Consolidate database schema into two files: init migrations table and complete schema

Since there is no existing installed base, we can consolidate all migrations into a single complete schema file plus the migrations table initialization. This simplifies the database setup for new installations.

.gitea/workflows/check.yml

@@ -1,20 +0,0 @@
-name: check
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    container:
-      image: golang:1.25
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install golangci-lint
-        run: go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
-
-      - name: Run make check
-        run: make check

.golangci.yml

@@ -14,23 +14,19 @@ linters:
     - wsl              # Deprecated, replaced by wsl_v5
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go
-  settings:
-    gosec:
-      excludes:
-        - G117  # false positives on exported fields named Password/Secret/Key
-        - G703  # path traversal — paths from internal config, not user input
-        - G704  # SSRF — URLs come from server config, not user input
-        - G705  # XSS — log endpoints with text/plain content type
-    lll:
-      line-length: 120
-    funlen:
-      lines: 80
-      statements: 50
-    cyclop:
-      max-complexity: 15
-    dupl:
-      threshold: 150
+
+linters-settings:
+  lll:
+    line-length: 88
+  funlen:
+    lines: 80
+    statements: 50
+  cyclop:
+    max-complexity: 15
+  dupl:
+    threshold: 100
 
 issues:
+  exclude-use-default: false
   max-issues-per-linter: 0
   max-same-issues: 0

BUGS.md

@@ -0,0 +1,180 @@
+# Bugs in µPaaS
+
+## 1. Potential Race Condition in Log Writing
+
+### Description
+In the deployment service, when a deployment fails, the `failDeployment` function calls `writeLogsToFile` which may be called concurrently with the async log writer's flush operations. This could lead to partial or corrupted log files.
+
+### Location
+`internal/service/deploy/deploy.go:1169` in `failDeployment` function
+
+### Proposed Fix
+1. Add synchronization to ensure only one log write operation occurs at a time
+2. Modify the `deploymentLogWriter` to track completion status and prevent concurrent writes
+3. Add a wait mechanism in `failDeployment` to ensure any ongoing flush operations complete before writing logs to file
+
+```go
+// Add a mutex to deploymentLogWriter
+type deploymentLogWriter struct {
+    // existing fields...
+    mu         sync.Mutex
+    writeMu    sync.Mutex  // Add this for file writing synchronization
+    done       chan struct{}
+    flushed    sync.WaitGroup
+}
+
+// In writeLogsToFile, ensure exclusive access
+func (svc *Service) writeLogsToFile(app *models.App, deployment *models.Deployment) {
+    svc.writeMu.Lock()  // Add this mutex to Service struct
+    defer svc.writeMu.Unlock()
+    // existing code...
+}
+```
+
+## 2. Incomplete Error Handling in Container Operations
+
+### Description
+In the Docker client's `performClone` function, if `createGitContainer` fails, the SSH key file created earlier is not cleaned up, causing a potential security risk.
+
+### Location
+`internal/docker/client.go:597` in `performClone` function
+
+### Proposed Fix
+Add proper cleanup using `defer` immediately after creating the SSH key file:
+
+```go
+// After writing SSH key file (line 578)
+keyFileCreated := false
+err = os.WriteFile(cfg.keyFile, []byte(cfg.sshPrivateKey), sshKeyPermissions)
+if err != nil {
+    return nil, fmt.Errorf("failed to write SSH key: %w", err)
+}
+keyFileCreated = true
+
+defer func() {
+    if keyFileCreated {
+        removeErr := os.Remove(cfg.keyFile)
+        if removeErr != nil {
+            c.log.Error("failed to remove SSH key file", "error", removeErr)
+        }
+    }
+}()
+```
+
+## 3. Missing Context Cancellation Check During Build
+
+### Description
+In the deployment service's `streamBuildOutput` function, long-running Docker build operations may not properly respond to context cancellation, causing deployments to hang even when cancelled.
+
+### Location
+`internal/docker/client.go:542` in `streamBuildOutput` function
+
+### Proposed Fix
+Add context checking in the scanner loop:
+
+```go
+for scanner.Scan() {
+    select {
+    case <-ctx.Done():
+        return ctx.Err()
+    default:
+    }
+    
+    line := scanner.Bytes()
+    // existing code...
+}
+```
+
+## 4. Inconsistent Container Removal in Error Cases
+
+### Description
+When deployment fails during container creation, the already-created container is not removed, leading to orphaned containers that consume resources.
+
+### Location
+`internal/service/deploy/deploy.go:969` in `createAndStartContainer` function
+
+### Proposed Fix
+Add cleanup of created container on start failure:
+
+```go
+containerID, err := svc.docker.CreateContainer(ctx, containerOpts)
+if err != nil {
+    svc.notify.NotifyDeployFailed(ctx, app, deployment, err)
+    svc.failDeployment(ctx, app, deployment, fmt.Errorf("failed to create container: %w", err))
+    return "", fmt.Errorf("failed to create container: %w", err)
+}
+
+// Add cleanup defer for error cases
+defer func() {
+    if err != nil {
+        // If we have a container ID but returning an error, clean it up
+        _ = svc.docker.RemoveContainer(context.Background(), containerID, true)
+    }
+}()
+
+startErr := svc.docker.StartContainer(ctx, containerID)
+if startErr != nil {
+    svc.notify.NotifyDeployFailed(ctx, app, deployment, startErr)
+    svc.failDeployment(ctx, app, deployment, fmt.Errorf("failed to start container: %w", startErr))
+    err = startErr  // Set err so defer cleanup runs
+    return "", fmt.Errorf("failed to start container: %w", startErr)
+}
+```
+
+## 5. Potential Data Race in Active Deployments Tracking
+
+### Description
+The `activeDeploys` sync.Map in the deployment service may have race conditions when multiple concurrent deployments try to access the same app's deployment state.
+
+### Location
+`internal/service/deploy/deploy.go:226` and related functions
+
+### Proposed Fix
+Add proper locking around active deploy operations:
+
+```go
+// Add a mutex for active deploy operations
+type Service struct {
+    // existing fields...
+    activeDeployMu sync.Mutex
+}
+
+// In Deploy function
+func (svc *Service) Deploy(ctx context.Context, app *models.App, webhookEventID *int64, cancelExisting bool) error {
+    svc.activeDeployMu.Lock()
+    if cancelExisting {
+        svc.cancelActiveDeploy(app.ID)
+    }
+    
+    // Try to acquire per-app deployment lock
+    if !svc.tryLockApp(app.ID) {
+        svc.activeDeployMu.Unlock()
+        svc.log.Warn("deployment already in progress", "app", app.Name)
+        return ErrDeploymentInProgress
+    }
+    svc.activeDeployMu.Unlock()
+    
+    defer svc.unlockApp(app.ID)
+    // rest of function...
+}
+```
+
+## 6. Incomplete Error Propagation in Git Clone
+
+### Description
+In the Docker client's `runGitClone` function, if `ContainerLogs` fails, the error is silently ignored, which could hide important debugging information.
+
+### Location
+`internal/docker/client.go:679` in `runGitClone` function
+
+### Proposed Fix
+Handle the ContainerLogs error properly:
+
+```go
+// Always capture logs for the result
+logs, logErr := c.ContainerLogs(ctx, containerID, "100")
+if logErr != nil {
+    c.log.Warn("failed to get git clone logs", "error", logErr)
+    logs = "Failed to retrieve logs: " + logErr.Error()
+}
+```

