Allow dots in app names (closes #260)

App names may now contain dots, such as sneak.berlin: runs of
lowercase letters and numbers joined by single dots or by hyphens,
2 to 63 characters. Docker accepts every such name in the app's image
name, upaas-<name>; a dot needs a letter or number on both sides
because Docker requires it. The rule also keeps a dot off either end,
so the name is safe as a directory and log file name.

The new and edit app forms use the same pattern. Their old one was not
a valid regular expression under the flag browsers compile it with, so
browsers ignored it.

A test deploys an app named sneak.berlin against the fake Docker API
and checks the image and container names with Docker's own rules.

Model: opus-5-5

.dockerignore

@@ -1,35 +1,8 @@
 # .git is sent so that `make build` in the Dockerfile can stamp the commit into
 # upaas. List no tracked file here: git would see it as deleted in the build and
 # the version would end in -dirty.
-
-# The patterns of .gitignore; **/ makes Docker match them in every directory.
-**/.DS_Store
-**/Thumbs.db
-**/*.swp
-**/*.swo
-**/*~
-**/*.bak
-**/.idea/
-**/.vscode/
-**/*.sublime-*
-**/node_modules/
-**/.env
-**/.env.*
-**/*.pem
-**/*.key
-**/bin/
-**/*.exe
-**/*.exe~
-**/*.dll
-**/*.so
-**/*.dylib
-**/*.test
-**/*.out
-/data/
-
-# Git never applies its ignore patterns inside .git; send all of it again.
-!.git/**
-
-# .git is sent without its config, because a remote URL there can carry a
-# credential; `git describe` does not need it. Keep this after !.git/**.
-.git/config
+.env
+bin/
+.vscode/
+.idea/
+*.test

.gitignore

@@ -1,5 +1,3 @@
-# .dockerignore repeats these patterns; change both together.
-
 # OS
 .DS_Store
 Thumbs.db
@@ -31,6 +29,3 @@ bin/
 *.dylib
 *.test
 *.out
-
-# upaasd's data directory when it runs from the checkout (UPAAS_DATA_DIR default)
-/data/

README.md

@@ -268,12 +268,6 @@ upaas fails the deploy instead of building. A Dockerfile that uses
 `RUN --network` needs Docker Engine 23.0 or later unless its `# syntax=` line
 names Dockerfile frontend 1.3 or later, such as `docker/dockerfile:1`.
 
-The build context leaves out the files the app's ignore file names, as
-`docker build` does: `<Dockerfile>.dockerignore` next to the app's Dockerfile if
-there is one, otherwise `.dockerignore` at the root of the repository. The
-Dockerfile and `.dockerignore` are always sent, even when the ignore file names
-them.
-
 Session secrets are automatically generated on first startup and persisted to
 `$UPAAS_DATA_DIR/session.key`.
 

TODO.md

@@ -10,13 +10,175 @@
 
 # Status
 
-1.0+.
+1.0+. Tagged 1.0.0 on 2026-02-26; 8 commits on main since. `make check` is green
+as of the golangci-lint v2.12.2 update.
 
 # Next Step
 
 Confirm `.gitea/workflows/check.yml` gates merges on `make check` so main cannot
 regress.
 
