Let a handler's flush reach the client through the access log (closes #191 )

The access log's response writer had no Unwrap method, so http.ResponseController stopped at it and a handler's Flush returned http.ErrNotSupported. It now has one. With metrics on, adding Unwrap alone is not enough: go-http-metrics' writer only passes a flush on when the writer inside it has a Flush method, and it sat inside Logging, so the flush silently did nothing. Metrics is now registered outside Logging, and the README's middleware list follows. A new test flushes through the production router, with the defaults and with metrics and Sentry on, on a global route and inside an admin page route group. Model: opus-5-5
2026-10-02 08:46:08 +00:00
15 changed files with 181 additions and 222 deletions
@@ -158,20 +158,19 @@ WireServer, which serves an Azure VM its credentials. Because it is a
 public address, listing it in `ALLOWED_EGRESS_CIDRS` reopens it.

 That is all the default blocklist covers: the IPv4 private and reserved
-ranges; of IPv6, only loopback (`::1`), the unspecified address (`::`),
-unique local addresses (`fc00::/7`), link-local addresses (`fe80::/10`),
-multicast (`ff00::/8`) and documentation space (`2001:db8::/32`); and
-certain public addresses. A public address belongs on the default
-blocklist only if it hands credentials, user data or bootstrap material
-to whatever can reach it, without the caller presenting anything. A
-provider's other public addresses are not refused. IBM Cloud, for
-example, serves its package mirrors, time servers and object storage on
-`161.26.0.0/16`, and the private endpoints of its own cloud services on
-`166.8.0.0/14`. Neither range hands out credentials that way: the token
-service among those endpoints issues a token only in exchange for
-something the caller presents, such as an API key. Reaching these
-services can be a legitimate delivery, and every cloud has some, so a
-partial list would promise coverage it does not give.
+ranges; of IPv6, only loopback (`::1`), unique local addresses
+(`fc00::/7`) and link-local addresses (`fe80::/10`); and certain public
+addresses. A public address belongs on the default blocklist only if it
+hands credentials, user data or bootstrap material to whatever can reach
+it, without the caller presenting anything. A provider's other public
+addresses are not refused. IBM Cloud, for example, serves its package
+mirrors, time servers and object storage on `161.26.0.0/16`, and the
+private endpoints of its own cloud services on `166.8.0.0/14`. Neither
+range hands out credentials that way: the token service among those
+endpoints issues a token only in exchange for something the caller
+presents, such as an API key. Reaching these services can be a
+legitimate delivery, and every cloud has some, so a partial list would
+promise coverage it does not give.

 That default is also inconvenient for the thing webhooker is mostly
 for: taking a public webhook and forwarding it to something on your own
@@ -211,16 +210,16 @@ Two things this setting cannot do:
  the list is always an allowlist; an empty list (the default) means
  every private and reserved range stays refused. Note that
  `0.0.0.0/0` gets you most of the way there anyway, per above.
- **It cannot open link-local, the unspecified addresses, or a cloud
-  metadata endpoint at a non-public address that discloses credentials
-  or user data.** A metadata address is on the list below when it is not
-  a public address and both of these hold: the provider fixes it, so it
-  cannot collide with anything you run; and reaching it hands out
-  credentials, user data or bootstrap material. Those stay blocked no
-  matter what you list, including when you list them outright or list a
-  supernet such as `0.0.0.0/0`, `::/0`, `fd00::/8` or `100.64.0.0/10`.
-  Treat this as best effort rather than a guarantee — it is a
-  hand-maintained list and the caveat below the table applies:
+- **It cannot open link-local, or a cloud metadata endpoint at a
+  non-public address that discloses credentials or user data.** An
+  address is on the list below when it is not a public address and both
+  of these hold: the provider fixes it, so it cannot collide with
+  anything you run; and reaching it hands out credentials, user data or
+  bootstrap material. Those stay blocked no matter what you list,
+  including when you list them outright or list a supernet such as
+  `0.0.0.0/0`, `::/0`, `fd00::/8` or `100.64.0.0/10`. Treat this as best
+  effort rather than a guarantee — it is a hand-maintained list and the
+  caveat below the table applies:

