Bind 0.0.0.0 to IPv4 only (closes #528)

Go listens on any unspecified address with one socket that answers
IPv4 and IPv6, so BIND_ADDRESS=0.0.0.0 also bound every IPv6 address,
which the README says it does not. The listener now uses tcp4 for an
IPv4 address; :: still binds both. The server's start hook suppresses
contextcheck, as the other start hooks do.

The image's health check asked for localhost, which wget reached over
::1 only, so it now asks for 127.0.0.1. The README says what that
means for a loopback bind in a container, drops the bindv6only
condition from :: (Go sets that socket option itself), and names an
ss check.

Model: opus-5-5

Dockerfile

@@ -214,16 +214,22 @@ RUN version="$(make version VERSION="$VERSION")"; \
 # (Alpine.js, extracted from its tarball in 3p/) first.
 RUN make build VERSION="$VERSION"
 
-# Rebuild with static linking for Alpine runtime.
-# make build already verified compilation.
-# The CGO binary from `make build` is dynamically linked against glibc,
-# which doesn't exist on Alpine (musl). Rebuild with static linking so
-# the binary runs on Alpine without glibc.
+# Rebuild with static linking for the Alpine runtime. The cgo binary the
+# step above builds is dynamically linked against glibc, which Alpine
+# (musl) does not have.
 #
-# The static flags go in through GO_LDFLAGS rather than a -ldflags of
-# their own: the build target composes them with the -X that stamps the
-# version, so this relink cannot silently drop the stamp.
-RUN CGO_ENABLED=1 make build VERSION="$VERSION" GO_LDFLAGS='-extldflags "-static"'
+# A statically linked glibc still loads shared libraries at run time for
+# getaddrinfo and dlopen, and Alpine has none to load, so the build tags
+# keep both out of the binary: netgo and osusergo select Go's own DNS
+# resolver and user lookup instead of glibc's, and
+# sqlite_omit_load_extension leaves out SQLite extension loading, which
+# webhooker never uses.
+#
+# The static flags and tags go in through GO_LDFLAGS and GO_TAGS rather
+# than a -ldflags of their own: the build target composes them with the
+# -X that stamps the version, so this relink cannot silently drop the
+# stamp.
+RUN CGO_ENABLED=1 make build VERSION="$VERSION" GO_TAGS=netgo,osusergo,sqlite_omit_load_extension GO_LDFLAGS='-extldflags "-static"'
 
 # Runtime stage
 # alpine:3.21, 2026-03-17
@@ -268,8 +274,11 @@ EXPOSE 8080
 # port.
 ENV BIND_ADDRESS=0.0.0.0
 
+# The address is 127.0.0.1 because wget tries only the first address
+# localhost resolves to. That can be ::1, which a 0.0.0.0 bind does
+# not answer.
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
-    CMD wget --no-verbose --tries=1 --spider http://localhost:8080/.well-known/healthcheck || exit 1
+    CMD wget --no-verbose --tries=1 --spider http://127.0.0.1:8080/.well-known/healthcheck || exit 1
 
 ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
 CMD ["/app/webhooker"]

Makefile

@@ -16,14 +16,16 @@ VERSION ?= $(shell script/version)
 # exists to correct.
 override VERSION := $(or $(strip $(VERSION)),$(shell script/version))
 
-# Extra linker flags for the build target. The static relink in the
-# Dockerfile adds -extldflags here rather than passing its own -ldflags,
-# so composing flags cannot drop the version stamp.
+# Extra linker flags and build tags for the build target. The static
+# relink in the Dockerfile passes -extldflags and its build tags through
+# these rather than a -ldflags of its own, so composing flags cannot drop
+# the version stamp.
 #
 # The build target itself always passes -trimpath and -s -w, as the Go
 # Dockerfile in REPO_POLICIES.md does: no build paths, symbol table or
 # debug information in the binary.
 GO_LDFLAGS ?=
+GO_TAGS ?=
 
 bootstrap:
 	@script/bootstrap
@@ -53,7 +55,7 @@ check:
 	@script/check
 
 build: assets
-	go build -trimpath -ldflags '$(strip -s -w -X main.version=$(VERSION) $(GO_LDFLAGS))' -o bin/webhooker ./cmd/webhooker
+	go build -trimpath -tags '$(GO_TAGS)' -ldflags '$(strip -s -w -X main.version=$(VERSION) $(GO_LDFLAGS))' -o bin/webhooker ./cmd/webhooker
 
 run: build
 	./bin/webhooker

README.md

@@ -316,10 +316,9 @@ The value must be an IP address literal:
 