+# Completed Steps
+
+- 2026-10-02: App names may contain dots, such as `sneak.berlin`: lowercase
+  letters and numbers joined by single dots or by hyphens, 2 to 63 characters.
+  Docker accepts every such name in the image name `upaas-<name>`; a dot needs a
+  letter or number on both sides because Docker requires it. The new and edit
+  app forms check the same rule; browsers ignored their old pattern, which was
+  not a valid regular expression there (#260).
+
+- 2026-10-02: The build no longer passes the CPU architecture in: upaas reads it
+  from Go's `runtime.GOARCH` when it runs, and the startup log line reports it
+  as `arch`. `CONVENTIONS.md` follows the updated conventions in `sneak/prompts`
+  (#259).
+
+- 2026-10-01: Built images are tagged `upaas-<app>:<short hash>`, git's short
+  form of the commit built, instead of the deployment number. A redeploy of a
+  commit gives its tag to the new image; the old one is kept while the app runs
+  it or Rollback would start it, then removed by its ID, found among the images
+  the app's deployments recorded. The removal of old images now keeps every
+  image any app runs or would roll back to. A deployment's commit is now saved
+  when it is updated, so manual deploys keep the commit read from the clone
+  (#239).
+
+- 2026-10-01: Two database writes at the same moment no longer fail with
+  "database is locked": each transaction now takes the write lock when it begins
+  and waits up to 5 seconds for another writer to finish (#253).
+
+- 2026-10-01: The hint under the app page's environment variable editor now says
+  changes take effect at the next deploy or rollback, in the page's warning
+  style, instead of asking for a container restart, which keeps the old values
+  (#255).
+
+- 2026-10-01: Builds attach a BuildKit session, as the docker command line does,
+  so a base image that is not on the host is pulled instead of the build failing
+  with "no active sessions" on Docker Engine 27. Container logs, and so the
+  clone output in the build log and the app logs, no longer carry Docker's
+  stream frame headers, and the commit is now read from the clone output (#251).
+
+- 2026-10-01: An app's first deploy no longer fails when a volume's host path
+  does not exist yet: upaas asks Docker to create a missing host path when the
+  app's container starts and to leave an existing one alone, so nobody has to
+  create it on the host first. The README has a Volume mounts section saying so
+  (#235).
+
+- 2026-09-29: The app page is 50% wider on large screens (84rem instead of
+  56rem), its build log and container log boxes are twice as tall, the build log
+  sits between the webhook URL and the environment variables, and the container
+  log sits above the deploy key (#246).
+
+- 2026-09-29: A failed build now fails the deploy with the build's own error
+  instead of a later "failed to inspect image", and the deployment log shows the
+  end of the build output before that error. upaas refuses to build on a Docker
+  Engine older than 18.09, which cannot build with BuildKit. The README's
+  Compose section says to update with `docker compose up -d --build` and names
+  the Docker Engine versions builds need (#234).
+
+- 2026-09-29: An image built from the `Dockerfile` now shows the commit it was
+  built from (the `git describe` output) in the footer and `/health` instead of
+  `dev`: `.dockerignore` no longer leaves out `.git`, nor any tracked file,
+  which git would count as deleted and mark `-dirty`. upaas now also logs its
+  version at startup; the logger's `Identify()` was never called (#236).
+
+- 2026-09-29: The app page shows the app's branch as a label in its title, next
+  to the status badge, instead of after the repository under it (#240).
+
+- 2026-09-29: An app's deployments page now lists only its 10 most recent
+  deployments, newest first, instead of 50 (#238).
+
+- 2026-09-29: `docker-compose.yml` now sets `UPAAS_PORT` to 8080 as well as
+  `PORT`, since upaas reads `UPAAS_PORT` first and a `UPAAS_PORT` in `.env` made
+  it listen away from the port mapping and healthcheck; the README's Compose
+  section names both (#230).
+
+- 2026-09-29: The README Configuration table now lists every setting upaas
+  reads, adding `UPAAS_MAINTENANCE_MODE`, `UPAAS_SESSION_SECRET` and
+  `UPAAS_CORS_ORIGINS`, and gives the real default and effect of each:
+  `UPAAS_PORT` wins over `PORT`, `UPAAS_HOST_DATA_DIR` falls back to
+  `UPAAS_DATA_DIR`, `UPAAS_DEBUG` drops the session cookie's `Secure` flag, and
+  `UPAAS_SENTRY_DSN` is not used (#229).
+
+- 2026-09-28: The README Configuration table now names `UPAAS_DEBUG`,
+  `UPAAS_SENTRY_DSN`, `UPAAS_METRICS_USERNAME` and `UPAAS_METRICS_PASSWORD`, the
+  names upaas actually reads (the unprefixed names it listed were ignored), and
+  the `UPAAS_HOST_DATA_DIR` row refers to `UPAAS_DATA_DIR` (#224).
+