  | Blocked unconditionally | What it is |
  | ----------------------- | ---------- |
@@ -234,25 +233,14 @@ Two things this setting cannot do:
  | `fd00:a9fe:a9fe::1/128` | Linode/Akamai metadata over IPv6 |
  | `100.100.100.200/32` | Alibaba Cloud metadata, inside CGNAT |
  | `192.0.0.192/32` | Oracle Cloud Classic metadata |
-  | `0.0.0.0/32` | IPv4 unspecified address, which reaches this host's loopback on Linux |
-  | `::/128` | IPv6 unspecified address, which reaches this host's loopback on Linux |
  | `::a9fe:a9fe/128` | `169.254.169.254` as an IPv4-compatible IPv6 address |
  | `64:ff9b::a9fe:a9fe/128` | `169.254.169.254` behind the NAT64 well-known prefix |

  The IPv4-mapped form `::ffff:169.254.169.254` is covered by the
-  `169.254.0.0/16` entry. Reaching any of these but the two unspecified
-  addresses is credential or user-data theft rather than delivery to an
-  internal service. Every entry outside the two link-local blocks is a
-  single address, so blocking it costs you nothing else on the network
-  around it.
-
-  The unspecified addresses `0.0.0.0` and `::` hand out nothing
-  themselves, but no host can have either, and on Linux a connection to
-  one reaches this host's own loopback. They are listed so that an
-  allowlist reaches loopback only through an entry that covers a loopback
-  address, such as `127.0.0.0/8`, `::1` or `0.0.0.0/0`, never through one
-  that covers only `0.0.0.0` or `::`; `0.0.0.0/8`, for example, does not
-  open loopback.
+  `169.254.0.0/16` entry. Reaching any of these is credential or
+  user-data theft rather than delivery to an internal service. Every
+  entry outside the two link-local blocks is a single address, so
+  blocking it costs you nothing else on the network around it.

  The six ULA entries, all inside `fd00::/8`, are why this matters in
  practice: `fd00::/8` is an ordinary block to allowlist for your own
@@ -2991,10 +2979,10 @@ Applied to all routes in this order:
 2. **SecurityHeaders** — Production security headers on every response
   (HSTS, X-Content-Type-Options, X-Frame-Options, CSP, Referrer-Policy,
   Permissions-Policy)
-3. **Logging** — Structured request logging (method, URL, status,
-   latency, remote IP, user agent, request ID)
-4. **Metrics** — Prometheus HTTP metrics (if `METRICS_USERNAME` and
+3. **Metrics** — Prometheus HTTP metrics (if `METRICS_USERNAME` and
   `METRICS_PASSWORD` are both set)
+4. **Logging** — Structured request logging (method, URL, status,
+   latency, remote IP, user agent, request ID)
 5. **CORS** — Cross-origin resource sharing headers
 6. **Timeout** — 60-second request timeout
 7. **Recoverer** — Panic recovery: one `ERROR` record through
@@ -3014,6 +3002,10 @@ local record instead of nothing. What that placement gives up is
 recovery of a panic in the six entries above it, none of which does
 more than set a header or start a timer.