 - `127.0.0.1` — loopback only (the binary's default). Use this with a reverse
   proxy on the same host.
-- `0.0.0.0` — every IPv4 address. The image's default; on a bare host, only
-  behind a firewall on the port.
-- `::` — every address, IPv6 and (on Linux, with the default
-  `net.ipv6.bindv6only=0`) IPv4 as well.
+- `0.0.0.0` — every IPv4 address and no IPv6 address. The image's default; on a
+  bare host, only behind a firewall on the port.
+- `::` — every IPv6 address and every IPv4 address.
 - A specific address such as `10.0.0.5` — that interface only.
 
 An **empty** value is treated as unset, as everywhere else here, and takes the
@@ -340,7 +339,8 @@ machine that has no such interface — is a valid literal, so it reaches the
 listener and fails there. The process logs the bind error and exits non-zero
 rather than staying up with nothing listening. The effective value is in the
 `bindAddress` field of the startup log line, which is the way to check what a
-running deployment actually bound.
+running deployment actually bound. On a bare host, `ss -ltn` lists the socket
+itself as `0.0.0.0:8080` for a `0.0.0.0` bind and as `*:8080` for `::`.
 
 #### Metrics credentials
 
@@ -465,10 +465,7 @@ idle timestamp is rewritten at most once per tenth of the idle window rather
 than on every request, which means a session may expire up to 10% early relative
 to the user's true last request, but never late.
 
-Both clocks are anchored by timestamps stored in the session cookie. Sessions
-issued before this feature existed carry neither, so they are treated as
-expired: upgrading to a build that has it logs every existing session out once,
-and those users sign in again.
+Both clocks are anchored by timestamps stored in the session cookie.
 
 #### Invalid values abort startup
 
@@ -670,10 +667,10 @@ Either set a literal or leave the variable out entirely.
 
 Overriding `BIND_ADDRESS` to a loopback address in a container — by that route
 or deliberately — makes the container unreachable from outside its namespace
-even with `-p`. The published port answers nothing, and the health check fails
-too: it requests `http://localhost:8080`, `localhost` resolves to `::1` first,
-and a `127.0.0.1` bind is not listening there. The container then goes
-`unhealthy` about **65 seconds** after start — from
+even with `-p`. The published port answers nothing. The health check requests
+`http://127.0.0.1:8080` from inside the container, so a `127.0.0.1` bind passes
+it and the container stays `healthy`. A `::1` bind fails it, and the container
+goes `unhealthy` about **65 seconds** after start — from
 `HEALTHCHECK --start-period=5s --interval=30s --retries=3`, so failing probes at
 5s, 35s and 65s, and `unhealthy` on the third. (Docker's probe cadence during
 the start period has changed between versions; re-derive from those three values
@@ -702,11 +699,11 @@ app as that user.
 `webhooker.db` holds target configuration in plaintext — bearer tokens, API
 keys, Slack webhook URLs — along with the session encryption key, so webhooker
 creates every SQLite file it owns `0600`: each database and both of its `-wal`
-and `-shm` sidecars, across all three tiers. Files an earlier build left `0644`
-are tightened when they are opened. The directory's `0750` is defence in depth —
-it stops other local users listing the directory and learning your webhook UUIDs
-from the `events-{uuid}.db` filenames — not the barrier protecting the
-credentials.
+and `-shm` sidecars, across all three tiers. Any of them found at another mode
+is set to `0600` when the database is opened. The directory's `0750` is defence
+in depth — it stops other local users listing the directory and learning your
+webhook UUIDs from the `events-{uuid}.db` filenames — not the barrier protecting
+the credentials.
 
 ### Running under upaas
 
@@ -729,7 +726,7 @@ credentials.
       address (directly, or through anything that can rewrite source addresses,
       such as NAT or a published container port). The `remoteIP` field of the
       `http request` log line for a request that came through the proxy shows
-      that address; the health check's own lines show `::1`. See
+      that address; the health check's own lines show `127.0.0.1`. See
       [Trusted proxies](#trusted-proxies).
     - Leave `BIND_ADDRESS` and `DATA_DIR` unset: the image sets `BIND_ADDRESS`
       to `0.0.0.0`, and `DATA_DIR` defaults to `/var/lib/webhooker`.
@@ -918,7 +915,7 @@ replaces the `max-age` it stored, so to end the policy sooner, set a short
 `HSTS_MAX_AGE` such as `1s` and keep it until returning browsers have picked it
 up, or have a reverse proxy send `max-age=0`.
 
