script/build stamps lightweight tags too (closes #156)

When VERSION is unset or empty, script/build now takes the version from
`git describe --tags --always --dirty`, the form script/docker and
script/cibuild use. Without --tags it ignored lightweight tags, so a
binary from `make build` could report a commit where the image built
from the same tree reported the tag. README.md Entrypoints names the
same form.

Model: opus-5-5

.editorconfig

@@ -11,8 +11,7 @@ insert_final_newline = true
 [Makefile]
 indent_style = tab
 
+# This repository's own entries, after the shared content above.
+
 [*.go]
 indent_style = tab
-
-# This repository's own sections, such as one for another language it
-# uses, go below this comment, and a re-vendor keeps them.

.gitignore

@@ -27,7 +27,7 @@ node_modules/
 # Environment files. `*.env` covers bare `.env` and the `prod.env`
 # convention. Only the templates `example.env` and `sample.env` are
 # re-included below. A repository that commits any other template adds
-# its own negation at the end of this file, for example `!.env.example`.
+# its own negation after these lines, for example `!.env.example`.
 *.[eE][nN][vV]
 .[eE][nN][vV].*
 .[eE][nN][vV][rR][cC]
@@ -46,9 +46,7 @@ node_modules/
 [iI][dD]_[eE][dD]25519
 [iI][dD]_[eE][dD]25519_[sS][kK]
 
-# This repository's own entries, such as its build outputs, go below
+# This repository's own entries, after the shared content above.
-# this comment, and a re-vendor keeps them. Anchor a binary built at the
-# root: `/myapp`, never `myapp`, which also ignores `cmd/myapp/`.
 
 # Build output
 dist/

.golangci.yml

@@ -25,8 +25,6 @@ linters:
     # silenced by disabling that name, not by enabling the successor.
     - wsl              # Deprecated, replaced by wsl_v5
     - gomodguard       # Deprecated, replaced by gomodguard_v2
-    # Misses findings at random in v2.14.0; back once a pinned release fixes it
-    - canonicalheader
   settings:
     lll:
       line-length: 88

README.md

@@ -218,10 +218,6 @@ stops. Its routes:
 It is an `fx`-wired Go application: `cmd/netwatch-server/` starts it, and its
 packages are in `internal/`:
 
-- **`cli`**: Runs `netwatch-server` from its command line: the `check-cidr` and
-  `prepare-data-dir` subcommands, which `bin/entrypoint.sh` runs before it
-  starts the server, and, given no arguments, the server, with the `fx` wiring.
-  It refuses any other arguments with a usage message and exit code 2.
 - **`config`**: Loads configuration from environment variables and config files
   via Viper.
 - **`handlers`**: HTTP request handlers for the API (health check, report

TODO.md

@@ -9,12 +9,11 @@
 
 # Status
 
-pre-1.0. Release candidates are tagged on `next`, the first being `v1.0.0-rc1`;
+pre-1.0. No git tags. `main` is the stable branch and `next` the development
-`git tag --merged origin/next` lists them. `main` is the stable branch and
+branch, which every PR targets. The frontend and the Go backend ship as one
-`next` the development branch, which every PR targets. The frontend and the Go
+Docker image, and the Gitea workflow `.gitea/workflows/check.yml` runs
-backend ship as one Docker image, and the Gitea workflow
+`script/cibuild` on every push, and cancels the older run on the same branch.
-`.gitea/workflows/check.yml` runs `script/cibuild` on every push, and cancels
+Working toward 1.0.0.
-the older run on the same branch. Working toward 1.0.0.
 