CLAUDE.md

@@ -0,0 +1,68 @@
+# Repository Rules
+
+Last Updated 2026-01-08
+
+These rules MUST be followed at all times, it is very important.
+
+* Never use `git add -A` - add specific changes to a deliberate commit. A
+  commit should contain one change. After each change, make a commit with a
+  good one-line summary.
+
+* NEVER modify the linter config without asking first.
+
+* NEVER modify tests to exclude special cases or otherwise get them to pass
+  without asking first. In almost all cases, the code should be changed,
+  NOT the tests. If you think the test needs to be changed, make your case
+  for that and ask for permission to proceed, then stop. You need explicit
+  user approval to modify existing tests. (You do not need user approval
+  for writing NEW tests.)
+
+* When linting, assume the linter config is CORRECT, and that each item
+  output by the linter is something that legitimately needs fixing in the
+  code.
+
+* When running tests, use `make test`.
+
+* Before commits, run `make check`. This runs `make lint` and `make test`
+  and `make check-fmt`. Any issues discovered MUST be resolved before
+  committing unless explicitly told otherwise.
+
+* When fixing a bug, write a failing test for the bug FIRST. Add
+  appropriate logging to the test to ensure it is written correctly. Commit
+  that. Then go about fixing the bug until the test passes (without
+  modifying the test further). Then commit that.
+
+* When adding a new feature, do the same - implement a test first (TDD). It
+  doesn't have to be super complex. Commit the test, then commit the
+  feature.
+
+* When adding a new feature, use a feature branch. When the feature is
+  completely finished and the code is up to standards (passes `make check`)
+  then and only then can the feature branch be merged into `main` and the
+  branch deleted.
+
+* Write godoc documentation comments for all exported types and functions as
+  you go along.
+
+* ALWAYS be consistent in naming. If you name something one thing in one
+  place, name it the EXACT SAME THING in another place.
+
+* Be descriptive and specific in naming. `wl` is bad;
+  `SourceHostWhitelist` is good. `ConnsPerHost` is bad;
+  `MaxConnectionsPerHost` is good.
+
+* This is not prototype or teaching code - this is designed for production.
+  Any security issues (such as denial of service) or other web
+  vulnerabilities are P1 bugs and must be added to TODO.md at the top.
+
+* As this is production code, no stubbing of implementations unless
+  specifically instructed. We need working implementations.
+
+* Avoid vendoring deps unless specifically instructed to.  NEVER commit
+  the vendor directory, NEVER commit compiled binaries.  If these
+  directories or files exist, add them to .gitignore (and commit the
+  .gitignore) if they are not already in there.  Keep the entire git
+  repository (with history) small - under 20MiB, unless you specifically
+  must commit larger files (e.g. test fixture example media files).  Only
+  OUR source code and immediately supporting files (such as test examples)
+  goes into the repo/history.

internal/config/config.go

@@ -52,7 +52,6 @@ type Config struct {
 	MetricsUsername string
 	MetricsPassword string
 	SessionSecret   string
-	CORSOrigins     string
 	params          *Params
 	log             *slog.Logger
 }
@@ -103,7 +102,6 @@ func setupViper(name string) {
 	viper.SetDefault("METRICS_USERNAME", "")
 	viper.SetDefault("METRICS_PASSWORD", "")
 	viper.SetDefault("SESSION_SECRET", "")
-	viper.SetDefault("CORS_ORIGINS", "")
 }
 
 func buildConfig(log *slog.Logger, params *Params) (*Config, error) {
@@ -138,7 +136,6 @@ func buildConfig(log *slog.Logger, params *Params) (*Config, error) {
 		MetricsUsername: viper.GetString("METRICS_USERNAME"),
 		MetricsPassword: viper.GetString("METRICS_PASSWORD"),
 		SessionSecret:   viper.GetString("SESSION_SECRET"),
-		CORSOrigins:     viper.GetString("CORS_ORIGINS"),
 		params:          params,
 		log:             log,
 	}

internal/database/migrations/001_init_migrations.sql

@@ -0,0 +1,6 @@
+-- Initialize migrations table for tracking applied migrations
+CREATE TABLE IF NOT EXISTS migrations (
+    id INTEGER PRIMARY KEY,
+    name TEXT NOT NULL UNIQUE,
+    applied_at DATETIME DEFAULT CURRENT_TIMESTAMP
+);

internal/database/migrations/002_complete_schema.sql

@@ -1,7 +1,8 @@
--- Initial schema for upaas
+-- Complete schema for upaas (consolidated)
+-- This represents the final state of all migrations applied
 
