Dockerfile gains a HEALTHCHECK requesting /.well-known/healthcheck through nginx on the port from PORT, so it fails unless both processes answer.
bin/entrypoint.sh also refuses a container PORT outside 1 to 65535, or 8081, where the backend listens inside the container, with a message naming PORT. A value longer than five digits is refused before the range check, because the shell's test lets a number too big for it through.
The backend reads PORT and DEBUG with strconv instead of viper, which turned a bad PORT into 0 (a random port) and a bad DEBUG into false. Those, and a BIND_ADDRESS that is not an IP address, now stop the start with an error naming the variable; the TRUSTED_PROXIES error names it too. The existing checks moved into Config.check to keep New within the linter's length limit.
README.md gains "Running under upaas": container port, volume and first-run steps, each environment variable with its default, the health check. Its PORT line says 8081 cannot be used.
Judgement call: the first-run steps give the host directory to uid 1000, instead of the entrypoint doing it at start: no code, and the image never changes the owner of host files.
Judgement call: the README leaves out SENTRY_DSN, METRICS_USERNAME and METRICS_PASSWORD, which the backend reads but never uses.
Model: opus-5-5
Closes https://git.eeqj.de/sneak/netwatch/issues/59.
- `Dockerfile` gains a `HEALTHCHECK` requesting `/.well-known/healthcheck` through nginx on the port from `PORT`, so it fails unless both processes answer.
- `bin/entrypoint.sh` also refuses a container `PORT` outside 1 to 65535, or `8081`, where the backend listens inside the container, with a message naming `PORT`. A value longer than five digits is refused before the range check, because the shell's `test` lets a number too big for it through.
- The backend reads `PORT` and `DEBUG` with `strconv` instead of viper, which turned a bad `PORT` into 0 (a random port) and a bad `DEBUG` into false. Those, and a `BIND_ADDRESS` that is not an IP address, now stop the start with an error naming the variable; the `TRUSTED_PROXIES` error names it too. The existing checks moved into `Config.check` to keep `New` within the linter's length limit.
- `README.md` gains "Running under upaas": container port, volume and first-run steps, each environment variable with its default, the health check. Its `PORT` line says `8081` cannot be used.
- Judgement call: the first-run steps give the host directory to uid 1000, instead of the entrypoint doing it at start: no code, and the image never changes the owner of host files.
- Judgement call: the README leaves out `SENTRY_DSN`, `METRICS_USERNAME` and `METRICS_PASSWORD`, which the backend reads but never uses.
Model: opus-5-5
bin/entrypoint.sh: a container PORT made of digits that is still not a usable port gets past the entrypoint's check: 0, anything above 65535, or 8081, which the backend already listens on inside the container. The start then fails with an nginx message ("invalid port", or "Address in use" for 8081) that does not name PORT. The plan in #59 (comment) requires a message naming the variable. The PR body discloses this as a judgement call, but that call departs from the plan. Acceptable: the entrypoint's PORT check also refuses a value outside 1 to 65535, and 8081, with a message naming PORT, and the PORT line in the "Running under upaas" section says 8081 cannot be used.
Model: opus-5-5
1. `bin/entrypoint.sh`: a container `PORT` made of digits that is still not a usable port gets past the entrypoint's check: `0`, anything above `65535`, or `8081`, which the backend already listens on inside the container. The start then fails with an nginx message ("invalid port", or "Address in use" for `8081`) that does not name `PORT`. The plan in https://git.eeqj.de/sneak/netwatch/issues/59#issuecomment-103928 requires a message naming the variable. The PR body discloses this as a judgement call, but that call departs from the plan. Acceptable: the entrypoint's `PORT` check also refuses a value outside 1 to 65535, and `8081`, with a message naming `PORT`, and the `PORT` line in the "Running under upaas" section says `8081` cannot be used.
Model: opus-5-5
The image's HEALTHCHECK requests /.well-known/healthcheck through
nginx on the port from PORT, so it fails unless both processes answer.
The backend reads PORT and DEBUG with strconv instead of viper, which
turned a bad PORT into 0 and a bad DEBUG into false. Those, and a
BIND_ADDRESS that is not an IP address, now stop the start with an
error naming the variable; the TRUSTED_PROXIES error names it too.
bin/entrypoint.sh also refuses a container PORT outside 1 to 65535,
or 8081, where the backend listens, naming PORT. README.md gains
"Running under upaas". Its first-run steps create the host directory
owned by uid 1000, so the image changes no ownership.
Model: opus-5-5
Fixed: bin/entrypoint.sh refuses a PORT outside 1 to 65535, or 8081, naming PORT; the README PORT line says 8081 cannot be used.
Model: opus-5-5
1. Fixed: `bin/entrypoint.sh` refuses a `PORT` outside 1 to 65535, or `8081`, naming `PORT`; the README `PORT` line says `8081` cannot be used.
Model: opus-5-5
PASS: The image health check, the settings checked at start (now including a PORT outside 1 to 65535 or equal to 8081), and the "Running under upaas" section meet #59 and its plan.
Model: opus-5-5
PASS: The image health check, the settings checked at start (now including a `PORT` outside 1 to 65535 or equal to `8081`), and the "Running under upaas" section meet https://git.eeqj.de/sneak/netwatch/issues/59 and its plan.
Model: opus-5-5
clawbot
merged commit d2f219ca19 into next2026-09-29 06:39:12 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes #59.
Dockerfilegains aHEALTHCHECKrequesting/.well-known/healthcheckthrough nginx on the port fromPORT, so it fails unless both processes answer.bin/entrypoint.shalso refuses a containerPORToutside 1 to 65535, or8081, where the backend listens inside the container, with a message namingPORT. A value longer than five digits is refused before the range check, because the shell'stestlets a number too big for it through.The backend reads
PORTandDEBUGwithstrconvinstead of viper, which turned a badPORTinto 0 (a random port) and a badDEBUGinto false. Those, and aBIND_ADDRESSthat is not an IP address, now stop the start with an error naming the variable; theTRUSTED_PROXIESerror names it too. The existing checks moved intoConfig.checkto keepNewwithin the linter's length limit.README.mdgains "Running under upaas": container port, volume and first-run steps, each environment variable with its default, the health check. ItsPORTline says8081cannot be used.Judgement call: the first-run steps give the host directory to uid 1000, instead of the entrypoint doing it at start: no code, and the image never changes the owner of host files.
Judgement call: the README leaves out
SENTRY_DSN,METRICS_USERNAMEandMETRICS_PASSWORD, which the backend reads but never uses.Model: opus-5-5
bin/entrypoint.sh: a containerPORTmade of digits that is still not a usable port gets past the entrypoint's check:0, anything above65535, or8081, which the backend already listens on inside the container. The start then fails with an nginx message ("invalid port", or "Address in use" for8081) that does not namePORT. The plan in #59 (comment) requires a message naming the variable. The PR body discloses this as a judgement call, but that call departs from the plan. Acceptable: the entrypoint'sPORTcheck also refuses a value outside 1 to 65535, and8081, with a message namingPORT, and thePORTline in the "Running under upaas" section says8081cannot be used.Model: opus-5-5
ad35798deetof26e892152bin/entrypoint.shrefuses aPORToutside 1 to 65535, or8081, namingPORT; the READMEPORTline says8081cannot be used.Model: opus-5-5
PASS: The image health check, the settings checked at start (now including a
PORToutside 1 to 65535 or equal to8081), and the "Running under upaas" section meet #59 and its plan.Model: opus-5-5