-## Backup, Restore, and Upgrades
+## Backup and Restore
 
 ### What to back up
 
@@ -1071,60 +1068,14 @@ beside it, or wait until there are none.
 
 4. Start the service. The container gives the directory and the restored files
    to the `webhooker` user before the app starts, whoever restored them (see
-   [Running with Docker](#running-with-docker)). Each restored database gets any
-   of its SQL migrations it has not had as it is opened (see
-   [Upgrades](#upgrades)).
-
-### Upgrades
-
-**Back up before every upgrade.** Each kind of database file has its schema in
-SQL files built into the binary, one directory per kind under
-`internal/db/migrations/`. In each, `000_migration.sql` creates the
-`schema_migrations` table, which records the number of every file the database
-has had, and `001_schema.sql` holds the whole schema. Opening a database runs,
-in one transaction, every file in its directory that `schema_migrations` does
-not list:
-
-- `main/` for the main database, on connect — settings, users, API keys,
-  webhooks, entrypoints and targets
-- `events/` for each event database, when it is lazily opened — events,
-  deliveries, delivery results and their running totals
-- `archive/` for each archive database, on every open and reopen
-
-There are no down migrations.
-
-Upgrade procedure:
-
-1. Stop the service.
-2. Back up `DATA_DIR` using one of the procedures above.
-3. Pull the new image and start it.
-4. Confirm `database migrations completed` in the logs before putting traffic
-   back on it.
-5. Confirm the new build is the one running:
-   `curl -s http://host:8080/.well-known/healthcheck` reports the version it was
-   stamped with (see [Version stamping](#version-stamping)).
-
-**Upgrading past the introduction of `BIND_ADDRESS`:** earlier versions always
-bound every interface. **Container deployments are unaffected** — the image
-ships `ENV BIND_ADDRESS=0.0.0.0`, so a `docker run` or Compose service that
-worked before still works with nothing changed.
-
-A **bare binary** is the case that changes: the listener now binds `127.0.0.1`
-unless `BIND_ADDRESS` says otherwise, so a deployment that relied on reaching it
-from another host becomes unreachable until it sets the address the proxy
-connects to. Check the `bindAddress` field of the startup log to see what a
-running process bound. See [Bind address](#bind-address).
-
-**Downgrade is unsupported.** Once a newer binary has migrated the files there
-is no way to move them back. The only supported way back to an older version is
-restoring the pre-upgrade backup, which discards everything received since that
-backup was taken.
+   [Running with Docker](#running-with-docker)).
 
 ### Version stamping
 
 The binary reports its version at `/.well-known/healthcheck` (the `version`
 field), in the UI footer, and in the startup log line (`msg=starting`,
 `version=...`). It is also the Sentry release name, as `webhooker-{version}`.
+`curl -s http://host:8080/.well-known/healthcheck` shows which build is running.
 The value is stamped in at build time by the linker; it is not read from a file
 at runtime, so it identifies the build itself.
 
@@ -1583,8 +1534,7 @@ The cap is not arbitrary: the reaper computes its cutoff as a `time.Duration`,
 an int64 nanosecond count, and a longer period overflows it. An overflowed
 cutoff lands in the future, where it matches every row, so the sweep would
 delete every event the webhook has instead of none. The reaper also clamps the
-value it is given, so a row written by an older version cannot trigger that
-either.
+value it reads to the cap, so no stored value can trigger that either.
 
 #### Entrypoint
 
@@ -1967,7 +1917,7 @@ and application state:
 - **APIKeys** — programmatic access credentials
 
 On first startup the main database is created from its SQL files (see
-[Upgrades](#upgrades)), a session encryption key is generated and stored, and an
+[Schema](#schema)), a session encryption key is generated and stored, and an
 `admin` user is created.
 
 **Per-Webhook Event Databases** (`{DATA_DIR}/events-{webhook_uuid}.db`) — each
@@ -2164,6 +2114,21 @@ The database uses the
 though CGO is required at build time due to the transitive `mattn/go-sqlite3`
 dependency from `gorm.io/driver/sqlite`.
 