+Metrics sits outside Logging so that a handler's flush reaches the
+client: go-http-metrics' writer passes a flush on only when the writer
+inside it has a `Flush` method, and the access log's writer has none.
+
 Each admin page route group (`/pages`, `/user/*`, `/hooks`,
 `/hook/*`) starts with its own **Recoverer** and, if `SENTRY_DSN` is
 set, its own **Sentry** error reporting. That Recoverer answers a panic
@@ -3105,8 +3097,7 @@ check, see [The login endpoint](#the-login-endpoint).
  route through a single decision function, so they cannot disagree
  about a destination. An operator can permit specific blocks with
  [`ALLOWED_EGRESS_CIDRS`](#allowing-egress-to-your-own-network); the
-  guard cannot be switched off, and link-local, the unspecified
-  addresses `0.0.0.0` and `::`, and a
+  guard cannot be switched off, and link-local plus a
  [pinned set](#allowing-egress-to-your-own-network) of known cloud
  metadata endpoints — several of which are ULAs outside link-local —
  stay blocked whatever is listed, though listing `0.0.0.0/0` or
@@ -196,13 +196,12 @@ type Config struct {
 	// otherwise refuse. The guard itself is always on: there is no
 	// setting that disables SSRF protection, and delivery's
 	// alwaysBlockedNetworks stays blocked no matter what is listed
-	// here. That set is link-local, the unspecified addresses
-	// 0.0.0.0 and ::, and the cloud metadata endpoints outside
-	// link-local that disclose credentials or user data at a
-	// provider-fixed, non-public address; it is not exhaustive of
-	// every cloud's metadata address. See
-	// alwaysBlockedNetworks for the authoritative list and why
-	// each entry is on it.
+	// here. That set is link-local plus the cloud metadata
+	// endpoints outside it that disclose credentials or user data
+	// at a provider-fixed, non-public address; it is not
+	// exhaustive of every cloud's metadata address. See
+	// alwaysBlockedNetworks for the authoritative list and the
+	// criterion it is built from.
 	AllowedEgressCIDRs []netip.Prefix

 	params *ConfigParams
@@ -124,11 +124,6 @@ func testEnvironmentConfigSuccess(

 	app := fxtest.New(
 		t,
-		// fx's own log is discarded, not sent to t.Logf: a hook still
-		// running after a start or stop timeout would write there after
-		// the test has returned. The same holds for every fxtest.New
-		// below.
-		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,
@@ -277,7 +272,6 @@ func testRetentionSweepIntervalSuccess(

 	app := fxtest.New(
 		t,
-		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,
@@ -370,7 +364,6 @@ func testSessionIdleTimeoutSuccess(

 	app := fxtest.New(
 		t,
-		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,
@@ -411,7 +404,6 @@ func TestDefaultDataDir(t *testing.T) {

 			app := fxtest.New(
 				t,
-				fx.NopLogger,
 				fx.Provide(
 					globals.New,
 					logger.New,
@@ -542,7 +534,6 @@ func testReceiverRateLimitSuccess(

 	app := fxtest.New(
 		t,
-		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,
@@ -659,7 +650,6 @@ func testTrustedProxiesSuccess(

 	app := fxtest.New(
 		t,
-		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,
@@ -773,7 +763,6 @@ func testAllowedEgressCIDRsSuccess(

 	app := fxtest.New(
 		t,
-		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,
@@ -1017,7 +1006,6 @@ func assertMetricsAuthAccepted(t *testing.T, expectAuth bool) {

 	app := fxtest.New(
 		t,
-		fx.NopLogger,
 		fx.Provide(globals.New, logger.New, config.New),
 		fx.Populate(&cfg),
 	)
@@ -37,8 +37,8 @@ var (
 		"blocked cloud metadata address",
 	)
 	errBlockedMetadata = errors.New(
-		"blocked link-local, cloud instance metadata or " +
-			"unspecified address: ALLOWED_EGRESS_CIDRS cannot open it",
+		"blocked link-local or cloud instance metadata " +
+			"address: ALLOWED_EGRESS_CIDRS cannot open it",
 	)
 	errInvalidScheme = errors.New(
 		"only http and https are allowed",
@@ -72,17 +72,14 @@ var blockedNetworks []*net.IPNet
 var blockedPublicNetworks []*net.IPNet