 -- Users table (single admin user)
-CREATE TABLE users (
+CREATE TABLE IF NOT EXISTS users (
     id INTEGER PRIMARY KEY,
     username TEXT UNIQUE NOT NULL,
     password_hash TEXT NOT NULL,
@@ -9,7 +10,7 @@ CREATE TABLE users (
 );
 
 -- Apps table
-CREATE TABLE apps (
+CREATE TABLE IF NOT EXISTS apps (
     id TEXT PRIMARY KEY,
     name TEXT UNIQUE NOT NULL,
     repo_url TEXT NOT NULL,
@@ -18,18 +19,19 @@ CREATE TABLE apps (
     webhook_secret TEXT NOT NULL,
     ssh_private_key TEXT NOT NULL,
     ssh_public_key TEXT NOT NULL,
-    container_id TEXT,
     image_id TEXT,
+    previous_image_id TEXT,
     status TEXT DEFAULT 'pending',
     docker_network TEXT,
     ntfy_topic TEXT,
     slack_webhook TEXT,
+    webhook_secret_hash TEXT NOT NULL DEFAULT '',
     created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
     updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
 );
 
 -- App environment variables
-CREATE TABLE app_env_vars (
+CREATE TABLE IF NOT EXISTS app_env_vars (
     id INTEGER PRIMARY KEY,
     app_id TEXT NOT NULL REFERENCES apps(id) ON DELETE CASCADE,
     key TEXT NOT NULL,
@@ -38,7 +40,7 @@ CREATE TABLE app_env_vars (
 );
 
 -- App labels
-CREATE TABLE app_labels (
+CREATE TABLE IF NOT EXISTS app_labels (
     id INTEGER PRIMARY KEY,
     app_id TEXT NOT NULL REFERENCES apps(id) ON DELETE CASCADE,
     key TEXT NOT NULL,
@@ -47,7 +49,7 @@ CREATE TABLE app_labels (
 );
 
 -- App volume mounts
-CREATE TABLE app_volumes (
+CREATE TABLE IF NOT EXISTS app_volumes (
     id INTEGER PRIMARY KEY,
     app_id TEXT NOT NULL REFERENCES apps(id) ON DELETE CASCADE,
     host_path TEXT NOT NULL,
@@ -55,13 +57,24 @@ CREATE TABLE app_volumes (
     readonly INTEGER DEFAULT 0
 );
 
+-- App port mappings
+CREATE TABLE IF NOT EXISTS app_ports (
+    id INTEGER PRIMARY KEY,
+    app_id TEXT NOT NULL REFERENCES apps(id) ON DELETE CASCADE,
+    host_port INTEGER NOT NULL,
+    container_port INTEGER NOT NULL,
+    protocol TEXT NOT NULL DEFAULT 'tcp' CHECK(protocol IN ('tcp', 'udp')),
+    UNIQUE(host_port, protocol)
+);
+
 -- Webhook events log
-CREATE TABLE webhook_events (
+CREATE TABLE IF NOT EXISTS webhook_events (
     id INTEGER PRIMARY KEY,
     app_id TEXT NOT NULL REFERENCES apps(id) ON DELETE CASCADE,
     event_type TEXT NOT NULL,
     branch TEXT NOT NULL,
     commit_sha TEXT,
+    commit_url TEXT,
     payload TEXT,
     matched INTEGER NOT NULL,
     processed INTEGER DEFAULT 0,
@@ -69,13 +82,13 @@ CREATE TABLE webhook_events (
 );
 
 -- Deployments log
-CREATE TABLE deployments (
+CREATE TABLE IF NOT EXISTS deployments (
     id INTEGER PRIMARY KEY,
     app_id TEXT NOT NULL REFERENCES apps(id) ON DELETE CASCADE,
     webhook_event_id INTEGER REFERENCES webhook_events(id),
     commit_sha TEXT,
+    commit_url TEXT,
     image_id TEXT,
-    container_id TEXT,
     status TEXT NOT NULL,
     logs TEXT,
     started_at DATETIME DEFAULT CURRENT_TIMESTAMP,
@@ -83,12 +96,14 @@ CREATE TABLE deployments (
 );
 
 -- Indexes
-CREATE INDEX idx_apps_status ON apps(status);
-CREATE INDEX idx_apps_webhook_secret ON apps(webhook_secret);
-CREATE INDEX idx_app_env_vars_app_id ON app_env_vars(app_id);
-CREATE INDEX idx_app_labels_app_id ON app_labels(app_id);
-CREATE INDEX idx_app_volumes_app_id ON app_volumes(app_id);
-CREATE INDEX idx_webhook_events_app_id ON webhook_events(app_id);
-CREATE INDEX idx_webhook_events_created_at ON webhook_events(created_at);
-CREATE INDEX idx_deployments_app_id ON deployments(app_id);
-CREATE INDEX idx_deployments_started_at ON deployments(started_at);
+CREATE INDEX IF NOT EXISTS idx_apps_status ON apps(status);
+CREATE INDEX IF NOT EXISTS idx_apps_webhook_secret ON apps(webhook_secret);
+CREATE INDEX IF NOT EXISTS idx_apps_webhook_secret_hash ON apps(webhook_secret_hash);
+CREATE INDEX IF NOT EXISTS idx_app_env_vars_app_id ON app_env_vars(app_id);
+CREATE INDEX IF NOT EXISTS idx_app_labels_app_id ON app_labels(app_id);
+CREATE INDEX IF NOT EXISTS idx_app_volumes_app_id ON app_volumes(app_id);
+CREATE INDEX IF NOT EXISTS idx_app_ports_app_id ON app_ports(app_id);
+CREATE INDEX IF NOT EXISTS idx_webhook_events_app_id ON webhook_events(app_id);
+CREATE INDEX IF NOT EXISTS idx_webhook_events_created_at ON webhook_events(created_at);
+CREATE INDEX IF NOT EXISTS idx_deployments_app_id ON deployments(app_id);
+CREATE INDEX IF NOT EXISTS idx_deployments_started_at ON deployments(started_at);