+#### Schema
+
+Each kind of database file has its schema in SQL files built into the binary,
+one directory per kind under `internal/db/migrations/`. In each,
+`000_migration.sql` creates the `schema_migrations` table, which records the
+number of every file the database has had, and `001_schema.sql` holds the whole
+schema. Opening a database runs, in one transaction, every file in its directory
+that `schema_migrations` does not list:
+
+- `main/` for the main database, on connect — settings, users, API keys,
+  webhooks, entrypoints and targets
+- `events/` for each event database, when it is lazily opened — events,
+  deliveries, delivery results and their running totals
+- `archive/` for each archive database, on every open and reopen
+
 ### Request Flow
 
 ```
@@ -3454,12 +3419,14 @@ fixed independently of the compiler's:
    phases and the `css-check` and `markdown-check` stages passing (it copies a
    file from each), runs `make build` (which extracts Alpine.js from `3p/`
    first), and then rebuilds the binary with `CGO_ENABLED=1` and static linking
-   so it runs on musl. Both builds go through `make build`, the relink adding
-   its `-extldflags` via `GO_LDFLAGS`, so neither can drop the `-X` that stamps
-   the version. The version is the `VERSION` build arg if one is given,
-   otherwise derived from the `.git` in the context, and the stage fails if a
-   context with `.git` would stamp an empty version, `dev` or `unknown` (see
-   [Version stamping](#version-stamping)).
+   so it runs on musl, with the build tags `netgo`, `osusergo` and
+   `sqlite_omit_load_extension` so it needs none of glibc's shared libraries at
+   run time. Both builds go through `make build`, the relink adding its
+   `-extldflags` via `GO_LDFLAGS` and its tags via `GO_TAGS`, so neither can
+   drop the `-X` that stamps the version. The version is the `VERSION` build arg
+   if one is given, otherwise derived from the `.git` in the context, and the
+   stage fails if a context with `.git` would stamp an empty version, `dev` or
+   `unknown` (see [Version stamping](#version-stamping)).
 7. **Runtime stage** (`alpine:3.21`) — copies the static binary and
    `deploy/docker-entrypoint.sh`, creates the `/var/lib/webhooker` directory for
    all SQLite databases, exposes port 8080, and includes a health check against

internal/database/model_event.go

@@ -45,8 +45,7 @@ type Event struct {
 
 	// ResubmittedFromID names the event this one was copied from by
 	// an operator resubmit. It is nil for an event that arrived on
-	// the receiver, which is every event created before the column
-	// existed. It is not a foreign key: the source event can be
+	// the receiver. It is not a foreign key: the source event can be
 	// reaped by retention while its copies remain, and the id is
 	// kept as the record of where the copy came from either way.
 	ResubmittedFromID *string `gorm:"type:uuid;index:idx_events_resubmitted_from_id,priority:1;index:idx_events_entrypoint_id,priority:3" json:"resubmittedFromId,omitempty"`

internal/database/model_webhook.go

@@ -82,7 +82,7 @@ type Webhook struct {
 // value while building the insert statement, which runs after
 // BeforeSave; rewriting any later than this loses that race and the
 // row lands at 30 days. Living on the model also means a future call
-// site — a REST API, a fixture, a migration — cannot bypass it.
+// site, such as a REST API or a fixture, cannot bypass it.
 func (w *Webhook) BeforeSave(_ *gorm.DB) error {
 	if w.RetentionDays <= 0 {
 		w.RetentionDays = RetentionForeverDays
@@ -98,8 +98,8 @@ func (w *Webhook) BeforeSave(_ *gorm.DB) error {
 // are exempt from reaping.
 //
 // It accepts the RetentionForeverDays sentinel written by BeforeSave
-// and, defensively, the non-positive values that rows written before
-// the sentinel existed may still carry.
+// and, defensively, any non-positive value, which BeforeSave treats
