Fix four deployability blockers found by QA (closes #189, closes #190, closes #191, closes #192)

- CSRF over plain HTTP (#189): gorilla/csrf assumed https for its
  same-origin check, so setup and every POST returned 403 over plain
  HTTP. Gate csrf.PlaintextHTTPRequest on a new UPAAS_PLAINTEXT_HTTP
  config value; the default keeps https, correct for a TLS-terminating
  reverse proxy. The README plain-HTTP recipe now sets it.
- git image never pulled (#190): ensureImage pulls alpine/git (pinned
  digest unchanged) when absent, before the clone container is created.
- port-mapping 500 (#192): the ports delete form used {{ .CSRFField }}
  inside {{range .Ports}}, where the dot is a *models.Port; use
  {{ $.CSRFField }} like the labels and volumes blocks.
- env-var 403 (#191): the editor read the CSRF token from $el (the
  submitting form, which has none) instead of $root, sending an empty
  token; read from $root.

Model: opus-4-8

.gitea/workflows/check.yml

@@ -13,4 +13,4 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4, 2024-10-13
 
       - name: Build (runs make check inside Dockerfile)
-        run: docker build .
+        run: script/cibuild

.golangci.yml

@@ -1,5 +1,9 @@
 version: "2"
 
+# Config schema uses the golangci-lint v2 layout (settings live under
+# linters.settings, not top-level linters-settings) so that the
+# thresholds below are actually applied by golangci-lint >= v2.
+
 run:
   timeout: 5m
   modules-download-mode: readonly
@@ -14,19 +18,17 @@ linters:
     - wsl              # Deprecated, replaced by wsl_v5
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go
-
-linters-settings:
-  lll:
-    line-length: 88
-  funlen:
-    lines: 80
-    statements: 50
-  cyclop:
-    max-complexity: 15
-  dupl:
-    threshold: 100
+  settings:
+    lll:
+      line-length: 88
+    funlen:
+      lines: 80
+      statements: 50
+    cyclop:
+      max-complexity: 15
+    dupl:
+      threshold: 100
 
 issues:
-  exclude-use-default: false
   max-issues-per-linter: 0
   max-same-issues: 0

Dockerfile

@@ -1,6 +1,6 @@
 # Lint stage — fast feedback on formatting and lint issues
-# golangci/golangci-lint:v2.10.1
-FROM golangci/golangci-lint@sha256:ea84d14c2fef724411be7dc45e09e6ef721d748315252b02df19a7e3113ee763 AS lint
+# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-07
+FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
 
 WORKDIR /src
 COPY go.mod go.sum ./

Makefile

@@ -1,4 +1,4 @@
-.PHONY: all build lint fmt fmt-check test check clean docker hooks
+.PHONY: all bootstrap setup build lint fmt fmt-check test check clean docker hooks
 
 BINARY := upaasd
 VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
@@ -7,37 +7,37 @@ LDFLAGS := -X main.Version=$(VERSION) -X main.Buildarch=$(BUILDARCH)
 
 all: check build
 
+bootstrap:
+	@script/bootstrap
+
+setup:
+	@script/setup
+
 build:
 	go build -ldflags "$(LDFLAGS)" -o bin/$(BINARY) ./cmd/upaasd
 
 lint:
-	golangci-lint run --config .golangci.yml ./...
+	@script/lint
 
 fmt:
-	gofmt -s -w .
-	goimports -w .
-	npx prettier --write --tab-width 4 static/js/*.js
+	@script/fmt
 
 fmt-check:
-	@test -z "$$(gofmt -l .)" || (echo "Files not formatted:" && gofmt -l . && exit 1)
+	@script/fmt-check
 
 test:
-	go test -v -race -cover -timeout 30s ./...
+	@script/test
 
 # Check runs all validation without making changes
 # Used by CI and Docker build - fails if anything is wrong
-check: fmt-check lint test
-	@echo "==> All checks passed!"
+check:
+	@script/check
 
 docker:
-	docker build .
+	@script/docker
 
 hooks:
-	@echo "Installing pre-commit hook..."
-	@mkdir -p .git/hooks
-	@printf '#!/bin/sh\nmake check\n' > .git/hooks/pre-commit
-	@chmod +x .git/hooks/pre-commit
-	@echo "Pre-commit hook installed."
+	@script/install-precommit
 
 clean:
 	rm -rf bin/

README.md

@@ -1,12 +1,12 @@
 # µPaaS by [@sneak](https://sneak.berlin)
 
-A simple self-hosted PaaS that auto-deploys Docker containers from Git repositories via Gitea webhooks.
+A simple self-hosted PaaS that auto-deploys Docker containers from Git repositories via webhooks from Gitea, GitHub, or GitLab.
 
 ## Features
 
 - Single admin user with argon2id password hashing
 - Per-app SSH keypairs for read-only deploy keys
-- Per-app UUID-based webhook URLs for Gitea integration
+- Per-app UUID-based webhook URLs with auto-detection of Gitea, GitHub, and GitLab
 - Branch filtering - only deploy on configured branch changes
 - Environment variables, labels, and volume mounts per app
 - CPU and memory resource limits per app
@@ -20,7 +20,7 @@ A simple self-hosted PaaS that auto-deploys Docker containers from Git repositor
 - Complex CI pipelines
 - Multiple container orchestration
 - SPA/API-first design
-- Support for non-Gitea webhooks
+- Support for non-push webhook events (e.g. issues, merge requests)
 
 ## Architecture
 
@@ -45,7 +45,7 @@ upaas/
 │   │   ├── auth/        # Authentication service
 │   │   ├── deploy/      # Deployment orchestration
 │   │   ├── notify/      # Notifications (ntfy, Slack)
-│   │   └── webhook/     # Gitea webhook processing
+│   │   └── webhook/     # Webhook processing (Gitea, GitHub, GitLab)
 │   └── ssh/             # SSH key generation
 ├── static/              # Embedded CSS/JS assets
 └── templates/           # Embedded HTML templates
@@ -100,6 +100,31 @@ chi Router ──► Middleware Stack ──► Handler
 - **Async deployments**: Webhook triggers deploy via goroutine with `context.WithoutCancel()`
 - **Embedded assets**: Templates and static files embedded via `//go:embed`
 
+## Entrypoints
+
+This repository adheres to the
+[Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
+standard: normalized scripts in `script/` are the entrypoints for the
+development workflow, and the Makefile targets are thin shims that call
+them. We provide:
+
+- `script/bootstrap` — install all dependencies (idempotent)
+- `script/setup` — make a fresh clone ready for development
+  (bootstrap, then install-precommit)
+- `script/projectname` — output the project name ("upaas")
+- `script/test` — run the test suite
+- `script/lint` — run golangci-lint
+- `script/fmt` — format all code (writes)
+- `script/fmt-check` — check formatting (read-only)
+- `script/check` — run test, lint, and fmt-check
+- `script/docker` — build the Docker image tagged via `script/projectname`
+- `script/cibuild` — CI entrypoint: `docker build .` (the Dockerfile
+  runs the checks, so a green build implies a green repo)
+- `script/precommit` — pre-commit checks (`go mod tidy` guard, then
+  `script/check`)
+- `script/install-precommit` — install the git pre-commit hook that
+  runs `script/precommit`
+
 ## Development
 
 ### Prerequisites
@@ -111,14 +136,16 @@ chi Router ──► Middleware Stack ──► Handler
 ### Commands
 
 ```bash
+make bootstrap # Install all dependencies (idempotent)
+make setup     # Bootstrap + install git pre-commit hook
 make fmt       # Format code
 make fmt-check # Check formatting (read-only, fails if unformatted)
 make lint      # Run comprehensive linting
 make test      # Run tests with race detection (30s timeout)
-make check     # Verify everything passes (fmt-check, lint, test)
+make check     # Verify everything passes (test, lint, fmt-check)
 make build     # Build binary
 make docker    # Build Docker image
-make hooks     # Install pre-commit hook (runs make check)
+make hooks     # Install pre-commit hook (runs script/precommit)
 ```
 
 ### Commit Requirements
@@ -164,6 +191,7 @@ Environment variables:
 | `UPAAS_DATA_DIR` | Data directory for SQLite and keys | `./data` (local dev only — use absolute path for Docker) |
 | `UPAAS_HOST_DATA_DIR` | Host path for DATA_DIR (when running in container) | *(none — must be set to an absolute path)* |
 | `UPAAS_DOCKER_HOST` | Docker socket path | unix:///var/run/docker.sock |
+| `UPAAS_PLAINTEXT_HTTP` | Set when µPaaS is reached over plain HTTP (no TLS-terminating proxy in front) so CSRF origin checks use `http://`. Leave unset behind a TLS-terminating reverse proxy. | false |
 | `DEBUG` | Enable debug logging | false |
 | `SENTRY_DSN` | Sentry error reporting DSN | "" |
 | `METRICS_USERNAME` | Basic auth for /metrics | "" |
@@ -177,9 +205,14 @@ docker run -d \
   -v /var/run/docker.sock:/var/run/docker.sock \
   -v /path/on/host/upaas-data:/var/lib/upaas \
   -e UPAAS_HOST_DATA_DIR=/path/on/host/upaas-data \
+  -e UPAAS_PLAINTEXT_HTTP=true \
   upaas
 ```
 
+This recipe serves plain HTTP, so `UPAAS_PLAINTEXT_HTTP=true` is required for
+setup and every other form to pass the CSRF origin check. Behind a
+TLS-terminating reverse proxy, drop that line.
+
 ### Docker Compose
 
 ```yaml
@@ -194,6 +227,8 @@ services:
       - ${HOST_DATA_DIR}:/var/lib/upaas
     environment:
       - UPAAS_HOST_DATA_DIR=${HOST_DATA_DIR}
+      # Set when serving plain HTTP (no TLS-terminating proxy); drop behind one
+      - UPAAS_PLAINTEXT_HTTP=true
       # Optional: uncomment to enable debug logging
       # - DEBUG=true
       # Optional: Sentry error reporting

REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-02-22
+last_modified: 2026-07-06
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -34,10 +34,46 @@ style conventions are in separate documents:
   every file before committing. There are zero exceptions to this rule.
 
 - Every repo with software must have a root `Makefile` with these targets:
-  `make test`, `make lint`, `make fmt` (writes), `make fmt-check` (read-only),
-  `make check` (prereqs: `test`, `lint`, `fmt-check`), `make docker`, and
-  `make hooks` (installs pre-commit hook). A model Makefile is at
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.
+  `make bootstrap`, `make setup`, `make test`, `make lint`, `make fmt` (writes),
+  `make fmt-check` (read-only), `make check` (runs `test`, `lint`, `fmt-check`),
+  `make docker`, and `make hooks` (installs pre-commit hook). A model Makefile
+  is at `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.
+
+- Repos follow the
+  [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
+  pattern: the implementation of each Makefile target lives in an executable
+  script in `script/` (`script/bootstrap`, `script/setup`, `script/test`,
+  `script/lint`, `script/fmt`, `script/fmt-check`, `script/check`,
+  `script/docker`), and the Makefile targets are thin shims that call them. The
+  scripts must be POSIX sh (`#!/bin/sh`, `set -eu`, no bashisms) so they run in
+  minimal containers (e.g. alpine images have no bash); locate the repo root
+  with `$(cd "$(dirname "$0")/.." && pwd -P)` and `cd` there before acting. From
+  the standard's canonical set we use `bootstrap`, `setup` (make the repo ready
+  for development after a fresh clone: runs `bootstrap`, then
+  `install-precommit`, plus any repo-specific initialization), `test`, and
+  `cibuild`. `script/bootstrap` installs all dependencies idempotently and
+  assumes nothing is present: base tools come from nix, apt, brew, or apk
+  (detected in that order; apt runs noninteractive). For node it uses the
+  installed node if present; otherwise it installs a PINNED node version via
+  nvm, first installing nvm itself if missing — from a hash-verified GitHub
+  release archive (never `curl | sh`), with bash installed as an explicit
+  prerequisite since nvm requires bash. yarn is then pinned via
+  `corepack prepare yarn@<version> --activate`. Never install "latest" or "lts";
+  always exact versions. `script/cibuild` runs the CI build: it changes to the
+  repo root and runs `docker build .`; the Gitea workflow calls it. Four further
+  scripts are our own extensions to the standard: `script/check` runs
+  `script/test`, `script/lint`, and `script/fmt-check`; `script/precommit` is
+  what the git pre-commit hook runs, and it calls `script/check`;
+  `script/install-precommit` installs the git pre-commit hook (the `make hooks`
+  target shims to it); and `script/projectname` (literally that filename) simply
+  outputs the project's name. Scripts that need the name call
+  `script/projectname` — e.g. `script/docker` assembles its image tag from it —
+  so those scripts stay byte-identical across all repos. Repo-type-specific
+  pre-commit extras (e.g. `go mod tidy` verification in Go repos) belong in
+  `script/precommit`, not in the hook itself. Model scripts are at
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`. The README
+  must document the provided scripts in an **Entrypoints** section (see the
+  README requirements below).
 
 - Always use Makefile targets (`make fmt`, `make test`, `make lint`, etc.)
   instead of invoking the underlying tools directly. The Makefile is the single
@@ -57,11 +93,83 @@ style conventions are in separate documents:
   as a build step so the build fails if the branch is not green. For non-server
   repos, the Dockerfile should bring up a development environment and run
   `make check`. For server repos, `make check` should run as an early build
-  stage before the final image is assembled.
+  stage before the final image is assembled. Dockerfiles install development
+  prerequisites by running `script/bootstrap` rather than duplicating installs
+  inline; COPY `script/` and the dependency manifests (`package.json` +
+  `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it so the bootstrap
+  layer stays cached until dependencies change.
+
+- **Dockerfiles must use a separate lint stage for fail-fast feedback.** Go
+  repos use a multistage build where linting runs in an independent stage based
+  on the `golangci/golangci-lint` image (pinned by hash). This stage runs
+  `make fmt-check` and `make lint` before the full build begins. The build stage
+  then declares an explicit dependency on the lint stage via
+  `COPY --from=lint /src/go.sum /dev/null`, which forces BuildKit to complete
+  linting before proceeding to compilation and tests. This ensures lint failures
+  surface in seconds rather than minutes, without blocking on dependency
+  download or compilation in the build stage.
+
+    The standard pattern for a Go repo Dockerfile is:
+
+    ```dockerfile
+    # Lint stage — fast feedback on formatting and lint issues
+    # golangci/golangci-lint:v2.x.x, YYYY-MM-DD
+    FROM golangci/golangci-lint@sha256:... AS lint
+    WORKDIR /src
+    COPY go.mod go.sum ./
+    RUN go mod download
+    COPY . .
+    RUN make fmt-check
+    RUN make lint
+
+    # Build stage
+    # golang:1.x-alpine, YYYY-MM-DD
+    FROM golang@sha256:... AS builder
+    WORKDIR /src
+
+    # Force BuildKit to run the lint stage before proceeding
+    COPY --from=lint /src/go.sum /dev/null
+
+    COPY go.mod go.sum ./
+    RUN go mod download
+    COPY . .
+    RUN make test
+
+    ARG VERSION=dev
+    RUN CGO_ENABLED=0 go build -trimpath \
+        -ldflags="-s -w -X main.Version=${VERSION}" \
+        -o /app ./cmd/app/
+
+    # Runtime stage
+    FROM alpine@sha256:...
+    COPY --from=builder /app /usr/local/bin/app
+    ENTRYPOINT ["app"]
+    ```
+
+    Key points:
+    - The lint stage uses the `golangci/golangci-lint` image directly (it
+      includes both Go and the linter), so there is no need to install the
+      linter separately.
+    - `COPY --from=lint /src/go.sum /dev/null` is a no-op file copy that creates
+      a stage dependency. BuildKit runs stages in parallel by default; without
+      this line, the build stage would not wait for lint to finish and a lint
+      failure might not fail the overall build.
+    - If the project uses `//go:embed` directives that reference build artifacts
+      (e.g. a web frontend compiled in a separate stage), the lint stage must
+      create placeholder files so the embed directives resolve. Example:
+      `RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css`.
+      The lint stage should not depend on the actual build output — it exists to
+      fail fast.
+    - If the project requires CGO or system libraries for linting (e.g.
+      `vips-dev`), install them in the lint stage with `apk add`.
+    - The build stage runs `make test` after compilation setup. Tests run in the
+      build stage, not the lint stage, because they may require compiled
+      artifacts or heavier dependencies.
 
 - Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
-  runs `docker build .` on push. Since the Dockerfile already runs `make check`,
-  a successful build implies all checks pass.
+  runs `script/cibuild` (which runs `docker build .`) on push. Since the
+  Dockerfile already runs `make check`, a successful build implies all checks
+  pass.
 
 - Use platform-standard formatters: `black` for Python, `prettier` for
   JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with
@@ -69,9 +177,11 @@ style conventions are in separate documents:
   Markdown (hard-wrap at 80 columns). Documentation and writing repos (Markdown,
   HTML, CSS) should also have `.prettierrc` and `.prettierignore`.
 
-- Pre-commit hook: `make check` if local testing is possible, otherwise
-  `make lint && make fmt-check`. The Makefile should provide a `make hooks`
-  target to install the pre-commit hook.
+- Pre-commit hook: runs `script/precommit`, which calls `script/check`. If local
+  testing is not possible in the repo, `script/precommit` may skip `script/test`
+  and run only `script/lint` and `script/fmt-check`. The hook is installed by
+  `script/install-precommit`; the Makefile must provide a `make hooks` target
+  that shims to it.
 
 - All repos with software must have tests that run via the platform-standard
   test framework (`go test`, `pytest`, `jest`/`vitest`, etc.). If no meaningful
@@ -82,6 +192,42 @@ style conventions are in separate documents:
 - `make test` must complete in under 20 seconds. Add a 30-second timeout in the
   Makefile.
 
+- **`make test` should use the conditional verbose rerun pattern.** Run tests
+  without `-v` (verbose) first. If tests fail, automatically rerun with `-v` to
+  show full output. This keeps CI logs and `docker build` output clean on
+  success (just package/suite summaries) while providing full diagnostic detail
+  on failure (every test case, every assertion). The general shell pattern:
+
+    ```makefile
+    test:
+    	@<test-command> || \
+    		{ echo "--- Rerunning with -v for details ---"; \
+    		  <test-command-with-v>; exit 1; }
+    ```
+
+    Go example:
+
+    ```makefile
+    test:
+    	@go test -timeout 30s -race -cover ./... || \
+    		{ echo "--- Rerunning with -v for details ---"; \
+    		  go test -timeout 30s -race -v ./...; exit 1; }
+    ```
+
+    Python example:
+
+    ```makefile
+    test:
+    	@python -m pytest || \
+    		{ echo "--- Rerunning with -v for details ---"; \
+    		  python -m pytest -v; exit 1; }
+    ```
+
+    The `exit 1` ensures the target always fails after a rerun — the first run
+    already proved the tests are broken, so the build must not pass even if a
+    flaky test happens to succeed on the second attempt. The rerun exists solely
+    for diagnostic output.
+
 - Docker builds must complete in under 5 minutes.
 
 - `make check` must not modify any files in the repo. Tests may use temporary
@@ -98,6 +244,13 @@ style conventions are in separate documents:
   `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up
   a new repo.
 
+- **No build artifacts in version control.** Code-derived data (compiled
+  bundles, minified output, generated assets) must never be committed to the
+  repository if it can be avoided. The build process (e.g. Dockerfile, Makefile)
+  should generate these at build time. Notable exception: Go protobuf generated
+  files (`.pb.go`) ARE committed because repos need to work with `go get`, which
+  downloads code but does not execute code generation.
+
 - Never use `git add -A` or `git add .`. Always stage files explicitly by name.
 
 - Never force-push to `main`.
@@ -121,12 +274,76 @@ style conventions are in separate documents:
 - Dockerized web services listen on port 8080 by default, overridable with
   `PORT`.
 
+- **HTTP/web services must be hardened for production internet exposure before
+  tagging 1.0.** This means full compliance with security best practices
+  including, without limitation, all of the following:
+    - **Security headers** on every response:
+        - `Strict-Transport-Security` (HSTS) with `max-age` of at least one year
+          and `includeSubDomains`.
+        - `Content-Security-Policy` (CSP) with a restrictive default policy
+          (`default-src 'self'` as a baseline, tightened per-resource as
+          needed). Never use `unsafe-inline` or `unsafe-eval` unless
+          unavoidable, and document the reason.
+        - `X-Frame-Options: DENY` (or `SAMEORIGIN` if framing is required).
+          Prefer the `frame-ancestors` CSP directive as the primary control.
+        - `X-Content-Type-Options: nosniff`.
+        - `Referrer-Policy: strict-origin-when-cross-origin` (or stricter).
+        - `Permissions-Policy` restricting access to browser features the
+          application does not use (camera, microphone, geolocation, etc.).
+    - **Request and response limits:**
+        - Maximum request body size enforced on all endpoints (e.g. Go
+          `http.MaxBytesReader`). Choose a sane default per-route; never accept
+          unbounded input.
+        - Maximum response body size where applicable (e.g. paginated APIs).
+        - `ReadTimeout` and `ReadHeaderTimeout` on the `http.Server` to defend
+          against slowloris attacks.
+        - `WriteTimeout` on the `http.Server`.
+        - `IdleTimeout` on the `http.Server`.
+        - Per-handler execution time limits via `context.WithTimeout` or
+          chi/stdlib `middleware.Timeout`.
+    - **Authentication and session security:**
+        - Rate limiting on password-based authentication endpoints. API keys are
+          high-entropy and not susceptible to brute force, so they are exempt.
+        - CSRF tokens on all state-mutating HTML forms. API endpoints
+          authenticated via `Authorization` header (Bearer token, API key) are
+          exempt because the browser does not attach these automatically.
+        - Passwords stored using bcrypt, scrypt, or argon2 — never plain-text,
+          MD5, or SHA.
+        - Session cookies set with `HttpOnly`, `Secure`, and `SameSite=Lax` (or
+          `Strict`) attributes.
+    - **Reverse proxy awareness:**
+        - True client IP detection when behind a reverse proxy
+          (`X-Forwarded-For`, `X-Real-IP`). The application must accept
+          forwarded headers only from a configured set of trusted proxy
+          addresses — never trust `X-Forwarded-For` unconditionally.
+    - **CORS:**
+        - Authenticated endpoints must restrict `Access-Control-Allow-Origin` to
+          an explicit allowlist of known origins. Wildcard (`*`) is acceptable
+          only for public, unauthenticated read-only APIs.
+    - **Error handling:**
+        - Internal errors must never leak stack traces, SQL queries, file paths,
+          or other implementation details to the client. Return generic error
+          messages in production; detailed errors only when `DEBUG` is enabled.
+    - **TLS:**
+        - Services never terminate TLS directly. They are always deployed behind
+          a TLS-terminating reverse proxy. The service itself listens on plain
+          HTTP. However, HSTS headers and `Secure` cookie flags must still be
+          set by the application so that the browser enforces HTTPS end-to-end.
+
+    This list is non-exhaustive. Apply defense-in-depth: if a standard security
+    hardening measure exists for HTTP services and is not listed here, it is
+    still expected. When in doubt, harden.
+
 - `README.md` is the primary documentation. Required sections:
     - **Description**: First line must include the project name, purpose,
       category (web server, SPA, CLI tool, etc.), license, and author. Example:
       "µPaaS is an MIT-licensed Go web application by @sneak that receives
       git-frontend webhooks and deploys applications via Docker in realtime."
     - **Getting Started**: Copy-pasteable install/usage code block.
+    - **Entrypoints**: Opens by stating that the repo adheres to the
+      [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
+      standard (with that link), then documents each provided `script/`
+      entrypoint and its purpose.
     - **Rationale**: Why does this exist?
     - **Design**: How is the program structured?
     - **TODO**: Update meticulously, even between commits. When planning, put
@@ -145,13 +362,13 @@ style conventions are in separate documents:
 
 - Database migrations live in `internal/db/migrations/` and must be embedded in
   the binary.
-  - `000_migration.sql` — contains ONLY the creation of the migrations tracking
-    table itself. Nothing else.
-  - `001_schema.sql` — the full application schema.
-  - **Pre-1.0.0:** never add additional migration files (002, 003, etc.). There
-    is no installed base to migrate. Edit `001_schema.sql` directly.
-  - **Post-1.0.0:** add new numbered migration files for each schema change.
-    Never edit existing migrations after release.
+    - `000_migration.sql` — contains ONLY the creation of the migrations
+      tracking table itself. Nothing else.
+    - `001_schema.sql` — the full application schema.
+    - **Pre-1.0.0:** never add additional migration files (002, 003, etc.).
+      There is no installed base to migrate. Edit `001_schema.sql` directly.
+    - **Post-1.0.0:** add new numbered migration files for each schema change.
+      Never edit existing migrations after release.
 