 # Next Step
 
@@ -23,50 +22,6 @@ Run `make frontend-viewport-test` in CI as its own step; it is not part of
 
 # Completed Steps
 
-- 2026-10-19: the server's `OnStart` hook in `internal/server/server.go` starts
-  `listenAndServe` with `go func() { s.listenAndServe() }()`, as the Go style
-  guide asks ([#162](https://git.eeqj.de/sneak/netwatch/issues/162)); it was
-  `go s.listenAndServe()`. No other `go` statement in the Go code called a
-  function directly. Nothing the server does changed
-- 2026-10-19: `.gitignore`, `.editorconfig` and `.golangci.yml` are the
-  sneak/prompts copies at `0653579`
-  ([#174](https://git.eeqj.de/sneak/netwatch/issues/174)). `.gitignore` is the
-  standard file followed by this repository's own entries; `.editorconfig` is
-  the standard file alone, which now carries the `[*.go]` section.
-  `.golangci.yml` disables `canonicalheader`, as the canonical copy does,
-  because golangci-lint v2.14.0 misses its findings at random
-- 2026-10-19: `package.json` has no `version` field and is marked
-  `"private": true` ([#158](https://git.eeqj.de/sneak/netwatch/issues/158)). It
-  said `1.0.0`, a release that has not been made, and nothing read it; the git
-  tag is the one version, which the image and `make build` take from
-  `git describe --tags`. The package is never published
-- 2026-10-19: Status names `v1.0.0-rc1`, the first release candidate, and says
-  release candidates are tagged on `next`, where it said there were no git tags
-  ([#157](https://git.eeqj.de/sneak/netwatch/issues/157)). The rest of Status
-  matches the tree
-- 2026-10-19: `netwatch-server` starts the server only when given no arguments
-  ([#179](https://git.eeqj.de/sneak/netwatch/issues/179)). `check-cidr CIDR` and
-  `prepare-data-dir DATA_DIR` behave as before; any other arguments, such as a
-  subcommand with no value or two, or a misspelt one, print a one-line usage
-  message naming both forms to stderr and exit 2. They used to start the server.
-  Unit tests call `cli.Main` with no arguments and check that it starts the
-  server, and with each subcommand given no value and two values and with a
-  misspelt subcommand, and check the exit code, the message and that the server
-  does not start
-- 2026-10-19: `main()` in `cmd/netwatch-server/main.go` is one call into a new
-  package, `internal/cli`, as the Go style guide asks
-  ([#160](https://git.eeqj.de/sneak/netwatch/issues/160)). `internal/cli` runs
-  the `check-cidr` and `prepare-data-dir` subcommands, with the same arguments,
-  messages and exit codes, and otherwise the server, with the `fx` wiring.
-  `Appname` and `Version` stay in `main`, where the build sets `Version`, and
-  `main` gives `cli.Main` stderr and the function that runs the server, which
-  the tests replace with a buffer and a function that fails them. Unit tests
-  call `cli.Main` with `check-cidr` and a CIDR the server takes and one it
-  refuses, and check the exit code and what it writes to stderr, and with
-  `prepare-data-dir` and a path outside `/data`, and check that it exits 1 with
-  the error from looking up the `netwatch` user, which the test image does not
-  have. Others give the functions behind the subcommands input they take and
-  input they refuse, and check the exit code and what they write to stderr
 - 2026-10-19: when `VERSION` is unset or empty, `script/build` stamps the
   version from `git describe --tags --always --dirty`, as `script/docker` does
   ([#156](https://git.eeqj.de/sneak/netwatch/issues/156)). Without `--tags` it

cmd/netwatch-server/main.go

@@ -1,11 +1,22 @@
-// Package main is the entry point for netwatch-server; package cli
+// Package main is the entry point for netwatch-server.
-// does the work.
 package main
 
 import (
+	"fmt"
 	"os"
+	"os/user"
 
-	"sneak.berlin/go/netwatch/internal/cli"
+	"sneak.berlin/go/netwatch/internal/config"
+	"sneak.berlin/go/netwatch/internal/globals"
+	"sneak.berlin/go/netwatch/internal/handlers"
+	"sneak.berlin/go/netwatch/internal/healthcheck"
+	"sneak.berlin/go/netwatch/internal/logger"
+	"sneak.berlin/go/netwatch/internal/middleware"
+	"sneak.berlin/go/netwatch/internal/reportbuf"
+	"sneak.berlin/go/netwatch/internal/server"
+
+	"go.uber.org/fx"
+	"go.uber.org/fx/fxevent"
 )
 