+// as a request to retain forever.
 func retainsForever(retentionDays int) bool {
 	return retentionDays <= 0 ||
 		retentionDays >= RetentionForeverDays

internal/database/retention.go

@@ -253,7 +253,7 @@ func (r *RetentionReaper) reapWebhook(
 // row in the database: the sweep then deletes every event, delivery,
 // and delivery result, including ones created seconds ago. Rejecting
 // out-of-range input at the form is the primary guard; saturating here
-// means an old row, a migration, or a future call site cannot turn a
+// means a value that reaches the row by any other path cannot turn a
 // too-large retention into total data loss.
 func retentionCutoff(
 	now time.Time,

internal/database/sqlite_open.go

@@ -118,9 +118,8 @@ const SQLiteFilePerm fs.FileMode = 0o600
 // SQLite still reports the absence rather than this function
 // materializing an empty database the caller asked not to create.
 //
-// Chmod of a file that already exists is what tightens a data
-// directory an earlier build left at 0644 — including a developer's
-// own scratch directory — without any migration machinery.
+// The mode is set on every open, whoever created the file, so a
+// database or sidecar found at a wider mode is tightened too.
 func reserveSQLiteFile(path string, create bool) error {
 	if create {
 		// gosec G304: the path is the database file the caller asked
@@ -242,7 +241,19 @@ func SQLiteDSN(path, mode string) string {
 	)
 	q.Add("_pragma", "journal_mode(WAL)")
 
-	return "file:" + path + "?" + q.Encode()
+	// SQLite reads a file: URI's path only up to the first ? or #, and
+	// decodes %XX escapes in it, so url.URL escapes the path. OmitHost
+	// keeps a relative path as "file:data/x.db"; written
+	// "file://data/x.db", SQLite would reject "data" as the URI's
+	// authority.
+	dsn := url.URL{
+		Scheme:   "file",
+		Path:     path,
+		OmitHost: true,
+		RawQuery: q.Encode(),
+	}
+
+	return dsn.String()
 }
 
 // OpenSQLite opens the SQLite file at path with the service's

internal/database/sqlite_open_test.go

@@ -2,6 +2,8 @@ package database_test
 
 import (
 	"context"
+	"database/sql"
+	"os"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -112,6 +114,79 @@ func TestMainDBAppliesPragmasOnALiveHandle(t *testing.T) {
 	assert.Equal(t, "10000", busy)
 }
 
+// TestOpenSQLiteOpensThePathAskedFor uses a data directory whose name
+// holds ?, # and %. SQLite reads a file: URI's path only up to a ? or
+// #, and decodes %41 to A, so an unescaped path sent every database in
+// that directory to one file outside it.
+func TestOpenSQLiteOpensThePathAskedFor(t *testing.T) {
+	t.Parallel()
+
+	dir := filepath.Join(t.TempDir(), "hooks#1?x%41")
+	require.NoError(t, os.Mkdir(dir, 0o700))
+
+	for _, name := range []string{
+		database.MainDBFileName,
+		"events-" + uuid.New().String() + ".db",
+	} {
+		path := filepath.Join(dir, name)
+
+		sqlDB, err := database.OpenSQLite(
+			path, database.SQLiteModeCreate,
+		)
+		require.NoError(t, err)
+
+		t.Cleanup(func() { assert.NoError(t, sqlDB.Close()) })
+
+		assertOpenedFile(t, sqlDB, path)
+	}
+}
+
+// TestOpenSQLiteOpensARelativePath opens a database at a path relative
+// to the working directory, which is what a relative DATA_DIR such as
+// the README's DATA_DIR=../webhooker-data gives OpenSQLite.
+//
+//nolint:paralleltest // t.Chdir moves the whole process.
+func TestOpenSQLiteOpensARelativePath(t *testing.T) {
+	t.Chdir(t.TempDir())
+	require.NoError(t, os.Mkdir("data", 0o700))
+
+	path := filepath.Join("data", database.MainDBFileName)
+
+	sqlDB, err := database.OpenSQLite(path, database.SQLiteModeCreate)
+	require.NoError(t, err)
+
+	defer func() { require.NoError(t, sqlDB.Close()) }()
+
+	assertOpenedFile(t, sqlDB, path)
+}
+
+// assertOpenedFile checks that sqlDB is the SQLite file at path.
+// database_list names the file SQLite actually opened, as an absolute
+// path with symlinks resolved, so the files are compared, not the names.
