13,8 +13,8 @@ import (
 	"go.uber.org/fx"
 )
 
-// requireConfigError builds the config as main does and fails the
+// requireConfigError builds the config as cli.RunServer does and fails
-// test unless that fails with an error naming setting. It uses
+// the test unless that fails with an error naming setting. It uses
 // fx.New, because fxtest.New fails the test itself on an error.
 func requireConfigError(t *testing.T, setting string) {
 	t.Helper()
@@ -31,8 +31,8 @@ func requireConfigError(t *testing.T, setting string) {
 	}
 }
 
-// requireTrustedProxies builds the config as main does and fails the
+// requireTrustedProxies builds the config as cli.RunServer does and
-// test unless its TrustedProxies are want.
+// fails the test unless its TrustedProxies are want.
 func requireTrustedProxies(t *testing.T, want []string) {
 	t.Helper()
 

internal/globals/globals.go

@@ -4,7 +4,7 @@ package globals
 
 import "go.uber.org/fx"
 
-//nolint:gochecknoglobals // set from main before fx starts
+//nolint:gochecknoglobals // set by cli.RunServer before fx starts
 var (
 	// Appname is the application name.
 	Appname string

internal/reportbuf/reportbuf_test.go

@@ -334,9 +334,9 @@ func stopWhileHeld(
 	return <-stopped
 }
 
-// startApp starts a Buffer through fx, as main does, with the DATA_DIR
+// startApp starts a Buffer through fx, as cli.RunServer does, with the
-// and DATA_DIR_MAX_BYTES the calling test has set, and returns it with
+// DATA_DIR and DATA_DIR_MAX_BYTES the calling test has set, and returns
-// the app, for tests that stop the app themselves.
+// it with the app, for tests that stop the app themselves.
 func startApp(t *testing.T) (*reportbuf.Buffer, *fxtest.App) {
 	t.Helper()
 
@@ -358,8 +358,8 @@ func startApp(t *testing.T) (*reportbuf.Buffer, *fxtest.App) {
 	return buf, app
 }
 
-// startBuffer starts a Buffer through fx, as main does, with the
+// startBuffer starts a Buffer through fx, as cli.RunServer does, with
-// DATA_DIR and DATA_DIR_MAX_BYTES the calling test has set.
+// the DATA_DIR and DATA_DIR_MAX_BYTES the calling test has set.
 func startBuffer(t *testing.T) *reportbuf.Buffer {
 	t.Helper()
 
@@ -1120,8 +1120,8 @@ func TestHealthCheckFailsWhileWritesFail(t *testing.T) {
 }
 
 // startBufferWithHandlers starts a Buffer and the Handlers that store
-// reports in it through fx, as main does, with the DATA_DIR the calling
+// reports in it through fx, as cli.RunServer does, with the DATA_DIR
-// test has set.
+// the calling test has set.
 func startBufferWithHandlers(
 	t *testing.T,
 ) (*reportbuf.Buffer, *handlers.Handlers) {

internal/server/routes_test.go

@@ -22,9 +22,9 @@ import (
 	"go.uber.org/fx/fxtest"
 )
 
-// newServer builds a Server from the same constructors as main,
+// newServer builds a Server from the same constructors as
-// configured from the environment. It is never started, so nothing
+// cli.RunServer, configured from the environment. It is never started,
-// listens.
+// so nothing listens.
 func newServer(t *testing.T) *server.Server {
 	t.Helper()
 

internal/server/server.go

@@ -79,7 +79,7 @@ func New(
 			s.SetupRoutes()
 			s.httpServer = s.newHTTPServer()
 