+- 2026-09-28: Added `docker-compose.yml` for deploying upaas: settings from
+  `.env`, the port published on `127.0.0.1` only for a TLS proxy in front, and a
+  healthcheck against `/health`; the README's plain-HTTP Compose example is
+  replaced by a short deploy section. upaas now refuses to start when
+  `UPAAS_HOST_DATA_DIR` is set to a relative path (#223).
+
+- 2026-09-23: Apps are now built with BuildKit, so the stages of a multi-stage
+  build stay in Docker's size-limited build cache instead of piling up as
+  untagged images; build progress is still written to the deployment log as
+  plain text (#220).
+
+- 2026-09-23: After a successful deploy, upaas removes the app's images other
+  than the running one and the one rollback would use, together with the
+  untagged images they were built on (#216).
+- 2026-09-23: The git clone container is now removed together with its anonymous
+  volume (the `alpine/git` image declares one at `/git`), so a deploy no longer
+  leaves a Docker volume behind (#215).
+- 2026-09-23: Deployment log files are now stored under `logs/<appname>/`
+  instead of `logs/<hostname>/<appname>/`, so downloads keep working after the
+  upaas container is recreated; logs written under an old hostname directory are
+  still found (#214).
+- 2026-09-23: Fixed the flaky `t.TempDir` cleanup race in `internal/handlers`
+  (the one fixed in `internal/service/webhook` by #198):
+  `TestHandleWebhookProcessesValidWebhook` now waits with the webhook service's
+  `WaitForDeployments` instead of sleeping (#211).
+- 2026-09-22: Vendored the canonical prettier/format toolchain from the
+  `sneak/prompts` scaffold: added `.prettierrc` (tabWidth 4, proseWrap always),
+  pinned `package.json` + `yarn.lock` (prettier 3.8.1), taught
+  `script/bootstrap` to install a pinned node/yarn via a hash-verified nvm
+  archive, and switched `script/fmt` to the pinned prettier reading
+  `.prettierrc` (no inline flags) over `static/js/*.js` and `**/*.md`. Reflowed
+  all markdown to house style; `alpine.min.js` stays byte-identical (#203).
+- 2026-09-22: Fixed the flaky `t.TempDir` cleanup race in
+  `internal/service/webhook` by tracking the async deployment goroutine in a
+  `sync.WaitGroup` and exposing `WaitForDeployments`; tests now synchronize on
+  completion instead of sleeping (#198).
+- 2026-09-22: Linting now runs only in Docker. Added `Dockerfile.lint` (pinned
+  golangci-lint v2.12.2, cache-busted via a `GATE_RUN` build arg so the linter
+  always executes), reduced `script/lint` to building it, dropped the
+  golangci-lint install from `script/bootstrap`, and switched the `Dockerfile`
+  lint stage to invoke `golangci-lint` directly instead of `make lint` to avoid
+  docker-in-docker (#188).
+- 2026-09-22: Added `.prettierignore` so `make fmt` no longer rewrites the
+  vendored `static/js/alpine.min.js` bundle (#185).
+- 2026-09-22: Fixed the gosec G703 path-traversal finding in the deploy log
+  download handler by verifying the resolved path stays within the deploy log
+  directory before serving, returning 404 on escape (#177).
+- 2026-09-22: `script/bootstrap` now installs a pinned `goimports`
+  (`golang.org/x/tools` v0.49.0) into `/usr/local/bin`, so `make fmt` succeeds
+  on a fresh machine after `make bootstrap` (#184).
+- 2026-09-09: Fixed four deployability blockers found by QA: CSRF origin check
+  over plain HTTP (`UPAAS_PLAINTEXT_HTTP`, #189), pulling the git image when
+  absent (#190), the env-var editor CSRF token lookup (#191), and the
+  port-mapping delete form's CSRF field (#192).
+- 2026-08-07: Updated golangci-lint to v2.12.2 (canonical `.golangci.yml`,
+  `Dockerfile` lint stage pin, `script/bootstrap` release-archive pins) and
+  fixed all resulting lint findings (noctx, gosec, goconst, lll, dupl,
+  nolintlint); `make check` green.
+- 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints, Makefile
+  shims, README Entrypoints section
+- 2026-03-11: Monolithic env var editing with bulk save (#158).
+- 2026-03-10: Webhook event history UI page (#164); added missing Makefile
+  docker and hooks targets plus test timeout (#159); notification settings
+  passed from create form (#160).
+- 2026-03-03: REPO_POLICIES compliance file set added (#155).
+- 2026-03-01: Module path changed to sneak.berlin/go/upaas (#143); Dockerfile
+  split into lint and build stages with forced lint execution (#152, #154).
+- 2026-02-26: 1.0.0 tagged; dashboard CSRFField crash fixed (#146).
+- 1.0 audit bug fixes (#120-#125): deferred rollback on commit error, deployment
+  log size cap, error path rendering, docker-compose bind mount, domain type
+  refactor.
+- CI simplified to docker build only (#130).
+- 2025-12-29 onward: core PaaS built out: deploys with real-time build log
+  streaming, container start/stop/restart and logs, TCP/UDP port mapping,
+  Alpine.js UI, Slack notifications, ULID app IDs, session handling.
+
 # Future Steps
 