+func assertOpenedFile(t *testing.T, sqlDB *sql.DB, path string) {
+	t.Helper()
+
+	var (
+		seq          int
+		schema, file string
+	)
+
+	require.NoError(t, sqlDB.
+		QueryRowContext(t.Context(), "pragma database_list").
+		Scan(&seq, &schema, &file))
+
+	asked, err := os.Stat(path)
+	require.NoError(t, err)
+
+	opened, err := os.Stat(file)
+	require.NoError(t, err)
+
+	assert.True(
+		t, os.SameFile(asked, opened),
+		"asked for %s, SQLite opened %s", path, file,
+	)
+}
+
 // TestConcurrentReaderDoesNotBlockWrites is the unit-scale form of the
 // reproduction in
 // https://git.eeqj.de/sneak/webhooker/issues/256: an operator's

internal/delivery/archive_sweeper.go

@@ -201,8 +201,7 @@ func (s *ArchiveSweeper) sweep(ctx context.Context) {
 
 // sweepTarget prunes the archive of a single database target.
 // A missing, empty, or "never" expiry parses as a zero duration
-// and is skipped entirely, so those archives keep exactly the
-// behaviour they had before the sweep existed.
+// and is skipped entirely, so those archives are never pruned.
 func (s *ArchiveSweeper) sweepTarget(target *database.Target) {
 	expiry, err := parseArchiveExpiry(target.Config)
 	if err != nil {

internal/delivery/target_headers.go

@@ -82,8 +82,8 @@ func isReservedTargetHeader(name string) bool {
 // one pair silently overwriting the other.
 //
 // An input with no pairs yields an empty map, which omitempty drops
-// from the stored config: a target configured with no headers keeps
-// the same config JSON it had before this field existed.
+// from the stored config, so a target configured with no headers
+// stores no headers key at all.
 func ParseTargetHeaders(raw string) (map[string]string, error) {
 	headers := make(map[string]string)
 

internal/delivery/target_redact.go

@@ -13,9 +13,9 @@ import (
 const RedactionMarker = "(redacted)"
 
 // Redactor removes one target's own credential material from
-// text that target's remote peer chose: a delivery response
-// body, or a delivery error stored before the delivery path
-// learned to mask the URLs it embeds.
+// a delivery response body, whose text the target's remote
+// peer chose, and from a stored delivery error as a second
+// line behind the delivery path's own URL masking.
 //
 // It removes byte-identical echoes of strings taken from the
 // target's stored configuration, and nothing else. Anything

internal/handlers/delivery_attempts_test.go

@@ -42,9 +42,6 @@ func TestDeliveryAttempts_ReadInTheTargetTypesOwnTerms(t *testing.T) {
 		{database.TargetTypeLog, true, 0, "", "written to the log", ""},
 	}
 
-	// Named for type and outcome, so that no two cases share a name:
-	// Go adds "#01" to a repeated one, and a "#" in the temporary
-	// directory's path cuts the path SQLiteDSN gives SQLite short.
 	for _, tc := range cases {
 		t.Run(string(tc.targetType)+" "+tc.outcome, func(t *testing.T) {
 			t.Parallel()

internal/handlers/delivery_result_view.go

@@ -12,13 +12,12 @@ import (
 //
 // The bound is enforced here and in SQL, because this page's
 // memory profile must not depend on a constant in another
-// package staying where it is, and because rows predating the
-// delivery engine's own cap or restored from an archive are
-// not covered by it at all.
+// package staying where it is, or on every stored row having
+// been written by the delivery engine under its own cap.
 //
 // It happens to equal that engine cap, so a row written by the
-// current engine reaches this one exactly and is never cut
-// twice. Nothing here may assume the two differ: see view.
+// engine reaches this one exactly and is never cut twice.
+// Nothing here may assume the two differ: see view.
 const maxRenderedResponseBytes = 4096
 
 // deliveryResultColumns is the delivery attempt projection.
@@ -40,9 +39,8 @@ const deliveryResultColumns = "delivery_id, attempt_num, created_at, " +
 //
 // Both Error and ResponseBody have been through the target's