 - All repos should have an `.editorconfig` enforcing the project's indentation
   settings.
@@ -181,6 +398,9 @@ style conventions are in separate documents:
     - `README.md`, `.git`, `.gitignore`, `.editorconfig`
     - `LICENSE`, `REPO_POLICIES.md` (copy from the `prompts` repo)
     - `Makefile`
+    - `script/` entrypoints (`bootstrap`, `setup`, `projectname`, `test`,
+      `lint`, `fmt`, `fmt-check`, `check`, `docker`, `cibuild`, `precommit`,
+      `install-precommit`)
     - `Dockerfile`, `.dockerignore`
     - `.gitea/workflows/check.yml`
     - Go: `go.mod`, `go.sum`, `.golangci.yml`

TODO.md

@@ -0,0 +1,53 @@
+# Workflow
+
+* branch (from `main`)
+* do the work in Next Step
+* move Next Step to the top of Completed Steps
+* move the top item of Future Steps into Next Step
+* commit (`TODO.md` changes in the same commit as the work)
+* merge to `main` if the branch is not protected, otherwise open a PR
+* push
+
+# Status
+
+1.0+. Tagged 1.0.0 on 2026-02-26; 8 commits on main since. `make check`
+is green as of the golangci-lint v2.12.2 update.
+
+# Next Step
+
+Confirm `.gitea/workflows/check.yml` gates merges on `make check` so
+main cannot regress.
+
+# Completed Steps
+
+- 2026-09-09: Fixed four deployability blockers found by QA: CSRF origin
+  check over plain HTTP (`UPAAS_PLAINTEXT_HTTP`, #189), pulling the git
+  image when absent (#190), the env-var editor CSRF token lookup (#191),
+  and the port-mapping delete form's CSRF field (#192).
+- 2026-08-07: Updated golangci-lint to v2.12.2 (canonical
+  `.golangci.yml`, `Dockerfile` lint stage pin, `script/bootstrap`
+  release-archive pins) and fixed all resulting lint findings (noctx,
+  gosec, goconst, lll, dupl, nolintlint); `make check` green.
+- 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
+  Makefile shims, README Entrypoints section
+- 2026-03-11: Monolithic env var editing with bulk save (#158).
+- 2026-03-10: Webhook event history UI page (#164); added missing
+  Makefile docker and hooks targets plus test timeout (#159);
+  notification settings passed from create form (#160).
+- 2026-03-03: REPO_POLICIES compliance file set added (#155).
+- 2026-03-01: Module path changed to sneak.berlin/go/upaas (#143);
+  Dockerfile split into lint and build stages with forced lint
+  execution (#152, #154).
+- 2026-02-26: 1.0.0 tagged; dashboard CSRFField crash fixed (#146).
+- 1.0 audit bug fixes (#120-#125): deferred rollback on commit error,
+  deployment log size cap, error path rendering, docker-compose bind
+  mount, domain type refactor.
+- CI simplified to docker build only (#130).
+- 2025-12-29 onward: core PaaS built out: deploys with real-time build
+  log streaming, container start/stop/restart and logs, TCP/UDP port
+  mapping, Alpine.js UI, Slack notifications, ULID app IDs, session
+  handling.
+
+# Future Steps
+
+- Resume feature work only after main is green.

internal/config/config.go

@@ -45,10 +45,11 @@ type Config struct {
 	Port            int
 	Debug           bool
 	DataDir         string
-	HostDataDir     string // Host path for DataDir (for Docker bind mounts when running in container)
+	HostDataDir     string // Host path for DataDir (Docker bind mounts in container)
 	DockerHost      string
 	SentryDSN       string
 	MaintenanceMode bool
+	PlaintextHTTP   bool // clients reach µPaaS over plain HTTP (no TLS-terminating proxy)
 	MetricsUsername string
 	MetricsPassword string
 	SessionSecret   string `json:"-"`
@@ -100,6 +101,7 @@ func setupViper(name string) {
 	viper.SetDefault("DOCKER_HOST", "unix:///var/run/docker.sock")
 	viper.SetDefault("SENTRY_DSN", "")
 	viper.SetDefault("MAINTENANCE_MODE", false)
+	viper.SetDefault("PLAINTEXT_HTTP", false)
 	viper.SetDefault("METRICS_USERNAME", "")
 	viper.SetDefault("METRICS_PASSWORD", "")
 	viper.SetDefault("SESSION_SECRET", "")
@@ -135,6 +137,7 @@ func buildConfig(log *slog.Logger, params *Params) (*Config, error) {
 		DockerHost:      viper.GetString("DOCKER_HOST"),
 		SentryDSN:       viper.GetString("SENTRY_DSN"),
 		MaintenanceMode: viper.GetBool("MAINTENANCE_MODE"),
+		PlaintextHTTP:   viper.GetBool("PLAINTEXT_HTTP"),
 		MetricsUsername: viper.GetString("METRICS_USERNAME"),
 		MetricsPassword: viper.GetString("METRICS_PASSWORD"),
 		SessionSecret:   viper.GetString("SESSION_SECRET"),

internal/database/database.go

@@ -178,7 +178,8 @@ func HashWebhookSecret(secret string) string {
 
 func (d *Database) backfillWebhookSecretHashes(ctx context.Context) error {
 	rows, err := d.database.QueryContext(ctx,
-		"SELECT id, webhook_secret FROM apps WHERE webhook_secret_hash = '' AND webhook_secret != ''")
+		"SELECT id, webhook_secret FROM apps"+
+			" WHERE webhook_secret_hash = '' AND webhook_secret != ''")
 	if err != nil {
 		return fmt.Errorf("querying apps for backfill: %w", err)
 	}

internal/database/migrations.go

@@ -2,36 +2,80 @@ package database
 
 import (
 	"context"
+	"database/sql"
 	"embed"
+	"errors"
 	"fmt"
 	"io/fs"
+	"log/slog"
 	"sort"
+	"strconv"
 	"strings"
 )
 
 //go:embed migrations/*.sql
 var migrationsFS embed.FS
 
-func (d *Database) migrate(ctx context.Context) error {
-	// Create migrations table if not exists
-	_, err := d.database.ExecContext(ctx, `
-		CREATE TABLE IF NOT EXISTS schema_migrations (
-			version TEXT PRIMARY KEY,
-			applied_at DATETIME DEFAULT CURRENT_TIMESTAMP
+// bootstrapVersion is the migration that creates the schema_migrations
+// table itself. It is applied before the normal migration loop.
+const bootstrapVersion = 0
+
+// ErrInvalidMigrationFilename indicates a migration filename does not follow
+// the expected "<version>.sql" or "<version>_<description>.sql" pattern.
+var ErrInvalidMigrationFilename = errors.New("invalid migration filename")
+
+// ParseMigrationVersion extracts the numeric version prefix from a migration
+// filename. Filenames must follow the pattern "<version>.sql" or
+// "<version>_<description>.sql", where version is a zero-padded numeric
+// string (e.g. "001", "002"). Returns the version as an integer and an
+// error if the filename does not match the expected pattern.
+func ParseMigrationVersion(filename string) (int, error) {
+	name := strings.TrimSuffix(filename, ".sql")
+	if name == "" || name == filename {
+		return 0, fmt.Errorf(
+			"%w: %q has no .sql extension or is empty",
+			ErrInvalidMigrationFilename, filename,
 		)
-	`)
-	if err != nil {
-		return fmt.Errorf("failed to create migrations table: %w", err)
 	}
 
-	// Get list of migration files
+	// Split on underscore to separate version from description.
+	// If there's no underscore, the entire stem is the version.
+	versionStr, _, _ := strings.Cut(name, "_")
+
+	if versionStr == "" {
+		return 0, fmt.Errorf(
+			"%w: %q has empty version prefix",
+			ErrInvalidMigrationFilename, filename,
+		)
+	}
+
+	// Validate the version is purely numeric.
+	for _, ch := range versionStr {
+		if ch < '0' || ch > '9' {
+			return 0, fmt.Errorf(
+				"%w: %q version %q contains non-numeric character %q",
+				ErrInvalidMigrationFilename, filename, versionStr, string(ch),
+			)
+		}
+	}
+
+	version, err := strconv.Atoi(versionStr)
+	if err != nil {
+		return 0, fmt.Errorf("%w: %q: %w", ErrInvalidMigrationFilename, filename, err)
+	}
+
+	return version, nil
+}
+
+// collectMigrations reads the embedded migrations directory and returns
+// migration filenames sorted lexicographically.
+func collectMigrations() ([]string, error) {
 	entries, err := fs.ReadDir(migrationsFS, "migrations")
 	if err != nil {
-		return fmt.Errorf("failed to read migrations directory: %w", err)
+		return nil, fmt.Errorf("failed to read migrations directory: %w", err)
 	}
 
-	// Sort migrations by name
-	migrations := make([]string, 0, len(entries))
+	var migrations []string
 
 	for _, entry := range entries {
 		if !entry.IsDir() && strings.HasSuffix(entry.Name(), ".sql") {
@@ -41,54 +85,118 @@ func (d *Database) migrate(ctx context.Context) error {
 
 	sort.Strings(migrations)
 
-	// Apply each migration
-	for _, migration := range migrations {
-		applied, err := d.isMigrationApplied(ctx, migration)
-		if err != nil {
-			return fmt.Errorf("failed to check migration %s: %w", migration, err)
-		}
+	return migrations, nil
+}
 
-		if applied {
-			d.log.Debug("migration already applied", "migration", migration)
+// bootstrapMigrationsTable ensures the schema_migrations table exists by
+// applying 000_migration.sql if the table is missing.
+func bootstrapMigrationsTable(ctx context.Context, db *sql.DB, log *slog.Logger) error {
+	var tableExists int
 
-			continue
-		}
+	err := db.QueryRowContext(ctx,
+		"SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name='schema_migrations'",
+	).Scan(&tableExists)
+	if err != nil {
+		return fmt.Errorf("failed to check for migrations table: %w", err)
+	}
 
-		err = d.applyMigration(ctx, migration)
-		if err != nil {
-			return fmt.Errorf("failed to apply migration %s: %w", migration, err)
-		}
-
-		d.log.Info("migration applied", "migration", migration)
+	if tableExists == 0 {
+		return applyBootstrapMigration(ctx, db, log)
 	}
 
 	return nil
 }
 
-func (d *Database) isMigrationApplied(ctx context.Context, version string) (bool, error) {
-	var count int
-
-	err := d.database.QueryRowContext(
-		ctx,
-		"SELECT COUNT(*) FROM schema_migrations WHERE version = ?",
-		version,
-	).Scan(&count)
+// applyBootstrapMigration reads and executes 000_migration.sql to create the
+// schema_migrations table on a fresh database.
+func applyBootstrapMigration(ctx context.Context, db *sql.DB, log *slog.Logger) error {
+	content, err := migrationsFS.ReadFile("migrations/000_migration.sql")
 	if err != nil {
-		return false, fmt.Errorf("failed to query migration status: %w", err)
+		return fmt.Errorf("failed to read bootstrap migration 000_migration.sql: %w", err)
 	}
 
-	return count > 0, nil
+	if log != nil {
+		log.Info("applying bootstrap migration", "version", bootstrapVersion)
+	}
+
+	_, err = db.ExecContext(ctx, string(content))
+	if err != nil {
+		return fmt.Errorf("failed to apply bootstrap migration: %w", err)
+	}
+
+	return nil
 }
 
-func (d *Database) applyMigration(ctx context.Context, filename string) error {
-	content, err := migrationsFS.ReadFile("migrations/" + filename)
-	if err != nil {
-		return fmt.Errorf("failed to read migration file: %w", err)
+// ApplyMigrations applies all pending migrations to db. An optional logger
+// may be provided for informational output; pass nil for silent operation.
+// This is exported so tests can apply the real schema without the full fx
+// lifecycle.
+func ApplyMigrations(ctx context.Context, db *sql.DB, log *slog.Logger) error {
+	bootstrapErr := bootstrapMigrationsTable(ctx, db, log)
+	if bootstrapErr != nil {
+		return bootstrapErr
 	}
 
-	transaction, err := d.database.BeginTx(ctx, nil)
+	migrations, err := collectMigrations()
 	if err != nil {
-		return fmt.Errorf("failed to begin transaction: %w", err)
+		return err
+	}
+
+	for _, migration := range migrations {
+		version, parseErr := ParseMigrationVersion(migration)
+		if parseErr != nil {
+			return parseErr
+		}
+
+		// Check if already applied.
+		var count int
+
+		err = db.QueryRowContext(ctx,
+			"SELECT COUNT(*) FROM schema_migrations WHERE version = ?",
+			version,
+		).Scan(&count)
+		if err != nil {
+			return fmt.Errorf("failed to check migration %s: %w", migration, err)
+		}
+
+		if count > 0 {
+			if log != nil {
+				log.Debug("migration already applied", "version", version)
+			}
+
+			continue
+		}
+
+		// Apply migration in a transaction.
+		applyErr := applyMigrationTx(ctx, db, migration, version)
+		if applyErr != nil {
+			return applyErr
+		}
+
+		if log != nil {
+			log.Info("migration applied", "version", version)
+		}
+	}
+
+	return nil
+}
+
+// applyMigrationTx reads and executes a migration file within a transaction,
+// recording the version in schema_migrations on success.
+func applyMigrationTx(
+	ctx context.Context,
+	db *sql.DB,
+	filename string,
+	version int,
+) error {
+	content, err := migrationsFS.ReadFile("migrations/" + filename)
+	if err != nil {
+		return fmt.Errorf("failed to read migration %s: %w", filename, err)
+	}
+
+	transaction, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("failed to begin transaction for migration %s: %w", filename, err)
 	}
 
 	defer func() {
@@ -97,26 +205,27 @@ func (d *Database) applyMigration(ctx context.Context, filename string) error {
 		}
 	}()
 
-	// Execute migration
 	_, err = transaction.ExecContext(ctx, string(content))
 	if err != nil {
-		return fmt.Errorf("failed to execute migration: %w", err)
+		return fmt.Errorf("failed to execute migration %s: %w", filename, err)
 	}
 
-	// Record migration
-	_, err = transaction.ExecContext(
-		ctx,
+	_, err = transaction.ExecContext(ctx,
 		"INSERT INTO schema_migrations (version) VALUES (?)",
-		filename,
+		version,
 	)
 	if err != nil {
-		return fmt.Errorf("failed to record migration: %w", err)
+		return fmt.Errorf("failed to record migration %s: %w", filename, err)
 	}
 
 	err = transaction.Commit()
 	if err != nil {
-		return fmt.Errorf("failed to commit migration: %w", err)
+		return fmt.Errorf("failed to commit migration %s: %w", filename, err)
 	}
 
 	return nil
 }
+
+func (d *Database) migrate(ctx context.Context) error {
+	return ApplyMigrations(ctx, d.database, d.log)
+}

internal/database/migrations/000_migration.sql

@@ -0,0 +1,9 @@
+-- Migration 000: Schema migrations tracking table
+-- Applied as a bootstrap step before the normal migration loop.
+
+CREATE TABLE IF NOT EXISTS schema_migrations (
+    version INTEGER PRIMARY KEY,
+    applied_at DATETIME DEFAULT CURRENT_TIMESTAMP
+);
+
+INSERT OR IGNORE INTO schema_migrations (version) VALUES (0);

internal/database/migrations_test.go

@@ -0,0 +1,117 @@
+package database_test
+
+import (
+	"context"
+	"database/sql"
+	"testing"
+
+	_ "github.com/mattn/go-sqlite3"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"sneak.berlin/go/upaas/internal/database"
+)
+
+func TestParseMigrationVersion(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		filename    string
+		wantVersion int
+		wantErr     bool
+	}{
+		{filename: "000_migration.sql", wantVersion: 0},
+		{filename: "001_initial.sql", wantVersion: 1},
+		{filename: "002_remove_container_id.sql", wantVersion: 2},
+		{filename: "007_add_resource_limits.sql", wantVersion: 7},
+		{filename: "100_large_version.sql", wantVersion: 100},
+		{filename: ".sql", wantErr: true},
+		{filename: "_foo.sql", wantErr: true},
+		{filename: "abc_foo.sql", wantErr: true},
+		{filename: "1a2_bad.sql", wantErr: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.filename, func(t *testing.T) {
+			t.Parallel()
+
+			version, err := database.ParseMigrationVersion(tt.filename)
+			if tt.wantErr {
+				assert.Error(t, err)
+
+				return
+			}
+
+			require.NoError(t, err)
+			assert.Equal(t, tt.wantVersion, version)
+		})
+	}
+}
+
+func TestApplyMigrationsFreshDatabase(t *testing.T) {
+	t.Parallel()
+
+	db, err := sql.Open("sqlite3", ":memory:?_foreign_keys=on")
+	require.NoError(t, err)
+
+	defer func() { _ = db.Close() }()
+
+	ctx := context.Background()
+
+	err = database.ApplyMigrations(ctx, db, nil)
+	require.NoError(t, err)
+
+	// Verify schema_migrations table exists with INTEGER version column.
+	var version int
+
+	err = db.QueryRowContext(ctx,
+		"SELECT version FROM schema_migrations WHERE version = 0",
+	).Scan(&version)
+	require.NoError(t, err)
+	assert.Equal(t, 0, version)
+
+	// Verify that all migrations were recorded.
+	var count int
+
+	err = db.QueryRowContext(ctx,
+		"SELECT COUNT(*) FROM schema_migrations",
+	).Scan(&count)
+	require.NoError(t, err)
+	// 000 bootstrap + 001 through 007 = 8 entries.
+	assert.Equal(t, 8, count)
+
+	// Verify application tables were created by the migrations.
+	var tableCount int
+
+	err = db.QueryRowContext(ctx,
+		"SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name='users'",
+	).Scan(&tableCount)
+	require.NoError(t, err)
+	assert.Equal(t, 1, tableCount)
+}
+
+func TestApplyMigrationsIdempotent(t *testing.T) {
+	t.Parallel()
+
+	db, err := sql.Open("sqlite3", ":memory:?_foreign_keys=on")
+	require.NoError(t, err)
+
+	defer func() { _ = db.Close() }()
+
+	ctx := context.Background()
+
+	// Apply twice — second run should be a no-op.
+	err = database.ApplyMigrations(ctx, db, nil)
+	require.NoError(t, err)
+
+	err = database.ApplyMigrations(ctx, db, nil)
+	require.NoError(t, err)
+
+	var count int
+
+	err = db.QueryRowContext(ctx,
+		"SELECT COUNT(*) FROM schema_migrations",
+	).Scan(&count)
+	require.NoError(t, err)
+	assert.Equal(t, 8, count)
+}

internal/docker/client.go

@@ -41,7 +41,8 @@ const stopTimeoutSeconds = 10
 
 // gitImage is the Docker image used for git operations.
 // alpine/git v2.47.2 - pulled 2025-12-30
-const gitImage = "alpine/git@sha256:d86f367afb53d022acc4377741e7334bc20add161bb10234272b91b459b4b7d8"
+const gitImage = "alpine/git@sha256:" +
+	"d86f367afb53d022acc4377741e7334bc20add161bb10234272b91b459b4b7d8"
 
 // ErrNotConnected is returned when Docker client is not connected.
 var ErrNotConnected = errors.New("docker client not connected")
@@ -145,7 +146,7 @@ type CreateContainerOptions struct {
 	Volumes     []VolumeMount
 	Ports       []PortMapping
 	Network     string
-	CPULimit    float64 // CPU cores (e.g. 0.5 = half a core, 2.0 = two cores). 0 means unlimited.
+	CPULimit    float64 // CPU cores (0.5 = half a core). 0 means unlimited.
 	MemoryLimit int64   // Memory in bytes. 0 means unlimited.
 }
 
@@ -303,7 +304,11 @@ func (c *Client) StopContainer(ctx context.Context, containerID ContainerID) err
 
 	timeout := stopTimeoutSeconds
 
-	err := c.docker.ContainerStop(ctx, containerID.String(), container.StopOptions{Timeout: &timeout})
+	err := c.docker.ContainerStop(
+		ctx,
+		containerID.String(),
+		container.StopOptions{Timeout: &timeout},
+	)
 	if err != nil {
 		return fmt.Errorf("failed to stop container: %w", err)
 	}
@@ -323,7 +328,11 @@ func (c *Client) RemoveContainer(
 
 	c.log.Info("removing container", "id", containerID, "force", force)
 
-	err := c.docker.ContainerRemove(ctx, containerID.String(), container.RemoveOptions{Force: force})
+	err := c.docker.ContainerRemove(
+		ctx,
+		containerID.String(),
+		container.RemoveOptions{Force: force},
+	)
 	if err != nil {
 		return fmt.Errorf("failed to remove container: %w", err)
 	}
@@ -469,7 +478,8 @@ type CloneResult struct {
 	CommitSHA string // The HEAD commit SHA after clone/checkout
 }
 
-// CloneRepo clones a git repository using SSH and optionally checks out a specific commit.
+// CloneRepo clones a git repository using SSH and optionally checks out a
+// specific commit.
 // containerDir is the path inside the upaas container (for writing files).
 // hostDir is the corresponding path on the Docker host (for bind mounts).
 // If commitSHA is provided, that specific commit will be checked out.
@@ -584,11 +594,13 @@ func (c *Client) performBuild(
 // scannerInitialBufferSize is the initial buffer size for the build log scanner.
 const scannerInitialBufferSize = 64 * 1024 // 64KB
 
-// scannerMaxBufferSize is the max buffer size for build log lines (base64 layers can be large).
+// scannerMaxBufferSize is the max buffer size for build log lines
+// (base64 layers can be large).
 const scannerMaxBufferSize = 1024 * 1024 // 1MB
 
-// streamBuildOutput reads Docker build output line by line and writes to stdout and optional log writer.
-// Docker sends newline-delimited JSON, so reading line by line ensures each log entry is written immediately.
+// streamBuildOutput reads Docker build output line by line and writes to
+// stdout and optional log writer. Docker sends newline-delimited JSON, so
+// reading line by line ensures each log entry is written immediately.
 func (c *Client) streamBuildOutput(body io.Reader, logWriter io.Writer) error {
 	scanner := bufio.NewScanner(body)
 	buf := make([]byte, 0, scannerInitialBufferSize)
@@ -616,7 +628,10 @@ func (c *Client) streamBuildOutput(body io.Reader, logWriter io.Writer) error {
 	return nil
 }
 