 - Resume feature work only after main is green.

go.mod

@@ -15,7 +15,6 @@ require (
 	github.com/joho/godotenv v1.5.1
 	github.com/mattn/go-sqlite3 v1.14.32
 	github.com/moby/buildkit v0.16.0
-	github.com/moby/patternmatcher v0.6.0
 	github.com/oklog/ulid/v2 v2.1.1
 	github.com/prometheus/client_golang v1.23.2
 	github.com/spf13/viper v1.21.0
@@ -61,6 +60,7 @@ require (
 	github.com/klauspost/compress v1.18.2 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/locker v1.0.1 // indirect
+	github.com/moby/patternmatcher v0.6.0 // indirect
 	github.com/moby/sys/sequential v0.6.0 // indirect
 	github.com/moby/sys/signal v0.7.1 // indirect
 	github.com/moby/sys/user v0.4.0 // indirect

internal/docker/buildcontext.go

@@ -1,114 +0,0 @@
-package docker
-
-import (
-	"errors"
-	"fmt"
-	"io"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"github.com/docker/docker/pkg/archive"
-	"github.com/moby/patternmatcher"
-	"github.com/moby/patternmatcher/ignorefile"
-)
-
-// defaultDockerfileName is the Dockerfile Docker builds when none is named.
-const defaultDockerfileName = "Dockerfile"
-
-// defaultDockerignoreName is the ignore file at the root of a build context,
-// read when the Dockerfile has no ignore file of its own.
-const defaultDockerignoreName = ".dockerignore"
-
-// tarBuildContext returns a tar of the build context in contextDir that leaves
-// out the files the app's ignore file names, as docker build does; Docker does
-// not apply the ignore file to a build context sent as a tar. dockerfile is
-// the path of the Dockerfile inside contextDir.
-func tarBuildContext(contextDir, dockerfile string) (io.ReadCloser, error) {
-	excludes, err := readDockerignore(contextDir, dockerfile)
-	if err != nil {
-		return nil, err
-	}
-
-	return archive.TarWithOptions(contextDir, &archive.TarOptions{
-		ExcludePatterns: excludes,
-	})
-}
-
-// readDockerignore returns the patterns of the files to leave out of the
-// build context in contextDir, read as docker build reads them for the
-// Dockerfile at dockerfile: from <dockerfile>.dockerignore next to the
-// Dockerfile if there is one, otherwise from .dockerignore at the root of the
-// context. Without either file there are no patterns.
-func readDockerignore(contextDir, dockerfile string) ([]string, error) {
-	// Docker reads the Dockerfile path as a path inside the build context:
-	// cleaned, with a leading / and any .. that would lead out of the context
-	// dropped, so ./Dockerfile and /Dockerfile both name the Dockerfile at the
-	// root.
-	dockerfile = strings.TrimPrefix(filepath.Join("/", dockerfile), "/")
-	if dockerfile == "" {
-		dockerfile = defaultDockerfileName
-	}
-
-	// Reading through os.Root keeps the read inside the build context, even
-	// when the ignore file is a symlink.
-	root, err := os.OpenRoot(contextDir)
-	if err != nil {
-		return nil, err
-	}
-
-	defer func() { _ = root.Close() }()
-
-	// When a Dockerfile named Dockerfile is missing, Docker builds a
-	// lowercase dockerfile in the same directory instead, and docker build
-	// then reads dockerfile.dockerignore as its ignore file.
-	if filepath.Base(dockerfile) == defaultDockerfileName {
-		lowercase := filepath.Join(filepath.Dir(dockerfile), "dockerfile")
-
-		_, dockerfileErr := root.Lstat(dockerfile)
-		_, lowercaseErr := root.Lstat(lowercase)
-
-		if errors.Is(dockerfileErr, fs.ErrNotExist) && lowercaseErr == nil {
-			dockerfile = lowercase
-		}
-	}
-
-	name := dockerfile + defaultDockerignoreName
-
-	file, err := root.Open(name)
-	if errors.Is(err, fs.ErrNotExist) {
-		name = defaultDockerignoreName
-		file, err = root.Open(name)
-	}
-
-	if errors.Is(err, fs.ErrNotExist) {
-		return nil, nil
-	}
-
-	if err != nil {
-		return nil, fmt.Errorf("failed to read %s: %w", name, err)
-	}
-
-	defer func() { _ = file.Close() }()
-
-	excludes, err := ignorefile.ReadAll(file)
-	if err != nil {
-		return nil, fmt.Errorf("failed to read %s: %w", name, err)
-	}
-
-	// Like the docker command line, never leave out .dockerignore or the
-	// Dockerfile: Docker reads the Dockerfile from the context.
-	for _, keep := range []string{defaultDockerignoreName, filepath.ToSlash(dockerfile)} {
-		excluded, err := patternmatcher.MatchesOrParentMatches(keep, excludes)
-		if err != nil {
-			return nil, fmt.Errorf("invalid pattern in %s: %w", name, err)
-		}
-
-		if excluded {
-			excludes = append(excludes, "!"+keep)
-		}
-	}
-
-	return excludes, nil
-}