 // Redactor. The engine already masks the URL out of the
-// errors it stores, so for errors this is a second line
-// covering rows written before it did; for response bodies it
-// is the only line, and its reach is what
+// errors it stores, so for errors this is a second line; for
+// response bodies it is the only line, and its reach is what
 // delivery.Redactor documents.
 type DeliveryResultView struct {
 	AttemptNum int

internal/handlers/target_retries.go

@@ -49,13 +49,6 @@ var (
 // working retry configuration over a typo. A default answers a
 // question that was not asked; it never answers one that was asked
 // badly.
-//
-// A target stored with a count above the ceiling before this
-// validation existed keeps rendering and keeps delivering — nothing
-// clamps the row. Re-saving it from the edit form does have to bring
-// it into range, because the form submits the pre-filled value back
-// and accepting it would be the ceiling not applying to the edit
-// path. The 400 names the ceiling, so the fix is one field.
 func parseMaxRetries(raw string, fallback int) (int, error) {
 	raw = strings.TrimSpace(raw)
 	if raw == "" {

internal/server/bind_address_test.go

@@ -5,6 +5,7 @@ import (
 	"net"
 	"net/http"
 	"strconv"
+	"syscall"
 	"testing"
 	"time"
 
@@ -25,6 +26,11 @@ const (
 	// its network namespace even with a published port.
 	wildcardV4 = "0.0.0.0"
 
+	// loopbackV6 and wildcardV6 are the IPv6 counterparts of the two
+	// above.
+	loopbackV6 = "::1"
+	wildcardV6 = "::"
+
 	// unavailableAddr is a TEST-NET-1 address (RFC 5737). It is a
 	// well-formed literal that no host is assigned, so binding it
 	// fails with EADDRNOTAVAIL rather than succeeding somewhere
@@ -116,6 +122,24 @@ func otherLocalAddr(t *testing.T) string {
 	return ""
 }
 
+// skipWithoutIPv6 skips the test when this host cannot bind
+// loopbackV6. Without IPv6 there is no second family for a bind to
+// claim or leave alone.
+func skipWithoutIPv6(t *testing.T) {
+	t.Helper()
+
+	var listenCfg net.ListenConfig
+
+	l, err := listenCfg.Listen(
+		t.Context(), "tcp6", net.JoinHostPort(loopbackV6, "0"),
+	)
+	if err != nil {
+		t.Skip("host has no IPv6 loopback to bind")
+	}
+
+	require.NoError(t, l.Close())
+}
+
 // startBoundServer starts the wired app with the given bind address
 // on a free port and returns that port. The app is stopped on
 // cleanup.
@@ -292,6 +316,50 @@ func TestBindAddress_WildcardReachesOtherAddresses(t *testing.T) {
 	requireDialable(t, net.JoinHostPort(other, strconv.Itoa(port)))
 }
 
+// TestBindAddress_WildcardV4IsIPv4Only pins that 0.0.0.0 answers on
+// IPv4 alone, as the README says. Go listens on 0.0.0.0 with a socket
+// that answers IPv6 too unless told otherwise, which put the admin UI
+// and the receiver on every IPv6 address of a host whose operator had
+// chosen an IPv4 bind.
+func TestBindAddress_WildcardV4IsIPv4Only(t *testing.T) {
+	t.Parallel()
+
+	skipWithoutIPv6(t)
+
+	port := startBoundServer(t, wildcardV4)
+
+	// Positive control: the service really is up, on IPv4.
+	requireDialable(t, net.JoinHostPort(loopbackV4, strconv.Itoa(port)))
+
+	dialer := net.Dialer{Timeout: dialTimeout}
+
+	conn, err := dialer.DialContext(
+		t.Context(), "tcp",
+		net.JoinHostPort(loopbackV6, strconv.Itoa(port)),
+	)
+	if err == nil {
+		_ = conn.Close()
+	}
+
+	require.ErrorIs(
+		t, err, syscall.ECONNREFUSED,
+		"a %s bind answered on %s", wildcardV4, loopbackV6,
+	)
+}
+
+// TestBindAddress_WildcardV6ReachesBothFamilies is the counterpart:
+// :: is the value that binds IPv6, and it answers IPv4 as well.
+func TestBindAddress_WildcardV6ReachesBothFamilies(t *testing.T) {
+	t.Parallel()
+
+	skipWithoutIPv6(t)
+
+	port := startBoundServer(t, wildcardV6)
+
+	requireDialable(t, net.JoinHostPort(loopbackV6, strconv.Itoa(port)))
+	requireDialable(t, net.JoinHostPort(loopbackV4, strconv.Itoa(port)))
+}
+