-			go s.listenAndServe()
+			go func() { s.listenAndServe() }()
 
 			return nil
 		},

package.json

@@ -1,6 +1,6 @@
 {
     "name": "netwatch",
-    "version": "1.0.0",
+    "private": true,
     "description": "Real-time network latency monitor SPA",
     "type": "module",
     "scripts": {

script/add-dependency

@@ -23,8 +23,8 @@ main() {
     "" | -* | *[[:space:]]*) usage ;;
     esac
     cd "$ROOT"
-    yarn add --dev "$1"
+    "$ROOT/script/yarn" add --dev "$1"
-    yarn install --frozen-lockfile
+    "$ROOT/script/yarn" install --frozen-lockfile
 }
 
 main "$@"

script/bootstrap

@@ -3,11 +3,14 @@
 # this repo. Idempotent: every install is guarded by a check so already
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
 # or apk (detected in that order); assumes nothing is present. Node is
-# used directly if it is at least NODE_MIN_VERSION; otherwise it is
+# used directly only if it has the major version of NODE_VERSION and is
-# installed at a pinned version via nvm (installing nvm itself first,
+# at least NODE_MIN_VERSION; otherwise NODE_VERSION is installed via nvm
-# from a hash-verified release archive, never curl | sh). Go, with its
+# (installing nvm itself first, from a hash-verified release archive,
-# gofmt, is used directly only if it is exactly GO_VERSION; otherwise
+# never curl | sh). Yarn is used directly only if it is exactly
-# that release is installed from its hash-verified archive.
+# YARN_VERSION; otherwise that version is prepared through corepack,
+# or installed with npm where there is no corepack.
+# Go, with its gofmt, is used directly only if it is exactly GO_VERSION;
+# otherwise that release is installed from its hash-verified archive.
 #
 # What this script installs outside the system package manager lives
 # under $HOME and is linked into ~/.local/bin, where make and the git
@@ -142,32 +145,63 @@ ensure_nvm() {
     rm -rf "$tmp"
 }
 
-# node_ok: the node on PATH is at least NODE_MIN_VERSION. node itself
+# node_ok: the node on PATH has the major version of NODE_VERSION and is
-# compares the two: major, then minor, then patch.
+# at least NODE_MIN_VERSION. Only the major is compared with the pin,
+# as REPO_POLICIES.md asks. node itself compares the versions: major,
+# then minor, then patch. A node that fails does not pass.
+# script/bootstrap and script/yarn carry this function unchanged.
 node_ok() {
-    if missing node; then return 1; fi
+    if ! command -v node >/dev/null 2>&1; then return 1; fi
     node -e '
         const have = process.versions.node.split(".").map(Number);
         const want = process.argv[1].split(".").map(Number);
+        const pinned = process.argv[2].split(".").map(Number);
+        if (have[0] !== pinned[0]) process.exit(1);
         for (let i = 0; i < 3; i++) {
             if (have[i] !== want[i]) process.exit(have[i] > want[i] ? 0 : 1);
         }
-    ' "$NODE_MIN_VERSION"
+    ' "$NODE_MIN_VERSION" "$NODE_VERSION"
 }
 
 # ensure_node: unless node_ok, install NODE_VERSION and link its node.
+# Afterwards node is looked up through PATH again and must pass node_ok.
 ensure_node() {
-    if node_ok; then return 0; fi
+    if node_ok; then
+        echo "bootstrap: using node $(node --version)"
+        return 0
+    fi
     ensure_nvm
     nvm_sh "nvm install $NODE_VERSION"
     link_bin "$HOME/.nvm/versions/node/v$NODE_VERSION/bin/node" node
+    hash -r
+    if ! node_ok; then
+        echo "bootstrap: after installing node $NODE_VERSION through nvm," >&2
+        echo "  the node on PATH, $(command -v node), is not it" >&2
+        exit 1
+    fi
+    echo "bootstrap: installed node $(node --version)"
 }
 