-func (c *Client) performClone(ctx context.Context, cfg *cloneConfig) (*CloneResult, error) {
+func (c *Client) performClone(
+	ctx context.Context,
+	cfg *cloneConfig,
+) (*CloneResult, error) {
 	// Create work directory for clone destination
 	err := os.MkdirAll(cfg.containerDir, workDirPermissions)
 	if err != nil {
@@ -642,16 +657,61 @@ func (c *Client) performClone(ctx context.Context, cfg *cloneConfig) (*CloneResu
 	}
 
 	defer func() {
-		_ = c.docker.ContainerRemove(ctx, gitContainerID.String(), container.RemoveOptions{Force: true})
+		_ = c.docker.ContainerRemove(
+			ctx,
+			gitContainerID.String(),
+			container.RemoveOptions{Force: true},
+		)
 	}()
 
 	return c.runGitClone(ctx, gitContainerID)
 }
 
+// ensureImage pulls ref if it is not already present locally. The pinned
+// digest is preserved: a pull of an image already present is a no-op, and a
+// missing one is fetched before it is used to create a container.
+func (c *Client) ensureImage(ctx context.Context, ref string) error {
+	_, _, err := c.docker.ImageInspectWithRaw(ctx, ref)
+	if err == nil {
+		return nil
+	}
+
+	if !client.IsErrNotFound(err) {
+		return fmt.Errorf("failed to inspect image %s: %w", ref, err)
+	}
+
+	c.log.Info("pulling image", "image", ref)
+
+	reader, err := c.docker.ImagePull(ctx, ref, image.PullOptions{})
+	if err != nil {
+		return fmt.Errorf("failed to pull image %s: %w", ref, err)
+	}
+
+	defer func() {
+		closeErr := reader.Close()
+		if closeErr != nil {
+			c.log.Error("failed to close image pull reader", "error", closeErr)
+		}
+	}()
+
+	// The pull only completes once its response stream is fully drained.
+	_, err = io.Copy(io.Discard, reader)
+	if err != nil {
+		return fmt.Errorf("failed to pull image %s: %w", ref, err)
+	}
+
+	return nil
+}
+
 func (c *Client) createGitContainer(
 	ctx context.Context,
 	cfg *cloneConfig,
 ) (ContainerID, error) {
+	err := c.ensureImage(ctx, gitImage)
+	if err != nil {
+		return "", err
+	}
+
 	gitSSHCmd := "ssh -i /keys/deploy_key -o StrictHostKeyChecking=no"
 
 	// Build the git command using environment variables to avoid shell injection.
@@ -680,7 +740,8 @@ func (c *Client) createGitContainer(
 	entrypoint := []string{}
 	cmd := []string{"sh", "-c", script}
 
-	// Use host paths for Docker bind mounts (Docker runs on the host, not in our container)
+	// Use host paths for Docker bind mounts
+	// (Docker runs on the host, not in our container)
 	resp, err := c.docker.ContainerCreate(ctx,
 		&container.Config{
 			Image:      gitImage,
@@ -711,13 +772,20 @@ func (c *Client) createGitContainer(
 	return ContainerID(resp.ID), nil
 }
 
-func (c *Client) runGitClone(ctx context.Context, containerID ContainerID) (*CloneResult, error) {
+func (c *Client) runGitClone(
+	ctx context.Context,
+	containerID ContainerID,
+) (*CloneResult, error) {
 	err := c.docker.ContainerStart(ctx, containerID.String(), container.StartOptions{})
 	if err != nil {
 		return nil, fmt.Errorf("failed to start git container: %w", err)
 	}
 
-	statusCh, errCh := c.docker.ContainerWait(ctx, containerID.String(), container.WaitConditionNotRunning)
+	statusCh, errCh := c.docker.ContainerWait(
+		ctx,
+		containerID.String(),
+		container.WaitConditionNotRunning,
+	)
 
 	select {
 	case err := <-errCh:

internal/docker/validation_test.go

@@ -6,11 +6,14 @@ import (
 	"testing"
 )
 
+// mainBranch is the branch name used across validation tests.
+const mainBranch = "main"
+
 func TestValidBranchRegex(t *testing.T) {
 	t.Parallel()
 
 	valid := []string{
-		"main",
+		mainBranch,
 		"develop",
 		"feature/my-feature",
 		"release-1.0",
@@ -70,7 +73,7 @@ func TestValidCommitSHARegex(t *testing.T) {
 	}
 }
 
-func TestCloneRepoRejectsInjection(t *testing.T) { //nolint:funlen // table-driven test
+func TestCloneRepoRejectsInjection(t *testing.T) {
 	t.Parallel()
 
 	c := &Client{
@@ -100,25 +103,25 @@ func TestCloneRepoRejectsInjection(t *testing.T) { //nolint:funlen // table-driv
 		},
 		{
 			name:      "injection in commitSHA",
-			branch:    "main",
+			branch:    mainBranch,
 			commitSHA: "not-a-sha; rm -rf /",
 			wantErr:   ErrInvalidCommitSHA,
 		},
 		{
 			name:      "short SHA rejected",
-			branch:    "main",
+			branch:    mainBranch,
 			commitSHA: "abc123",
 			wantErr:   ErrInvalidCommitSHA,
 		},
 		{
 			name:      "valid inputs pass validation (hit NotConnected)",
-			branch:    "main",
+			branch:    mainBranch,
 			commitSHA: "abc123def456789012345678901234567890abcd",
 			wantErr:   ErrNotConnected,
 		},
 		{
 			name:    "valid branch no SHA passes validation (hit NotConnected)",
-			branch:  "main",
+			branch:  mainBranch,
 			wantErr: ErrNotConnected,
 		},
 	}

internal/handlers/api.go

@@ -84,7 +84,7 @@ func (h *Handlers) HandleAPILoginPOST() http.HandlerFunc {
 		decodeErr := json.NewDecoder(request.Body).Decode(&req)
 		if decodeErr != nil {
 			h.respondJSON(writer, request,
-				map[string]string{"error": "invalid JSON body"},
+				map[string]string{jsonKeyError: "invalid JSON body"},
 				http.StatusBadRequest)
 
 			return
@@ -95,7 +95,7 @@ func (h *Handlers) HandleAPILoginPOST() http.HandlerFunc {
 
 		if username == "" || credential == "" {
 			h.respondJSON(writer, request,
-				map[string]string{"error": "username and password are required"},
+				map[string]string{jsonKeyError: "username and password are required"},
 				http.StatusBadRequest)
 
 			return
@@ -104,7 +104,7 @@ func (h *Handlers) HandleAPILoginPOST() http.HandlerFunc {
 		user, authErr := h.auth.Authenticate(request.Context(), username, credential)
 		if authErr != nil {
 			h.respondJSON(writer, request,
-				map[string]string{"error": "invalid credentials"},
+				map[string]string{jsonKeyError: "invalid credentials"},
 				http.StatusUnauthorized)
 
 			return
@@ -114,7 +114,7 @@ func (h *Handlers) HandleAPILoginPOST() http.HandlerFunc {
 		if sessionErr != nil {
 			h.log.Error("api: failed to create session", "error", sessionErr)
 			h.respondJSON(writer, request,
-				map[string]string{"error": "failed to create session"},
+				map[string]string{jsonKeyError: "failed to create session"},
 				http.StatusInternalServerError)
 
 			return
@@ -133,7 +133,7 @@ func (h *Handlers) HandleAPIListApps() http.HandlerFunc {
 		apps, err := h.appService.ListApps(request.Context())
 		if err != nil {
 			h.respondJSON(writer, request,
-				map[string]string{"error": "failed to list apps"},
+				map[string]string{jsonKeyError: "failed to list apps"},
 				http.StatusInternalServerError)
 
 			return
@@ -156,7 +156,7 @@ func (h *Handlers) HandleAPIGetApp() http.HandlerFunc {
 		application, err := h.appService.GetApp(request.Context(), appID)
 		if err != nil {
 			h.respondJSON(writer, request,
-				map[string]string{"error": "internal server error"},
+				map[string]string{jsonKeyError: "internal server error"},
 				http.StatusInternalServerError)
 
 			return
@@ -164,7 +164,7 @@ func (h *Handlers) HandleAPIGetApp() http.HandlerFunc {
 
 		if application == nil {
 			h.respondJSON(writer, request,
-				map[string]string{"error": "app not found"},
+				map[string]string{jsonKeyError: "app not found"},
 				http.StatusNotFound)
 
 			return
@@ -185,7 +185,7 @@ func (h *Handlers) HandleAPIListDeployments() http.HandlerFunc {
 		application, err := h.appService.GetApp(request.Context(), appID)
 		if err != nil || application == nil {
 			h.respondJSON(writer, request,
-				map[string]string{"error": "app not found"},
+				map[string]string{jsonKeyError: "app not found"},
 				http.StatusNotFound)
 
 			return
@@ -205,7 +205,7 @@ func (h *Handlers) HandleAPIListDeployments() http.HandlerFunc {
 		)
 		if deployErr != nil {
 			h.respondJSON(writer, request,
-				map[string]string{"error": "failed to list deployments"},
+				map[string]string{jsonKeyError: "failed to list deployments"},
 				http.StatusInternalServerError)
 
 			return
@@ -231,7 +231,7 @@ func (h *Handlers) HandleAPIWhoAmI() http.HandlerFunc {
 		user, err := h.auth.GetCurrentUser(request.Context(), request)
 		if err != nil || user == nil {
 			h.respondJSON(writer, request,
-				map[string]string{"error": "unauthorized"},
+				map[string]string{jsonKeyError: "unauthorized"},
 				http.StatusUnauthorized)
 
 			return

internal/handlers/api_test.go

@@ -47,7 +47,12 @@ func setupAPITest(t *testing.T) (*testContext, []*http.Cookie) {
 	r := apiRouter(tc)
 
 	loginBody := `{"username":"admin","password":"password123"}`
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/login", strings.NewReader(loginBody))
+	req := httptest.NewRequestWithContext(
+		t.Context(),
+		http.MethodPost,
+		"/api/v1/login",
+		strings.NewReader(loginBody),
+	)
 	req.Header.Set("Content-Type", "application/json")
 
 	rr := httptest.NewRecorder()
@@ -70,7 +75,7 @@ func apiGet(
 ) *httptest.ResponseRecorder {
 	t.Helper()
 
-	req := httptest.NewRequest(http.MethodGet, path, nil)
+	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, path, nil)
 
 	for _, c := range cookies {
 		req.AddCookie(c)
@@ -95,7 +100,12 @@ func TestAPILoginSuccess(t *testing.T) {
 	r := apiRouter(tc)
 
 	body := `{"username":"admin","password":"password123"}`
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/login", strings.NewReader(body))
+	req := httptest.NewRequestWithContext(
+		t.Context(),
+		http.MethodPost,
+		"/api/v1/login",
+		strings.NewReader(body),
+	)
 	req.Header.Set("Content-Type", "application/json")
 
 	rr := httptest.NewRecorder()
@@ -122,7 +132,12 @@ func TestAPILoginInvalidCredentials(t *testing.T) {
 	r := apiRouter(tc)
 
 	body := `{"username":"admin","password":"wrong"}`
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/login", strings.NewReader(body))
+	req := httptest.NewRequestWithContext(
+		t.Context(),
+		http.MethodPost,
+		"/api/v1/login",
+		strings.NewReader(body),
+	)
 	req.Header.Set("Content-Type", "application/json")
 
 	rr := httptest.NewRecorder()
@@ -139,7 +154,12 @@ func TestAPILoginMissingFields(t *testing.T) {
 	r := apiRouter(tc)
 
 	body := `{"username":"","password":""}`
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/login", strings.NewReader(body))
+	req := httptest.NewRequestWithContext(
+		t.Context(),
+		http.MethodPost,
+		"/api/v1/login",
+		strings.NewReader(body),
+	)
 	req.Header.Set("Content-Type", "application/json")
 
 	rr := httptest.NewRecorder()
@@ -155,7 +175,9 @@ func TestAPIRejectsUnauthenticated(t *testing.T) {
 
 	r := apiRouter(tc)
 
-	req := httptest.NewRequest(http.MethodGet, "/api/v1/apps", nil)
+	req := httptest.NewRequestWithContext(
+		t.Context(), http.MethodGet, "/api/v1/apps", nil,
+	)
 	rr := httptest.NewRecorder()
 	r.ServeHTTP(rr, req)
 

internal/handlers/app.go

@@ -7,6 +7,7 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
+	"net/url"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -15,6 +16,7 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
+	"sneak.berlin/go/upaas/internal/database"
 	"sneak.berlin/go/upaas/internal/models"
 	"sneak.berlin/go/upaas/internal/service/app"
 	"sneak.berlin/go/upaas/templates"
@@ -27,6 +29,23 @@ const (
 	deploymentsHistoryLimit = 50
 )
 
+// redirectToApp issues a SeeOther redirect to the page for the given
+// app ID, with an optional suffix such as "/deployments" or
+// "?success=updated". The ID is path-escaped so the target is always
+// a relative application URL.
+func redirectToApp(
+	writer http.ResponseWriter,
+	request *http.Request,
+	appID, suffix string,
+) {
+	http.Redirect(
+		writer,
+		request,
+		"/apps/"+url.PathEscape(appID)+suffix,
+		http.StatusSeeOther,
+	)
+}
+
 // HandleAppNew returns the new app form handler.
 func (h *Handlers) HandleAppNew() http.HandlerFunc {
 	tmpl := templates.GetParsed()
@@ -39,7 +58,9 @@ func (h *Handlers) HandleAppNew() http.HandlerFunc {
 }
 
 // HandleAppCreate handles app creation.
-func (h *Handlers) HandleAppCreate() http.HandlerFunc { //nolint:funlen // validation adds necessary length
+//
+//nolint:funlen // validation adds necessary length
+func (h *Handlers) HandleAppCreate() http.HandlerFunc {
 	tmpl := templates.GetParsed()
 
 	return func(writer http.ResponseWriter, request *http.Request) {
@@ -160,10 +181,14 @@ func (h *Handlers) HandleAppDetail() http.HandlerFunc {
 		}
 
 		webhookURL := "https://" + request.Host + "/webhook/" + application.WebhookSecret
-		deployKey := formatDeployKey(application.SSHPublicKey, application.CreatedAt, application.Name)
+		deployKey := formatDeployKey(
+			application.SSHPublicKey,
+			application.CreatedAt,
+			application.Name,
+		)
 
 		data := h.addGlobals(map[string]any{
-			"App":              application,
+			dataKeyApp:         application,
 			"EnvVars":          envVars,
 			"Labels":           labels,
 			"Volumes":          volumes,
@@ -201,7 +226,7 @@ func (h *Handlers) HandleAppEdit() http.HandlerFunc {
 		}
 
 		data := h.addGlobals(map[string]any{
-			"App": application,
+			dataKeyApp: application,
 		}, request)
 
 		h.renderTemplate(writer, tmpl, "app_edit.html", data)
@@ -209,7 +234,7 @@ func (h *Handlers) HandleAppEdit() http.HandlerFunc {
 }
 
 // HandleAppUpdate handles app updates.
-func (h *Handlers) HandleAppUpdate() http.HandlerFunc { //nolint:funlen // validation adds necessary length
+func (h *Handlers) HandleAppUpdate() http.HandlerFunc {
 	tmpl := templates.GetParsed()
 
 	return func(writer http.ResponseWriter, request *http.Request) {
@@ -234,8 +259,8 @@ func (h *Handlers) HandleAppUpdate() http.HandlerFunc { //nolint:funlen // valid
 		nameErr := validateAppName(newName)
 		if nameErr != nil {
 			data := h.addGlobals(map[string]any{
-				"App":   application,
-				"Error": "Invalid app name: " + nameErr.Error(),
+				dataKeyApp:   application,
+				dataKeyError: "Invalid app name: " + nameErr.Error(),
 			}, request)
 			h.renderTemplate(writer, tmpl, "app_edit.html", data)
 
@@ -245,8 +270,8 @@ func (h *Handlers) HandleAppUpdate() http.HandlerFunc { //nolint:funlen // valid
 		repoURLErr := validateRepoURL(request.FormValue("repo_url"))
 		if repoURLErr != nil {
 			data := h.addGlobals(map[string]any{
-				"App":   application,
-				"Error": "Invalid repository URL: " + repoURLErr.Error(),
+				dataKeyApp:   application,
+				dataKeyError: "Invalid repository URL: " + repoURLErr.Error(),
 			}, request)
 			h.renderTemplate(writer, tmpl, "app_edit.html", data)
 
@@ -264,8 +289,8 @@ func (h *Handlers) HandleAppUpdate() http.HandlerFunc { //nolint:funlen // valid
 		limitsErr := applyResourceLimits(application, request)
 		if limitsErr != "" {
 			data := h.addGlobals(map[string]any{
-				"App":   application,
-				"Error": limitsErr,
+				dataKeyApp:   application,
+				dataKeyError: limitsErr,
 			}, request)
 			h.renderTemplate(writer, tmpl, "app_edit.html", data)
 
@@ -277,16 +302,15 @@ func (h *Handlers) HandleAppUpdate() http.HandlerFunc { //nolint:funlen // valid
 			h.log.Error("failed to update app", "error", saveErr)
 
 			data := h.addGlobals(map[string]any{
-				"App":   application,
-				"Error": "Failed to update app",
+				dataKeyApp:   application,
+				dataKeyError: "Failed to update app",
 			}, request)
 			h.renderTemplate(writer, tmpl, "app_edit.html", data)
 
 			return
 		}
 
-		redirectURL := "/apps/" + application.ID + "?success=updated"
-		http.Redirect(writer, request, redirectURL, http.StatusSeeOther)
+		redirectToApp(writer, request, application.ID, "?success=updated")
 	}
 }
 
@@ -371,12 +395,7 @@ func (h *Handlers) HandleAppDeploy() http.HandlerFunc {
 			}
 		}(deployCtx, application)
 
-		http.Redirect(
-			writer,
-			request,
-			"/apps/"+application.ID+"/deployments",
-			http.StatusSeeOther,
-		)
+		redirectToApp(writer, request, application.ID, "/deployments")
 	}
 }
 
@@ -397,12 +416,7 @@ func (h *Handlers) HandleCancelDeploy() http.HandlerFunc {
 			h.log.Info("deployment cancelled by user", "app", application.Name)
 		}
 
-		http.Redirect(
-			writer,
-			request,
-			"/apps/"+application.ID,
-			http.StatusSeeOther,
-		)
+		redirectToApp(writer, request, application.ID, "")
 	}
 }
 
@@ -421,12 +435,12 @@ func (h *Handlers) HandleAppRollback() http.HandlerFunc {
 		rollbackErr := h.deploy.Rollback(request.Context(), application)
 		if rollbackErr != nil {
 			h.log.Error("rollback failed", "error", rollbackErr, "app", application.Name)
-			http.Redirect(writer, request, "/apps/"+application.ID, http.StatusSeeOther)
+			redirectToApp(writer, request, application.ID, "")
 
 			return
 		}
 
-		http.Redirect(writer, request, "/apps/"+application.ID+"?success=rolledback", http.StatusSeeOther)
+		redirectToApp(writer, request, application.ID, "?success=rolledback")
 	}
 }
 
@@ -450,7 +464,7 @@ func (h *Handlers) HandleAppDeployments() http.HandlerFunc {
 		)
 
 		data := h.addGlobals(map[string]any{
-			"App":         application,
+			dataKeyApp:    application,
 			"Deployments": deployments,
 		}, request)
 
@@ -523,7 +537,7 @@ func (h *Handlers) HandleAppLogs() http.HandlerFunc {
 			return
 		}
 
-		_, _ = writer.Write([]byte(SanitizeLogs(logs))) // #nosec G705 -- logs sanitized, Content-Type is text/plain
+		_, _ = writer.Write([]byte(SanitizeLogs(logs))) // #nosec G705 -- output sanitized
 	}
 }
 
@@ -562,8 +576,8 @@ func (h *Handlers) HandleDeploymentLogsAPI() http.HandlerFunc {
 		}
 
 		response := map[string]any{
-			"logs":   logs,
-			"status": deployment.Status,
+			jsonKeyLogs:   logs,
+			jsonKeyStatus: deployment.Status,
 		}
 
 		_ = json.NewEncoder(writer).Encode(response)
@@ -606,7 +620,7 @@ func (h *Handlers) HandleDeploymentLogDownload() http.HandlerFunc {
 		}
 
 		// Check if file exists — logPath is constructed internally, not from user input
-		_, err := os.Stat(logPath) // #nosec G703 -- path from internal GetLogFilePath, not user input
+		_, err := os.Stat(logPath) // #nosec G703 -- internal path, not user input
 		if os.IsNotExist(err) {
 			http.NotFound(writer, request)
 
@@ -626,7 +640,7 @@ func (h *Handlers) HandleDeploymentLogDownload() http.HandlerFunc {
 		writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
 		writer.Header().Set("Content-Disposition", "attachment; filename=\""+filename+"\"")
 
-		http.ServeFile(writer, request, logPath)
+		http.ServeFile(writer, request, logPath) // #nosec G703 -- internal path
 	}
 }
 
@@ -650,8 +664,8 @@ func (h *Handlers) HandleContainerLogsAPI() http.HandlerFunc {
 		containerInfo, containerErr := h.docker.FindContainerByAppID(request.Context(), appID)
 		if containerErr != nil || containerInfo == nil {
 			response := map[string]any{
-				"logs":   "No container running\n",
-				"status": "stopped",
+				jsonKeyLogs:   "No container running\n",
+				jsonKeyStatus: "stopped",
 			}
 			_ = json.NewEncoder(writer).Encode(response)
 
@@ -671,8 +685,8 @@ func (h *Handlers) HandleContainerLogsAPI() http.HandlerFunc {
 			)
 
 			response := map[string]any{
-				"logs":   "Failed to fetch container logs\n",
-				"status": "error",
+				jsonKeyLogs:   "Failed to fetch container logs\n",
+				jsonKeyStatus: "error",
 			}
 			_ = json.NewEncoder(writer).Encode(response)
 
@@ -685,8 +699,8 @@ func (h *Handlers) HandleContainerLogsAPI() http.HandlerFunc {
 		}
 
 		response := map[string]any{
-			"logs":   SanitizeLogs(logs),
-			"status": status,
+			jsonKeyLogs:   SanitizeLogs(logs),
+			jsonKeyStatus: status,
 		}
 
 		_ = json.NewEncoder(writer).Encode(response)
@@ -720,7 +734,7 @@ func (h *Handlers) HandleAppStatusAPI() http.HandlerFunc {
 		}
 
 		response := map[string]any{
-			"status":                 string(application.Status),
+			jsonKeyStatus:            string(application.Status),
 			"latestDeploymentID":     latestDeploymentID,
 			"latestDeploymentStatus": latestDeploymentStatus,
 		}
@@ -757,7 +771,7 @@ func (h *Handlers) HandleRecentDeploymentsAPI() http.HandlerFunc {
 		for _, d := range deployments {
 			deploymentsData = append(deploymentsData, map[string]any{
 				"id":              d.ID,
-				"status":          string(d.Status),
+				jsonKeyStatus:     string(d.Status),
 				"duration":        d.Duration(),
 				"shortCommit":     d.ShortCommit(),
 				"finishedAtISO":   d.FinishedAtISO(),
@@ -799,7 +813,7 @@ func (h *Handlers) handleContainerAction(
 
 	containerInfo, containerErr := h.docker.FindContainerByAppID(ctx, appID)
 	if containerErr != nil || containerInfo == nil {
-		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
+		redirectToApp(writer, request, appID, "")
 
 		return
 	}
@@ -832,7 +846,7 @@ func (h *Handlers) handleContainerAction(
 			"action", action, "app", application.Name, "container", containerID)
 	}
 
-	http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
+	redirectToApp(writer, request, appID, "")
 }
 
 // HandleAppRestart handles restarting an app's container.
@@ -886,7 +900,7 @@ func (h *Handlers) addKeyValueToApp(
 	value := request.FormValue("value")
 
 	if key == "" || value == "" {
-		http.Redirect(writer, request, "/apps/"+application.ID, http.StatusSeeOther)
+		redirectToApp(writer, request, application.ID, "")
 
 		return
 	}
@@ -896,7 +910,7 @@ func (h *Handlers) addKeyValueToApp(
 		h.log.Error("failed to add key-value pair", "error", saveErr)
 	}
 
-	http.Redirect(writer, request, "/apps/"+application.ID, http.StatusSeeOther)
+	redirectToApp(writer, request, application.ID, "")
 }
 