 // alwaysBlockedNetworks are the ranges no configuration can
-// open, so a supplied CIDR that covers one still leaves it
-// blocked. An entry is here for one of two reasons: it is a
-// metadata endpoint (the link-local blocks and the cloud
-// instance metadata endpoints that live outside them), or it is
-// an unspecified address. Reaching a metadata endpoint is
-// credential or user-data theft rather than delivery to an
-// internal service.
+// open: the link-local blocks and the cloud instance metadata
+// endpoints that live outside them. Reaching one is credential
+// or user-data theft rather than delivery to an internal
+// service, so a supplied CIDR that covers such an address still
+// leaves it blocked.
 //
-// Inclusion criterion for metadata endpoints — one belongs here
-// only if BOTH hold, and every metadata entry below satisfies
-// both:
+// Inclusion criterion — an address belongs here only if BOTH
+// hold, and every entry below satisfies both:
 //
 //  1. It is a fixed address assigned by the provider, or a
 //     range reserved by IANA — never one the operator chose.
@@ -93,8 +90,8 @@ var blockedPublicNetworks []*net.IPNet
 //     not cheaply rotated.
 //
 // Both halves are load-bearing, so use them to refuse a
-// metadata candidate and say why. An endpoint disclosing only
-// the operator's own inventory (instance id, region, disks, NICs)
+// candidate and say why. An endpoint disclosing only the
+// operator's own inventory (instance id, region, disks, NICs)
 // fails (2): letting a delivery target reach the operator's own
 // infrastructure is the feature ALLOWED_EGRESS_CIDRS exists to
 // provide. But (2) is not "IAM credentials only" either —
@@ -115,15 +112,6 @@ var blockedPublicNetworks []*net.IPNet
 // This is a criterion, not an enumeration of every metadata
 // address in existence.
 //
-// The unspecified addresses 0.0.0.0 and :: are here for a
-// separate reason: they disclose nothing, but no host can have
-// either, and on Linux a connection to one reaches this host's
-// own loopback. Listing them means an allowlist reaches loopback
-// only through an entry that covers a loopback address
-// (127.0.0.0/8, ::1/128, 0.0.0.0/0), never through one that
-// covers only 0.0.0.0 or :: (0.0.0.0/8, for example). Nothing
-// else lives at either address, so refusing them costs nothing.
-//
 // Every entry is either already in blockedNetworks — this list is
 // what makes it unconditional — or an alternate encoding of
 // 169.254.169.254 that Contains does not match against
@@ -143,46 +131,23 @@ var alwaysBlockedNetworks []*net.IPNet
 //nolint:gochecknoinits // init is the idiomatic way to parse CIDRs once at startup
 func init() {
 	blockedNetworks = mustParseCIDRs([]string{
-		// IPv4 loopback.
 		"127.0.0.0/8",
-		// RFC 1918 private network.
 		"10.0.0.0/8",
-		// RFC 1918 private network.
 		"172.16.0.0/12",
-		// RFC 1918 private network.
 		"192.168.0.0/16",
-		// IPv4 link-local.
 		"169.254.0.0/16",
-		// "This network", holding the IPv4 unspecified address 0.0.0.0.
 		"0.0.0.0/8",
-		// Carrier-grade NAT shared address space.
 		"100.64.0.0/10",
-		// IETF protocol assignments.
 		"192.0.0.0/24",
-		// IPv4 documentation (TEST-NET-1).
 		"192.0.2.0/24",
-		// Benchmarking.
 		"198.18.0.0/15",
-		// IPv4 documentation (TEST-NET-2).
 		"198.51.100.0/24",
-		// IPv4 documentation (TEST-NET-3).
 		"203.0.113.0/24",
-		// IPv4 multicast.
 		"224.0.0.0/4",
-		// Reserved, including the broadcast address.
 		"240.0.0.0/4",
-		// IPv6 loopback.
 		"::1/128",
-		// IPv6 unspecified address.
-		"::/128",
-		// IPv6 unique local addresses.
 		"fc00::/7",
-		// IPv6 link-local.
 		"fe80::/10",
-		// IPv6 multicast.
-		"ff00::/8",
-		// IPv6 documentation.
-		"2001:db8::/32",
 	})

 	blockedPublicNetworks = mustParseCIDRs([]string{
@@ -242,14 +207,6 @@ func init() {
 		// allowlist from opening it.
 		"192.0.0.192/32",