-# ensure_yarn: corepack writes its shims (pnpm and yarnpkg as well as
+# yarn_ok: yarn --version on PATH prints exactly YARN_VERSION, compared
-# yarn) into $TOOLCHAIN rather than next to itself, and the npm fallback
+# over the whole version. A yarn that fails or prints anything else does
-# installs there too; only yarn is linked.
+# not pass.
+yarn_ok() {
+    if missing yarn; then return 1; fi
+    version="$(yarn --version 2>/dev/null)" || return 1
+    [ "$version" = "$YARN_VERSION" ]
+}
+
+# ensure_yarn: unless yarn_ok, prepare YARN_VERSION and link its yarn.
+# corepack writes its shims (pnpm and yarnpkg as well as yarn) into
+# $TOOLCHAIN rather than next to itself, and the npm fallback installs
+# there too; only yarn is linked. Afterwards yarn is looked up through
+# PATH again and must pass yarn_ok, so another yarn that hides the link
+# stops bootstrap.
 ensure_yarn() {
-    if ! missing yarn; then return 0; fi
+    if yarn_ok; then
+        echo "bootstrap: using yarn $(yarn --version)"
+        return 0
+    fi
     shims="$TOOLCHAIN/corepack-shims"
     mkdir -p "$shims"
     if ! missing corepack; then
@@ -182,6 +216,13 @@ ensure_yarn() {
         shims="$TOOLCHAIN/npm-global/bin"
     fi
     link_bin "$shims/yarn" yarn
+    hash -r
+    if ! yarn_ok; then
+        echo "bootstrap: after installing yarn $YARN_VERSION in $shims," >&2
+        echo "  the yarn on PATH, $(command -v yarn), does not report it" >&2
+        exit 1
+    fi
+    echo "bootstrap: installed yarn $(yarn --version)"
 }
 
 # go_ok: the go on PATH has its gofmt beside it (a Go release ships the

script/build

@@ -8,11 +8,12 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    yarn build
+    "$ROOT/script/yarn" build
 
-    # VERSION comes from the environment. Unset or empty, it is git
+    # VERSION comes from the environment. Unset or empty, it is
-    # describe, or "dev" where there is no git or no repository history.
+    # `git describe --tags --always --dirty`, as in script/docker, or
-    version="${VERSION:-$(git describe --always --dirty 2>/dev/null || echo dev)}"
+    # "dev" where there is no git or no repository history.
+    version="${VERSION:-$(git describe --tags --always --dirty 2>/dev/null || echo dev)}"
 
     CGO_ENABLED=0 go build -trimpath \
         -ldflags "-s -w -X main.Version=$version" \

script/dev

@@ -7,7 +7,7 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    yarn dev
+    "$ROOT/script/yarn" dev
 }
 
 main "$@"

script/frontend-fmt

@@ -10,7 +10,7 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    yarn prettier --write '**/*.{js,css,html,md}'
+    "$ROOT/script/yarn" prettier --write '**/*.{js,css,html,md}'
 }
 
 main "$@"

script/frontend-fmt-check

@@ -7,7 +7,7 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    yarn prettier --check '**/*.{js,css,html,md}'
+    "$ROOT/script/yarn" prettier --check '**/*.{js,css,html,md}'
 }
 
 main "$@"

script/frontend-test

@@ -14,12 +14,14 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    NODE_OPTIONS=--test-reporter=dot timeout 90 yarn --silent run test || {
+    NODE_OPTIONS=--test-reporter=dot \
+        timeout 90 "$ROOT/script/yarn" --silent run test || {
         echo "--- Rerunning with every test listed for details ---"
-        NODE_OPTIONS=--test-reporter=spec timeout 90 yarn --silent run test
+        NODE_OPTIONS=--test-reporter=spec \
+            timeout 90 "$ROOT/script/yarn" --silent run test
         exit 1
     }
-    timeout 30 yarn build
+    timeout 30 "$ROOT/script/yarn" build
 }
 
 main "$@"