 //nolint:gochecknoglobals // set via ldflags at build time
@@ -15,5 +26,64 @@ var (
 )
 
 func main() {
-	os.Exit(cli.Main(os.Stderr, Appname, Version, os.Args[1:], cli.RunServer))
+	// "netwatch-server check-cidr CIDR" exits 1, with the error, if
+	// this server would refuse CIDR in its TRUSTED_PROXIES.
+	// bin/entrypoint.sh runs it on each entry it gives nginx.
+	if len(os.Args) == 3 && os.Args[1] == "check-cidr" {
+		_, err := middleware.ParseTrustedProxies(os.Args[2:])
+		if err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(1)
+		}
+
+		return
+	}
+
+	// "netwatch-server prepare-data-dir DATA_DIR" gets DATA_DIR ready
+	// for the netwatch user, or exits 1 with the error; see
+	// reportbuf.PrepareDataDir. bin/entrypoint.sh runs it as root
+	// before it starts this server as that user.
+	if len(os.Args) == 3 && os.Args[1] == "prepare-data-dir" {
+		netwatch, err := user.Lookup("netwatch")
+		if err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(1)
+		}
+
+		err = reportbuf.PrepareDataDir("/data", os.Args[2], netwatch)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "DATA_DIR '%s': %v\n", os.Args[2], err)
+			os.Exit(1)
+		}
+
+		return
+	}
+
+	globals.Appname = Appname
+	globals.Version = Version
+
+	fx.New(
+		// fx logs each step of starting and stopping through the
+		// server's own logger, so off a terminal those lines are
+		// JSON like every other line.
+		fx.WithLogger(func(log *logger.Logger) fxevent.Logger {
+			return &fxevent.SlogLogger{Logger: log.Get()}
+		}),
+		fx.Provide(
+			config.New,
+			globals.New,
+			handlers.New,
+			healthcheck.New,
+			logger.New,
+			middleware.New,
+			reportbuf.New,
+			server.New,
+		),
+		fx.Invoke(
+			// First, so the name and version are logged even when
+			// a setting stops the start.
+			func(log *logger.Logger) { log.Identify() },
+			func(*server.Server) {},
+		),
+	).Run()
 }