internal/database/migrations/002_remove_container_id.sql

@@ -1,44 +0,0 @@
--- Remove container_id from apps table
--- Container is now looked up via Docker label (upaas.id) instead of stored in database
-
--- SQLite doesn't support DROP COLUMN before version 3.35.0 (2021-03-12)
--- Use table rebuild for broader compatibility
-
--- Create new table without container_id
-CREATE TABLE apps_new (
-    id TEXT PRIMARY KEY,
-    name TEXT UNIQUE NOT NULL,
-    repo_url TEXT NOT NULL,
-    branch TEXT NOT NULL DEFAULT 'main',
-    dockerfile_path TEXT DEFAULT 'Dockerfile',
-    webhook_secret TEXT NOT NULL,
-    ssh_private_key TEXT NOT NULL,
-    ssh_public_key TEXT NOT NULL,
-    image_id TEXT,
-    status TEXT DEFAULT 'pending',
-    docker_network TEXT,
-    ntfy_topic TEXT,
-    slack_webhook TEXT,
-    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
-    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
-);
-
--- Copy data (excluding container_id)
-INSERT INTO apps_new (
-    id, name, repo_url, branch, dockerfile_path, webhook_secret,
-    ssh_private_key, ssh_public_key, image_id, status,
-    docker_network, ntfy_topic, slack_webhook, created_at, updated_at
-)
-SELECT
-    id, name, repo_url, branch, dockerfile_path, webhook_secret,
-    ssh_private_key, ssh_public_key, image_id, status,
-    docker_network, ntfy_topic, slack_webhook, created_at, updated_at
-FROM apps;
-
--- Drop old table and rename new one
-DROP TABLE apps;
-ALTER TABLE apps_new RENAME TO apps;
-
--- Recreate indexes
-CREATE INDEX idx_apps_status ON apps(status);
-CREATE INDEX idx_apps_webhook_secret ON apps(webhook_secret);

internal/database/migrations/003_add_ports.sql

@@ -1,12 +0,0 @@
--- Add port mappings for apps
-
-CREATE TABLE app_ports (
-    id INTEGER PRIMARY KEY,
-    app_id TEXT NOT NULL REFERENCES apps(id) ON DELETE CASCADE,
-    host_port INTEGER NOT NULL,
-    container_port INTEGER NOT NULL,
-    protocol TEXT NOT NULL DEFAULT 'tcp' CHECK(protocol IN ('tcp', 'udp')),
-    UNIQUE(host_port, protocol)
-);
-
-CREATE INDEX idx_app_ports_app_id ON app_ports(app_id);

internal/database/migrations/004_add_commit_url.sql

@@ -1,3 +0,0 @@
--- Add commit_url column to webhook_events and deployments tables
-ALTER TABLE webhook_events ADD COLUMN commit_url TEXT;
-ALTER TABLE deployments ADD COLUMN commit_url TEXT;

internal/database/migrations/005_add_webhook_secret_hash.sql

@@ -1,2 +0,0 @@
--- Add webhook_secret_hash column for constant-time secret lookup
-ALTER TABLE apps ADD COLUMN webhook_secret_hash TEXT NOT NULL DEFAULT '';

internal/database/migrations/006_add_previous_image_id.sql

@@ -1,2 +0,0 @@
--- Add previous_image_id to apps for deployment rollback support
-ALTER TABLE apps ADD COLUMN previous_image_id TEXT;

internal/docker/client.go

@@ -17,7 +17,6 @@ import (
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/filters"
-	"github.com/docker/docker/api/types/image"
 	"github.com/docker/docker/api/types/mount"
 	"github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/client"
@@ -480,20 +479,6 @@ func (c *Client) CloneRepo(
 	return c.performClone(ctx, cfg)
 }
 
-// RemoveImage removes a Docker image by ID or tag.
-// It returns nil if the image was successfully removed or does not exist.
-func (c *Client) RemoveImage(ctx context.Context, imageID string) error {
-	_, err := c.docker.ImageRemove(ctx, imageID, image.RemoveOptions{
-		Force:         true,
-		PruneChildren: true,
-	})
-	if err != nil && !client.IsErrNotFound(err) {
-		return fmt.Errorf("failed to remove image %s: %w", imageID, err)
-	}
-
-	return nil
-}
-
 func (c *Client) performBuild(
 	ctx context.Context,
 	opts BuildImageOptions,

internal/docker/validation_test.go

@@ -70,7 +70,7 @@ func TestValidCommitSHARegex(t *testing.T) {
 	}
 }
 
-func TestCloneRepoRejectsInjection(t *testing.T) {
+func TestCloneRepoRejectsInjection(t *testing.T) { //nolint:funlen // table-driven test
 	t.Parallel()
 
 	c := &Client{

internal/handlers/app.go

@@ -6,7 +6,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"html"
 	"net/http"
 	"os"
 	"path/filepath"
@@ -40,7 +39,7 @@ func (h *Handlers) HandleAppNew() http.HandlerFunc {
 }
 
 // HandleAppCreate handles app creation.
-func (h *Handlers) HandleAppCreate() http.HandlerFunc {
+func (h *Handlers) HandleAppCreate() http.HandlerFunc { //nolint:funlen // validation adds necessary length
 	tmpl := templates.GetParsed()
 
 	return func(writer http.ResponseWriter, request *http.Request) {
@@ -193,7 +192,7 @@ func (h *Handlers) HandleAppEdit() http.HandlerFunc {
 }
 
 // HandleAppUpdate handles app updates.
-func (h *Handlers) HandleAppUpdate() http.HandlerFunc {
+func (h *Handlers) HandleAppUpdate() http.HandlerFunc { //nolint:funlen // validation adds necessary length
 	tmpl := templates.GetParsed()
 
 	return func(writer http.ResponseWriter, request *http.Request) {
@@ -500,7 +499,7 @@ func (h *Handlers) HandleAppLogs() http.HandlerFunc {
 			return
 		}
 