 // TestBindAddress_ServesRequestsOnConfiguredAddress proves the bound
 // listener serves the application rather than merely accepting TCP,
 // so a bind address that is honoured cannot be mistaken for one that

internal/server/http.go

@@ -1,9 +1,11 @@
 package server
 
 import (
+	"context"
 	"errors"
 	"net"
 	"net/http"
+	"net/netip"
 	"strconv"
 	"time"
 )
@@ -39,6 +41,21 @@ func (s *Server) listenAddr() string {
 	)
 }
 
+// listenNetwork returns the network the HTTP listener binds on, "tcp4"
+// for an IPv4 BindAddress and "tcp" for any other.
+//
+// On "tcp", Go binds 0.0.0.0 with a socket that answers IPv6 as well,
+// exactly as it binds ::. "tcp4" keeps 0.0.0.0 to IPv4, which is what
+// the README says it means. :: stays on "tcp" and answers both.
+func (s *Server) listenNetwork() string {
+	addr, err := netip.ParseAddr(s.params.Config.BindAddress)
+	if err == nil && addr.Is4() {
+		return "tcp4"
+	}
+
+	return "tcp"
+}
+
 // newHTTPServer builds the HTTP server for this Server's
 // configuration.
 //
@@ -67,7 +84,17 @@ func (s *Server) serveUntilShutdown() {
 
 	s.log.Info("http begin listen", "listenaddr", s.httpServer.Addr)
 
-	err := s.httpServer.ListenAndServe()
+	// ListenAndServe always listens on "tcp", which would undo
+	// listenNetwork.
+	var listenCfg net.ListenConfig
+
+	listener, err := listenCfg.Listen(
+		context.Background(), s.listenNetwork(), s.httpServer.Addr,
+	)
+	if err == nil {
+		err = s.httpServer.Serve(listener)
+	}
+
 	if err != nil && !errors.Is(err, http.ErrServerClosed) {
 		s.log.Error("listen error", "error", err)
 		s.shutdownWithFailure()

internal/server/server.go

@@ -135,6 +135,8 @@ func New(lc fx.Lifecycle, params ServerParams) (*Server, error) {
 	s.httpServer = s.newHTTPServer()
 
 	lc.Append(fx.Hook{
+		//nolint:contextcheck // The listener outlives this hook, whose
+		// context fx cancels once the app has started.
 		OnStart: func(_ context.Context) error {
 			s.startupTime = time.Now()
 			go s.Run()

internal/session/session.go

@@ -441,10 +441,9 @@ func (s *Session) Regenerate(
 //
 // Whichever comes first ends the session.
 //
-// A session that claims to be authenticated but carries no
-// timestamps predates this check; it is treated as expired so the
-// user re-authenticates rather than being granted an unbounded
-// session.
+// A session that claims to be authenticated but lacks the timestamp
+// a deadline is measured from is treated as expired, so the user
+// re-authenticates rather than being granted an unbounded session.
 func (s *Session) expired(sess *sessions.Session) bool {
 	now := s.now()
 

internal/versionscript/version_script_test.go

@@ -156,7 +156,8 @@ func TestVersion_IsStableAcrossInvocations(t *testing.T) {
 // The build target is the only place composing linker flags. If a
 // future edit drops either half, the binary silently reports "dev"
 // again (the defect this package exists for) or fails to link on
-// Alpine.
+// Alpine. If it stops passing GO_TAGS, the image's static binary links
+// glibc's getaddrinfo and dlopen again.
 func TestMakefile_BuildComposesVersionAndExtraFlags(t *testing.T) {
 	t.Parallel()
 
@@ -164,6 +165,7 @@ func TestMakefile_BuildComposesVersionAndExtraFlags(t *testing.T) {
 
 	require.Contains(t, makefile, "-X main.version=$(VERSION)")
 	require.Contains(t, makefile, "$(GO_LDFLAGS)")
+	require.Contains(t, makefile, "-tags '$(GO_TAGS)'")
 	require.Contains(t, makefile, "VERSION ?= $(shell script/version)")
 }
 
@@ -233,7 +235,9 @@ func TestDockerfile_BuildsThroughTheMakeTarget(t *testing.T) {
 		"a raw go build bypasses the Makefile's -X flag")
 	require.Contains(t, dockerfile, "ARG VERSION")
 	require.Contains(t, dockerfile,
-		`make build VERSION="$VERSION" GO_LDFLAGS='-extldflags "-static"'`)
+		`make build VERSION="$VERSION"`+
+			` GO_TAGS=netgo,osusergo,sqlite_omit_load_extension`+
+			` GO_LDFLAGS='-extldflags "-static"'`)
 }
 
 func read(t *testing.T, path string) string {