internal/cli/cli.go

@@ -1,143 +0,0 @@
-// Package cli runs netwatch-server from its command line: the
-// check-cidr and prepare-data-dir subcommands, which bin/entrypoint.sh
-// runs before it starts the server, and, given no arguments, the
-// server, with the fx wiring.
-package cli
-
-import (
-	"fmt"
-	"io"
-	"os/user"
-
-	"sneak.berlin/go/netwatch/internal/config"
-	"sneak.berlin/go/netwatch/internal/globals"
-	"sneak.berlin/go/netwatch/internal/handlers"
-	"sneak.berlin/go/netwatch/internal/healthcheck"
-	"sneak.berlin/go/netwatch/internal/logger"
-	"sneak.berlin/go/netwatch/internal/middleware"
-	"sneak.berlin/go/netwatch/internal/reportbuf"
-	"sneak.berlin/go/netwatch/internal/server"
-
-	"go.uber.org/fx"
-	"go.uber.org/fx/fxevent"
-)
-
-// usageExitCode is what Main returns for a command line it does not
-// understand, the usual exit code for a usage error.
-const usageExitCode = 2
-
-// Main runs netwatch-server with args, its command line after the
-// program's name, and returns the exit code. With no args, Main runs
-// the server by calling serve with appname and version, the name and
-// version the server logs and reports. With "check-cidr CIDR" or
-// "prepare-data-dir DATA_DIR" it runs that subcommand, which writes its
-// errors to stderr. Any other args get a one-line usage message on
-// stderr and exit code 2. main passes os.Stderr and RunServer; the
-// tests pass a buffer and a function of their own, so that no test
-// starts the server. When serve is RunServer and the server fails to
-// start, to listen or to stop, fx's Run exits the process with status 1
-// and Main never returns.
-func Main(
-	stderr io.Writer,
-	appname, version string,
-	args []string,
-	serve func(appname, version string),
-) int {
-	// "netwatch-server check-cidr CIDR" exits 1, with the error, if
-	// this server would refuse CIDR in its TRUSTED_PROXIES.
-	// bin/entrypoint.sh runs it on each entry it gives nginx.
-	if len(args) == 2 && args[0] == "check-cidr" {
-		return checkCIDR(stderr, args[1])
-	}
-
-	// "netwatch-server prepare-data-dir DATA_DIR" gets DATA_DIR ready
-	// for the netwatch user, or exits 1 with the error; see
-	// reportbuf.PrepareDataDir. bin/entrypoint.sh runs it as root
-	// before it starts this server as that user.
-	if len(args) == 2 && args[0] == "prepare-data-dir" {
-		return prepareDataDir(stderr, "/data", args[1], "netwatch")
-	}
-
-	// Any other command line is refused, so that a mistyped one does
-	// not start the server.
-	if len(args) > 0 {
-		_, _ = fmt.Fprintln(stderr,
-			"usage: netwatch-server [check-cidr CIDR | prepare-data-dir DATA_DIR]")
-
-		return usageExitCode
-	}
-
-	serve(appname, version)
-
-	return 0
-}
-
-// checkCIDR returns 0 if the server would take cidr in its
-// TRUSTED_PROXIES, and otherwise writes the error to stderr and
-// returns 1.
-func checkCIDR(stderr io.Writer, cidr string) int {
-	_, err := middleware.ParseTrustedProxies([]string{cidr})
-	if err != nil {
-		_, _ = fmt.Fprintln(stderr, err)
-
-		return 1
-	}
-
-	return 0
-}
-
-// prepareDataDir gets dataDir ready for the user named username with
-// reportbuf.PrepareDataDir, volume being where the data volume is
-// mounted, and returns 0. Otherwise it writes the error to stderr and
-// returns 1.
-func prepareDataDir(stderr io.Writer, volume, dataDir, username string) int {
-	owner, err := user.Lookup(username)
-	if err != nil {
-		_, _ = fmt.Fprintln(stderr, err)
-
-		return 1
-	}
-
-	err = reportbuf.PrepareDataDir(volume, dataDir, owner)
-	if err != nil {
-		_, _ = fmt.Fprintf(stderr, "DATA_DIR '%s': %v\n", dataDir, err)
-
-		return 1
-	}
-
-	return 0
-}
-
-// RunServer runs the server until it is told to stop, with appname and
-// version as the name and version it logs and reports. If the server
-// fails to start, to listen or to stop, fx's Run exits the process
-// with status 1 itself.
-func RunServer(appname, version string) {
-	globals.Appname = appname
-	globals.Version = version
-
-	fx.New(
-		// fx logs each step of starting and stopping through the
-		// server's own logger, so off a terminal those lines are
-		// JSON like every other line.
-		fx.WithLogger(func(log *logger.Logger) fxevent.Logger {
-			return &fxevent.SlogLogger{Logger: log.Get()}
-		}),
-		fx.Provide(
-			config.New,
-			globals.New,
-			handlers.New,
-			healthcheck.New,
-			logger.New,
-			middleware.New,
-			reportbuf.New,
-			server.New,
-		),
-		fx.Invoke(
-			// First, so the name and version are logged even when
-			// a setting stops the start.
-			func(log *logger.Logger) { log.Identify() },
-			func(*server.Server) {},
-		),
-	).Run()
-}