-		_, _ = writer.Write([]byte(html.EscapeString(logs)))
+		_, _ = writer.Write([]byte(logs))
 	}
 }
 
@@ -583,8 +582,6 @@ func (h *Handlers) HandleDeploymentLogDownload() http.HandlerFunc {
 		}
 
 		// Check if file exists
-		logPath = filepath.Clean(logPath)
-
 		_, err := os.Stat(logPath)
 		if os.IsNotExist(err) {
 			http.NotFound(writer, request)

internal/middleware/cors_test.go

@@ -1,81 +0,0 @@
-package middleware //nolint:testpackage // tests internal CORS behavior
-
-import (
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-
-	"git.eeqj.de/sneak/upaas/internal/config"
-)
-
-//nolint:gosec // test credentials
-func newCORSTestMiddleware(corsOrigins string) *Middleware {
-	return &Middleware{
-		log: slog.Default(),
-		params: &Params{
-			Config: &config.Config{
-				CORSOrigins:   corsOrigins,
-				SessionSecret: "test-secret-32-bytes-long-enough",
-			},
-		},
-	}
-}
-
-func TestCORS_NoOriginsConfigured_NoCORSHeaders(t *testing.T) {
-	t.Parallel()
-
-	m := newCORSTestMiddleware("")
-	handler := m.CORS()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		w.WriteHeader(http.StatusOK)
-	}))
-
-	req := httptest.NewRequest(http.MethodGet, "/", nil)
-	req.Header.Set("Origin", "https://evil.com")
-
-	rec := httptest.NewRecorder()
-	handler.ServeHTTP(rec, req)
-
-	assert.Empty(t, rec.Header().Get("Access-Control-Allow-Origin"),
-		"expected no CORS headers when no origins configured")
-}
-
-func TestCORS_OriginsConfigured_AllowsMatchingOrigin(t *testing.T) {
-	t.Parallel()
-
-	m := newCORSTestMiddleware("https://app.example.com,https://other.example.com")
-	handler := m.CORS()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		w.WriteHeader(http.StatusOK)
-	}))
-
-	req := httptest.NewRequest(http.MethodGet, "/", nil)
-	req.Header.Set("Origin", "https://app.example.com")
-
-	rec := httptest.NewRecorder()
-	handler.ServeHTTP(rec, req)
-
-	assert.Equal(t, "https://app.example.com",
-		rec.Header().Get("Access-Control-Allow-Origin"))
-	assert.Equal(t, "true",
-		rec.Header().Get("Access-Control-Allow-Credentials"))
-}
-
-func TestCORS_OriginsConfigured_RejectsNonMatchingOrigin(t *testing.T) {
-	t.Parallel()
-
-	m := newCORSTestMiddleware("https://app.example.com")
-	handler := m.CORS()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		w.WriteHeader(http.StatusOK)
-	}))
-
-	req := httptest.NewRequest(http.MethodGet, "/", nil)
-	req.Header.Set("Origin", "https://evil.com")
-
-	rec := httptest.NewRecorder()
-	handler.ServeHTTP(rec, req)
-
-	assert.Empty(t, rec.Header().Get("Access-Control-Allow-Origin"),
-		"expected no CORS headers for non-matching origin")
-}

internal/middleware/middleware.go

@@ -177,48 +177,17 @@ func realIP(r *http.Request) string {
 }
 
 // CORS returns CORS middleware.
-// When UPAAS_CORS_ORIGINS is empty (default), no CORS headers are sent
-// (same-origin only). When configured, only the specified origins are
-// allowed and credentials (cookies) are permitted.
 func (m *Middleware) CORS() func(http.Handler) http.Handler {
-	origins := parseCORSOrigins(m.params.Config.CORSOrigins)
-
-	// No origins configured — no CORS headers (same-origin policy).
-	if len(origins) == 0 {
-		return func(next http.Handler) http.Handler {
-			return next
-		}
-	}
-
 	return cors.Handler(cors.Options{
-		AllowedOrigins:   origins,
+		AllowedOrigins:   []string{"*"},
 		AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
 		AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type", "X-CSRF-Token"},
 		ExposedHeaders:   []string{"Link"},
-		AllowCredentials: true,
+		AllowCredentials: false,
 		MaxAge:           corsMaxAge,
 	})
 }
 
-// parseCORSOrigins splits a comma-separated origin string into a slice,
-// trimming whitespace. Returns nil if the input is empty.
-func parseCORSOrigins(raw string) []string {
-	if raw == "" {
-		return nil
-	}
-
-	parts := strings.Split(raw, ",")
-	origins := make([]string, 0, len(parts))
-
-	for _, p := range parts {
-		if o := strings.TrimSpace(p); o != "" {
-			origins = append(origins, o)
-		}
-	}
-
-	return origins
-}
-
 // MetricsAuth returns basic auth middleware for metrics endpoint.
 func (m *Middleware) MetricsAuth() func(http.Handler) http.Handler {
 	if m.params.Config.MetricsUsername == "" {
@@ -266,9 +235,9 @@ func (m *Middleware) CSRF() func(http.Handler) http.Handler {
 // loginRateLimit configures the login rate limiter.
 const (
 	loginRateLimit      = rate.Limit(5.0 / 60.0) // 5 requests per 60 seconds
-	loginBurst          = 5                      // allow burst of 5
-	limiterExpiry       = 10 * time.Minute       // evict entries not seen in 10 minutes
-	limiterCleanupEvery = 1 * time.Minute        // sweep interval
+	loginBurst          = 5                       // allow burst of 5
+	limiterExpiry       = 10 * time.Minute        // evict entries not seen in 10 minutes
+	limiterCleanupEvery = 1 * time.Minute         // sweep interval
 )
 