script/yarn

@@ -0,0 +1,55 @@
+#!/bin/sh
+# script/yarn: run yarn with the given arguments under the node
+# script/bootstrap would use. Every script that runs yarn on the host
+# runs it through this one, except script/bootstrap, which picks its
+# own node and yarn.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+# Must match the pins in script/bootstrap.
+NODE_VERSION="22.17.0"
+NODE_MIN_VERSION="22.13.0"
+
+# node_ok: the node on PATH has the major version of NODE_VERSION and is
+# at least NODE_MIN_VERSION. Only the major is compared with the pin,
+# as REPO_POLICIES.md asks. node itself compares the versions: major,
+# then minor, then patch. A node that fails does not pass.
+# script/bootstrap and script/yarn carry this function unchanged.
+node_ok() {
+    if ! command -v node >/dev/null 2>&1; then return 1; fi
+    node -e '
+        const have = process.versions.node.split(".").map(Number);
+        const want = process.argv[1].split(".").map(Number);
+        const pinned = process.argv[2].split(".").map(Number);
+        if (have[0] !== pinned[0]) process.exit(1);
+        for (let i = 0; i < 3; i++) {
+            if (have[i] !== want[i]) process.exit(have[i] > want[i] ? 0 : 1);
+        }
+    ' "$NODE_MIN_VERSION" "$NODE_VERSION"
+}
+
+# Run the yarn script/bootstrap installed: the yarn on PATH when the
+# node on PATH passes node_ok, and otherwise yarn under the pinned node
+# in nvm. nvm is a bash script, hence the subshell.
+run_yarn() {
+    if node_ok && command -v yarn >/dev/null 2>&1; then
+        exec yarn "$@"
+    fi
+    if node_ok || [ ! -s "$HOME/.nvm/nvm.sh" ]; then
+        echo "script/yarn: no yarn; run script/bootstrap first" >&2
+        exit 1
+    fi
+    exec bash -c '. "$HOME/.nvm/nvm.sh" && nvm use "$1" >/dev/null &&
+        shift && exec yarn "$@"' bash "$NODE_VERSION" "$@"
+}
+
+main() {
+    cd "$ROOT"
+    # script/bootstrap links the node and yarn it installs into
+    # ~/.local/bin, which the shell that called it may not have on PATH.
+    PATH="$HOME/.local/bin:$PATH"
+    run_yarn "$@"
+}
+
+main "$@"

test/unit/main.test.js

@@ -180,6 +180,91 @@ test("a check fetches the target's URL as written, with no query string added",
     );
 });
 
+test("a check sends no Referer header, wherever the page is served from", async (t) => {
+    mockTargets(t, () => 10);
+    const check = measureLatency("https://fsn1-speed.hetzner.com");
+    t.mock.timers.tick(10);
+    assert.notEqual(await settled(check), "still waiting");
+    assert.equal(
+        fetch.mock.calls[0].arguments[1].referrerPolicy,
+        "no-referrer",
+    );
+});
+
+// These targets' home pages answer with a redirect. A check follows it and
+// times the request to the new URL too, often on another host. The Google
+// Cloud Console redirects only requests that do not say they come from
+// another site, such as curl's. Each target is checked at /robots.txt on
+// its own host, which answers without a redirect. An S3 region answers it
+// with 403, and any answer counts as reachable.
+test("a target whose home page redirects is checked at /robots.txt on its own host", () => {
+    const checked = new Map(
+        new AppState([]).wan.map((host) => [host.name, host.url]),
+    );
+    for (const [name, url] of [
+        ["AWS Console", "https://console.aws.amazon.com/robots.txt"],
+        ["Google Cloud Console", "https://console.cloud.google.com/robots.txt"],
+        ["Akamai", "https://www.akamai.com/robots.txt"],
+        ["B2", "https://api.backblazeb2.com/robots.txt"],
+        [
+            "S3 af-south-1 (Cape Town)",
+            "https://s3.af-south-1.amazonaws.com/robots.txt",
+        ],
+        [
+            "S3 eu-west-2 (London)",
+            "https://s3.eu-west-2.amazonaws.com/robots.txt",
+        ],
+        [
+            "S3 me-south-1 (Bahrain)",
+            "https://s3.me-south-1.amazonaws.com/robots.txt",
+        ],
+        [
+            "S3 ap-northeast-1 (Tokyo)",
+            "https://s3.ap-northeast-1.amazonaws.com/robots.txt",
+        ],
+        [
+            "S3 ap-southeast-1 (Singapore)",
+            "https://s3.ap-southeast-1.amazonaws.com/robots.txt",
+        ],
+        [
+            "S3 ap-southeast-2 (Sydney)",
+            "https://s3.ap-southeast-2.amazonaws.com/robots.txt",
+        ],
+        [
+            "S3 us-west-2 (Oregon)",
+            "https://s3.us-west-2.amazonaws.com/robots.txt",
+        ],
+        [
+            "S3 sa-east-1 (São Paulo)",
+            "https://s3.sa-east-1.amazonaws.com/robots.txt",
+        ],
+    ]) {
+        assert.equal(checked.get(name), url);
+    }
+});
+
+// Chrome keeps the connection to an S3 region open after a HEAD check, but
+// closes it after most GET checks. The Hetzner servers do not answer HEAD.
+test("a round checks each S3 region with a HEAD request and every other target with a GET request", async (t) => {
+    const state = new AppState([
+        { name: "Local CPE", url: "http://192.168.100.1" },
+    ]);
+    mockTargets(t, () => 10);
+    const round = tick(state, new AbortController().signal);
+    t.mock.timers.tick(10);
+    assert.notEqual(await settled(round), "still waiting");
+    const methods = new Map(
+        fetch.mock.calls.map((call) => [
+            call.arguments[0],
+            call.arguments[1].method,
+        ]),
+    );
+    for (const host of state.allHosts) {
+        const method = host.name.startsWith("S3 ") ? "HEAD" : "GET";
+        assert.equal(methods.get(host.url), method, host.name);
+    }
+});
+
 test("at a 30000ms interval, a target answering after 1000ms shows in its row while another target's check is still waiting", async (t) => {
     CONFIG.updateInterval = 30000;
     const state = new AppState([