internal/cli/cli_test.go

@@ -1,219 +0,0 @@
-package cli_test
-
-import (
-	"bytes"
-	"os"
-	"os/user"
-	"path/filepath"
-	"strconv"
-	"strings"
-	"testing"
-
-	"sneak.berlin/go/netwatch/internal/cli"
-	"sneak.berlin/go/netwatch/internal/reportbuf"
-)
-
-// TestMainRunsCheckCIDR: Main given check-cidr returns 0, writing
-// nothing, for a CIDR the server takes in its TRUSTED_PROXIES, and 1,
-// with an error naming TRUSTED_PROXIES and the CIDR, for one it
-// refuses, and does not start the server.
-func TestMainRunsCheckCIDR(t *testing.T) {
-	t.Parallel()
-
-	var stderr bytes.Buffer
-
-	code := cli.Main(&stderr, "netwatch", "test",
-		[]string{"check-cidr", "10.0.0.0/8"}, failIfServerStarts(t))
-	if code != 0 || stderr.Len() != 0 {
-		t.Errorf("check-cidr 10.0.0.0/8: exit %d, stderr %q; want exit 0 and no output",
-			code, stderr.String())
-	}
-
-	stderr.Reset()
-
-	code = cli.Main(&stderr, "netwatch", "test",
-		[]string{"check-cidr", "1.2.3/32"}, failIfServerStarts(t))
-
-	want := `TRUSTED_PROXIES "1.2.3/32": `
-	if code != 1 || !strings.HasPrefix(stderr.String(), want) {
-		t.Errorf("check-cidr 1.2.3/32: exit %d, stderr %q; want exit 1 and %q...",
-			code, stderr.String(), want)
-	}
-}
-
-// TestMainRunsPrepareDataDir: Main given prepare-data-dir runs the
-// prepare-data-dir subcommand for the netwatch user, and does not start
-// the server. The test image has no netwatch user, so that subcommand
-// exits 1 with the error from looking the user up;
-// TestPrepareDataDirRefusesPathOutsideVolume checks the path.
-func TestMainRunsPrepareDataDir(t *testing.T) {
-	t.Parallel()
-
-	var stderr bytes.Buffer
-
-	code := cli.Main(&stderr, "netwatch", "test",
-		[]string{"prepare-data-dir", "/etc"}, failIfServerStarts(t))
-
-	want := user.UnknownUserError("netwatch").Error() + "\n"
-	if code != 1 || stderr.String() != want {
-		t.Errorf("prepare-data-dir /etc: exit %d, stderr %q; want exit 1 and %q",
-			code, stderr.String(), want)
-	}
-}
-
-// TestMainRunsServerWithNoArguments: Main given no arguments starts the
-// server with the name and version it was given, writes nothing and
-// returns 0.
-func TestMainRunsServerWithNoArguments(t *testing.T) {
-	t.Parallel()
-
-	var (
-		stderr                 bytes.Buffer
-		gotAppname, gotVersion string
-	)
-
-	code := cli.Main(&stderr, "netwatch", "test", []string{},
-		func(appname, version string) {
-			gotAppname, gotVersion = appname, version
-		})
-	if code != 0 || stderr.Len() != 0 {
-		t.Errorf("exit %d, stderr %q; want exit 0 and no output",
-			code, stderr.String())
-	}
-
-	if gotAppname != "netwatch" || gotVersion != "test" {
-		t.Errorf("server started with %q %q; want %q %q",
-			gotAppname, gotVersion, "netwatch", "test")
-	}
-}
-
-// TestMainRefusesOtherCommandLines: Main given a subcommand with too
-// few or too many values, or a misspelt subcommand, writes the usage
-// message to stderr, returns 2 and does not start the server.
-func TestMainRefusesOtherCommandLines(t *testing.T) {
-	t.Parallel()
-
-	want := "usage: netwatch-server " +
-		"[check-cidr CIDR | prepare-data-dir DATA_DIR]\n"
-
-	for _, commandLine := range []string{
-		"netwatch-server check-cidr",
-		"netwatch-server check-cidr 192.0.2.0/24 198.51.100.0/24",
-		"netwatch-server prepare-data-dir",
-		"netwatch-server prepare-data-dir /data/reports /data/other",
-		"netwatch-server check-cdir 192.0.2.0/24",
-	} {
