4 Commits

Include renames

Author	SHA1	Message	Date
clawbot	957de7f99f	Make the HSTS max-age configurable with HSTS_MAX_AGE (closes #271) ... HSTS_MAX_AGE, a Go duration, sets the max-age of the Strict-Transport-Security header. Unset, it is ten years (87600h); 0 sends no header at all. A negative value, or one that is not a whole number of seconds, stops startup like an unparseable one. includeSubDomains and preload stay in the header. The value is shown on /settings and in the startup log, and the README's HSTS section now says what each part of the header commits the operator to. Model: opus-5-5	2026-10-13 03:27:24 +02:00
clawbot	4958a6f2e4	Isolate config tests from the shell; any out-of-range PORT is ErrInvalidPort (closes #94) ... The config tests unset variables without restoring them and read whatever the developer's shell exported, so results could differ from one machine to the next. config.ClearEnvForTest, in internal/config/testing.go, unsets every variable in the process environment and, when the test ends, leaves it exactly as it found it; every config test and the first-boot test call it before setting their own. TestEnvPositiveInt and TestEnvPort share one table runner, and the port errors name the bad value. A PORT of zero, below zero, or too large to parse now matches ErrInvalidPort, as one above 65535 already did. The README and the Settings page say an unparseable or non-positive RETENTION_SWEEP_INTERVAL stops startup. Model: opus-5-5	2026-10-02 17:44:30 +02:00
clawbot	21aafbf928	Remove the no-op MAINTENANCE_MODE setting (closes #317) ... MAINTENANCE_MODE did nothing but make the healthcheck JSON report maintenanceMode: true; no request was ever served differently, so an operator who set it expecting requests to be refused got nothing. It is removed from the configuration, the startup configuration log line, the healthcheck JSON, the README and the Settings page, together with the uncalled Server.MaintenanceMode method and the healthcheck's dependency on the configuration. A leftover value in an environment is ignored like any other unknown variable. Model: opus-5-5	2026-10-02 13:27:43 +02:00
clawbot	287e47df7f	Add a read-only Settings page for the loaded configuration (closes #402) ... A new page at /settings, linked from the navigation bar and behind the login, lists every configuration field the server loaded at startup: its environment variable, the README table's description, and the value in effect. METRICS_PASSWORD and SENTRY_DSN show only as set or not set; their values are replaced before rendering and never reach the template. The route is GET only and its group is built like the other admin page groups. Tests set the credentials one at a time so each value shown is checked against its own field and a set secret never appears in the page. Model: opus-5-5	2026-10-02 12:30:21 +02:00