internal/docker/buildcontext_test.go

@@ -1,326 +0,0 @@
-package docker //nolint:testpackage // tests the unexported performBuild
-
-import (
-	"archive/tar"
-	"errors"
-	"io"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"slices"
-	"strings"
-	"testing"
-
-	"github.com/docker/docker/client"
-)
-
-// File names used in more than one test build context, as constants to
-// satisfy the goconst linter.
-const (
-	testMainGo              = "main.go"
-	testSecretFile          = "secret.txt"
-	testDeployDockerfile    = "deploy/Dockerfile"
-	testLowercaseDockerfile = "dockerfile"
-)
-
-// TestPerformBuildFollowsDockerignore runs builds against a fake Docker API
-// and checks which files the build context sent to it holds.
-func TestPerformBuildFollowsDockerignore(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name       string
-		dockerfile string
-		files      map[string]string // path in the context: contents
-		want       []string          // files sent in the build context
-	}{
-		{
-			name:       "no ignore file",
-			dockerfile: defaultDockerfileName,
-			files:      map[string]string{defaultDockerfileName: "", testMainGo: ""},
-			want:       []string{defaultDockerfileName, testMainGo},
-		},
-		{
-			name:       "excludes and re-includes",
-			dockerfile: defaultDockerfileName,
-			files: map[string]string{
-				defaultDockerignoreName: "secret.txt\n*.md\n!README.md\n",
-				defaultDockerfileName:   "",
-				"NOTES.md":              "",
-				"README.md":             "",
-				testMainGo:              "",
-				testSecretFile:          "",
-			},
-			want: []string{
-				defaultDockerignoreName, defaultDockerfileName, "README.md", testMainGo,
-			},
-		},
-		{
-			name:       "keeps the Dockerfile and .dockerignore",
-			dockerfile: defaultDockerfileName,
-			files: map[string]string{
-				defaultDockerignoreName: "Dockerfile\n.dockerignore\nsecret.txt\n",
-				defaultDockerfileName:   "",
-				testMainGo:              "",
-				testSecretFile:          "",
-			},
-			want: []string{defaultDockerignoreName, defaultDockerfileName, testMainGo},
-		},
-		{
-			name:       "an ignore file next to the Dockerfile wins over .dockerignore",
-			dockerfile: testDeployDockerfile,
-			files: map[string]string{
-				defaultDockerignoreName:          "main.go\n",
-				testDeployDockerfile:             "",
-				"deploy/Dockerfile.dockerignore": "secret.txt\n",
-				testMainGo:                       "",
-				testSecretFile:                   "",
-			},
-			want: []string{
-				defaultDockerignoreName,
-				testDeployDockerfile,
-				"deploy/Dockerfile.dockerignore",
-				testMainGo,
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			contextDir := t.TempDir()
-			writeFiles(t, contextDir, tt.files)
-
-			got, err := buildContextFiles(t, contextDir, tt.dockerfile)
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			if !slices.Equal(got, tt.want) {
-				t.Errorf("build context holds %q, want %q", got, tt.want)
-			}
-		})
-	}
-}
-
-// TestPerformBuildKeepsLowercaseDockerfile checks that when the Dockerfile
-// named Dockerfile is missing, the lowercase dockerfile Docker builds instead
-// stays in the build context, and its own ignore file is read.
-func TestPerformBuildKeepsLowercaseDockerfile(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name  string
-		files map[string]string // path in the context: contents
-		want  []string          // files sent in the build context
-	}{
-		{
-			name: "kept when the ignore file names it",
-			files: map[string]string{
-				defaultDockerignoreName: "*\n",
-				testLowercaseDockerfile: "",
-			},
-			want: []string{defaultDockerignoreName, testLowercaseDockerfile},
-		},
-		{
-			name: "its own ignore file wins over .dockerignore",
-			files: map[string]string{
-				defaultDockerignoreName:   "main.go\n",
-				testLowercaseDockerfile:   "",
-				"dockerfile.dockerignore": "secret.txt\n",
-				testMainGo:                "",
-				testSecretFile:            "",
-			},
-			want: []string{
-				defaultDockerignoreName,
-				testLowercaseDockerfile,
-				"dockerfile.dockerignore",
-				testMainGo,
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			contextDir := t.TempDir()
-			writeFiles(t, contextDir, tt.files)
-
-			got, err := buildContextFiles(t, contextDir, defaultDockerfileName)
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			if !slices.Equal(got, tt.want) {
-				t.Errorf("build context holds %q, want %q", got, tt.want)
-			}
-		})
-	}
-}
-
-// TestPerformBuildReadsDockerfilePathInsideContext checks that ./Dockerfile
-// and /Dockerfile name the Dockerfile at the root of the context, as Docker
-// reads them, so an ignore file that names the Dockerfile does not leave it
-// out.
-func TestPerformBuildReadsDockerfilePathInsideContext(t *testing.T) {
-	t.Parallel()
-
-	for _, dockerfile := range []string{"./Dockerfile", "/Dockerfile"} {
-		t.Run(dockerfile, func(t *testing.T) {
-			t.Parallel()
-
-			contextDir := t.TempDir()
-			writeFiles(t, contextDir, map[string]string{
-				defaultDockerignoreName: "Dockerfile\nsecret.txt\n",
-				defaultDockerfileName:   "",
-				testMainGo:              "",
-				testSecretFile:          "",
-			})
-
-			got, err := buildContextFiles(t, contextDir, dockerfile)
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			want := []string{defaultDockerignoreName, defaultDockerfileName, testMainGo}
-			if !slices.Equal(got, want) {
-				t.Errorf("build context holds %q, want %q", got, want)
-			}
-		})
-	}
-}
-
-// TestPerformBuildFailsOnMalformedDockerignore checks that a pattern the
-// docker command line would reject fails the build.
-func TestPerformBuildFailsOnMalformedDockerignore(t *testing.T) {
-	t.Parallel()
-
-	contextDir := t.TempDir()
-	writeFiles(t, contextDir, map[string]string{defaultDockerignoreName: "[\n"})
-
-	_, err := buildContextFiles(t, contextDir, defaultDockerfileName)
-
-	want := "failed to create build context: " +
-		"invalid pattern in .dockerignore: syntax error in pattern"
-	if err == nil || err.Error() != want {
-		t.Errorf("got error %v, want %q", err, want)
-	}
-}
-
-// TestPerformBuildFailsOnUnreadableDockerignore checks that an ignore file
-// that cannot be read, here because it is a directory, fails the build.
-func TestPerformBuildFailsOnUnreadableDockerignore(t *testing.T) {
-	t.Parallel()
-
-	contextDir := t.TempDir()
-
-	err := os.Mkdir(filepath.Join(contextDir, defaultDockerignoreName), 0o750)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	_, err = buildContextFiles(t, contextDir, defaultDockerfileName)
-
-	want := "failed to create build context: failed to read .dockerignore: "
-	if err == nil || !strings.HasPrefix(err.Error(), want) {
-		t.Errorf("got error %v, want one starting %q", err, want)
-	}
-}
-
-// writeFiles writes files, a map of paths inside dir to their contents,
-// creating the directories they are in.
-func writeFiles(t *testing.T, dir string, files map[string]string) {
-	t.Helper()
-
-	for name, contents := range files {
-		path := filepath.Join(dir, name)
-
-		err := os.MkdirAll(filepath.Dir(path), 0o750)
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		err = os.WriteFile(path, []byte(contents), 0o600)
-		if err != nil {
-			t.Fatal(err)
-		}
-	}
-}
-
-// buildContextFiles runs a build of contextDir against a fake Docker API and
-// returns the names of the files in the build context sent to it, sorted.
-func buildContextFiles(t *testing.T, contextDir, dockerfile string) ([]string, error) {
-	t.Helper()
-
-	sent := make(chan []string, 1)
-
-	srv := httptest.NewServer(http.HandlerFunc(
-		func(w http.ResponseWriter, r *http.Request) {
-			switch {
-			case strings.HasSuffix(r.URL.Path, "/version"):
-				_, _ = w.Write([]byte(`{"Version":"27.3.1","ApiVersion":"1.47"}`))
-			case strings.HasSuffix(r.URL.Path, "/session"):
-				serveSession(t, w, r, make(chan string, 1))
-			case strings.HasSuffix(r.URL.Path, "/build"):
-				sent <- tarFileNames(t, r.Body)
-			default:
-				t.Errorf("unexpected request to %s", r.URL.Path)
-			}
-		},
-	))
-	t.Cleanup(srv.Close)
-
-	dockerAPI, err := client.NewClientWithOpts(
-		client.WithHost("tcp://" + srv.Listener.Addr().String()),
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	c := &Client{docker: dockerAPI, log: slog.Default()}
-
-	_, err = c.performBuild(t.Context(), BuildImageOptions{
-		ContextDir:     contextDir,
-		DockerfilePath: dockerfile,
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	return <-sent, nil
-}
-
-// tarFileNames returns the names of the regular files in the tar read from r,
-// sorted.
-func tarFileNames(t *testing.T, r io.Reader) []string {
-	t.Helper()
-
-	var names []string
-
-	reader := tar.NewReader(r)
-
-	for {
-		header, err := reader.Next()
-		if errors.Is(err, io.EOF) {
-			break
-		}
-
-		if err != nil {
-			t.Errorf("reading the build context: %v", err)
-
-			return nil
-		}
-
-		if header.Typeflag == tar.TypeReg {
-			names = append(names, header.Name)
-		}
-	}
-
-	slices.Sort(names)
-
-	return names
-}