web/src/main.js

@@ -67,51 +67,66 @@ export const CONFIG = {
 
 // WAN endpoints to monitor. These are used for the aggregate health/stats
 // display (min/max/avg). Ordered: personal, LLM APIs, big-3 cloud, then
-// CDN/hosting/other.
+// CDN/hosting/other. A check follows a redirect and times the request to
+// the new URL too. So a target whose home page redirects is checked at
+// /robots.txt on its own host. That URL answers without a redirect.
 const WAN_HOSTS = [
     { name: "datavi.be", url: "https://datavi.be" },
     { name: "Anthropic API", url: "https://api.anthropic.com" },
     { name: "OpenAI API", url: "https://api.openai.com" },
-    { name: "AWS Console", url: "https://console.aws.amazon.com" },
+    { name: "AWS Console", url: "https://console.aws.amazon.com/robots.txt" },
-    { name: "Google Cloud Console", url: "https://console.cloud.google.com" },
+    {
+        name: "Google Cloud Console",
+        url: "https://console.cloud.google.com/robots.txt",
+    },
     { name: "Microsoft Azure", url: "https://portal.azure.com" },
     { name: "Cloudflare", url: "https://www.cloudflare.com" },
     { name: "Fastly CDN", url: "https://www.fastly.com" },
-    { name: "Akamai", url: "https://www.akamai.com" },
+    { name: "Akamai", url: "https://www.akamai.com/robots.txt" },
     { name: "Google", url: "https://www.google.com" },
     { name: "GitHub", url: "https://github.com" },
-    { name: "B2", url: "https://api.backblazeb2.com" },
+    { name: "B2", url: "https://api.backblazeb2.com/robots.txt" },
+    // Chrome keeps the connection to an S3 region open after a HEAD check,
+    // but closes it after most GET checks.
     {
         name: "S3 af-south-1 (Cape Town)",
-        url: "https://s3.af-south-1.amazonaws.com",
+        url: "https://s3.af-south-1.amazonaws.com/robots.txt",
+        method: "HEAD",
     },
     {
         name: "S3 eu-west-2 (London)",
-        url: "https://s3.eu-west-2.amazonaws.com",
+        url: "https://s3.eu-west-2.amazonaws.com/robots.txt",
+        method: "HEAD",
     },
     {
         name: "S3 me-south-1 (Bahrain)",
-        url: "https://s3.me-south-1.amazonaws.com",
+        url: "https://s3.me-south-1.amazonaws.com/robots.txt",
+        method: "HEAD",
     },
     {
         name: "S3 ap-northeast-1 (Tokyo)",
-        url: "https://s3.ap-northeast-1.amazonaws.com",
+        url: "https://s3.ap-northeast-1.amazonaws.com/robots.txt",
+        method: "HEAD",
     },
     {
         name: "S3 ap-southeast-1 (Singapore)",
-        url: "https://s3.ap-southeast-1.amazonaws.com",
+        url: "https://s3.ap-southeast-1.amazonaws.com/robots.txt",
+        method: "HEAD",
     },
     {
         name: "S3 ap-southeast-2 (Sydney)",
-        url: "https://s3.ap-southeast-2.amazonaws.com",
+        url: "https://s3.ap-southeast-2.amazonaws.com/robots.txt",
+        method: "HEAD",
     },
     {
         name: "S3 us-west-2 (Oregon)",
-        url: "https://s3.us-west-2.amazonaws.com",
+        url: "https://s3.us-west-2.amazonaws.com/robots.txt",
+        method: "HEAD",
     },
     {
         name: "S3 sa-east-1 (São Paulo)",
-        url: "https://s3.sa-east-1.amazonaws.com",
+        url: "https://s3.sa-east-1.amazonaws.com/robots.txt",
+        method: "HEAD",
     },
     // Hetzner regional speed test servers — genuine per-DC endpoints
     {
@@ -271,6 +286,7 @@ export class HostState {
     constructor(host, pinned = false) {
         this.name = host.name;
         this.url = host.url;
+        this.method = host.method;
         // Each entry is either a check's result, { timestamp, latency,
         // error }, or a round skipped while paused, { timestamp,
         // latency: null, paused: true }.
@@ -567,16 +583,18 @@ export class Reporter {
 