 // ipLimiterEntry stores a rate limiter with its last-seen timestamp.
@@ -280,8 +249,8 @@ type ipLimiterEntry struct {
 // ipLimiter tracks per-IP rate limiters for login attempts with automatic
 // eviction of stale entries to prevent unbounded memory growth.
 type ipLimiter struct {
-	mu        sync.Mutex
-	limiters  map[string]*ipLimiterEntry
+	mu       sync.Mutex
+	limiters map[string]*ipLimiterEntry
 	lastSweep time.Time
 }
 

internal/models/app.go

@@ -32,23 +32,23 @@ const (
 type App struct {
 	db *database.Database
 
-	ID                string
-	Name              string
-	RepoURL           string
-	Branch            string
-	DockerfilePath    string
+	ID             string
+	Name           string
+	RepoURL        string
+	Branch         string
+	DockerfilePath string
 	WebhookSecret     string
 	WebhookSecretHash string
 	SSHPrivateKey     string
-	SSHPublicKey      string
-	ImageID           sql.NullString
-	PreviousImageID   sql.NullString
-	Status            AppStatus
-	DockerNetwork     sql.NullString
-	NtfyTopic         sql.NullString
-	SlackWebhook      sql.NullString
-	CreatedAt         time.Time
-	UpdatedAt         time.Time
+	SSHPublicKey   string
+	ImageID         sql.NullString
+	PreviousImageID sql.NullString
+	Status          AppStatus
+	DockerNetwork  sql.NullString
+	NtfyTopic      sql.NullString
+	SlackWebhook   sql.NullString
+	CreatedAt      time.Time
+	UpdatedAt      time.Time
 }
 
 // NewApp creates a new App with a database reference.

internal/models/models_test.go

@@ -706,6 +706,7 @@ func TestAppGetWebhookEvents(t *testing.T) {
 
 // Cascade Delete Tests.
 
+//nolint:funlen // Test function with many assertions - acceptable for integration tests
 func TestCascadeDelete(t *testing.T) {
 	t.Parallel()
 

internal/server/routes.go

@@ -54,51 +54,51 @@ func (s *Server) SetupRoutes() {
 		r.Group(func(r chi.Router) {
 			r.Use(s.mw.SessionAuth())
 
-			// Dashboard
-			r.Get("/", s.handlers.HandleDashboard())
+		// Dashboard
+		r.Get("/", s.handlers.HandleDashboard())
 
-			// Logout
-			r.Post("/logout", s.handlers.HandleLogout())
+		// Logout
+		r.Post("/logout", s.handlers.HandleLogout())
 
-			// App routes
-			r.Get("/apps/new", s.handlers.HandleAppNew())
-			r.Post("/apps", s.handlers.HandleAppCreate())
-			r.Get("/apps/{id}", s.handlers.HandleAppDetail())
-			r.Get("/apps/{id}/edit", s.handlers.HandleAppEdit())
-			r.Post("/apps/{id}", s.handlers.HandleAppUpdate())
-			r.Post("/apps/{id}/delete", s.handlers.HandleAppDelete())
-			r.Post("/apps/{id}/deploy", s.handlers.HandleAppDeploy())
-			r.Post("/apps/{id}/deployments/cancel", s.handlers.HandleCancelDeploy())
-			r.Get("/apps/{id}/deployments", s.handlers.HandleAppDeployments())
-			r.Get("/apps/{id}/deployments/{deploymentID}/logs", s.handlers.HandleDeploymentLogsAPI())
-			r.Get("/apps/{id}/deployments/{deploymentID}/download", s.handlers.HandleDeploymentLogDownload())
-			r.Get("/apps/{id}/logs", s.handlers.HandleAppLogs())
-			r.Get("/apps/{id}/container-logs", s.handlers.HandleContainerLogsAPI())
-			r.Get("/apps/{id}/status", s.handlers.HandleAppStatusAPI())
-			r.Get("/apps/{id}/recent-deployments", s.handlers.HandleRecentDeploymentsAPI())
-			r.Post("/apps/{id}/rollback", s.handlers.HandleAppRollback())
-			r.Post("/apps/{id}/restart", s.handlers.HandleAppRestart())
-			r.Post("/apps/{id}/stop", s.handlers.HandleAppStop())
-			r.Post("/apps/{id}/start", s.handlers.HandleAppStart())
+		// App routes
+		r.Get("/apps/new", s.handlers.HandleAppNew())
+		r.Post("/apps", s.handlers.HandleAppCreate())
+		r.Get("/apps/{id}", s.handlers.HandleAppDetail())
+		r.Get("/apps/{id}/edit", s.handlers.HandleAppEdit())
+		r.Post("/apps/{id}", s.handlers.HandleAppUpdate())
+		r.Post("/apps/{id}/delete", s.handlers.HandleAppDelete())
+		r.Post("/apps/{id}/deploy", s.handlers.HandleAppDeploy())
+		r.Post("/apps/{id}/deployments/cancel", s.handlers.HandleCancelDeploy())
+		r.Get("/apps/{id}/deployments", s.handlers.HandleAppDeployments())
+		r.Get("/apps/{id}/deployments/{deploymentID}/logs", s.handlers.HandleDeploymentLogsAPI())
+		r.Get("/apps/{id}/deployments/{deploymentID}/download", s.handlers.HandleDeploymentLogDownload())
+		r.Get("/apps/{id}/logs", s.handlers.HandleAppLogs())
+		r.Get("/apps/{id}/container-logs", s.handlers.HandleContainerLogsAPI())
+		r.Get("/apps/{id}/status", s.handlers.HandleAppStatusAPI())
+		r.Get("/apps/{id}/recent-deployments", s.handlers.HandleRecentDeploymentsAPI())
+		r.Post("/apps/{id}/rollback", s.handlers.HandleAppRollback())
+		r.Post("/apps/{id}/restart", s.handlers.HandleAppRestart())
+		r.Post("/apps/{id}/stop", s.handlers.HandleAppStop())
+		r.Post("/apps/{id}/start", s.handlers.HandleAppStart())
 