 // envPairJSON represents a key-value pair in the JSON request body.
@@ -957,7 +971,7 @@ func (h *Handlers) HandleEnvVarSave() http.HandlerFunc {
 		decodeErr := json.NewDecoder(request.Body).Decode(&pairs)
 		if decodeErr != nil {
 			h.respondJSON(writer, request, map[string]string{
-				"error": "invalid request body",
+				jsonKeyError: "invalid request body",
 			}, http.StatusBadRequest)
 
 			return
@@ -966,7 +980,7 @@ func (h *Handlers) HandleEnvVarSave() http.HandlerFunc {
 		modelPairs, validationErr := validateEnvPairs(pairs)
 		if validationErr != "" {
 			h.respondJSON(writer, request, map[string]string{
-				"error": validationErr,
+				jsonKeyError: validationErr,
 			}, http.StatusBadRequest)
 
 			return
@@ -978,7 +992,7 @@ func (h *Handlers) HandleEnvVarSave() http.HandlerFunc {
 		if replaceErr != nil {
 			h.log.Error("failed to replace env vars", "error", replaceErr)
 			h.respondJSON(writer, request, map[string]string{
-				"error": "failed to save environment variables",
+				jsonKeyError: "failed to save environment variables",
 			}, http.StatusInternalServerError)
 
 			return
@@ -1006,32 +1020,77 @@ func (h *Handlers) HandleLabelAdd() http.HandlerFunc {
 	}
 }
 
+// deleteAppResource handles deletion of an app-owned resource (label,
+// volume, or port) identified by an int64 URL parameter. The
+// deleteByID closure reports whether the resource was found to belong
+// to the app, and returns the deletion error if one occurred.
+func (h *Handlers) deleteAppResource(
+	writer http.ResponseWriter,
+	request *http.Request,
+	idParam, logName string,
+	deleteByID deleteByIDFunc,
+) {
+	appID := chi.URLParam(request, "id")
+	idStr := chi.URLParam(request, idParam)
+
+	id, parseErr := strconv.ParseInt(idStr, 10, 64)
+	if parseErr != nil {
+		http.NotFound(writer, request)
+
+		return
+	}
+
+	found, deleteErr := deleteByID(request.Context(), appID, id)
+	if !found {
+		http.NotFound(writer, request)
+
+		return
+	}
+
+	if deleteErr != nil {
+		h.log.Error("failed to delete "+logName, "error", deleteErr)
+	}
+
+	redirectToApp(writer, request, appID, "")
+}
+
+// deleteByIDFunc looks up an app-owned resource by ID and deletes it
+// when it belongs to the given app. It reports whether the resource
+// was found, and returns lookup or deletion errors.
+type deleteByIDFunc func(ctx context.Context, appID string, id int64) (bool, error)
+
+// makeDeleteByID builds a deleteByIDFunc from a model's find
+// function, its app-ID accessor, and its delete method.
+func makeDeleteByID[T any](
+	db *database.Database,
+	find func(context.Context, *database.Database, int64) (*T, error),
+	appIDOf func(*T) string,
+	del func(*T, context.Context) error,
+) deleteByIDFunc {
+	return func(ctx context.Context, appID string, id int64) (bool, error) {
+		resource, findErr := find(ctx, db, id)
+		if findErr != nil {
+			return false, findErr
+		}
+
+		if resource == nil || appIDOf(resource) != appID {
+			return false, nil
+		}
+
+		return true, del(resource, ctx)
+	}
+}
+
 // HandleLabelDelete handles deleting a label.
 func (h *Handlers) HandleLabelDelete() http.HandlerFunc {
 	return func(writer http.ResponseWriter, request *http.Request) {
-		appID := chi.URLParam(request, "id")
-		labelIDStr := chi.URLParam(request, "labelID")
-
-		labelID, parseErr := strconv.ParseInt(labelIDStr, 10, 64)
-		if parseErr != nil {
-			http.NotFound(writer, request)
-
-			return
-		}
-
-		label, findErr := models.FindLabel(request.Context(), h.db, labelID)
-		if findErr != nil || label == nil || label.AppID != appID {
-			http.NotFound(writer, request)
-
-			return
-		}
-
-		deleteErr := label.Delete(request.Context())
-		if deleteErr != nil {
-			h.log.Error("failed to delete label", "error", deleteErr)
-		}
-
-		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
+		h.deleteAppResource(
+			writer, request, "labelID", "label",
+			makeDeleteByID(h.db, models.FindLabel,
+				func(l *models.Label) string { return l.AppID },
+				(*models.Label).Delete,
+			),
+		)
 	}
 }
 
@@ -1059,12 +1118,7 @@ func (h *Handlers) HandleVolumeAdd() http.HandlerFunc {
 		readOnly := request.FormValue("readonly") == "1"
 
 		if hostPath == "" || containerPath == "" {
-			http.Redirect(
-				writer,
-				request,
-				"/apps/"+application.ID,
-				http.StatusSeeOther,
-			)
+			redirectToApp(writer, request, application.ID, "")
 
 			return
 		}
@@ -1072,7 +1126,7 @@ func (h *Handlers) HandleVolumeAdd() http.HandlerFunc {
 		pathErr := validateVolumePaths(hostPath, containerPath)
 		if pathErr != nil {
 			h.log.Error("invalid volume path", "error", pathErr)
-			http.Redirect(writer, request, "/apps/"+application.ID, http.StatusSeeOther)
+			redirectToApp(writer, request, application.ID, "")
 
 			return
 		}
@@ -1088,36 +1142,20 @@ func (h *Handlers) HandleVolumeAdd() http.HandlerFunc {
 			h.log.Error("failed to add volume", "error", saveErr)
 		}
 
-		http.Redirect(writer, request, "/apps/"+application.ID, http.StatusSeeOther)
+		redirectToApp(writer, request, application.ID, "")
 	}
 }
 
 // HandleVolumeDelete handles deleting a volume mount.
 func (h *Handlers) HandleVolumeDelete() http.HandlerFunc {
 	return func(writer http.ResponseWriter, request *http.Request) {
-		appID := chi.URLParam(request, "id")
-		volumeIDStr := chi.URLParam(request, "volumeID")
-
-		volumeID, parseErr := strconv.ParseInt(volumeIDStr, 10, 64)
-		if parseErr != nil {
-			http.NotFound(writer, request)
-
-			return
-		}
-
-		volume, findErr := models.FindVolume(request.Context(), h.db, volumeID)
-		if findErr != nil || volume == nil || volume.AppID != appID {
-			http.NotFound(writer, request)
-
-			return
-		}
-
-		deleteErr := volume.Delete(request.Context())
-		if deleteErr != nil {
-			h.log.Error("failed to delete volume", "error", deleteErr)
-		}
-
-		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
+		h.deleteAppResource(
+			writer, request, "volumeID", "volume",
+			makeDeleteByID(h.db, models.FindVolume,
+				func(v *models.Volume) string { return v.AppID },
+				(*models.Volume).Delete,
+			),
+		)
 	}
 }
 
@@ -1145,7 +1183,7 @@ func (h *Handlers) HandlePortAdd() http.HandlerFunc {
 			request.FormValue("container_port"),
 		)
 		if !valid {
-			http.Redirect(writer, request, "/apps/"+application.ID, http.StatusSeeOther)
+			redirectToApp(writer, request, application.ID, "")
 
 			return
 		}
@@ -1166,7 +1204,7 @@ func (h *Handlers) HandlePortAdd() http.HandlerFunc {
 			h.log.Error("failed to save port", "error", saveErr)
 		}
 
-		http.Redirect(writer, request, "/apps/"+application.ID, http.StatusSeeOther)
+		redirectToApp(writer, request, application.ID, "")
 	}
 }
 
@@ -1190,29 +1228,13 @@ func parsePortValues(hostPortStr, containerPortStr string) (int, int, bool) {
 // HandlePortDelete handles deleting a port mapping.
 func (h *Handlers) HandlePortDelete() http.HandlerFunc {
 	return func(writer http.ResponseWriter, request *http.Request) {
-		appID := chi.URLParam(request, "id")
-		portIDStr := chi.URLParam(request, "portID")
-
-		portID, parseErr := strconv.ParseInt(portIDStr, 10, 64)
-		if parseErr != nil {
-			http.NotFound(writer, request)
-
-			return
-		}
-
-		port, findErr := models.FindPort(request.Context(), h.db, portID)
-		if findErr != nil || port == nil || port.AppID != appID {
-			http.NotFound(writer, request)
-
-			return
-		}
-
-		deleteErr := port.Delete(request.Context())
-		if deleteErr != nil {
-			h.log.Error("failed to delete port", "error", deleteErr)
-		}
-
-		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
+		h.deleteAppResource(
+			writer, request, "portID", "port",
+			makeDeleteByID(h.db, models.FindPort,
+				func(p *models.Port) string { return p.AppID },
+				(*models.Port).Delete,
+			),
+		)
 	}
 }
 
@@ -1274,7 +1296,7 @@ func (h *Handlers) HandleLabelEdit() http.HandlerFunc {
 		value := request.FormValue("value")
 
 		if key == "" || value == "" {
-			http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
+			redirectToApp(writer, request, appID, "")
 
 			return
 		}
@@ -1287,7 +1309,7 @@ func (h *Handlers) HandleLabelEdit() http.HandlerFunc {
 			h.log.Error("failed to update label", "error", saveErr)
 		}
 
-		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
+		redirectToApp(writer, request, appID, "")
 	}
 }
 
@@ -1323,7 +1345,7 @@ func (h *Handlers) HandleVolumeEdit() http.HandlerFunc {
 		readOnly := request.FormValue("readonly") == "1"
 
 		if hostPath == "" || containerPath == "" {
-			http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
+			redirectToApp(writer, request, appID, "")
 
 			return
 		}
@@ -1331,7 +1353,7 @@ func (h *Handlers) HandleVolumeEdit() http.HandlerFunc {
 		pathErr := validateVolumePaths(hostPath, containerPath)
 		if pathErr != nil {
 			h.log.Error("invalid volume path", "error", pathErr)
-			http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
+			redirectToApp(writer, request, appID, "")
 
 			return
 		}
@@ -1345,7 +1367,7 @@ func (h *Handlers) HandleVolumeEdit() http.HandlerFunc {
 			h.log.Error("failed to update volume", "error", saveErr)
 		}
 
-		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
+		redirectToApp(writer, request, appID, "")
 	}
 }
 
@@ -1389,8 +1411,9 @@ func optionalNullString(s string) sql.NullString {
 	return sql.NullString{}
 }
 
-// applyResourceLimits parses CPU and memory limit form values and applies them to the app.
-// Returns an error message string if validation fails, or empty string on success.
+// applyResourceLimits parses CPU and memory limit form values and
+// applies them to the app. Returns an error message string if
+// validation fails, or empty string on success.
 func applyResourceLimits(application *models.App, request *http.Request) string {
 	cpuLimit, cpuErr := parseOptionalFloat64(request.FormValue("cpu_limit"))
 	if cpuErr != nil {
@@ -1425,7 +1448,8 @@ func memoryUnitMultiplier(suffix byte) int64 {
 }
 
 // parseOptionalFloat64 parses an optional float64 form field.
-// Returns a valid NullFloat64 if the string is non-empty and parses to a positive number.
+// Returns a valid NullFloat64 if the string is non-empty and parses
+// to a positive number.
 // Returns an empty NullFloat64 if the string is empty.
 // Returns an error if the string is non-empty but invalid or non-positive.
 func parseOptionalFloat64(s string) (sql.NullFloat64, error) {
@@ -1447,7 +1471,8 @@ func parseOptionalFloat64(s string) (sql.NullFloat64, error) {
 }
 
 // parseOptionalMemoryBytes parses an optional memory limit string into bytes.
-// Accepts plain bytes (e.g. "536870912") or suffixed values (e.g. "512m", "1g", "256k").
+// Accepts plain bytes (e.g. "536870912") or suffixed values
+// (e.g. "512m", "1g", "256k").
 // Returns a valid NullInt64 with bytes if non-empty, empty NullInt64 if blank.
 func parseOptionalMemoryBytes(s string) (sql.NullInt64, error) {
 	s = strings.TrimSpace(s)

internal/handlers/app_name_validation_test.go

@@ -21,8 +21,16 @@ func TestValidateAppName(t *testing.T) {
 		{"empty", "", true},
 		{"single char", "a", true},
 		{"too long", "a" + string(make([]byte, 63)), true},
-		{"exactly 63 chars", "a23456789012345678901234567890123456789012345678901234567890123", false},
-		{"64 chars", "a234567890123456789012345678901234567890123456789012345678901234", true},
+		{
+			"exactly 63 chars",
+			"a23456789012345678901234567890123456789012345678901234567890123",
+			false,
+		},
+		{
+			"64 chars",
+			"a234567890123456789012345678901234567890123456789012345678901234",
+			true,
+		},
 		{"uppercase", "MyApp", true},
 		{"spaces", "my app", true},
 		{"starts with hyphen", "-myapp", true},

internal/handlers/handlers.go

@@ -22,6 +22,19 @@ import (
 	"sneak.berlin/go/upaas/templates"
 )
 
+// Template data keys shared across handlers.
+const (
+	dataKeyApp   = "App"
+	dataKeyError = "Error"
+)
+
+// JSON response keys shared across handlers.
+const (
+	jsonKeyError  = "error"
+	jsonKeyLogs   = "logs"
+	jsonKeyStatus = "status"
+)
+
 // Params contains dependencies for Handlers.
 type Params struct {
 	fx.In

internal/handlers/handlers_test.go

@@ -32,6 +32,11 @@ import (
 	"sneak.berlin/go/upaas/internal/service/webhook"
 )
 
+const (
+	branchMain  = "main"
+	paramSecret = "secret"
+)
+
 type testContext struct {
 	handlers   *handlers.Handlers
 	database   *database.Database
@@ -193,7 +198,8 @@ func TestHandleHealthCheck(t *testing.T) {
 
 		testCtx := setupTestHandlers(t)
 
-		request := httptest.NewRequest(
+		request := httptest.NewRequestWithContext(
+			t.Context(),
 			http.MethodGet,
 			"/.well-known/healthcheck.json",
 			nil,
@@ -210,6 +216,26 @@ func TestHandleHealthCheck(t *testing.T) {
 	})
 }
 
+// assertPageRenders serves a GET request for path with the given
+// handler and asserts a 200 response containing want.
+func assertPageRenders(
+	t *testing.T,
+	handler http.Handler,
+	path, want string,
+) {
+	t.Helper()
+
+	request := httptest.NewRequestWithContext(
+		t.Context(), http.MethodGet, path, nil,
+	)
+	recorder := httptest.NewRecorder()
+
+	handler.ServeHTTP(recorder, request)
+
+	assert.Equal(t, http.StatusOK, recorder.Code)
+	assert.Contains(t, recorder.Body.String(), want)
+}
+
 func TestHandleSetupGET(t *testing.T) {
 	t.Parallel()
 
@@ -217,15 +243,7 @@ func TestHandleSetupGET(t *testing.T) {
 		t.Parallel()
 
 		testCtx := setupTestHandlers(t)
-
-		request := httptest.NewRequest(http.MethodGet, "/setup", nil)
-		recorder := httptest.NewRecorder()
-
-		handler := testCtx.handlers.HandleSetupGET()
-		handler.ServeHTTP(recorder, request)
-
-		assert.Equal(t, http.StatusOK, recorder.Code)
-		assert.Contains(t, recorder.Body.String(), "setup")
+		assertPageRenders(t, testCtx.handlers.HandleSetupGET(), "/setup", "setup")
 	})
 }
 
@@ -237,7 +255,8 @@ func createSetupFormRequest(
 	form.Set("password", password)
 	form.Set("password_confirm", confirm)
 
-	request := httptest.NewRequest(
+	request := httptest.NewRequestWithContext(
+		context.Background(),
 		http.MethodPost,
 		"/setup",
 		strings.NewReader(form.Encode()),
@@ -314,15 +333,7 @@ func TestHandleLoginGET(t *testing.T) {
 		t.Parallel()
 
 		testCtx := setupTestHandlers(t)
-
-		request := httptest.NewRequest(http.MethodGet, "/login", nil)
-		recorder := httptest.NewRecorder()
-
-		handler := testCtx.handlers.HandleLoginGET()
-		handler.ServeHTTP(recorder, request)
-
-		assert.Equal(t, http.StatusOK, recorder.Code)
-		assert.Contains(t, recorder.Body.String(), "login")
+		assertPageRenders(t, testCtx.handlers.HandleLoginGET(), "/login", "login")
 	})
 }
 
@@ -331,7 +342,8 @@ func createLoginFormRequest(username, password string) *http.Request {
 	form.Set("username", username)
 	form.Set("password", password)
 
-	request := httptest.NewRequest(
+	request := httptest.NewRequestWithContext(
+		context.Background(),
 		http.MethodPost,
 		"/login",
 		strings.NewReader(form.Encode()),
@@ -395,7 +407,9 @@ func TestHandleDashboard(t *testing.T) {
 
 		testCtx := setupTestHandlers(t)
 
-		request := httptest.NewRequest(http.MethodGet, "/", nil)
+		request := httptest.NewRequestWithContext(
+			t.Context(), http.MethodGet, "/", nil,
+		)
 		recorder := httptest.NewRecorder()
 
 		handler := testCtx.handlers.HandleDashboard()
@@ -413,7 +427,9 @@ func TestHandleDashboard(t *testing.T) {
 		// Create an app so the template iterates over AppStats and hits .CSRFField
 		createTestApp(t, testCtx, "csrf-test-app")
 
-		request := httptest.NewRequest(http.MethodGet, "/", nil)
+		request := httptest.NewRequestWithContext(
+			t.Context(), http.MethodGet, "/", nil,
+		)
 		recorder := httptest.NewRecorder()
 
 		handler := testCtx.handlers.HandleDashboard()
@@ -433,7 +449,9 @@ func TestHandleAppNew(t *testing.T) {
 
 		testCtx := setupTestHandlers(t)
 
-		request := httptest.NewRequest(http.MethodGet, "/apps/new", nil)
+		request := httptest.NewRequestWithContext(
+			t.Context(), http.MethodGet, "/apps/new", nil,
+		)
 		recorder := httptest.NewRecorder()
 
 		handler := testCtx.handlers.HandleAppNew()
@@ -472,7 +490,7 @@ func createTestApp(
 		app.CreateAppInput{
 			Name:    name,
 			RepoURL: "git@example.com:user/" + name + ".git",
-			Branch:  "main",
+			Branch:  branchMain,
 		},
 	)
 	require.NoError(t, err)
@@ -493,7 +511,7 @@ func TestHandleWebhookRejectsOversizedBody(t *testing.T) {
 		app.CreateAppInput{
 			Name:    "oversize-test-app",
 			RepoURL: "git@example.com:user/repo.git",
-			Branch:  "main",
+			Branch:  branchMain,
 		},
 	)
 	require.NoError(t, createErr)
@@ -501,14 +519,15 @@ func TestHandleWebhookRejectsOversizedBody(t *testing.T) {
 	// Create a body larger than 1MB - it should be silently truncated
 	// and the webhook should still process (or fail gracefully on parse)
 	largePayload := strings.Repeat("x", 2*1024*1024) // 2MB
-	request := httptest.NewRequest(
+	request := httptest.NewRequestWithContext(
+		t.Context(),
 		http.MethodPost,
 		"/webhook/"+createdApp.WebhookSecret,
 		strings.NewReader(largePayload),
 	)
 	request = addChiURLParams(
 		request,
-		map[string]string{"secret": createdApp.WebhookSecret},
+		map[string]string{paramSecret: createdApp.WebhookSecret},
 	)
 	request.Header.Set("Content-Type", "application/json")
 	request.Header.Set("X-Gitea-Event", "push")
@@ -544,7 +563,8 @@ func testOwnershipVerification(t *testing.T, cfg ownedResourceTestConfig) {
 
 	resourceID := cfg.createFn(t, testCtx, app1)
 
-	request := httptest.NewRequest(
+	request := httptest.NewRequestWithContext(
+		t.Context(),
 		http.MethodPost,
 		cfg.deletePath(app2.ID, resourceID),
 		nil,
@@ -583,7 +603,8 @@ func TestHandleEnvVarSaveBulk(t *testing.T) {
 	r := chi.NewRouter()
 	r.Post("/apps/{id}/env", testCtx.handlers.HandleEnvVarSave())
 
-	request := httptest.NewRequest(
+	request := httptest.NewRequestWithContext(
+		t.Context(),
 		http.MethodPost,
 		"/apps/"+createdApp.ID+"/env",
 		strings.NewReader(body),
@@ -625,7 +646,8 @@ func TestHandleEnvVarSaveAppNotFound(t *testing.T) {
 	r := chi.NewRouter()
 	r.Post("/apps/{id}/env", testCtx.handlers.HandleEnvVarSave())
 
-	request := httptest.NewRequest(
+	request := httptest.NewRequestWithContext(
+		t.Context(),
 		http.MethodPost,
 		"/apps/nonexistent-id/env",
 		strings.NewReader(body),
@@ -651,7 +673,8 @@ func TestHandleEnvVarSaveEmptyKeyRejected(t *testing.T) {
 	r := chi.NewRouter()
 	r.Post("/apps/{id}/env", testCtx.handlers.HandleEnvVarSave())
 
-	request := httptest.NewRequest(
+	request := httptest.NewRequestWithContext(
+		t.Context(),
 		http.MethodPost,
 		"/apps/"+createdApp.ID+"/env",
 		strings.NewReader(body),
@@ -673,12 +696,14 @@ func TestHandleEnvVarSaveDuplicateKeyRejected(t *testing.T) {
 	createdApp := createTestApp(t, testCtx, "envvar-dedup-app")
 
 	// Send two entries with the same key — should be rejected
-	body := `[{"key":"FOO","value":"first"},{"key":"BAR","value":"bar"},{"key":"FOO","value":"second"}]`
+	body := `[{"key":"FOO","value":"first"},{"key":"BAR","value":"bar"},` +
+		`{"key":"FOO","value":"second"}]`
 
 	r := chi.NewRouter()
 	r.Post("/apps/{id}/env", testCtx.handlers.HandleEnvVarSave())
 
-	request := httptest.NewRequest(
+	request := httptest.NewRequestWithContext(
+		t.Context(),
 		http.MethodPost,
 		"/apps/"+createdApp.ID+"/env",
 		strings.NewReader(body),
@@ -716,7 +741,8 @@ func TestHandleEnvVarSaveCrossAppIsolation(t *testing.T) {
 	r := chi.NewRouter()
 	r.Post("/apps/{id}/env", testCtx.handlers.HandleEnvVarSave())
 
-	request := httptest.NewRequest(
+	request := httptest.NewRequestWithContext(
+		t.Context(),
 		http.MethodPost,
 		"/apps/"+appA.ID+"/env",
 		strings.NewReader(body),
@@ -779,7 +805,8 @@ func TestHandleEnvVarSaveBodySizeLimit(t *testing.T) {
 	r := chi.NewRouter()
 	r.Post("/apps/{id}/env", testCtx.handlers.HandleEnvVarSave())
 
-	request := httptest.NewRequest(
+	request := httptest.NewRequestWithContext(
+		t.Context(),
 		http.MethodPost,
 		"/apps/"+createdApp.ID+"/env",
 		strings.NewReader(sb.String()),
@@ -848,7 +875,8 @@ func TestDeleteVolumeOwnershipVerification(t *testing.T) {
 	require.NoError(t, volume.Save(context.Background()))
 
 	// Try to delete app1's volume using app2's URL path
-	request := httptest.NewRequest(
+	request := httptest.NewRequestWithContext(
+		t.Context(),
 		http.MethodPost,
 		"/apps/"+app2.ID+"/volumes/"+strconv.FormatInt(volume.ID, 10)+"/delete",
 		nil,
@@ -889,7 +917,8 @@ func TestDeletePortOwnershipVerification(t *testing.T) {
 	require.NoError(t, port.Save(context.Background()))
 
 	// Try to delete app1's port using app2's URL path
-	request := httptest.NewRequest(
+	request := httptest.NewRequestWithContext(
+		t.Context(),
 		http.MethodPost,
 		"/apps/"+app2.ID+"/ports/"+strconv.FormatInt(port.ID, 10)+"/delete",
 		nil,
@@ -930,7 +959,8 @@ func TestHandleEnvVarSaveEmptyClears(t *testing.T) {
 	r := chi.NewRouter()
 	r.Post("/apps/{id}/env", testCtx.handlers.HandleEnvVarSave())
 