 // --- Latency Measurement -----------------------------------------------------
 
-// Checks one target. The check times out after CONFIG.requestTimeout; the
+// Checks one target with the given HTTP method, GET when none is given. The
-// caller can give it up sooner through the optional signal, which also ends
+// check times out after CONFIG.requestTimeout; the caller can give it up
-// it as a timeout. A failed check's reason says what went wrong and after
+// sooner through the optional signal, which also ends it as a timeout. A
-// how long; a check that answered has none.
+// failed check's reason says what went wrong and after how long; a check
+// that answered has none.
 //
-// The URL is fetched as written, with nothing added to it: the Hetzner
+// The Hetzner speed-test servers close the connection without an answer
-// speed-test servers close the connection without an answer when the URL
+// when the URL has a query string or the request has a Referer header. So
-// has a query string, and cache: "no-store" keeps the browser's cache out
+// the URL is fetched as written, and referrerPolicy: "no-referrer" sends
-// of the measurement.
+// no Referer header, wherever the page is served from. cache: "no-store"
-export async function measureLatency(url, signal) {
+// keeps the browser's cache out of the measurement.
+export async function measureLatency(url, signal, method = "GET") {
     const controller = new AbortController();
     const timeoutId = setTimeout(
         () => controller.abort(),
@@ -588,9 +606,10 @@ export async function measureLatency(url, signal) {
 
     try {
         await fetch(url, {
-            method: "GET",
+            method,
             mode: "no-cors",
             cache: "no-store",
+            referrerPolicy: "no-referrer",
             signal: controller.signal,
         });
         const latency = Math.round(performance.now() - start);
@@ -1290,7 +1309,7 @@ export async function tick(state, signal, onOffline) {
     // the round started.
     await Promise.all(
         state.allHosts.map(async (host) => {
-            const r = await measureLatency(host.url, signal);
+            const r = await measureLatency(host.url, signal, host.method);
             if (state.paused || signal.aborted || state.tickCount === 0) {
                 return;
             }
@@ -1363,7 +1382,7 @@ function startRecoveryProbe(state, startRounds) {
         const checks = new AbortController();
         state._recoveryProbeChecks = checks;
         for (const host of canaries) {
-            measureLatency(host.url, checks.signal).then((r) => {
+            measureLatency(host.url, checks.signal, host.method).then((r) => {
                 if (r.error !== null || checks.signal.aborted) return;
                 log.notice("Recovery probe: connectivity detected");
                 stopRecoveryProbe(state);