-		var stderr bytes.Buffer
-
-		// Main takes the command line after the program's name.
-		args := strings.Fields(commandLine)[1:]
-
-		code := cli.Main(&stderr, "netwatch", "test", args, failIfServerStarts(t))
-		if code != 2 || stderr.String() != want {
-			t.Errorf("%q: exit %d, stderr %q; want exit 2 and %q",
-				commandLine, code, stderr.String(), want)
-		}
-	}
-}
-
-// TestCheckCIDRTakesCIDR: check-cidr exits 0, writing nothing, for a
-// CIDR the server takes in its TRUSTED_PROXIES.
-func TestCheckCIDRTakesCIDR(t *testing.T) {
-	t.Parallel()
-
-	for _, cidr := range []string{"10.0.0.0/8", "192.0.2.1/32", "2001:db8::/32"} {
-		var stderr bytes.Buffer
-
-		code := cli.CheckCIDR(&stderr, cidr)
-		if code != 0 || stderr.Len() != 0 {
-			t.Errorf("%q: exit %d, stderr %q; want exit 0 and no output",
-				cidr, code, stderr.String())
-		}
-	}
-}
-
-// TestCheckCIDRRefusesOtherInput: check-cidr exits 1, with an error
-// naming TRUSTED_PROXIES and the input, for anything the server would
-// refuse in its TRUSTED_PROXIES, such as 1.2.3/32, which nginx would
-// look up as a hostname.
-func TestCheckCIDRRefusesOtherInput(t *testing.T) {
-	t.Parallel()
-
-	for _, cidr := range []string{
-		"1.2.3/32", "example.com/32", "10.0.0.0/33", "10.0.0.1", "",
-	} {
-		var stderr bytes.Buffer
-
-		code := cli.CheckCIDR(&stderr, cidr)
-
-		want := "TRUSTED_PROXIES " + strconv.Quote(cidr) + ": "
-		if code != 1 || !strings.HasPrefix(stderr.String(), want) {
-			t.Errorf("%q: exit %d, stderr %q; want exit 1 and %q...",
-				cidr, code, stderr.String(), want)
-		}
-	}
-}
-
-// TestPrepareDataDirTakesPathInVolume: prepare-data-dir exits 0,
-// writing nothing, for a DATA_DIR below the volume, and creates it.
-func TestPrepareDataDirTakesPathInVolume(t *testing.T) {
-	t.Parallel()
-
-	volume := t.TempDir()
-	dataDir := filepath.Join(volume, "reports")
-
-	var stderr bytes.Buffer
-
-	code := cli.PrepareDataDir(&stderr, volume, dataDir, currentUsername(t))
-	if code != 0 || stderr.Len() != 0 {
-		t.Errorf("exit %d, stderr %q; want exit 0 and no output",
-			code, stderr.String())
-	}
-
-	info, err := os.Stat(dataDir)
-	if err != nil || !info.IsDir() {
-		t.Errorf("DATA_DIR not created: %v", err)
-	}
-}
-
-// TestPrepareDataDirRefusesPathOutsideVolume: prepare-data-dir exits
-// 1, with an error naming DATA_DIR and its value, for a DATA_DIR
-// outside the volume.
-func TestPrepareDataDirRefusesPathOutsideVolume(t *testing.T) {
-	t.Parallel()
-
-	volume := t.TempDir()
-
-	var stderr bytes.Buffer
-
-	code := cli.PrepareDataDir(&stderr, volume, "/etc", currentUsername(t))
-
-	want := "DATA_DIR '/etc': " + reportbuf.ErrDataDirOutsideVolume.Error() + "\n"
-	if code != 1 || stderr.String() != want {
-		t.Errorf("exit %d, stderr %q; want exit 1 and %q",
-			code, stderr.String(), want)
-	}
-}
-
-// currentUsername is the name of the user the test runs as, the only
-// owner a test not run as root can give files to.
-func currentUsername(t *testing.T) string {
-	t.Helper()
-
-	current, err := user.Current()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	return current.Username
-}
-
-// failIfServerStarts is what the tests give Main in place of
-// cli.RunServer: it fails the test instead of starting the server.
-func failIfServerStarts(t *testing.T) func(appname, version string) {
-	t.Helper()
-
-	return func(string, string) {
-		t.Error("Main started the server")
-	}
-}