internal/docker/client.go

@@ -25,6 +25,7 @@ import (
 	"github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/api/types/versions"
 	"github.com/docker/docker/client"
+	"github.com/docker/docker/pkg/archive"
 	"github.com/docker/docker/pkg/jsonmessage"
 	"github.com/docker/docker/pkg/stdcopy"
 	"github.com/docker/go-connections/nat"
@@ -659,7 +660,7 @@ func (c *Client) performBuild(
 	}
 
 	// Create tar archive of build context
-	tarArchive, err := tarBuildContext(opts.ContextDir, opts.DockerfilePath)
+	tarArchive, err := archive.TarWithOptions(opts.ContextDir, &archive.TarOptions{})
 	if err != nil {
 		return "", fmt.Errorf("failed to create build context: %w", err)
 	}

internal/handlers/app_name_validation_test.go

@@ -1,16 +1,7 @@
 package handlers //nolint:testpackage // testing unexported validateAppName
 
 import (
-	"bytes"
-	"strconv"
-	"strings"
 	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"sneak.berlin/go/upaas/internal/models"
-	"sneak.berlin/go/upaas/templates"
 )
 
 func TestValidateAppName(t *testing.T) {
@@ -72,42 +63,3 @@ func TestValidateAppName(t *testing.T) {
 		})
 	}
 }
-
-func TestValidateAppNameErrorMentionsDots(t *testing.T) {
-	t.Parallel()
-
-	err := validateAppName("a..b")
-
-	require.ErrorIs(t, err, errAppNamePattern)
-	assert.Contains(t, err.Error(), "dots")
-}
-
-// TestAppFormsCheckAppNameLikeServer checks that the name field on the new
-// and edit app forms has the server's pattern and length limits, and that
-// its hint mentions dots.
-func TestAppFormsCheckAppNameLikeServer(t *testing.T) {
-	t.Parallel()
-
-	pattern := strings.TrimSuffix(strings.TrimPrefix(validAppNameRe.String(), "^"), "$")
-
-	pages := map[string]map[string]any{
-		"app_new.html":  {},
-		"app_edit.html": {dataKeyApp: &models.App{}},
-	}
-
-	for page, data := range pages {
-		var out bytes.Buffer
-
-		require.NoError(t, templates.GetParsed().ExecuteTemplate(&out, page, data))
-
-		// The name field and its hint, up to the end of their div.
-		_, field, found := strings.Cut(out.String(), `id="name"`)
-		require.True(t, found, page)
-
-		field, _, _ = strings.Cut(field, "</div>")
-		assert.Contains(t, field, `pattern="`+pattern+`"`, page)
-		assert.Contains(t, field, `minlength="`+strconv.Itoa(appNameMinLength)+`"`, page)
-		assert.Contains(t, field, `maxlength="`+strconv.Itoa(appNameMaxLength)+`"`, page)
-		assert.Contains(t, field, "hyphens, and dots", page)
-	}
-}