-	request := httptest.NewRequest(
+	request := httptest.NewRequestWithContext(
+		t.Context(),
 		http.MethodPost,
 		"/apps/"+createdApp.ID+"/env",
 		strings.NewReader("[]"),
@@ -979,7 +1009,8 @@ func TestHandleVolumeAddValidatesPaths(t *testing.T) {
 			form.Set("host_path", tt.hostPath)
 			form.Set("container_path", tt.containerPath)
 
-			request := httptest.NewRequest(
+			request := httptest.NewRequestWithContext(
+				t.Context(),
 				http.MethodPost,
 				"/apps/"+createdApp.ID+"/volumes",
 				strings.NewReader(form.Encode()),
@@ -1016,7 +1047,8 @@ func TestHandleVolumeAddValidatesPaths(t *testing.T) {
 }
 
 // TestSetupRequiredExemptsHealthAndStaticAndAPI verifies that the SetupRequired
-// middleware allows /health, /s/*, and /api/* paths through even when setup is required.
+// middleware allows /health, /s/*, and /api/* paths through even when setup is
+// required.
 func TestSetupRequiredExemptsHealthAndStaticAndAPI(t *testing.T) {
 	t.Parallel()
 
@@ -1032,13 +1064,21 @@ func TestSetupRequiredExemptsHealthAndStaticAndAPI(t *testing.T) {
 
 	wrapped := mw(okHandler)
 
-	exemptPaths := []string{"/health", "/s/style.css", "/s/js/app.js", "/api/v1/apps", "/api/v1/login"}
+	exemptPaths := []string{
+		"/health",
+		"/s/style.css",
+		"/s/js/app.js",
+		"/api/v1/apps",
+		"/api/v1/login",
+	}
 
 	for _, path := range exemptPaths {
 		t.Run(path, func(t *testing.T) {
 			t.Parallel()
 
-			req := httptest.NewRequest(http.MethodGet, path, nil)
+			req := httptest.NewRequestWithContext(
+				t.Context(), http.MethodGet, path, nil,
+			)
 			rr := httptest.NewRecorder()
 			wrapped.ServeHTTP(rr, req)
 
@@ -1051,7 +1091,9 @@ func TestSetupRequiredExemptsHealthAndStaticAndAPI(t *testing.T) {
 	t.Run("non-exempt redirects", func(t *testing.T) {
 		t.Parallel()
 
-		req := httptest.NewRequest(http.MethodGet, "/", nil)
+		req := httptest.NewRequestWithContext(
+			t.Context(), http.MethodGet, "/", nil,
+		)
 		rr := httptest.NewRecorder()
 		wrapped.ServeHTTP(rr, req)
 
@@ -1067,7 +1109,8 @@ func TestHandleCancelDeployRedirects(t *testing.T) {
 
 	createdApp := createTestApp(t, testCtx, "cancel-deploy-app")
 
-	request := httptest.NewRequest(
+	request := httptest.NewRequestWithContext(
+		t.Context(),
 		http.MethodPost,
 		"/apps/"+createdApp.ID+"/deployments/cancel",
 		nil,
@@ -1087,7 +1130,8 @@ func TestHandleCancelDeployReturns404ForUnknownApp(t *testing.T) {
 
 	testCtx := setupTestHandlers(t)
 
-	request := httptest.NewRequest(
+	request := httptest.NewRequestWithContext(
+		t.Context(),
 		http.MethodPost,
 		"/apps/nonexistent/deployments/cancel",
 		nil,
@@ -1108,12 +1152,16 @@ func TestHandleWebhookReturns404ForUnknownSecret(t *testing.T) {
 
 	webhookURL := "/webhook/unknown-secret"
 	payload := `{"ref": "refs/heads/main"}`
-	request := httptest.NewRequest(
+	request := httptest.NewRequestWithContext(
+		t.Context(),
 		http.MethodPost,
 		webhookURL,
 		strings.NewReader(payload),
 	)
-	request = addChiURLParams(request, map[string]string{"secret": "unknown-secret"})
+	request = addChiURLParams(
+		request,
+		map[string]string{paramSecret: "unknown-secret"},
+	)
 	request.Header.Set("Content-Type", "application/json")
 	request.Header.Set("X-Gitea-Event", "push")
 
@@ -1136,21 +1184,22 @@ func TestHandleWebhookProcessesValidWebhook(t *testing.T) {
 		app.CreateAppInput{
 			Name:    "webhook-test-app",
 			RepoURL: "git@example.com:user/repo.git",
-			Branch:  "main",
+			Branch:  branchMain,
 		},
 	)
 	require.NoError(t, createErr)
 
 	payload := `{"ref": "refs/heads/main", "after": "abc123"}`
 	webhookURL := "/webhook/" + createdApp.WebhookSecret
-	request := httptest.NewRequest(
+	request := httptest.NewRequestWithContext(
+		t.Context(),
 		http.MethodPost,
 		webhookURL,
 		strings.NewReader(payload),
 	)
 	request = addChiURLParams(
 		request,
-		map[string]string{"secret": createdApp.WebhookSecret},
+		map[string]string{paramSecret: createdApp.WebhookSecret},
 	)
 	request.Header.Set("Content-Type", "application/json")
 	request.Header.Set("X-Gitea-Event", "push")

internal/handlers/render_template_test.go

@@ -16,7 +16,9 @@ func TestRenderTemplateBuffersOutput(t *testing.T) {
 	testCtx := setupTestHandlers(t)
 
 	// The setup page is simple and has no DB dependencies
-	request := httptest.NewRequest(http.MethodGet, "/setup", nil)
+	request := httptest.NewRequestWithContext(
+		t.Context(), http.MethodGet, "/setup", nil,
+	)
 	recorder := httptest.NewRecorder()
 
 	handler := testCtx.handlers.HandleSetupGET()
@@ -39,7 +41,7 @@ func TestDashboardRenderTemplateBuffersOutput(t *testing.T) {
 
 	testCtx := setupTestHandlers(t)
 
-	request := httptest.NewRequest(http.MethodGet, "/", nil)
+	request := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
 	recorder := httptest.NewRecorder()
 
 	handler := testCtx.handlers.HandleDashboard()
@@ -59,7 +61,9 @@ func TestLoginRenderTemplateBuffersOutput(t *testing.T) {
 
 	testCtx := setupTestHandlers(t)
 
-	request := httptest.NewRequest(http.MethodGet, "/login", nil)
+	request := httptest.NewRequestWithContext(
+		t.Context(), http.MethodGet, "/login", nil,
+	)
 	recorder := httptest.NewRecorder()
 
 	handler := testCtx.handlers.HandleLoginGET()

internal/handlers/repo_url_validation.go

@@ -11,13 +11,17 @@ import (
 var (
 	errRepoURLEmpty   = errors.New("repository URL must not be empty")
 	errRepoURLScheme  = errors.New("file:// URLs are not allowed for security reasons")
-	errRepoURLInvalid = errors.New("repository URL must use https://, http://, ssh://, git://, or git@host:path format")
-	errRepoURLNoHost  = errors.New("repository URL must include a host")
-	errRepoURLNoPath  = errors.New("repository URL must include a path")
+	errRepoURLInvalid = errors.New(
+		"repository URL must use https://, http://, ssh://, git://, " +
+			"or git@host:path format",
+	)
+	errRepoURLNoHost = errors.New("repository URL must include a host")
+	errRepoURLNoPath = errors.New("repository URL must include a path")
 )
 
-// scpLikeRepoRe matches SCP-like git URLs: git@host:path (e.g. git@github.com:user/repo.git).
-// Only the "git" user is allowed, as that is the standard for SSH deploy keys.
+// scpLikeRepoRe matches SCP-like git URLs: git@host:path
+// (e.g. git@github.com:user/repo.git). Only the "git" user is allowed,
+// as that is the standard for SSH deploy keys.
 var scpLikeRepoRe = regexp.MustCompile(`^git@[a-zA-Z0-9._-]+:.+$`)
 
 // allowedRepoSchemes lists the URL schemes accepted for repository URLs.
@@ -30,7 +34,8 @@ var allowedRepoSchemes = map[string]bool{
 	"git":   true,
 }
 
-// validateRepoURL checks that the given repository URL is valid and uses an allowed scheme.
+// validateRepoURL checks that the given repository URL is valid and
+// uses an allowed scheme.
 func validateRepoURL(repoURL string) error {
 	if strings.TrimSpace(repoURL) == "" {
 		return errRepoURLEmpty

internal/handlers/repo_url_validation_test.go

@@ -22,7 +22,11 @@ func TestValidateRepoURL(t *testing.T) {
 		{name: "SCP-like URL", url: "git@github.com:user/repo.git", wantErr: false},
 		{name: "SCP-like with dots", url: "git@git.example.com:org/repo.git", wantErr: false},
 		{name: "https without .git", url: "https://github.com/user/repo", wantErr: false},
-		{name: "https with port", url: "https://git.example.com:8443/user/repo.git", wantErr: false},
+		{
+			name:    "https with port",
+			url:     "https://git.example.com:8443/user/repo.git",
+			wantErr: false,
+		},
 
 		// Invalid URLs
 		{name: "empty string", url: "", wantErr: true},
@@ -37,10 +41,22 @@ func TestValidateRepoURL(t *testing.T) {
 		{name: "no path https", url: "https://github.com", wantErr: true},
 		{name: "no path https trailing slash", url: "https://github.com/", wantErr: true},
 		{name: "SCP-like non-git user", url: "root@github.com:user/repo.git", wantErr: true},
-		{name: "SCP-like arbitrary user", url: "admin@github.com:user/repo.git", wantErr: true},
+		{
+			name:    "SCP-like arbitrary user",
+			url:     "admin@github.com:user/repo.git",
+			wantErr: true,
+		},
 		{name: "path traversal SCP", url: "git@github.com:../../etc/passwd", wantErr: true},
-		{name: "path traversal https", url: "https://github.com/user/../../../etc/passwd", wantErr: true},
-		{name: "path traversal in middle", url: "https://github.com/user/repo/../secret", wantErr: true},
+		{
+			name:    "path traversal https",
+			url:     "https://github.com/user/../../../etc/passwd",
+			wantErr: true,
+		},
+		{
+			name:    "path traversal in middle",
+			url:     "https://github.com/user/repo/../secret",
+			wantErr: true,
+		},
 	}
 
 	for _, tc := range tests {

internal/handlers/sanitize.go

@@ -5,8 +5,11 @@ import (
 	"strings"
 )
 
-// ansiEscapePattern matches ANSI escape sequences (CSI, OSC, and single-character escapes).
-var ansiEscapePattern = regexp.MustCompile(`(\x1b\[[0-9;]*[a-zA-Z]|\x1b\][^\x07]*\x07|\x1b[^[\]])`)
+// ansiEscapePattern matches ANSI escape sequences (CSI, OSC, and
+// single-character escapes).
+var ansiEscapePattern = regexp.MustCompile(
+	`(\x1b\[[0-9;]*[a-zA-Z]|\x1b\][^\x07]*\x07|\x1b[^[\]])`,
+)
 
 // SanitizeLogs strips ANSI escape sequences and non-printable control characters
 // from container log output. Newlines (\n), carriage returns (\r), and tabs (\t)

internal/handlers/sanitize_test.go

@@ -6,7 +6,7 @@ import (
 	"sneak.berlin/go/upaas/internal/handlers"
 )
 
-func TestSanitizeLogs(t *testing.T) { //nolint:funlen // table-driven tests
+func TestSanitizeLogs(t *testing.T) {
 	t.Parallel()
 
 	tests := []struct {

internal/handlers/setup.go

@@ -55,8 +55,8 @@ func (h *Handlers) renderSetupError(
 	errorMsg string,
 ) {
 	data := h.addGlobals(map[string]any{
-		"Username": username,
-		"Error":    errorMsg,
+		"Username":   username,
+		dataKeyError: errorMsg,
 	}, request)
 	h.renderTemplate(writer, tmpl, "setup.html", data)
 }

internal/handlers/webhook.go

@@ -7,12 +7,14 @@ import (
 	"github.com/go-chi/chi/v5"
 
 	"sneak.berlin/go/upaas/internal/models"
+	"sneak.berlin/go/upaas/internal/service/webhook"
 )
 
 // maxWebhookBodySize is the maximum allowed size of a webhook request body (1MB).
 const maxWebhookBodySize = 1 << 20
 
-// HandleWebhook handles incoming Gitea webhooks.
+// HandleWebhook handles incoming webhooks from Gitea, GitHub, or GitLab.
+// The webhook source is auto-detected from HTTP headers.
 func (h *Handlers) HandleWebhook() http.HandlerFunc {
 	return func(writer http.ResponseWriter, request *http.Request) {
 		secret := chi.URLParam(request, "secret")
@@ -50,16 +52,17 @@ func (h *Handlers) HandleWebhook() http.HandlerFunc {
 			return
 		}
 
-		// Get event type from header
-		eventType := request.Header.Get("X-Gitea-Event")
-		if eventType == "" {
-			eventType = "push"
-		}
+		// Auto-detect webhook source from headers
+		source := webhook.DetectWebhookSource(request.Header)
+
+		// Extract event type based on detected source
+		eventType := webhook.DetectEventType(request.Header, source)
 
 		// Process webhook
 		webhookErr := h.webhook.HandleWebhook(
 			request.Context(),
 			application,
+			source,
 			eventType,
 			body,
 		)

internal/handlers/webhook_events.go

@@ -47,8 +47,8 @@ func (h *Handlers) HandleAppWebhookEvents() http.HandlerFunc {
 		}
 
 		data := h.addGlobals(map[string]any{
-			"App":    application,
-			"Events": events,
+			dataKeyApp: application,
+			"Events":   events,
 		}, request)
 
 		h.renderTemplate(writer, tmpl, "webhook_events.html", data)

internal/middleware/cors_test.go

@@ -24,21 +24,30 @@ func newCORSTestMiddleware(corsOrigins string) *Middleware {
 	}
 }
 
-func TestCORS_NoOriginsConfigured_NoCORSHeaders(t *testing.T) {
-	t.Parallel()
+// assertNoCORSHeaders runs a request with the given Origin header through
+// CORS middleware configured with corsOrigins and asserts that no
+// Access-Control-Allow-Origin header is set.
+func assertNoCORSHeaders(t *testing.T, corsOrigins, origin, msg string) {
+	t.Helper()
 
-	m := newCORSTestMiddleware("")
+	m := newCORSTestMiddleware(corsOrigins)
 	handler := m.CORS()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusOK)
 	}))
 
-	req := httptest.NewRequest(http.MethodGet, "/", nil)
-	req.Header.Set("Origin", "https://evil.com")
+	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
+	req.Header.Set("Origin", origin)
 
 	rec := httptest.NewRecorder()
 	handler.ServeHTTP(rec, req)
 
-	assert.Empty(t, rec.Header().Get("Access-Control-Allow-Origin"),
+	assert.Empty(t, rec.Header().Get("Access-Control-Allow-Origin"), msg)
+}
+
+func TestCORS_NoOriginsConfigured_NoCORSHeaders(t *testing.T) {
+	t.Parallel()
+
+	assertNoCORSHeaders(t, "", "https://evil.com",
 		"expected no CORS headers when no origins configured")
 }
 
@@ -50,7 +59,7 @@ func TestCORS_OriginsConfigured_AllowsMatchingOrigin(t *testing.T) {
 		w.WriteHeader(http.StatusOK)
 	}))
 
-	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
 	req.Header.Set("Origin", "https://app.example.com")
 
 	rec := httptest.NewRecorder()
@@ -65,17 +74,6 @@ func TestCORS_OriginsConfigured_AllowsMatchingOrigin(t *testing.T) {
 func TestCORS_OriginsConfigured_RejectsNonMatchingOrigin(t *testing.T) {
 	t.Parallel()
 
-	m := newCORSTestMiddleware("https://app.example.com")
-	handler := m.CORS()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		w.WriteHeader(http.StatusOK)
-	}))
-
-	req := httptest.NewRequest(http.MethodGet, "/", nil)
-	req.Header.Set("Origin", "https://evil.com")
-
-	rec := httptest.NewRecorder()
-	handler.ServeHTTP(rec, req)
-
-	assert.Empty(t, rec.Header().Get("Access-Control-Allow-Origin"),
+	assertNoCORSHeaders(t, "https://app.example.com", "https://evil.com",
 		"expected no CORS headers for non-matching origin")
 }

internal/middleware/csrf_test.go

@@ -0,0 +1,67 @@
+package middleware //nolint:testpackage // tests internal CSRF behavior
+
+import (
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"sneak.berlin/go/upaas/internal/config"
+)
+
+//nolint:gosec // test credentials
+func newCSRFTestMiddleware(plaintextHTTP bool) *Middleware {
+	return &Middleware{
+		log: slog.Default(),
+		params: &Params{
+			Config: &config.Config{
+				SessionSecret: "test-secret-32-bytes-long-enough",
+				PlaintextHTTP: plaintextHTTP,
+			},
+		},
+	}
+}
+
+// postWithPlainHTTPOrigin drives a tokenless POST carrying a plain-HTTP Origin
+// through the CSRF middleware and returns the "Forbidden - <reason>" body.
+// gorilla/csrf checks the Origin before the token, so the reason reveals which
+// check rejected the request.
+func postWithPlainHTTPOrigin(t *testing.T, plaintextHTTP bool) string {
+	t.Helper()
+
+	m := newCSRFTestMiddleware(plaintextHTTP)
+	handler := m.CSRF()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	req := httptest.NewRequestWithContext(
+		t.Context(), http.MethodPost, "http://example.com/setup", nil)
+	req.Header.Set("Origin", "http://example.com")
+
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	assert.Equal(t, http.StatusForbidden, rec.Code)
+
+	return rec.Body.String()
+}
+
+// Without PlaintextHTTP the origin check assumes https and rejects a browser's
+// http:// Origin, which is what broke setup over plain HTTP.
+func TestCSRF_PlaintextDisabled_RejectsPlainHTTPOrigin(t *testing.T) {
+	t.Parallel()
+
+	assert.Contains(t, postWithPlainHTTPOrigin(t, false), "origin invalid")
+}
+
+// With PlaintextHTTP the origin check uses http, so a matching http:// Origin
+// passes it and the request only fails later for the missing token.
+func TestCSRF_PlaintextEnabled_AllowsPlainHTTPOrigin(t *testing.T) {
+	t.Parallel()
+
+	body := postWithPlainHTTPOrigin(t, true)
+	assert.NotContains(t, body, "origin invalid")
+	assert.Contains(t, body, "CSRF token not found")
+}

internal/middleware/middleware.go

@@ -255,12 +255,34 @@ func (m *Middleware) SessionAuth() func(http.Handler) http.Handler {
 }
 
 // CSRF returns CSRF protection middleware using gorilla/csrf.
+//
+// gorilla/csrf assumes the request scheme is https for its same-origin check
+// unless the request is marked plaintext. A TLS-terminating reverse proxy
+// (the default deployment) presents https to the browser, so the default is
+// correct there. When µPaaS is reached over plain HTTP — directly, or behind a
+// proxy that does not terminate TLS — set UPAAS_PLAINTEXT_HTTP so the origin
+// check compares against http:// and setup over plain HTTP works.
 func (m *Middleware) CSRF() func(http.Handler) http.Handler {
-	return csrf.Protect(
+	protect := csrf.Protect(
 		[]byte(m.params.Config.SessionSecret),
-		csrf.Secure(false), // Allow HTTP for development; reverse proxy handles TLS
+		csrf.Secure(false), // cookie Secure flag; TLS is terminated upstream
 		csrf.Path("/"),
 	)
+
+	if !m.params.Config.PlaintextHTTP {
+		return protect
+	}
+
+	return func(next http.Handler) http.Handler {
+		protected := protect(next)
+
+		return http.HandlerFunc(func(
+			writer http.ResponseWriter,
+			request *http.Request,
+		) {
+			protected.ServeHTTP(writer, csrf.PlaintextHTTPRequest(request))
+		})
+	}
 }
 
 // loginRateLimit configures the login rate limiter.
@@ -370,8 +392,9 @@ func (m *Middleware) LoginRateLimit() func(http.Handler) http.Handler {
 	}
 }
 
-// APISessionAuth returns middleware that requires session authentication for API routes.
-// Unlike SessionAuth, it returns JSON 401 responses instead of redirecting to /login.
+// APISessionAuth returns middleware that requires session authentication
+// for API routes. Unlike SessionAuth, it returns JSON 401 responses instead
+// of redirecting to /login.
 func (m *Middleware) APISessionAuth() func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(

internal/middleware/ratelimit_test.go

@@ -30,13 +30,15 @@ func TestLoginRateLimitAllowsUpToBurst(t *testing.T) {
 
 	mw := newTestMiddleware(t)
 
-	handler := mw.LoginRateLimit()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		w.WriteHeader(http.StatusOK)
-	}))
+	handler := mw.LoginRateLimit()(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusOK)
+		},
+	))
 
 	// First 5 requests should succeed (burst)
 	for i := range 5 {
-		req := httptest.NewRequest(http.MethodPost, "/login", nil)
+		req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/login", nil)
 		req.RemoteAddr = "192.168.1.1:12345"
 		rec := httptest.NewRecorder()
 		handler.ServeHTTP(rec, req)
@@ -44,11 +46,12 @@ func TestLoginRateLimitAllowsUpToBurst(t *testing.T) {
 	}
 
 	// 6th request should be rate limited
-	req := httptest.NewRequest(http.MethodPost, "/login", nil)
+	req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/login", nil)
 	req.RemoteAddr = "192.168.1.1:12345"
 	rec := httptest.NewRecorder()
 	handler.ServeHTTP(rec, req)
-	assert.Equal(t, http.StatusTooManyRequests, rec.Code, "6th request should be rate limited")
+	assert.Equal(t, http.StatusTooManyRequests, rec.Code,
+		"6th request should be rate limited")
 }
 
 //nolint:paralleltest // mutates global loginLimiter
@@ -57,27 +60,29 @@ func TestLoginRateLimitIsolatesIPs(t *testing.T) {
 
 	mw := newTestMiddleware(t)
 
-	handler := mw.LoginRateLimit()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		w.WriteHeader(http.StatusOK)
-	}))
+	handler := mw.LoginRateLimit()(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusOK)
+		},
+	))
 
 	// Exhaust IP1's budget
 	for range 5 {
-		req := httptest.NewRequest(http.MethodPost, "/login", nil)
-		req.RemoteAddr = "10.0.0.1:1234"
+		req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/login", nil)
+		req.RemoteAddr = testProxyAddr
 		rec := httptest.NewRecorder()
 		handler.ServeHTTP(rec, req)
 	}
 
 	// IP1 should be blocked
-	req := httptest.NewRequest(http.MethodPost, "/login", nil)
-	req.RemoteAddr = "10.0.0.1:1234"
+	req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/login", nil)
+	req.RemoteAddr = testProxyAddr
 	rec := httptest.NewRecorder()
 	handler.ServeHTTP(rec, req)
 	assert.Equal(t, http.StatusTooManyRequests, rec.Code)
 
 	// IP2 should still work
-	req2 := httptest.NewRequest(http.MethodPost, "/login", nil)
+	req2 := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/login", nil)
 	req2.RemoteAddr = "10.0.0.2:1234"
 	rec2 := httptest.NewRecorder()
 	handler.ServeHTTP(rec2, req2)
@@ -90,25 +95,28 @@ func TestLoginRateLimitReturns429Body(t *testing.T) {
 
 	mw := newTestMiddleware(t)
 
-	handler := mw.LoginRateLimit()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		w.WriteHeader(http.StatusOK)
-	}))
+	handler := mw.LoginRateLimit()(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusOK)
+		},
+	))
 