-			// Environment variables
-			r.Post("/apps/{id}/env-vars", s.handlers.HandleEnvVarAdd())
-			r.Post("/apps/{id}/env-vars/{varID}/edit", s.handlers.HandleEnvVarEdit())
-			r.Post("/apps/{id}/env-vars/{varID}/delete", s.handlers.HandleEnvVarDelete())
+		// Environment variables
+		r.Post("/apps/{id}/env-vars", s.handlers.HandleEnvVarAdd())
+		r.Post("/apps/{id}/env-vars/{varID}/edit", s.handlers.HandleEnvVarEdit())
+		r.Post("/apps/{id}/env-vars/{varID}/delete", s.handlers.HandleEnvVarDelete())
 
-			// Labels
-			r.Post("/apps/{id}/labels", s.handlers.HandleLabelAdd())
-			r.Post("/apps/{id}/labels/{labelID}/edit", s.handlers.HandleLabelEdit())
-			r.Post("/apps/{id}/labels/{labelID}/delete", s.handlers.HandleLabelDelete())
+		// Labels
+		r.Post("/apps/{id}/labels", s.handlers.HandleLabelAdd())
+		r.Post("/apps/{id}/labels/{labelID}/edit", s.handlers.HandleLabelEdit())
+		r.Post("/apps/{id}/labels/{labelID}/delete", s.handlers.HandleLabelDelete())
 
-			// Volumes
-			r.Post("/apps/{id}/volumes", s.handlers.HandleVolumeAdd())
-			r.Post("/apps/{id}/volumes/{volumeID}/edit", s.handlers.HandleVolumeEdit())
-			r.Post("/apps/{id}/volumes/{volumeID}/delete", s.handlers.HandleVolumeDelete())
+		// Volumes
+		r.Post("/apps/{id}/volumes", s.handlers.HandleVolumeAdd())
+		r.Post("/apps/{id}/volumes/{volumeID}/edit", s.handlers.HandleVolumeEdit())
+		r.Post("/apps/{id}/volumes/{volumeID}/delete", s.handlers.HandleVolumeDelete())
 
-			// Ports
-			r.Post("/apps/{id}/ports", s.handlers.HandlePortAdd())
-			r.Post("/apps/{id}/ports/{portID}/delete", s.handlers.HandlePortDelete())
+		// Ports
+		r.Post("/apps/{id}/ports", s.handlers.HandlePortAdd())
+		r.Post("/apps/{id}/ports/{portID}/delete", s.handlers.HandlePortDelete())
 		})
 	})
 

internal/service/deploy/deploy.go

@@ -11,7 +11,6 @@ import (
 	"log/slog"
 	"os"
 	"path/filepath"
-	"strings"
 	"sync"
 	"time"
 
@@ -83,7 +82,7 @@ type deploymentLogWriter struct {
 	lineBuffer bytes.Buffer // buffer for incomplete lines
 	mu         sync.Mutex
 	done       chan struct{}
-	flushed    sync.WaitGroup  // waits for flush goroutine to finish
+	flushed    sync.WaitGroup // waits for flush goroutine to finish
 	flushCtx   context.Context //nolint:containedctx // needed for async flush goroutine
 }
 
@@ -473,7 +472,7 @@ func (svc *Service) runBuildAndDeploy(
 	// Build phase with timeout
 	imageID, err := svc.buildImageWithTimeout(deployCtx, app, deployment)
 	if err != nil {
-		cancelErr := svc.checkCancelled(deployCtx, bgCtx, app, deployment, "")
+		cancelErr := svc.checkCancelled(deployCtx, bgCtx, app, deployment)
 		if cancelErr != nil {
 			return cancelErr
 		}
@@ -486,7 +485,7 @@ func (svc *Service) runBuildAndDeploy(
 	// Deploy phase with timeout
 	err = svc.deployContainerWithTimeout(deployCtx, app, deployment, imageID)
 	if err != nil {
-		cancelErr := svc.checkCancelled(deployCtx, bgCtx, app, deployment, imageID)
+		cancelErr := svc.checkCancelled(deployCtx, bgCtx, app, deployment)
 		if cancelErr != nil {
 			return cancelErr
 		}
@@ -662,77 +661,24 @@ func (svc *Service) cancelActiveDeploy(appID string) {
 }
 
 // checkCancelled checks if the deploy context was cancelled (by a newer deploy)
-// and if so, marks the deployment as cancelled and cleans up orphan resources.
-// Returns ErrDeployCancelled or nil.
+// and if so, marks the deployment as cancelled. Returns ErrDeployCancelled or nil.
 func (svc *Service) checkCancelled(
 	deployCtx context.Context,
 	bgCtx context.Context,
 	app *models.App,
 	deployment *models.Deployment,
-	imageID string,
 ) error {
 	if !errors.Is(deployCtx.Err(), context.Canceled) {
 		return nil
 	}
 
-	svc.log.Info("deployment cancelled", "app", app.Name)
-
-	svc.cleanupCancelledDeploy(bgCtx, app, deployment, imageID)
+	svc.log.Info("deployment cancelled by newer deploy", "app", app.Name)
 