internal/handlers/dashboard_layout_test.go

@@ -1,77 +0,0 @@
-package handlers_test
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"sneak.berlin/go/upaas/internal/service/app"
-)
-
-// TestDashboardTableFitsCard checks that the card around the app table
-// scrolls sideways instead of hiding what does not fit, and that a long
-// repository URL wraps instead of pushing the action buttons out.
-func TestDashboardTableFitsCard(t *testing.T) {
-	t.Parallel()
-
-	testCtx := setupTestHandlers(t)
-
-	repoURL := "https://git.example.com/user/" +
-		"a-repository-name-long-enough-to-push-the-action-buttons-out.git"
-
-	_, err := testCtx.appSvc.CreateApp(t.Context(), app.CreateAppInput{
-		Name:    "long-url-app",
-		RepoURL: repoURL,
-	})
-	require.NoError(t, err)
-
-	request := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
-	recorder := httptest.NewRecorder()
-
-	testCtx.handlers.HandleDashboard().ServeHTTP(recorder, request)
-
-	require.Equal(t, http.StatusOK, recorder.Code)
-
-	body := recorder.Body.String()
-
-	beforeTable, _, found := strings.Cut(body, `<table class="table">`)
-	require.True(t, found, "dashboard has no app table")
-
-	cardTag := beforeTable[strings.LastIndex(beforeTable, "<div"):]
-	assert.Contains(t, cardTag, "overflow-x-auto")
-	assert.NotContains(t, cardTag, "overflow-hidden")
-
-	beforeURL, _, found := strings.Cut(body, ">"+repoURL+"</td>")
-	require.True(t, found, "dashboard has no repository cell")
-
-	cellTag := beforeURL[strings.LastIndex(beforeURL, "<td"):]
-	assert.Contains(t, cellTag, "whitespace-normal")
-	assert.Contains(t, cellTag, "break-all")
-}
-
-// TestTopBarWrapsWhenNarrow checks that the top bar keeps a gap between the
-// µPaaS title and the New App and Logout buttons, and puts the buttons on a
-// second row in a window too narrow for one, instead of letting them meet.
-func TestTopBarWrapsWhenNarrow(t *testing.T) {
-	t.Parallel()
-
-	testCtx := setupTestHandlers(t)
-
-	request := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
-	recorder := httptest.NewRecorder()
-
-	testCtx.handlers.HandleDashboard().ServeHTTP(recorder, request)
-
-	require.Equal(t, http.StatusOK, recorder.Code)
-
-	_, afterNav, found := strings.Cut(recorder.Body.String(), `<nav class="app-bar">`)
-	require.True(t, found, "dashboard has no top bar")
-
-	rowTag, _, _ := strings.Cut(strings.TrimSpace(afterNav), ">")
-	assert.Contains(t, rowTag, "flex-wrap")
-	assert.Contains(t, rowTag, "gap-")
-}

internal/handlers/handlers_test.go

@@ -109,9 +109,6 @@ func createAppServices(
 	})
 	require.NoError(t, authErr)
 
-	// 1 MiB per password hash instead of 64 MiB; see auth.Service.ArgonMemory.
-	authSvc.ArgonMemory = 1024
-
 	appSvc, appErr := app.New(fx.Lifecycle(nil), app.ServiceParams{
 		Logger:   logInstance,
 		Database: dbInstance,

internal/service/auth/auth.go

@@ -59,13 +59,6 @@ type ServiceParams struct {
 
 // Service provides authentication functionality.
 type Service struct {
-	// ArgonMemory is the memory each argon2id hash takes, in KiB. New sets
-	// argonMemory, 64 MiB, and upaasd never changes it. Tests lower it, since
-	// many 64 MiB hashes at once under the race detector need more memory
-	// than a 4 GiB build machine has. A hash verifies only with the value it
-	// was made with.
-	ArgonMemory uint32
-
 	log    *slog.Logger
 	db     *database.Database
 	store  *sessions.CookieStore
@@ -84,11 +77,10 @@ func New(_ fx.Lifecycle, params ServiceParams) (*Service, error) {
 	}
 
 	return &Service{
-		ArgonMemory: argonMemory,
-		log:         params.Logger.Get(),
-		db:          params.Database,
-		store:       store,
-		params:      &params,
+		log:    params.Logger.Get(),
+		db:     params.Database,
+		store:  store,
+		params: &params,
 	}, nil
 }
 
@@ -105,7 +97,7 @@ func (svc *Service) HashPassword(password string) (string, error) {
 		[]byte(password),
 		salt,
 		argonTime,
-		svc.ArgonMemory,
+		argonMemory,
 		argonThreads,
 		argonKeyLen,
 	)
@@ -140,7 +132,7 @@ func (svc *Service) VerifyPassword(hashedPassword, password string) bool {
 		[]byte(password),
 		salt,
 		argonTime,
-		svc.ArgonMemory,
+		argonMemory,
 		argonThreads,
 		argonKeyLen,
 	)

internal/service/auth/auth_test.go

@@ -65,10 +65,6 @@ func setupTestService(t *testing.T) (*auth.Service, func()) {
 	})
 	require.NoError(t, err)
 
-	// 1 MiB per hash instead of 64 MiB; see Service.ArgonMemory. The tests
-	// that use setupAuthService keep 64 MiB.
-	svc.ArgonMemory = 1024
-
 	// t.TempDir() automatically cleans up after test
 	cleanup := func() {}
 
@@ -241,21 +237,6 @@ func TestVerifyPassword(testingT *testing.T) {
 	})
 }
 
-// TestHashPasswordWithUpaasdMemory hashes and verifies a password with the
-// memory New sets, which upaasd uses. setupTestService lowers it.
-func TestHashPasswordWithUpaasdMemory(t *testing.T) {
-	t.Parallel()
-
-	svc := setupAuthService(t, false)
-	require.Equal(t, uint32(64*1024), svc.ArgonMemory)
-
-	hash, err := svc.HashPassword("correctpassword")
-	require.NoError(t, err)
-
-	assert.True(t, svc.VerifyPassword(hash, "correctpassword"))
-	assert.False(t, svc.VerifyPassword(hash, "wrongpassword"))
-}
-
 func TestIsSetupRequired(testingT *testing.T) {
 	testingT.Parallel()
 

internal/service/deploy/deploy_app_name_test.go

@@ -2,13 +2,7 @@ package deploy_test
 
 import (
 	"context"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"os"
 	"slices"
-	"strings"
 	"testing"
 