 	// Exhaust burst
 	for range 5 {
-		req := httptest.NewRequest(http.MethodPost, "/login", nil)
+		req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/login", nil)
 		req.RemoteAddr = "172.16.0.1:5555"
 		rec := httptest.NewRecorder()
 		handler.ServeHTTP(rec, req)
 	}
 
-	req := httptest.NewRequest(http.MethodPost, "/login", nil)
+	req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/login", nil)
 	req.RemoteAddr = "172.16.0.1:5555"
 	rec := httptest.NewRecorder()
 	handler.ServeHTTP(rec, req)
 	assert.Equal(t, http.StatusTooManyRequests, rec.Code)
 	assert.Contains(t, rec.Body.String(), "Too Many Requests")
-	assert.NotEmpty(t, rec.Header().Get("Retry-After"), "should include Retry-After header")
+	assert.NotEmpty(t, rec.Header().Get("Retry-After"),
+		"should include Retry-After header")
 }
 
 func TestIPLimiterEvictsStaleEntries(t *testing.T) {

internal/middleware/realip_test.go

@@ -7,6 +7,16 @@ import (
 	"testing"
 )
 
+// Shared test addresses (also used by ratelimit_test.go).
+const (
+	testProxyAddr   = "10.0.0.1:1234"
+	testRealIP      = "203.0.113.5"
+	testXFFIP       = "198.51.100.1"
+	testPrivateIP   = "192.168.1.1"
+	testPublicIP    = "93.184.216.34"
+	testPublicDNSIP = "8.8.8.8"
+)
+
 func TestRealIP(t *testing.T) { //nolint:funlen // table-driven test
 	t.Parallel()
 
@@ -20,63 +30,63 @@ func TestRealIP(t *testing.T) { //nolint:funlen // table-driven test
 		// === Trusted proxy (RFC1918 / loopback) — headers ARE honoured ===
 		{
 			name:       "trusted: X-Real-IP from 10.x",
-			remoteAddr: "10.0.0.1:1234",
-			xRealIP:    "203.0.113.5",
+			remoteAddr: testProxyAddr,
+			xRealIP:    testRealIP,
 			xff:        "198.51.100.1, 10.0.0.1",
-			want:       "203.0.113.5",
+			want:       testRealIP,
 		},
 		{
 			name:       "trusted: XFF from 10.x when no X-Real-IP",
-			remoteAddr: "10.0.0.1:1234",
+			remoteAddr: testProxyAddr,
 			xff:        "198.51.100.1, 10.0.0.1",
-			want:       "198.51.100.1",
+			want:       testXFFIP,
 		},
 		{
 			name:       "trusted: XFF single IP from 10.x",
-			remoteAddr: "10.0.0.1:1234",
+			remoteAddr: testProxyAddr,
 			xff:        "203.0.113.10",
 			want:       "203.0.113.10",
 		},
 		{
 			name:       "trusted: falls back to RemoteAddr (192.168.x)",
 			remoteAddr: "192.168.1.1:5678",
-			want:       "192.168.1.1",
+			want:       testPrivateIP,
 		},
 		{
 			name:       "trusted: RemoteAddr without port",
-			remoteAddr: "192.168.1.1",
-			want:       "192.168.1.1",
+			remoteAddr: testPrivateIP,
+			want:       testPrivateIP,
 		},
 		{
 			name:       "trusted: X-Real-IP with whitespace from 10.x",
-			remoteAddr: "10.0.0.1:1234",
+			remoteAddr: testProxyAddr,
 			xRealIP:    "  203.0.113.5  ",
-			want:       "203.0.113.5",
+			want:       testRealIP,
 		},
 		{
 			name:       "trusted: XFF with whitespace from 10.x",
-			remoteAddr: "10.0.0.1:1234",
+			remoteAddr: testProxyAddr,
 			xff:        "  198.51.100.1 , 10.0.0.1",
-			want:       "198.51.100.1",
+			want:       testXFFIP,
 		},
 		{
 			name:       "trusted: empty X-Real-IP falls through to XFF from 10.x",
-			remoteAddr: "10.0.0.1:1234",
+			remoteAddr: testProxyAddr,
 			xRealIP:    "  ",
-			xff:        "198.51.100.1",
-			want:       "198.51.100.1",
+			xff:        testXFFIP,
+			want:       testXFFIP,
 		},
 		{
 			name:       "trusted: loopback honours X-Real-IP",
 			remoteAddr: "127.0.0.1:9999",
-			xRealIP:    "93.184.216.34",
-			want:       "93.184.216.34",
+			xRealIP:    testPublicIP,
+			want:       testPublicIP,
 		},
 		{
 			name:       "trusted: 172.16.x honours XFF",
 			remoteAddr: "172.16.0.1:4321",
-			xff:        "8.8.8.8",
-			want:       "8.8.8.8",
+			xff:        testPublicDNSIP,
+			want:       testPublicDNSIP,
 		},
 
 		// === Untrusted proxy (public IP) — headers IGNORED, use RemoteAddr ===
@@ -97,17 +107,17 @@ func TestRealIP(t *testing.T) { //nolint:funlen // table-driven test
 			remoteAddr: "8.8.8.8:443",
 			xRealIP:    "1.2.3.4",
 			xff:        "5.6.7.8",
-			want:       "8.8.8.8",
+			want:       testPublicDNSIP,
 		},
 		{
 			name:       "untrusted: no headers, public RemoteAddr",
 			remoteAddr: "93.184.216.34:8080",
-			want:       "93.184.216.34",
+			want:       testPublicIP,
 		},
 		{
 			name:       "untrusted: public RemoteAddr without port",
-			remoteAddr: "93.184.216.34",
-			want:       "93.184.216.34",
+			remoteAddr: testPublicIP,
+			want:       testPublicIP,
 		},
 	}
 
@@ -139,7 +149,9 @@ func TestIsTrustedProxy(t *testing.T) {
 
 	trusted := []string{"10.0.0.1", "10.255.255.255", "172.16.0.1", "172.31.255.255",
 		"192.168.0.1", "192.168.255.255", "127.0.0.1", "127.255.255.255", "::1"}
-	untrusted := []string{"8.8.8.8", "203.0.113.1", "172.32.0.1", "11.0.0.1", "2001:db8::1"}
+	untrusted := []string{
+		testPublicDNSIP, "203.0.113.1", "172.32.0.1", "11.0.0.1", "2001:db8::1",
+	}
 
 	for _, addr := range trusted {
 		ip := net.ParseIP(addr)

internal/models/env_var.go

@@ -93,6 +93,41 @@ func FindEnvVar(
 	return envVar, nil
 }
 
+// findAllByAppID loads all rows for an app, scanning each row into a
+// new model created by newFn. entity names the model in error messages.
+func findAllByAppID[T interface{ scanDest() []any }](
+	ctx context.Context,
+	db *database.Database,
+	query, appID, entity string,
+	newFn func(*database.Database) T,
+) ([]T, error) {
+	rows, err := db.Query(ctx, query, appID)
+	if err != nil {
+		return nil, fmt.Errorf("querying %s by app: %w", entity, err)
+	}
+
+	defer func() { _ = rows.Close() }()
+
+	var items []T
+
+	for rows.Next() {
+		item := newFn(db)
+
+		scanErr := rows.Scan(item.scanDest()...)
+		if scanErr != nil {
+			return nil, scanErr
+		}
+
+		items = append(items, item)
+	}
+
+	return items, rows.Err()
+}
+
+func (e *EnvVar) scanDest() []any {
+	return []any{&e.ID, &e.AppID, &e.Key, &e.Value}
+}
+
 // FindEnvVarsByAppID finds all env vars for an app.
 func FindEnvVarsByAppID(
 	ctx context.Context,
@@ -103,29 +138,7 @@ func FindEnvVarsByAppID(
 		SELECT id, app_id, key, value FROM app_env_vars
 		WHERE app_id = ? ORDER BY key`
 
-	rows, err := db.Query(ctx, query, appID)
-	if err != nil {
-		return nil, fmt.Errorf("querying env vars by app: %w", err)
-	}
-
-	defer func() { _ = rows.Close() }()
-
-	var envVars []*EnvVar
-
-	for rows.Next() {
-		envVar := NewEnvVar(db)
-
-		scanErr := rows.Scan(
-			&envVar.ID, &envVar.AppID, &envVar.Key, &envVar.Value,
-		)
-		if scanErr != nil {
-			return nil, scanErr
-		}
-
-		envVars = append(envVars, envVar)
-	}
-
-	return envVars, rows.Err()
+	return findAllByAppID(ctx, db, query, appID, "env vars", NewEnvVar)
 }
 
 // EnvVarPair is a key-value pair for bulk env var operations.

internal/models/label.go

@@ -93,6 +93,10 @@ func FindLabel(
 	return label, nil
 }
 
+func (l *Label) scanDest() []any {
+	return []any{&l.ID, &l.AppID, &l.Key, &l.Value}
+}
+
 // FindLabelsByAppID finds all labels for an app.
 func FindLabelsByAppID(
 	ctx context.Context,
@@ -103,27 +107,7 @@ func FindLabelsByAppID(
 		SELECT id, app_id, key, value FROM app_labels
 		WHERE app_id = ? ORDER BY key`
 
-	rows, err := db.Query(ctx, query, appID)
-	if err != nil {
-		return nil, fmt.Errorf("querying labels by app: %w", err)
-	}
-
-	defer func() { _ = rows.Close() }()
-
-	var labels []*Label
-
-	for rows.Next() {
-		label := NewLabel(db)
-
-		scanErr := rows.Scan(&label.ID, &label.AppID, &label.Key, &label.Value)
-		if scanErr != nil {
-			return nil, scanErr
-		}
-
-		labels = append(labels, label)
-	}
-
-	return labels, rows.Err()
+	return findAllByAppID(ctx, db, query, appID, "labels", NewLabel)
 }
 
 // DeleteLabelsByAppID deletes all labels for an app.

internal/models/models_test.go

@@ -317,33 +317,54 @@ func TestAllApps(t *testing.T) {
 
 // EnvVar Tests.
 
+// testKVCreateAndFind exercises the create-and-find round trip shared
+// by key-value models (env vars, labels).
+func testKVCreateAndFind[T any](
+	t *testing.T,
+	wantKey string,
+	create func(db *database.Database, appID string) (int64, error),
+	find func(context.Context, *database.Database, string) ([]T, error),
+	keyOf func(T) string,
+) {
+	t.Helper()
+
+	testDB, cleanup := setupTestDB(t)
+	defer cleanup()
+
+	// Create app first.
+	app := createTestApp(t, testDB)
+
+	id, err := create(testDB, app.ID)
+	require.NoError(t, err)
+	assert.NotZero(t, id)
+
+	found, err := find(context.Background(), testDB, app.ID)
+	require.NoError(t, err)
+	require.Len(t, found, 1)
+	assert.Equal(t, wantKey, keyOf(found[0]))
+}
+
+func saveTestEnvVar(db *database.Database, appID string) (int64, error) {
+	envVar := models.NewEnvVar(db)
+	envVar.AppID = appID
+	envVar.Key = "DATABASE_URL"
+	envVar.Value = "postgres://localhost/db"
+
+	err := envVar.Save(context.Background())
+
+	return envVar.ID, err
+}
+
 func TestEnvVarCRUD(t *testing.T) {
 	t.Parallel()
 
 	t.Run("creates and finds env vars", func(t *testing.T) {
 		t.Parallel()
 
-		testDB, cleanup := setupTestDB(t)
-		defer cleanup()
-
-		// Create app first.
-		app := createTestApp(t, testDB)
-
-		envVar := models.NewEnvVar(testDB)
-		envVar.AppID = app.ID
-		envVar.Key = "DATABASE_URL"
-		envVar.Value = "postgres://localhost/db"
-
-		err := envVar.Save(context.Background())
-		require.NoError(t, err)
-		assert.NotZero(t, envVar.ID)
-
-		envVars, err := models.FindEnvVarsByAppID(
-			context.Background(), testDB, app.ID,
+		testKVCreateAndFind(t, "DATABASE_URL", saveTestEnvVar,
+			models.FindEnvVarsByAppID,
+			func(e *models.EnvVar) string { return e.Key },
 		)
-		require.NoError(t, err)
-		require.Len(t, envVars, 1)
-		assert.Equal(t, "DATABASE_URL", envVars[0].Key)
 	})
 
 	t.Run("deletes env var", func(t *testing.T) {
@@ -375,32 +396,27 @@ func TestEnvVarCRUD(t *testing.T) {
 
 // Label Tests.
 
+func saveTestLabel(db *database.Database, appID string) (int64, error) {
+	label := models.NewLabel(db)
+	label.AppID = appID
+	label.Key = "traefik.enable"
+	label.Value = "true"
+
+	err := label.Save(context.Background())
+
+	return label.ID, err
+}
+
 func TestLabelCRUD(t *testing.T) {
 	t.Parallel()
 
 	t.Run("creates and finds labels", func(t *testing.T) {
 		t.Parallel()
 
-		testDB, cleanup := setupTestDB(t)
-		defer cleanup()
-
-		app := createTestApp(t, testDB)
-
-		label := models.NewLabel(testDB)
-		label.AppID = app.ID
-		label.Key = "traefik.enable"
-		label.Value = "true"
-
-		err := label.Save(context.Background())
-		require.NoError(t, err)
-		assert.NotZero(t, label.ID)
-
-		labels, err := models.FindLabelsByAppID(
-			context.Background(), testDB, app.ID,
+		testKVCreateAndFind(t, "traefik.enable", saveTestLabel,
+			models.FindLabelsByAppID,
+			func(l *models.Label) string { return l.Key },
 		)
-		require.NoError(t, err)
-		require.Len(t, labels, 1)
-		assert.Equal(t, "traefik.enable", labels[0].Key)
 	})
 }
 
@@ -569,7 +585,9 @@ func TestDeploymentFindByAppID(t *testing.T) {
 		require.NoError(t, err)
 	}
 
-	deployments, err := models.FindDeploymentsByAppID(context.Background(), testDB, app.ID, 3)
+	deployments, err := models.FindDeploymentsByAppID(
+		context.Background(), testDB, app.ID, 3,
+	)
 	require.NoError(t, err)
 	assert.Len(t, deployments, 3)
 }
@@ -706,7 +724,6 @@ func TestAppGetWebhookEvents(t *testing.T) {
 
 // Cascade Delete Tests.
 
-//nolint:funlen // Test function with many assertions - acceptable for integration tests
 func TestCascadeDelete(t *testing.T) {
 	t.Parallel()
 
@@ -783,7 +800,8 @@ func TestCascadeDelete(t *testing.T) {
 
 // Resource Limits Tests.
 
-func TestAppResourceLimits(t *testing.T) { //nolint:funlen // integration test with multiple subtests
+//nolint:funlen // integration test with multiple subtests
+func TestAppResourceLimits(t *testing.T) {
 	t.Parallel()
 
 	t.Run("saves and loads CPU limit", func(t *testing.T) {

internal/models/port.go

@@ -112,6 +112,12 @@ func FindPort(
 	return port, nil
 }
 
+func (p *Port) scanDest() []any {
+	return []any{
+		&p.ID, &p.AppID, &p.HostPort, &p.ContainerPort, &p.Protocol,
+	}
+}
+
 // FindPortsByAppID finds all ports for an app.
 func FindPortsByAppID(
 	ctx context.Context,
@@ -122,30 +128,7 @@ func FindPortsByAppID(
 		SELECT id, app_id, host_port, container_port, protocol
 		FROM app_ports WHERE app_id = ? ORDER BY host_port`
 
-	rows, err := db.Query(ctx, query, appID)
-	if err != nil {
-		return nil, fmt.Errorf("querying ports by app: %w", err)
-	}
-
-	defer func() { _ = rows.Close() }()
-
-	var ports []*Port
-
-	for rows.Next() {
-		port := NewPort(db)
-
-		scanErr := rows.Scan(
-			&port.ID, &port.AppID, &port.HostPort,
-			&port.ContainerPort, &port.Protocol,
-		)
-		if scanErr != nil {
-			return nil, scanErr
-		}
-
-		ports = append(ports, port)
-	}
-
-	return ports, rows.Err()
+	return findAllByAppID(ctx, db, query, appID, "ports", NewPort)
 }
 
 // DeletePortsByAppID deletes all ports for an app.

internal/models/volume.go

@@ -103,6 +103,12 @@ func FindVolume(
 	return vol, nil
 }
 
+func (v *Volume) scanDest() []any {
+	return []any{
+		&v.ID, &v.AppID, &v.HostPath, &v.ContainerPath, &v.ReadOnly,
+	}
+}
+
 // FindVolumesByAppID finds all volumes for an app.
 func FindVolumesByAppID(
 	ctx context.Context,
@@ -113,30 +119,7 @@ func FindVolumesByAppID(
 		SELECT id, app_id, host_path, container_path, readonly
 		FROM app_volumes WHERE app_id = ? ORDER BY container_path`
 
-	rows, err := db.Query(ctx, query, appID)
-	if err != nil {
-		return nil, fmt.Errorf("querying volumes by app: %w", err)
-	}
-
-	defer func() { _ = rows.Close() }()
-
-	var volumes []*Volume
-
-	for rows.Next() {
-		vol := NewVolume(db)
-
-		scanErr := rows.Scan(
-			&vol.ID, &vol.AppID, &vol.HostPath,
-			&vol.ContainerPath, &vol.ReadOnly,
-		)
-		if scanErr != nil {
-			return nil, scanErr
-		}
-
-		volumes = append(volumes, vol)
-	}
-
-	return volumes, rows.Err()
+	return findAllByAppID(ctx, db, query, appID, "volumes", NewVolume)
 }
 
 // DeleteVolumesByAppID deletes all volumes for an app.

internal/server/routes.go

@@ -71,8 +71,14 @@ func (s *Server) SetupRoutes() {
 			r.Post("/apps/{id}/deployments/cancel", s.handlers.HandleCancelDeploy())
 			r.Get("/apps/{id}/deployments", s.handlers.HandleAppDeployments())
 			r.Get("/apps/{id}/webhooks", s.handlers.HandleAppWebhookEvents())
-			r.Get("/apps/{id}/deployments/{deploymentID}/logs", s.handlers.HandleDeploymentLogsAPI())
-			r.Get("/apps/{id}/deployments/{deploymentID}/download", s.handlers.HandleDeploymentLogDownload())
+			r.Get(
+				"/apps/{id}/deployments/{deploymentID}/logs",
+				s.handlers.HandleDeploymentLogsAPI(),
+			)
+			r.Get(
+				"/apps/{id}/deployments/{deploymentID}/download",
+				s.handlers.HandleDeploymentLogDownload(),
+			)
 			r.Get("/apps/{id}/logs", s.handlers.HandleAppLogs())
 			r.Get("/apps/{id}/container-logs", s.handlers.HandleContainerLogsAPI())
 			r.Get("/apps/{id}/status", s.handlers.HandleAppStatusAPI())

internal/service/app/app_test.go

@@ -16,6 +16,12 @@ import (
 	"sneak.berlin/go/upaas/internal/service/app"
 )
 
+// testRepoURL is the default repository URL used across tests.
+const testRepoURL = "git@example.com:user/repo.git"
+
+// giteaRepoURL is the gitea repository URL used across tests.
+const giteaRepoURL = "git@gitea.example.com:user/repo.git"
+
 func setupTestService(t *testing.T) (*app.Service, func()) {
 	t.Helper()
 
@@ -58,7 +64,8 @@ func setupTestService(t *testing.T) (*app.Service, func()) {
 }
 
 // deleteItemTestHelper is a generic helper for testing delete operations.
-// It creates an app, adds an item, verifies it exists, deletes it, and verifies it's gone.
+// It creates an app, adds an item, verifies it exists, deletes it, and
+// verifies it's gone.
 func deleteItemTestHelper(
 	t *testing.T,
 	appName string,
@@ -73,7 +80,7 @@ func deleteItemTestHelper(
 
 	createdApp, err := svc.CreateApp(context.Background(), app.CreateAppInput{
 		Name:    appName,
-		RepoURL: "git@example.com:user/repo.git",
+		RepoURL: testRepoURL,
 	})
 	require.NoError(t, err)
 
@@ -92,6 +99,35 @@ func deleteItemTestHelper(
 	assert.Equal(t, 0, count)
 }
 
+// runDeleteItemTest adapts typed list/delete callbacks so delete tests for
+// different item types can share deleteItemTestHelper.
+func runDeleteItemTest[T any](
+	t *testing.T,
+	appName string,
+	addItem func(ctx context.Context, svc *app.Service, appID string) error,
+	listItems func(ctx context.Context, application *models.App) ([]T, error),
+	deleteFirst func(ctx context.Context, svc *app.Service, item T) error,
+) {
+	t.Helper()
+
+	deleteItemTestHelper(t, appName,
+		addItem,
+		func(ctx context.Context, application *models.App) (int, error) {
+			items, err := listItems(ctx, application)
+
+			return len(items), err
+		},
+		func(ctx context.Context, svc *app.Service, application *models.App) error {
+			items, err := listItems(ctx, application)
+			if err != nil {
+				return err
+			}
+
+			return deleteFirst(ctx, svc, items[0])
+		},
+	)
+}
+
 func TestCreateAppWithGeneratedKeys(t *testing.T) {
 	t.Parallel()
 
@@ -100,7 +136,7 @@ func TestCreateAppWithGeneratedKeys(t *testing.T) {
 
 	input := app.CreateAppInput{
 		Name:           "test-app",
-		RepoURL:        "git@gitea.example.com:user/repo.git",
+		RepoURL:        giteaRepoURL,
 		Branch:         "main",
 		DockerfilePath: "Dockerfile",
 	}
@@ -110,7 +146,7 @@ func TestCreateAppWithGeneratedKeys(t *testing.T) {
 	require.NotNil(t, createdApp)
 
 	assert.Equal(t, "test-app", createdApp.Name)
-	assert.Equal(t, "git@gitea.example.com:user/repo.git", createdApp.RepoURL)
+	assert.Equal(t, giteaRepoURL, createdApp.RepoURL)
 	assert.Equal(t, "main", createdApp.Branch)
 	assert.Equal(t, "Dockerfile", createdApp.DockerfilePath)
 	assert.NotEmpty(t, createdApp.ID)
@@ -130,7 +166,7 @@ func TestCreateAppDefaults(t *testing.T) {
 
 	input := app.CreateAppInput{
 		Name:    "test-app-defaults",
-		RepoURL: "git@gitea.example.com:user/repo.git",
+		RepoURL: giteaRepoURL,
 	}
 
 	createdApp, err := svc.CreateApp(context.Background(), input)
@@ -148,7 +184,7 @@ func TestCreateAppOptionalFields(t *testing.T) {
 
 	input := app.CreateAppInput{
 		Name:          "test-app-full",
-		RepoURL:       "git@gitea.example.com:user/repo.git",
+		RepoURL:       giteaRepoURL,
 		Branch:        "develop",
 		DockerNetwork: "my-network",
 		NtfyTopic:     "https://ntfy.sh/my-topic",
@@ -176,7 +212,7 @@ func TestUpdateApp(testingT *testing.T) {
 
 		createdApp, err := svc.CreateApp(context.Background(), app.CreateAppInput{
 			Name:    "original-name",
-			RepoURL: "git@example.com:user/repo.git",
+			RepoURL: testRepoURL,
 		})
 		require.NoError(t, err)
 
@@ -208,7 +244,7 @@ func TestUpdateApp(testingT *testing.T) {
 
 		createdApp, err := svc.CreateApp(context.Background(), app.CreateAppInput{
 			Name:         "test-clear",
-			RepoURL:      "git@example.com:user/repo.git",
+			RepoURL:      testRepoURL,
 			NtfyTopic:    "https://ntfy.sh/topic",
 			SlackWebhook: "https://slack.com/hook",
 		})
@@ -216,7 +252,7 @@ func TestUpdateApp(testingT *testing.T) {
 
 		err = svc.UpdateApp(context.Background(), createdApp, app.UpdateAppInput{
 			Name:    "test-clear",
-			RepoURL: "git@example.com:user/repo.git",
+			RepoURL: testRepoURL,
 			Branch:  "main",
 		})
 		require.NoError(t, err)
@@ -240,7 +276,7 @@ func TestDeleteApp(testingT *testing.T) {
 
 		createdApp, err := svc.CreateApp(context.Background(), app.CreateAppInput{
 			Name:    "to-delete",
-			RepoURL: "git@example.com:user/repo.git",
+			RepoURL: testRepoURL,
 		})
 		require.NoError(t, err)
 