internal/cli/export_test.go

@@ -1,16 +0,0 @@
-package cli
-
-import "io"
-
-// CheckCIDR exposes the check-cidr subcommand to the external tests,
-// which read what it writes to stderr.
-func CheckCIDR(stderr io.Writer, cidr string) int {
-	return checkCIDR(stderr, cidr)
-}
-
-// PrepareDataDir exposes the prepare-data-dir subcommand to the
-// external tests, which give it a volume and a user of their own in
-// place of /data and netwatch.
-func PrepareDataDir(stderr io.Writer, volume, dataDir, username string) int {
-	return prepareDataDir(stderr, volume, dataDir, username)
-}

internal/config/config_test.go

@@ -13,8 +13,8 @@ import (
 	"go.uber.org/fx"
 )
 
-// requireConfigError builds the config as cli.RunServer does and fails
+// requireConfigError builds the config as main does and fails the
-// the test unless that fails with an error naming setting. It uses
+// test unless that fails with an error naming setting. It uses
 // fx.New, because fxtest.New fails the test itself on an error.
 func requireConfigError(t *testing.T, setting string) {
 	t.Helper()
@@ -31,8 +31,8 @@ func requireConfigError(t *testing.T, setting string) {
 	}
 }
 
-// requireTrustedProxies builds the config as cli.RunServer does and
+// requireTrustedProxies builds the config as main does and fails the
-// fails the test unless its TrustedProxies are want.
+// test unless its TrustedProxies are want.
 func requireTrustedProxies(t *testing.T, want []string) {
 	t.Helper()
 

internal/globals/globals.go

@@ -4,7 +4,7 @@ package globals
 
 import "go.uber.org/fx"
 
-//nolint:gochecknoglobals // set by cli.RunServer before fx starts
+//nolint:gochecknoglobals // set from main before fx starts
 var (
 	// Appname is the application name.
 	Appname string

internal/reportbuf/reportbuf_test.go

@@ -334,9 +334,9 @@ func stopWhileHeld(
 	return <-stopped
 }
 
-// startApp starts a Buffer through fx, as cli.RunServer does, with the
+// startApp starts a Buffer through fx, as main does, with the DATA_DIR
-// DATA_DIR and DATA_DIR_MAX_BYTES the calling test has set, and returns
+// and DATA_DIR_MAX_BYTES the calling test has set, and returns it with
-// it with the app, for tests that stop the app themselves.
+// the app, for tests that stop the app themselves.
 func startApp(t *testing.T) (*reportbuf.Buffer, *fxtest.App) {
 	t.Helper()
 
@@ -358,8 +358,8 @@ func startApp(t *testing.T) (*reportbuf.Buffer, *fxtest.App) {
 	return buf, app
 }
 
-// startBuffer starts a Buffer through fx, as cli.RunServer does, with
+// startBuffer starts a Buffer through fx, as main does, with the
-// the DATA_DIR and DATA_DIR_MAX_BYTES the calling test has set.
+// DATA_DIR and DATA_DIR_MAX_BYTES the calling test has set.
 func startBuffer(t *testing.T) *reportbuf.Buffer {
 	t.Helper()
 
@@ -1120,8 +1120,8 @@ func TestHealthCheckFailsWhileWritesFail(t *testing.T) {
 }
 
 // startBufferWithHandlers starts a Buffer and the Handlers that store
-// reports in it through fx, as cli.RunServer does, with the DATA_DIR
+// reports in it through fx, as main does, with the DATA_DIR the calling
-// the calling test has set.
+// test has set.
 func startBufferWithHandlers(
 	t *testing.T,
 ) (*reportbuf.Buffer, *handlers.Handlers) {

internal/server/routes_test.go

@@ -22,9 +22,9 @@ import (
 	"go.uber.org/fx/fxtest"
 )
 
-// newServer builds a Server from the same constructors as
+// newServer builds a Server from the same constructors as main,
-// cli.RunServer, configured from the environment. It is never started,
+// configured from the environment. It is never started, so nothing
-// so nothing listens.
+// listens.
 func newServer(t *testing.T) *server.Server {
 	t.Helper()
 

internal/server/server.go

@@ -79,7 +79,7 @@ func New(
 			s.SetupRoutes()
 			s.httpServer = s.newHTTPServer()
 
-			go func() { s.listenAndServe() }()
+			go s.listenAndServe()
 
 			return nil
 		},

package.json

@@ -1,6 +1,6 @@
 {
     "name": "netwatch",
-    "private": true,
+    "version": "1.0.0",
     "description": "Real-time network latency monitor SPA",
     "type": "module",
     "scripts": {