 	"github.com/distribution/reference"
@@ -16,17 +10,11 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"sneak.berlin/go/upaas/internal/database"
-	"sneak.berlin/go/upaas/internal/globals"
-	"sneak.berlin/go/upaas/internal/handlers"
-	"sneak.berlin/go/upaas/internal/logger"
 	"sneak.berlin/go/upaas/internal/models"
-	"sneak.berlin/go/upaas/internal/service/app"
 )
 
-// TestDeployAppWithDotInName creates an app named sneak.berlin through the
-// new app form, as a user does, then builds and deploys it against a fake
-// Docker API and checks that Docker accepts the names of the image it
+// TestDeployAppWithDotInName deploys an app named sneak.berlin against a
+// fake Docker API and checks that Docker accepts the names of the image it
 // builds and of the container it runs, using Docker's own rules for each.
 func TestDeployAppWithDotInName(t *testing.T) {
 	t.Parallel()
@@ -39,15 +27,15 @@ func TestDeployAppWithDotInName(t *testing.T) {
 	svc, db := newImageTestService(t, api)
 	ctx := context.Background()
 
-	createdApp := createAppWithForm(t, db, "sneak.berlin")
+	app := saveApp(t, db, "sneak.berlin", "", "")
 
 	deployment := models.NewDeployment(db)
-	deployment.AppID = createdApp.ID
+	deployment.AppID = app.ID
 	require.NoError(t, deployment.Save(ctx))
 
-	imageID, err := svc.BuildImage(ctx, createdApp, deployment)
+	imageID, err := svc.BuildImage(ctx, app, deployment)
 	require.NoError(t, err)
-	require.NoError(t, svc.DeployContainer(ctx, createdApp, deployment, imageID))
+	require.NoError(t, svc.DeployContainer(ctx, app, deployment, imageID))
 
 	images, _ := api.state()
 
@@ -65,57 +53,5 @@ func TestDeployAppWithDotInName(t *testing.T) {
 	require.Equal(t, []string{"upaas-sneak.berlin"}, containers)
 	assert.Regexp(t, names.RestrictedNamePattern, containers[0])
 
-	assert.DirExists(t, svc.GetBuildDirExported(createdApp.Name))
-}
-
-// createAppWithForm posts the new app form with the given name, which
-// checks the name as it does for a user, and returns the app it created.
-func createAppWithForm(
-	t *testing.T,
-	db *database.Database,
-	name string,
-) *models.App {
-	t.Helper()
-
-	log := logger.NewForTest(slog.New(slog.NewTextHandler(os.Stderr, nil)))
-
-	appSvc, err := app.New(nil, app.ServiceParams{Logger: log, Database: db})
-	require.NoError(t, err)
-
-	globalInstance, err := globals.New(nil)
-	require.NoError(t, err)
-
-	handlersInstance, err := handlers.New(nil, handlers.Params{
-		Logger:   log,
-		Globals:  globalInstance,
-		Database: db,
-		App:      appSvc,
-	})
-	require.NoError(t, err)
-
-	form := url.Values{
-		"name":     {name},
-		"repo_url": {"git@example.com:sneak/" + name + ".git"},
-	}
-	request := httptest.NewRequestWithContext(
-		t.Context(), http.MethodPost, "/apps", strings.NewReader(form.Encode()),
-	)
-	request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-
-	recorder := httptest.NewRecorder()
-
-	handlersInstance.HandleAppCreate().ServeHTTP(recorder, request)
-
-	// The form redirects to the new app's page; it shows the form again,
-	// with the error, when it refuses the name.
-	require.Equal(t, http.StatusSeeOther, recorder.Code, recorder.Body.String())
-
-	appID, found := strings.CutPrefix(recorder.Header().Get("Location"), "/apps/")
-	require.True(t, found)
-
-	createdApp, err := models.FindApp(t.Context(), db, appID)
-	require.NoError(t, err)
-	require.NotNil(t, createdApp)
-
-	return createdApp
+	assert.DirExists(t, svc.GetBuildDirExported(app.Name))
 }

templates/base.html

@@ -26,7 +26,7 @@
 
 {{define "nav"}}
 <nav class="app-bar">
-    <div class="max-w-6xl mx-auto flex flex-wrap justify-between items-center gap-3">
+    <div class="max-w-6xl mx-auto flex justify-between items-center">
         <div class="flex items-center gap-3">
             <a href="/" class="text-xl font-medium text-gray-900 hover:text-primary-600 transition-colors">µPaaS</a>
             <span class="text-sm text-gray-500">by <a href="https://sneak.berlin" class="text-primary-600 hover:text-primary-800">@sneak</a></span>

templates/dashboard.html

@@ -20,7 +20,7 @@
     </div>
 
     {{if .AppStats}}
-    <div class="card overflow-x-auto">
+    <div class="card overflow-hidden">
         <table class="table">
             <thead class="table-header">
                 <tr>
@@ -41,7 +41,7 @@
                             {{.App.Name}}
                         </a>
                     </td>
-                    <td class="text-gray-500 font-mono text-xs whitespace-normal break-all">{{.App.RepoURL}}</td>
+                    <td class="text-gray-500 font-mono text-xs">{{.App.RepoURL}}</td>
                     <td class="text-gray-500">{{.App.Branch}}</td>
                     <td>
                         {{if eq .App.Status "running"}}