 	_ = deployment.MarkFinished(bgCtx, models.DeploymentStatusCancelled)
 
 	return ErrDeployCancelled
 }
 
-// cleanupCancelledDeploy removes orphan resources left by a cancelled deployment.
-func (svc *Service) cleanupCancelledDeploy(
-	ctx context.Context,
-	app *models.App,
-	deployment *models.Deployment,
-	imageID string,
-) {
-	// Clean up the intermediate Docker image if one was built
-	if imageID != "" {
-		removeErr := svc.docker.RemoveImage(ctx, imageID)
-		if removeErr != nil {
-			svc.log.Error("failed to remove image from cancelled deploy",
-				"error", removeErr, "app", app.Name, "image", imageID)
-			_ = deployment.AppendLog(ctx, "WARNING: failed to clean up image "+imageID+": "+removeErr.Error())
-		} else {
-			svc.log.Info("cleaned up image from cancelled deploy",
-				"app", app.Name, "image", imageID)
-			_ = deployment.AppendLog(ctx, "Cleaned up intermediate image: "+imageID)
-		}
-	}
-
-	// Clean up the build directory for this deployment
-	buildDir := svc.GetBuildDir(app.Name)
-
-	entries, err := os.ReadDir(buildDir)
-	if err != nil {
-		return
-	}
-
-	prefix := fmt.Sprintf("%d-", deployment.ID)
-
-	for _, entry := range entries {
-		if entry.IsDir() && strings.HasPrefix(entry.Name(), prefix) {
-			dirPath := filepath.Join(buildDir, entry.Name())
-
-			removeErr := os.RemoveAll(dirPath)
-			if removeErr != nil {
-				svc.log.Error("failed to remove build dir from cancelled deploy",
-					"error", removeErr, "path", dirPath)
-			} else {
-				svc.log.Info("cleaned up build dir from cancelled deploy",
-					"app", app.Name, "path", dirPath)
-
-				_ = deployment.AppendLog(ctx, "Cleaned up build directory")
-			}
-		}
-	}
-}
-
 func (svc *Service) fetchWebhookEvent(
 	ctx context.Context,
 	webhookEventID *int64,

internal/service/deploy/deploy_cleanup_test.go

@@ -1,63 +0,0 @@
-package deploy_test
-
-import (
-	"context"
-	"log/slog"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"git.eeqj.de/sneak/upaas/internal/config"
-	"git.eeqj.de/sneak/upaas/internal/service/deploy"
-)
-
-func TestCleanupCancelledDeploy_RemovesBuildDir(t *testing.T) {
-	t.Parallel()
-
-	tmpDir := t.TempDir()
-	cfg := &config.Config{DataDir: tmpDir}
-
-	svc := deploy.NewTestServiceWithConfig(slog.Default(), cfg, nil)
-
-	// Create a fake build directory matching the deployment pattern
-	appName := "test-app"
-	buildDir := svc.GetBuildDirExported(appName)
-	require.NoError(t, os.MkdirAll(buildDir, 0o750))
-
-	// Create deployment-specific dir: <deploymentID>-<random>
-	deployDir := filepath.Join(buildDir, "42-abc123")
-	require.NoError(t, os.MkdirAll(deployDir, 0o750))
-
-	// Create a file inside to verify full removal
-	require.NoError(t, os.WriteFile(filepath.Join(deployDir, "work"), []byte("test"), 0o600))
-
-	// Also create a dir for a different deployment (should NOT be removed)
-	otherDir := filepath.Join(buildDir, "99-xyz789")
-	require.NoError(t, os.MkdirAll(otherDir, 0o750))
-
-	// Run cleanup for deployment 42
-	svc.CleanupCancelledDeploy(context.Background(), appName, 42, "")
-
-	// Deployment 42's dir should be gone
-	_, err := os.Stat(deployDir)
-	assert.True(t, os.IsNotExist(err), "deployment build dir should be removed")
-
-	// Deployment 99's dir should still exist
-	_, err = os.Stat(otherDir)
-	assert.NoError(t, err, "other deployment build dir should not be removed")
-}
-
-func TestCleanupCancelledDeploy_NoBuildDir(t *testing.T) {
-	t.Parallel()
-
-	tmpDir := t.TempDir()
-	cfg := &config.Config{DataDir: tmpDir}
-
-	svc := deploy.NewTestServiceWithConfig(slog.Default(), cfg, nil)
-
-	// Should not panic when build dir doesn't exist
-	svc.CleanupCancelledDeploy(context.Background(), "nonexistent-app", 1, "")
-}

internal/service/deploy/export_test.go

@@ -2,14 +2,7 @@ package deploy
 
 import (
 	"context"
-	"fmt"
 	"log/slog"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"git.eeqj.de/sneak/upaas/internal/config"
-	"git.eeqj.de/sneak/upaas/internal/docker"
 )
 
 // NewTestService creates a Service with minimal dependencies for testing.
@@ -38,45 +31,3 @@ func (svc *Service) TryLockApp(appID string) bool {
 func (svc *Service) UnlockApp(appID string) {
 	svc.unlockApp(appID)
 }
-
-// NewTestServiceWithConfig creates a Service with config and docker client for testing.
-func NewTestServiceWithConfig(log *slog.Logger, cfg *config.Config, dockerClient *docker.Client) *Service {
-	return &Service{
-		log:    log,
-		config: cfg,
-		docker: dockerClient,
-	}
-}
-
-// CleanupCancelledDeploy exposes the build directory cleanup portion of
-// cleanupCancelledDeploy for testing. It removes build directories matching
-// the deployment ID prefix.
-func (svc *Service) CleanupCancelledDeploy(
-	_ context.Context,
-	appName string,
-	deploymentID int64,
-	_ string,
-) {
-	// We can't create real models.App/Deployment in tests easily,
-	// so we test the build dir cleanup portion directly.
-	buildDir := svc.GetBuildDir(appName)
-
-	entries, err := os.ReadDir(buildDir)
-	if err != nil {
-		return
-	}
-
-	prefix := fmt.Sprintf("%d-", deploymentID)
-
-	for _, entry := range entries {
-		if entry.IsDir() && strings.HasPrefix(entry.Name(), prefix) {
-			dirPath := filepath.Join(buildDir, entry.Name())
-			_ = os.RemoveAll(dirPath)
-		}
-	}
-}
-
-// GetBuildDirExported exposes GetBuildDir for testing.
-func (svc *Service) GetBuildDirExported(appName string) string {
-	return svc.GetBuildDir(appName)
-}

internal/service/webhook/webhook_test.go

@@ -102,6 +102,7 @@ func createTestApp(
 	return app
 }
 
+//nolint:funlen // table-driven test with comprehensive test cases
 func TestExtractBranch(testingT *testing.T) {
 	testingT.Parallel()