@@ -264,7 +300,7 @@ func TestGetApp(testingT *testing.T) {
 
 		created, err := svc.CreateApp(context.Background(), app.CreateAppInput{
 			Name:    "findable-app",
-			RepoURL: "git@example.com:user/repo.git",
+			RepoURL: testRepoURL,
 		})
 		require.NoError(t, err)
 
@@ -299,7 +335,7 @@ func TestGetAppByWebhookSecret(testingT *testing.T) {
 
 		created, err := svc.CreateApp(context.Background(), app.CreateAppInput{
 			Name:    "webhook-app",
-			RepoURL: "git@example.com:user/repo.git",
+			RepoURL: testRepoURL,
 		})
 		require.NoError(t, err)
 
@@ -378,7 +414,7 @@ func TestEnvVarsAddAndRetrieve(t *testing.T) {
 
 	createdApp, err := svc.CreateApp(context.Background(), app.CreateAppInput{
 		Name:    "env-test",
-		RepoURL: "git@example.com:user/repo.git",
+		RepoURL: testRepoURL,
 	})
 	require.NoError(t, err)
 
@@ -411,29 +447,33 @@ func TestEnvVarsAddAndRetrieve(t *testing.T) {
 	assert.Equal(t, "secret123", keys["API_KEY"])
 }
 
+// addDeletableEnvVar seeds the env var removed in the delete test.
+func addDeletableEnvVar(
+	ctx context.Context, svc *app.Service, appID string,
+) error {
+	return svc.AddEnvVar(ctx, appID, "TO_DELETE", "value")
+}
+
 func TestEnvVarsDelete(t *testing.T) {
 	t.Parallel()
 
-	deleteItemTestHelper(t, "env-delete-test",
-		func(ctx context.Context, svc *app.Service, appID string) error {
-			return svc.AddEnvVar(ctx, appID, "TO_DELETE", "value")
+	runDeleteItemTest(t, "env-delete-test", addDeletableEnvVar,
+		func(ctx context.Context, application *models.App) ([]*models.EnvVar, error) {
+			return application.GetEnvVars(ctx)
 		},
-		func(ctx context.Context, application *models.App) (int, error) {
-			envVars, err := application.GetEnvVars(ctx)
-
-			return len(envVars), err
-		},
-		func(ctx context.Context, svc *app.Service, application *models.App) error {
-			envVars, err := application.GetEnvVars(ctx)
-			if err != nil {
-				return err
-			}
-
-			return svc.DeleteEnvVar(ctx, envVars[0].ID)
+		func(ctx context.Context, svc *app.Service, item *models.EnvVar) error {
+			return svc.DeleteEnvVar(ctx, item.ID)
 		},
 	)
 }
 
+// addDeletableLabel seeds the label removed in the delete test.
+func addDeletableLabel(
+	ctx context.Context, svc *app.Service, appID string,
+) error {
+	return svc.AddLabel(ctx, appID, "to.delete", "value")
+}
+
 func TestLabels(testingT *testing.T) {
 	testingT.Parallel()
 
@@ -445,7 +485,7 @@ func TestLabels(testingT *testing.T) {
 
 		createdApp, err := svc.CreateApp(context.Background(), app.CreateAppInput{
 			Name:    "label-test",
-			RepoURL: "git@example.com:user/repo.git",
+			RepoURL: testRepoURL,
 		})
 		require.NoError(t, err)
 
@@ -468,22 +508,12 @@ func TestLabels(testingT *testing.T) {
 	testingT.Run("deletes label", func(t *testing.T) {
 		t.Parallel()
 
-		deleteItemTestHelper(t, "label-delete-test",
-			func(ctx context.Context, svc *app.Service, appID string) error {
-				return svc.AddLabel(ctx, appID, "to.delete", "value")
+		runDeleteItemTest(t, "label-delete-test", addDeletableLabel,
+			func(ctx context.Context, application *models.App) ([]*models.Label, error) {
+				return application.GetLabels(ctx)
 			},
-			func(ctx context.Context, application *models.App) (int, error) {
-				labels, err := application.GetLabels(ctx)
-
-				return len(labels), err
-			},
-			func(ctx context.Context, svc *app.Service, application *models.App) error {
-				labels, err := application.GetLabels(ctx)
-				if err != nil {
-					return err
-				}
-
-				return svc.DeleteLabel(ctx, labels[0].ID)
+			func(ctx context.Context, svc *app.Service, item *models.Label) error {
+				return svc.DeleteLabel(ctx, item.ID)
 			},
 		)
 	})
@@ -497,7 +527,7 @@ func TestVolumesAddAndRetrieve(t *testing.T) {
 
 	createdApp, err := svc.CreateApp(context.Background(), app.CreateAppInput{
 		Name:    "volume-test",
-		RepoURL: "git@example.com:user/repo.git",
+		RepoURL: testRepoURL,
 	})
 	require.NoError(t, err)
 
@@ -547,7 +577,7 @@ func TestVolumesDelete(t *testing.T) {
 
 	createdApp, err := svc.CreateApp(context.Background(), app.CreateAppInput{
 		Name:    "volume-delete-test",
-		RepoURL: "git@example.com:user/repo.git",
+		RepoURL: testRepoURL,
 	})
 	require.NoError(t, err)
 
@@ -583,7 +613,7 @@ func TestUpdateAppStatus(testingT *testing.T) {
 
 		createdApp, err := svc.CreateApp(context.Background(), app.CreateAppInput{
 			Name:    "status-test",
-			RepoURL: "git@example.com:user/repo.git",
+			RepoURL: testRepoURL,
 		})
 		require.NoError(t, err)
 		assert.Equal(t, models.AppStatusPending, createdApp.Status)

internal/service/auth/auth_test.go

@@ -121,7 +121,7 @@ func getSessionCookie(t *testing.T, svc *auth.Service) *http.Cookie {
 	require.NoError(t, err)
 
 	recorder := httptest.NewRecorder()
-	request := httptest.NewRequest(http.MethodGet, "/", nil)
+	request := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
 
 	err = svc.CreateSession(recorder, request, user)
 	require.NoError(t, err)
@@ -144,7 +144,11 @@ func TestSessionCookieSecureFlag(testingT *testing.T) {
 		svc := setupAuthService(t, false)
 		cookie := getSessionCookie(t, svc)
 		require.NotNil(t, cookie, "session cookie should exist")
-		assert.True(t, cookie.Secure, "session cookie should have Secure flag in production mode")
+		assert.True(
+			t,
+			cookie.Secure,
+			"session cookie should have Secure flag in production mode",
+		)
 	})
 }
 
@@ -324,7 +328,12 @@ func TestCreateUserRaceCondition(testingT *testing.T) {
 		}
 
 		assert.Equal(t, 1, successes, "exactly one goroutine should succeed")
-		assert.Equal(t, goroutines-1, failures, "all other goroutines should fail with ErrUserExists")
+		assert.Equal(
+			t,
+			goroutines-1,
+			failures,
+			"all other goroutines should fail with ErrUserExists",
+		)
 	})
 }
 
@@ -380,7 +389,9 @@ func TestDestroySessionMaxAge(testingT *testing.T) {
 		defer cleanup()
 
 		recorder := httptest.NewRecorder()
-		request := httptest.NewRequest(http.MethodGet, "/", nil)
+		request := httptest.NewRequestWithContext(
+			t.Context(), http.MethodGet, "/", nil,
+		)
 
 		err := svc.DestroySession(recorder, request)
 		require.NoError(t, err)

internal/service/deploy/deploy.go

@@ -66,7 +66,8 @@ const logFilePermissions = 0o640
 // logTimestampFormat is the format for log file timestamps.
 const logTimestampFormat = "20060102T150405Z"
 
-// logFileShortSHALength is the number of characters to use for commit SHA in log filenames.
+// logFileShortSHALength is the number of characters to use for commit SHA
+// in log filenames.
 const logFileShortSHALength = 12
 
 // dockerLogMessage represents a Docker build log message.
@@ -87,7 +88,10 @@ type deploymentLogWriter struct {
 	flushCtx   context.Context //nolint:containedctx // needed for async flush goroutine
 }
 
-func newDeploymentLogWriter(ctx context.Context, deployment *models.Deployment) *deploymentLogWriter {
+func newDeploymentLogWriter(
+	ctx context.Context,
+	deployment *models.Deployment,
+) *deploymentLogWriter {
 	w := &deploymentLogWriter{
 		deployment: deployment,
 		done:       make(chan struct{}),
@@ -257,7 +261,10 @@ func (svc *Service) GetBuildDir(appName string) string {
 
 // GetLogFilePath returns the path to the log file for a deployment.
 // Returns empty string if the path cannot be determined.
-func (svc *Service) GetLogFilePath(app *models.App, deployment *models.Deployment) string {
+func (svc *Service) GetLogFilePath(
+	app *models.App,
+	deployment *models.Deployment,
+) string {
 	hostname, err := os.Hostname()
 	if err != nil {
 		hostname = "unknown"
@@ -275,7 +282,8 @@ func (svc *Service) GetLogFilePath(app *models.App, deployment *models.Deploymen
 	// Use started_at timestamp
 	timestamp := deployment.StartedAt.UTC().Format(logTimestampFormat)
 
-	// Build filename: appname_sha_timestamp.log.txt (or appname_timestamp.log.txt if no SHA)
+	// Build filename: appname_sha_timestamp.log.txt
+	// (or appname_timestamp.log.txt if no SHA)
 	var filename string
 	if sha != "" {
 		filename = fmt.Sprintf("%s_%s_%s.log.txt", app.Name, sha, timestamp)
@@ -308,7 +316,8 @@ func (svc *Service) CancelDeploy(appID string) bool {
 
 // Deploy deploys an app. If cancelExisting is true (e.g. webhook-triggered),
 // any in-progress deploy for the same app will be cancelled before starting.
-// If cancelExisting is false and a deploy is in progress, ErrDeploymentInProgress is returned.
+// If cancelExisting is false and a deploy is in progress,
+// ErrDeploymentInProgress is returned.
 func (svc *Service) Deploy(
 	ctx context.Context,
 	app *models.App,
@@ -342,7 +351,8 @@ func (svc *Service) Deploy(
 	// Fetch webhook event and create deployment record
 	webhookEvent := svc.fetchWebhookEvent(deployCtx, webhookEventID)
 
-	// Use a background context for DB operations that must complete regardless of cancellation
+	// Use a background context for DB operations that must complete
+	// regardless of cancellation
 	bgCtx := context.WithoutCancel(deployCtx)
 
 	deployment, err := svc.createDeploymentRecord(bgCtx, app, webhookEventID, webhookEvent)
@@ -401,7 +411,10 @@ func (svc *Service) createRollbackDeployment(
 		return nil, fmt.Errorf("failed to create rollback deployment: %w", saveErr)
 	}
 
-	_ = deployment.AppendLog(ctx, "Rolling back to previous image: "+app.PreviousImageID.String)
+	_ = deployment.AppendLog(
+		ctx,
+		"Rolling back to previous image: "+app.PreviousImageID.String,
+	)
 
 	return deployment, nil
 }
@@ -417,7 +430,11 @@ func (svc *Service) executeRollback(
 
 	svc.removeOldContainer(ctx, app, deployment)
 
-	rollbackOpts, err := svc.buildContainerOptions(ctx, app, docker.ImageID(previousImageID))
+	rollbackOpts, err := svc.buildContainerOptions(
+		ctx,
+		app,
+		docker.ImageID(previousImageID),
+	)
 	if err != nil {
 		svc.failDeployment(bgCtx, app, deployment, err)
 
@@ -426,7 +443,12 @@ func (svc *Service) executeRollback(
 
 	containerID, err := svc.docker.CreateContainer(ctx, rollbackOpts)
 	if err != nil {
-		svc.failDeployment(bgCtx, app, deployment, fmt.Errorf("failed to create rollback container: %w", err))
+		svc.failDeployment(
+			bgCtx,
+			app,
+			deployment,
+			fmt.Errorf("failed to create rollback container: %w", err),
+		)
 
 		return fmt.Errorf("failed to create rollback container: %w", err)
 	}
@@ -436,7 +458,12 @@ func (svc *Service) executeRollback(
 
 	startErr := svc.docker.StartContainer(ctx, containerID)
 	if startErr != nil {
-		svc.failDeployment(bgCtx, app, deployment, fmt.Errorf("failed to start rollback container: %w", startErr))
+		svc.failDeployment(
+			bgCtx,
+			app,
+			deployment,
+			fmt.Errorf("failed to start rollback container: %w", startErr),
+		)
 
 		return fmt.Errorf("failed to start rollback container: %w", startErr)
 	}
@@ -695,7 +722,11 @@ func (svc *Service) cleanupCancelledDeploy(
 		if removeErr != nil {
 			svc.log.Error("failed to remove image from cancelled deploy",
 				"error", removeErr, "app", app.Name, "image", imageID)
-			_ = deployment.AppendLog(ctx, "WARNING: failed to clean up image "+imageID.String()+": "+removeErr.Error())
+			_ = deployment.AppendLog(
+				ctx,
+				"WARNING: failed to clean up image "+
+					imageID.String()+": "+removeErr.Error(),
+			)
 		} else {
 			svc.log.Info("cleaned up image from cancelled deploy",
 				"app", app.Name, "image", imageID)
@@ -870,14 +901,24 @@ func (svc *Service) cloneRepository(
 
 	err := os.MkdirAll(appBuildsDir, buildsDirPermissions)
 	if err != nil {
-		svc.failDeployment(ctx, app, deployment, fmt.Errorf("failed to create builds dir: %w", err))
+		svc.failDeployment(
+			ctx,
+			app,
+			deployment,
+			fmt.Errorf("failed to create builds dir: %w", err),
+		)
 
 		return "", nil, fmt.Errorf("failed to create builds dir: %w", err)
 	}
 
 	buildDir, err := os.MkdirTemp(appBuildsDir, fmt.Sprintf("%d-*", deployment.ID))
 	if err != nil {
-		svc.failDeployment(ctx, app, deployment, fmt.Errorf("failed to create temp dir: %w", err))
+		svc.failDeployment(
+			ctx,
+			app,
+			deployment,
+			fmt.Errorf("failed to create temp dir: %w", err),
+		)
 
 		return "", nil, fmt.Errorf("failed to create temp dir: %w", err)
 	}
@@ -908,7 +949,12 @@ func (svc *Service) cloneRepository(
 	)
 	if cloneErr != nil {
 		cleanup()
-		svc.failDeployment(ctx, app, deployment, fmt.Errorf("failed to clone repo: %w", cloneErr))
+		svc.failDeployment(
+			ctx,
+			app,
+			deployment,
+			fmt.Errorf("failed to clone repo: %w", cloneErr),
+		)
 
 		return "", nil, fmt.Errorf("failed to clone repo: %w", cloneErr)
 	}

internal/service/deploy/deploy_cleanup_test.go

@@ -32,7 +32,10 @@ func TestCleanupCancelledDeploy_RemovesBuildDir(t *testing.T) {
 	require.NoError(t, os.MkdirAll(deployDir, 0o750))
 
 	// Create a file inside to verify full removal
-	require.NoError(t, os.WriteFile(filepath.Join(deployDir, "work"), []byte("test"), 0o600))
+	require.NoError(
+		t,
+		os.WriteFile(filepath.Join(deployDir, "work"), []byte("test"), 0o600),
+	)
 
 	// Also create a dir for a different deployment (should NOT be removed)
 	otherDir := filepath.Join(buildDir, "99-xyz789")

internal/service/deploy/deploy_container_test.go

@@ -31,7 +31,9 @@ func TestBuildContainerOptionsUsesImageID(t *testing.T) {
 
 	const expectedImageID = docker.ImageID("sha256:abc123def456")
 
-	opts, err := svc.BuildContainerOptionsExported(context.Background(), app, expectedImageID)
+	opts, err := svc.BuildContainerOptionsExported(
+		context.Background(), app, expectedImageID,
+	)
 	if err != nil {
 		t.Fatalf("buildContainerOptions returned error: %v", err)
 	}
@@ -77,14 +79,20 @@ func TestBuildContainerOptionsNoResourceLimits(t *testing.T) {
 	}
 }
 
-func TestBuildContainerOptionsCPULimit(t *testing.T) {
-	t.Parallel()
+// buildOptsForApp saves an app configured by setup and returns the container
+// options built for it.
+func buildOptsForApp(
+	t *testing.T,
+	name string,
+	setup func(app *models.App),
+) docker.CreateContainerOptions {
+	t.Helper()
 
 	db := database.NewTestDatabase(t)
 
 	app := models.NewApp(db)
-	app.Name = "cpulimit"
-	app.CPULimit = sql.NullFloat64{Float64: 0.5, Valid: true}
+	app.Name = name
+	setup(app)
 
 	err := app.Save(context.Background())
 	if err != nil {
@@ -101,6 +109,16 @@ func TestBuildContainerOptionsCPULimit(t *testing.T) {
 		t.Fatalf("buildContainerOptions returned error: %v", err)
 	}
 
+	return opts
+}
+
+func TestBuildContainerOptionsCPULimit(t *testing.T) {
+	t.Parallel()
+
+	opts := buildOptsForApp(t, "cpulimit", func(app *models.App) {
+		app.CPULimit = sql.NullFloat64{Float64: 0.5, Valid: true}
+	})
+
 	if opts.CPULimit != 0.5 {
 		t.Errorf("expected CPULimit=0.5, got %v", opts.CPULimit)
 	}
@@ -109,26 +127,9 @@ func TestBuildContainerOptionsCPULimit(t *testing.T) {
 func TestBuildContainerOptionsMemoryLimit(t *testing.T) {
 	t.Parallel()
 
-	db := database.NewTestDatabase(t)
-
-	app := models.NewApp(db)
-	app.Name = "memlimit"
-	app.MemoryLimit = sql.NullInt64{Int64: 536870912, Valid: true} // 512m
-
-	err := app.Save(context.Background())
-	if err != nil {
-		t.Fatalf("failed to save app: %v", err)
-	}
-
-	log := slog.New(slog.NewTextHandler(os.Stderr, nil))
-	svc := deploy.NewTestService(log)
-
-	opts, err := svc.BuildContainerOptionsExported(
-		context.Background(), app, docker.ImageID("test:latest"),
-	)
-	if err != nil {
-		t.Fatalf("buildContainerOptions returned error: %v", err)
-	}
+	opts := buildOptsForApp(t, "memlimit", func(app *models.App) {
+		app.MemoryLimit = sql.NullInt64{Int64: 536870912, Valid: true} // 512m
+	})
 
 	if opts.MemoryLimit != 536870912 {
 		t.Errorf("expected MemoryLimit=536870912, got %v", opts.MemoryLimit)

internal/service/deploy/export_test.go

@@ -26,7 +26,11 @@ func (svc *Service) CancelActiveDeploy(appID string) {
 }
 
 // RegisterActiveDeploy registers an active deploy for testing.
-func (svc *Service) RegisterActiveDeploy(appID string, cancel context.CancelFunc, done chan struct{}) {
+func (svc *Service) RegisterActiveDeploy(
+	appID string,
+	cancel context.CancelFunc,
+	done chan struct{},
+) {
 	svc.activeDeploys.Store(appID, &activeDeploy{cancel: cancel, done: done})
 }
 
@@ -41,7 +45,11 @@ func (svc *Service) UnlockApp(appID string) {
 }
 
 // NewTestServiceWithConfig creates a Service with config and docker client for testing.
-func NewTestServiceWithConfig(log *slog.Logger, cfg *config.Config, dockerClient *docker.Client) *Service {
+func NewTestServiceWithConfig(
+	log *slog.Logger,
+	cfg *config.Config,
+	dockerClient *docker.Client,
+) *Service {
 	return &Service{
 		log:    log,
 		config: cfg,

internal/service/notify/notify.go

@@ -159,7 +159,8 @@ func (svc *Service) NotifyDeployFailed(
 ) {
 	duration := time.Since(deployment.StartedAt)
 	title := "Deploy failed: " + app.Name
-	message := "Deployment failed after " + formatDuration(duration) + ": " + deployErr.Error()
+	message := "Deployment failed after " + formatDuration(duration) +
+		": " + deployErr.Error()
 
 	svc.sendNotifications(ctx, app, title, message, message, "error")
 }
@@ -266,7 +267,8 @@ func (svc *Service) sendNtfy(
 	request.Header.Set("Title", title)
 	request.Header.Set("Priority", svc.ntfyPriority(priority))
 
-	resp, err := svc.client.Do(request) // #nosec G704 -- URL from validated config, not user input
+	// #nosec G704 -- URL from validated config, not user input
+	resp, err := svc.client.Do(request)
 	if err != nil {
 		return fmt.Errorf("failed to send ntfy request: %w", err)
 	}
@@ -363,7 +365,8 @@ func (svc *Service) sendSlack(
 
 	request.Header.Set("Content-Type", "application/json")
 
-	resp, err := svc.client.Do(request) // #nosec G704 -- URL from validated config, not user input
+	// #nosec G704 -- URL from validated config, not user input
+	resp, err := svc.client.Do(request)
 	if err != nil {
 		return fmt.Errorf("failed to send slack request: %w", err)
 	}

internal/service/webhook/payloads.go

@@ -0,0 +1,237 @@
+package webhook
+
+import "encoding/json"
+
+// GiteaPushPayload represents a Gitea push webhook payload.
+//
+//nolint:tagliatelle // Field names match Gitea API (snake_case)
+type GiteaPushPayload struct {
+	Ref        string      `json:"ref"`
+	Before     string      `json:"before"`
+	After      string      `json:"after"`
+	CompareURL UnparsedURL `json:"compare_url"`
+	Repository struct {
+		FullName string      `json:"full_name"`
+		CloneURL UnparsedURL `json:"clone_url"`
+		SSHURL   string      `json:"ssh_url"`
+		HTMLURL  UnparsedURL `json:"html_url"`
+	} `json:"repository"`
+	Pusher struct {
+		Username string `json:"username"`
+		Email    string `json:"email"`
+	} `json:"pusher"`
+	Commits []struct {
+		ID      string      `json:"id"`
+		URL     UnparsedURL `json:"url"`
+		Message string      `json:"message"`
+		Author  struct {
+			Name  string `json:"name"`
+			Email string `json:"email"`
+		} `json:"author"`
+	} `json:"commits"`
+}
+
+// GitHubPushPayload represents a GitHub push webhook payload.
+//
+//nolint:tagliatelle // Field names match GitHub API (snake_case)
+type GitHubPushPayload struct {
+	Ref        string `json:"ref"`
+	Before     string `json:"before"`
+	After      string `json:"after"`
+	CompareURL string `json:"compare"`
+	Repository struct {
+		FullName string      `json:"full_name"`
+		CloneURL UnparsedURL `json:"clone_url"`
+		SSHURL   string      `json:"ssh_url"`
+		HTMLURL  UnparsedURL `json:"html_url"`
+	} `json:"repository"`
+	Pusher struct {
+		Name  string `json:"name"`
+		Email string `json:"email"`
+	} `json:"pusher"`
+	HeadCommit *struct {
+		ID      string      `json:"id"`
+		URL     UnparsedURL `json:"url"`
+		Message string      `json:"message"`
+	} `json:"head_commit"`
+	Commits []struct {
+		ID      string      `json:"id"`
+		URL     UnparsedURL `json:"url"`
+		Message string      `json:"message"`
+		Author  struct {
+			Name  string `json:"name"`
+			Email string `json:"email"`
+		} `json:"author"`
+	} `json:"commits"`
+}
+
+// GitLabPushPayload represents a GitLab push webhook payload.
+//
+//nolint:tagliatelle // Field names match GitLab API (snake_case)
+type GitLabPushPayload struct {
+	Ref       string `json:"ref"`
+	Before    string `json:"before"`
+	After     string `json:"after"`
+	UserName  string `json:"user_name"`
+	UserEmail string `json:"user_email"`
+	Project   struct {
+		PathWithNamespace string      `json:"path_with_namespace"`
+		GitHTTPURL        UnparsedURL `json:"git_http_url"`
+		GitSSHURL         string      `json:"git_ssh_url"`
+		WebURL            UnparsedURL `json:"web_url"`
+	} `json:"project"`
+	Commits []struct {
+		ID      string      `json:"id"`
+		URL     UnparsedURL `json:"url"`
+		Message string      `json:"message"`
+		Author  struct {
+			Name  string `json:"name"`
+			Email string `json:"email"`
+		} `json:"author"`
+	} `json:"commits"`
+}
+
+// ParsePushPayload parses a raw webhook payload into a normalized PushEvent
+// based on the detected webhook source. Returns an error if JSON unmarshaling
+// fails. For SourceUnknown, falls back to Gitea format for backward
+// compatibility.
+func ParsePushPayload(source Source, payload []byte) (*PushEvent, error) {
+	switch source {
+	case SourceGitHub:
+		return parsePush(payload, githubPushEvent)
+	case SourceGitLab:
+		return parsePush(payload, gitlabPushEvent)
+	case SourceGitea, SourceUnknown:
+		// Gitea and unknown both use Gitea format for backward compatibility.
+		return parsePush(payload, giteaPushEvent)
+	}
+
+	// Unreachable for known source values, but satisfies exhaustive checker.
+	return parsePush(payload, giteaPushEvent)
+}
+
+// parsePush unmarshals payload into P and converts it into a normalized
+// PushEvent via build.
+func parsePush[P any](payload []byte, build func(P) *PushEvent) (*PushEvent, error) {
+	var p P
+
+	unmarshalErr := json.Unmarshal(payload, &p)
+	if unmarshalErr != nil {
+		return nil, unmarshalErr
+	}
+
+	return build(p), nil
+}
+
+// basePushEvent builds a PushEvent populated with the fields shared by all
+// webhook sources.
+func basePushEvent(source Source, ref, before, after string) *PushEvent {
+	return &PushEvent{
+		Source: source,
+		Ref:    ref,
+		Before: before,
+		After:  after,
+		Branch: extractBranch(ref),
+	}
+}
+
+// giteaPushEvent converts a Gitea push payload to a normalized PushEvent.
+func giteaPushEvent(p GiteaPushPayload) *PushEvent {
+	event := basePushEvent(SourceGitea, p.Ref, p.Before, p.After)
+	event.RepoName = p.Repository.FullName
+	event.CloneURL = p.Repository.CloneURL
+	event.HTMLURL = p.Repository.HTMLURL
+	event.CommitURL = extractGiteaCommitURL(p)
+	event.Pusher = p.Pusher.Username
+
+	return event
+}
+
+// gitlabPushEvent converts a GitLab push payload to a normalized PushEvent.
+func gitlabPushEvent(p GitLabPushPayload) *PushEvent {
+	event := basePushEvent(SourceGitLab, p.Ref, p.Before, p.After)
+	event.RepoName = p.Project.PathWithNamespace
+	event.CloneURL = p.Project.GitHTTPURL
+	event.HTMLURL = p.Project.WebURL
+	event.CommitURL = extractGitLabCommitURL(p)
+	event.Pusher = p.UserName
+
+	return event
+}
+
+// githubPushEvent converts a GitHub push payload to a normalized PushEvent.
+func githubPushEvent(p GitHubPushPayload) *PushEvent {
+	event := basePushEvent(SourceGitHub, p.Ref, p.Before, p.After)
+	event.RepoName = p.Repository.FullName
+	event.CloneURL = p.Repository.CloneURL
+	event.HTMLURL = p.Repository.HTMLURL
+	event.CommitURL = extractGitHubCommitURL(p)
+	event.Pusher = p.Pusher.Name
+
+	return event
+}
+
+// extractBranch extracts the branch name from a git ref.
+func extractBranch(ref string) string {
+	// refs/heads/main -> main
+	const prefix = "refs/heads/"
+
+	if len(ref) >= len(prefix) && ref[:len(prefix)] == prefix {
+		return ref[len(prefix):]
+	}
+
+	return ref
+}
+
+// extractGiteaCommitURL extracts the commit URL from a Gitea push payload.
+// Prefers the URL from the head commit, falls back to constructing from repo URL.
+func extractGiteaCommitURL(payload GiteaPushPayload) UnparsedURL {
+	for _, commit := range payload.Commits {
+		if commit.ID == payload.After && commit.URL != "" {
+			return commit.URL
+		}
+	}
+
+	if payload.Repository.HTMLURL != "" && payload.After != "" {
+		return UnparsedURL(payload.Repository.HTMLURL.String() + "/commit/" + payload.After)
+	}
+
+	return ""
+}
+
+// extractGitHubCommitURL extracts the commit URL from a GitHub push payload.
+// Prefers head_commit.url, then searches commits, then constructs from repo URL.
+func extractGitHubCommitURL(payload GitHubPushPayload) UnparsedURL {
+	if payload.HeadCommit != nil && payload.HeadCommit.URL != "" {
+		return payload.HeadCommit.URL
+	}
+
+	for _, commit := range payload.Commits {
+		if commit.ID == payload.After && commit.URL != "" {
+			return commit.URL
+		}
+	}
+
+	if payload.Repository.HTMLURL != "" && payload.After != "" {
+		return UnparsedURL(payload.Repository.HTMLURL.String() + "/commit/" + payload.After)
+	}
+
+	return ""
+}
+
+// extractGitLabCommitURL extracts the commit URL from a GitLab push payload.
+// Prefers commit URL from the commits list, falls back to constructing from
+// project web URL.
+func extractGitLabCommitURL(payload GitLabPushPayload) UnparsedURL {
+	for _, commit := range payload.Commits {
+		if commit.ID == payload.After && commit.URL != "" {
+			return commit.URL
+		}
+	}
+
+	if payload.Project.WebURL != "" && payload.After != "" {
+		return UnparsedURL(payload.Project.WebURL.String() + "/-/commit/" + payload.After)
+	}
+
+	return ""
+}

internal/service/webhook/types.go

@@ -1,5 +1,7 @@
 package webhook
 
+import "net/http"
+
 // UnparsedURL is a URL stored as a plain string without parsing.
 // Use this instead of string when the value is known to be a URL
 // but should not be parsed into a net/url.URL (e.g. webhook URLs,
@@ -8,3 +10,84 @@ type UnparsedURL string
 
 // String implements the fmt.Stringer interface.
 func (u UnparsedURL) String() string { return string(u) }
+
+// Source identifies which git hosting platform sent the webhook.
+type Source string
+
+const (
+	// SourceGitea indicates the webhook was sent by a Gitea instance.
+	SourceGitea Source = "gitea"
+
+	// SourceGitHub indicates the webhook was sent by GitHub.
+	SourceGitHub Source = "github"
+
+	// SourceGitLab indicates the webhook was sent by a GitLab instance.
+	SourceGitLab Source = "gitlab"
+
+	// SourceUnknown indicates the webhook source could not be determined.
+	SourceUnknown Source = "unknown"
+)
+
+// String implements the fmt.Stringer interface.
+func (s Source) String() string { return string(s) }
+
+// DetectWebhookSource determines the webhook source from HTTP headers.
+// It checks for platform-specific event headers in this order:
+// Gitea (X-Gitea-Event), GitHub (X-GitHub-Event), GitLab (X-Gitlab-Event).
+// Returns SourceUnknown if no recognized header is found.
+func DetectWebhookSource(headers http.Header) Source {
+	if headers.Get("X-Gitea-Event") != "" {
+		return SourceGitea
+	}
+
+	if headers.Get("X-Github-Event") != "" {
+		return SourceGitHub
+	}
+
+	if headers.Get("X-Gitlab-Event") != "" {
+		return SourceGitLab
+	}
+
+	return SourceUnknown
+}
+
+// DetectEventType extracts the event type string from HTTP headers
+// based on the detected webhook source. Returns "push" as a fallback
+// when no event header is found.
+func DetectEventType(headers http.Header, source Source) string {
+	switch source {
+	case SourceGitea:
+		if v := headers.Get("X-Gitea-Event"); v != "" {
+			return v
+		}
+	case SourceGitHub:
+		if v := headers.Get("X-Github-Event"); v != "" {
+			return v
+		}
+	case SourceGitLab:
+		if v := headers.Get("X-Gitlab-Event"); v != "" {
+			return v
+		}
+	case SourceUnknown:
+		// Fall through to default
+	}
+
+	return "push"
+}
+
+// PushEvent is a normalized representation of a push webhook payload
+// from any supported source (Gitea, GitHub, GitLab). The webhook
+// service converts source-specific payloads into this format before
+// processing.
+type PushEvent struct {
+	Source    Source
+	Ref       string
+	Before    string
+	After     string
+	Branch    string
+	RepoName  string
+	CloneURL  UnparsedURL
+	HTMLURL   UnparsedURL
+	CommitURL UnparsedURL
+	Pusher    string
+}

internal/service/webhook/webhook.go

@@ -4,7 +4,6 @@ package webhook
 import (
 	"context"
 	"database/sql"
-	"encoding/json"
 	"fmt"
 	"log/slog"
 
@@ -44,68 +43,46 @@ func New(_ fx.Lifecycle, params ServiceParams) (*Service, error) {
 	}, nil
 }
 
-// GiteaPushPayload represents a Gitea push webhook payload.
-//
-//nolint:tagliatelle // Field names match Gitea API (snake_case)
-type GiteaPushPayload struct {
-	Ref        string      `json:"ref"`
-	Before     string      `json:"before"`
-	After      string      `json:"after"`
-	CompareURL UnparsedURL `json:"compare_url"`
-	Repository struct {
-		FullName string      `json:"full_name"`
-		CloneURL UnparsedURL `json:"clone_url"`
-		SSHURL   string      `json:"ssh_url"`
-		HTMLURL  UnparsedURL `json:"html_url"`
-	} `json:"repository"`
-	Pusher struct {
-		Username string `json:"username"`
-		Email    string `json:"email"`
-	} `json:"pusher"`
-	Commits []struct {
-		ID      string      `json:"id"`
-		URL     UnparsedURL `json:"url"`
-		Message string      `json:"message"`
-		Author  struct {
-			Name  string `json:"name"`
-			Email string `json:"email"`
-		} `json:"author"`
-	} `json:"commits"`
-}
-
-// HandleWebhook processes a webhook request.
+// HandleWebhook processes a webhook request from any supported source
+// (Gitea, GitHub, or GitLab). The source parameter determines which
+// payload format to use for parsing.
 func (svc *Service) HandleWebhook(
 	ctx context.Context,
 	app *models.App,
+	source Source,
 	eventType string,
 	payload []byte,
 ) error {
-	svc.log.Info("processing webhook", "app", app.Name, "event", eventType)
+	svc.log.Info("processing webhook",
+		"app", app.Name,
+		"source", source.String(),
+		"event", eventType,
+	)
 
-	// Parse payload
-	var pushPayload GiteaPushPayload
-
-	unmarshalErr := json.Unmarshal(payload, &pushPayload)
-	if unmarshalErr != nil {
-		svc.log.Warn("failed to parse webhook payload", "error", unmarshalErr)
-		// Continue anyway to log the event
+	// Parse payload into normalized push event
+	pushEvent, parseErr := ParsePushPayload(source, payload)
+	if parseErr != nil {
+		svc.log.Warn("failed to parse webhook payload",
+			"error", parseErr,
+			"source", source.String(),
+		)
+		// Continue with empty push event to still log the webhook
+		pushEvent = &PushEvent{Source: source}
 	}
 
-	// Extract branch from ref
-	branch := extractBranch(pushPayload.Ref)
-	commitSHA := pushPayload.After
-	commitURL := extractCommitURL(pushPayload)
-
 	// Check if branch matches
-	matched := branch == app.Branch
+	matched := pushEvent.Branch == app.Branch
 
 	// Create webhook event record
 	event := models.NewWebhookEvent(svc.db)
 	event.AppID = app.ID
 	event.EventType = eventType
-	event.Branch = branch
-	event.CommitSHA = sql.NullString{String: commitSHA, Valid: commitSHA != ""}
-	event.CommitURL = sql.NullString{String: commitURL.String(), Valid: commitURL != ""}
+	event.Branch = pushEvent.Branch
+	event.CommitSHA = sql.NullString{String: pushEvent.After, Valid: pushEvent.After != ""}
+	event.CommitURL = sql.NullString{
+		String: pushEvent.CommitURL.String(),
+		Valid:  pushEvent.CommitURL != "",
+	}
 	event.Payload = sql.NullString{String: string(payload), Valid: true}
 	event.Matched = matched
 	event.Processed = false
@@ -117,9 +94,10 @@ func (svc *Service) HandleWebhook(
 
 	svc.log.Info("webhook event recorded",
 		"app", app.Name,
-		"branch", branch,
+		"source", source.String(),
+		"branch", pushEvent.Branch,
 		"matched", matched,
-		"commit", commitSHA,
+		"commit", pushEvent.After,
 	)
 
 	// If branch matches, trigger deployment
@@ -154,33 +132,3 @@ func (svc *Service) triggerDeployment(
 		_ = event.Save(deployCtx)
 	}()
 }
-
-// extractBranch extracts the branch name from a git ref.
-func extractBranch(ref string) string {
-	// refs/heads/main -> main
-	const prefix = "refs/heads/"
-
-	if len(ref) >= len(prefix) && ref[:len(prefix)] == prefix {
-		return ref[len(prefix):]
-	}
-
-	return ref
-}
-
-// extractCommitURL extracts the commit URL from the webhook payload.
-// Prefers the URL from the head commit, falls back to constructing from repo URL.
-func extractCommitURL(payload GiteaPushPayload) UnparsedURL {
-	// Try to find the URL from the head commit (matching After SHA)
-	for _, commit := range payload.Commits {
-		if commit.ID == payload.After && commit.URL != "" {
-			return commit.URL
-		}
-	}
-
-	// Fall back to constructing URL from repo HTML URL
-	if payload.Repository.HTMLURL != "" && payload.After != "" {
-		return UnparsedURL(payload.Repository.HTMLURL.String() + "/commit/" + payload.After)
-	}
-
-	return ""
-}

script/bootstrap

@@ -0,0 +1,121 @@
+#!/bin/sh
+# script/bootstrap: install all dependencies needed to build and develop
+# this repo. Idempotent: every install is guarded by a check so already
+# installed tools are skipped. Base tooling comes from nix, apt, brew,
+# or apk (detected in that order); assumes NOTHING is present (not git,
+# make, or go). golangci-lint is packaged in nix, brew, and apk; on apt
+# it is installed from a hash-verified GitHub release archive (never
+# curl | sh).
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+# Pinned versions, 2026-08-07. Never "latest"; exact versions only.
+GOLANGCI_LINT_VERSION="2.12.2"
+# sha256 of golangci-lint-2.12.2-linux-<arch>.tar.gz release archives
+GOLANGCI_LINT_SHA256_AMD64="8df580d2670fed8fa984aac0507099af8df275e665215f5c7a2ae3943893a553"
+GOLANGCI_LINT_SHA256_ARM64="44cd40a8c76c86755375adfeea52cfd3533cb43d7bd647771e0ae065e166df3a"
+
+PKGMGR=""
+SUDO=""
+
+detect_pkgmgr() {
+    [ -n "$PKGMGR" ] && return 0
+    if command -v nix-env >/dev/null 2>&1; then
+        PKGMGR="nix"
+    elif command -v apt-get >/dev/null 2>&1; then
+        PKGMGR="apt"
+    elif command -v brew >/dev/null 2>&1; then
+        PKGMGR="brew"
+    elif command -v apk >/dev/null 2>&1; then
+        PKGMGR="apk"
+    else
+        echo "bootstrap: no supported package manager (nix, apt, brew, apk)" >&2
+        exit 1
+    fi
+    if [ "$PKGMGR" = "apt" ]; then
+        export DEBIAN_FRONTEND=noninteractive
+        if [ "$(id -u)" != "0" ]; then
+            SUDO="sudo"
+        fi
+    fi
+}
+
+# pkg_install <nix-attr> <apt-pkg> <brew-formula> <apk-pkg>
+pkg_install() {
+    detect_pkgmgr
+    case "$PKGMGR" in
+        nix) nix-env -iA "nixpkgs.$1" ;;
+        apt) $SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2" ;;
+        brew) brew install "$3" ;;
+        apk) apk add --no-cache "$4" ;;
+    esac
+}
+
+missing() {
+    ! command -v "$1" >/dev/null 2>&1
+}
+
+# verify_sha256 <file> <expected-hash>
+verify_sha256() {
+    if command -v sha256sum >/dev/null 2>&1; then
+        actual="$(sha256sum "$1" | cut -d' ' -f1)"
+    else
+        actual="$(shasum -a 256 "$1" | cut -d' ' -f1)"
+    fi
+    if [ "$actual" != "$2" ]; then
+        echo "bootstrap: sha256 mismatch for $1" >&2
+        echo "  expected: $2" >&2
+        echo "  actual:   $actual" >&2
+        exit 1
+    fi
+}
+
+# apt has no golangci-lint package: install a pinned release archive
+# from GitHub, verified by hardcoded sha256 (never curl | sh).
+install_golangci_lint_release() {
+    case "$(uname -m)" in
+        x86_64) goarch="amd64"; sha="$GOLANGCI_LINT_SHA256_AMD64" ;;
+        aarch64|arm64) goarch="arm64"; sha="$GOLANGCI_LINT_SHA256_ARM64" ;;
+        *)
+            echo "bootstrap: unsupported architecture $(uname -m)" >&2
+            exit 1
+            ;;
+    esac
+    if missing curl; then pkg_install curl curl curl curl; fi
+    name="golangci-lint-${GOLANGCI_LINT_VERSION}-linux-${goarch}"
+    tmp="$(mktemp -d)"
+    curl -fsSL -o "$tmp/$name.tar.gz" \
+        "https://github.com/golangci/golangci-lint/releases/download/v${GOLANGCI_LINT_VERSION}/${name}.tar.gz"
+    verify_sha256 "$tmp/$name.tar.gz" "$sha"
+    tar -xzf "$tmp/$name.tar.gz" -C "$tmp"
+    $SUDO install -m 0755 "$tmp/$name/golangci-lint" /usr/local/bin/golangci-lint
+    rm -rf "$tmp"
+}
+
+ensure_golangci_lint() {
+    if ! missing golangci-lint; then return 0; fi
+    detect_pkgmgr
+    case "$PKGMGR" in
+        apt) install_golangci_lint_release ;;
+        *) pkg_install golangci-lint golangci-lint golangci-lint golangci-lint ;;
+    esac
+}
+
+main() {
+    cd "$ROOT"
+
+    # Base tooling
+    if missing git; then pkg_install git git git git; fi
+    if missing make; then pkg_install gnumake make make make; fi
+
+    # Go toolchain and linter
+    if missing go; then pkg_install go golang go go; fi
+    ensure_golangci_lint
+
+    go mod download
+
+    echo "bootstrap complete"
+}
+
+main "$@"

script/check

@@ -0,0 +1,15 @@
+#!/bin/sh
+# script/check: run all checks (test, lint, fmt-check). Our own
+# extension to scripts-to-rule-them-all. Must not modify any files.
+# Generic: usually needs no adaptation.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+
+main() {
+    "$SCRIPT_DIR/test"
+    "$SCRIPT_DIR/lint"
+    "$SCRIPT_DIR/fmt-check"
+}
+
+main "$@"

script/cibuild

@@ -0,0 +1,15 @@
+#!/bin/sh
+# script/cibuild: run the CI build. The Dockerfile runs the checks
+# (make fmt-check, lint, test), so a successful build implies a green
+# repo. Generic: needs no adaptation. The Gitea workflow runs this on
+# push.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    docker build .
+}
+
+main "$@"

script/docker

@@ -0,0 +1,15 @@
+#!/bin/sh
+# script/docker: build the Docker image tagged with the project name.
+# Identical in all repos; the tag comes from script/projectname.
+# Generic: needs no adaptation.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    docker build -t "$("$SCRIPT_DIR/projectname")" .
+}
+
+main "$@"

script/fmt

@@ -0,0 +1,14 @@
+#!/bin/sh
+# script/fmt: format all files (writes).
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    gofmt -s -w .
+    goimports -w .
+    npx prettier --write --tab-width 4 static/js/*.js
+}
+
+main "$@"

script/fmt-check

@@ -0,0 +1,17 @@
+#!/bin/sh
+# script/fmt-check: check formatting (read-only). Same scope as
+# script/fmt, but fails instead of writing.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    if [ -n "$(gofmt -l .)" ]; then
+        echo "Files not formatted:"
+        gofmt -l .
+        exit 1
+    fi
+}
+
+main "$@"

script/install-precommit

@@ -0,0 +1,16 @@
+#!/bin/sh
+# script/install-precommit: install the git pre-commit hook that runs
+# script/precommit. Our own extension to scripts-to-rule-them-all.
+# Generic: needs no adaptation.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    printf '#!/bin/sh\nset -e\nscript/precommit\n' > .git/hooks/pre-commit
+    chmod +x .git/hooks/pre-commit
+    echo "pre-commit hook installed: runs script/precommit"
+}
+
+main "$@"

script/lint

@@ -0,0 +1,12 @@
+#!/bin/sh
+# script/lint: run the linter.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    golangci-lint run --config .golangci.yml ./...
+}
+
+main "$@"

script/precommit

@@ -0,0 +1,21 @@
+#!/bin/sh
+# script/precommit: run by the git pre-commit hook; fails the commit if
+# checks fail. Our own extension to scripts-to-rule-them-all. Go repo
+# extras: go mod tidy must not change go.mod/go.sum.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    go mod tidy
+    git diff --exit-code -- go.mod go.sum || {
+        echo "precommit: go mod tidy changed go.mod/go.sum;" \
+            "stage the changes and retry" >&2
+        exit 1
+    }
+    "$SCRIPT_DIR/check"
+}
+
+main "$@"

script/projectname

@@ -0,0 +1,12 @@
+#!/bin/sh
+# script/projectname: output the name of this project. Our own
+# extension to scripts-to-rule-them-all. Other scripts that need the
+# name (e.g. script/docker) call this, so they can stay identical
+# across all repos.
+set -eu
+
+main() {
+    echo "upaas"
+}
+
+main "$@"

script/setup

@@ -0,0 +1,14 @@
+#!/bin/sh
+# script/setup: set up the repo for development after a fresh clone:
+# installs dependencies (script/bootstrap) and the git pre-commit hook.
+# Add any repo-specific initialization (db init, .env template) here.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+
+main() {
+    "$SCRIPT_DIR/bootstrap"
+    "$SCRIPT_DIR/install-precommit"
+}
+
+main "$@"

script/test

@@ -0,0 +1,12 @@
+#!/bin/sh
+# script/test: run the test suite.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    go test -v -race -cover -timeout 30s ./...
+}
+
+main "$@"

static/js/app-detail.js

@@ -59,7 +59,7 @@ document.addEventListener("alpine:init", () => {
         },
 
         submitAll() {
-            const csrfInput = this.$el.querySelector(
+            const csrfInput = this.$root.querySelector(
                 'input[name="gorilla.csrf.Token"]',
             );
             const csrfToken = csrfInput ? csrfInput.value : "";

templates/app_detail.html

@@ -322,7 +322,7 @@
                         </td>
                         <td class="text-right">
                             <form method="POST" action="/apps/{{$.App.ID}}/ports/{{.ID}}/delete" class="inline" x-data="confirmAction('Delete this port mapping?')" @submit="confirm($event)">
-                {{ .CSRFField }}
+                {{ $.CSRFField }}
                                 <button type="submit" class="text-error-500 hover:text-error-700 text-sm">Delete</button>
                             </form>
                         </td>