-		// The unspecified addresses, each of which reaches this
-		// host's loopback on Linux.
-		//
-		// IPv4 unspecified address, inside the blocked 0.0.0.0/8.
-		"0.0.0.0/32",
-		// IPv6 unspecified address.
-		"::/128",
-
 		// 169.254.169.254 as an IPv4-compatible IPv6 address.
 		"::a9fe:a9fe/128",
 		// 169.254.169.254 behind the NAT64 well-known prefix.
@@ -386,9 +343,8 @@ func (g *Guard) allows(ip net.IP) bool {
 // The order is the policy:
 //
 //  1. alwaysBlockedNetworks is refused before the allowlist is
-//     consulted, so no configured CIDR reaches link-local, a
-//     cloud metadata endpoint at a non-public address, or an
-//     unspecified address.
+//     consulted, so no configured CIDR reaches link-local or a
+//     cloud metadata endpoint at a non-public address.
 //  2. The allowlist is consulted next, so a listed private
 //     network, or a listed public address on the default
 //     blocklist, becomes reachable.
@@ -168,13 +168,12 @@ func TestGuardAllowlist_UnlistedPrivateStillRefused(t *testing.T) {

 // TestGuardAllowlist_MetadataAlwaysRefused is the load-bearing
 // case: cloud instance metadata endpoints are credential theft
-// rather than delivery to an internal service, and the
-// unspecified addresses 0.0.0.0 and :: reach this host's loopback
-// on Linux, so no allowlist reaches any of them. Every guard
-// below names a CIDR that covers its target — including
-// 0.0.0.0/0, ::/0, and the ordinary ULA and CGNAT blocks an
-// operator would really list — and the address must stay
-// refused anyway, on both the validation and the delivery path.
+// rather than delivery to an internal service, so no allowlist
+// reaches one. Every guard below names a CIDR that covers its
+// target — including 0.0.0.0/0, ::/0, and the ordinary ULA and
+// CGNAT blocks an operator would really list — and the address
+// must stay refused anyway, on both the validation and the
+// delivery path.
 func TestGuardAllowlist_MetadataAlwaysRefused(t *testing.T) {
 	t.Parallel()

@@ -220,17 +219,15 @@ type metadataAlwaysRefusedCase struct {
 }

 // metadataAlwaysRefusedCases enumerates every unconditionally
-// blocked address (link-local, the cloud metadata endpoints and
-// the unspecified addresses) together with an allowlist entry
-// that would otherwise reach it. Split by family of address only
-// to stay under the function-length limit.
+// blocked address together with an allowlist entry that would
+// otherwise reach it. Split by family of address only to stay
+// under the function-length limit.
 func metadataAlwaysRefusedCases() []metadataAlwaysRefusedCase {
 	cases := linkLocalRefusedCases()
 	cases = append(cases, ulaMetadataRefusedCases()...)
 	cases = append(cases, ipv4MetadataRefusedCases()...)
-	cases = append(cases, encodedMetadataRefusedCases()...)

-	return append(cases, unspecifiedRefusedCases()...)
+	return append(cases, encodedMetadataRefusedCases()...)
 }

 // linkLocalRefusedCases covers the link-local blocks, including
@@ -370,23 +367,6 @@ func encodedMetadataRefusedCases() []metadataAlwaysRefusedCase {
 	}
 }

-// unspecifiedRefusedCases covers the unspecified addresses, each
-// of which reaches this host's loopback on Linux.
-func unspecifiedRefusedCases() []metadataAlwaysRefusedCase {
-	return []metadataAlwaysRefusedCase{
-		{
-			name:   "IPv4 unspecified address under 0.0.0.0/0",
-			allow:  allowAllIPv4,
-			target: "http://0.0.0.0:8080/hook",
-		},
-		{
-			name:   "IPv6 unspecified address under ::/0",
-			allow:  allowAllIPv6,
-			target: "http://[::]:8080/hook",
-		},
-	}
-}
-
 // TestGuardAllowlist_PublicUnaffected asserts the allowlist does
 // not narrow anything: public addresses were reachable before it
 // existed and stay reachable, whether or not a list is set.
@@ -544,10 +524,6 @@ func TestAlwaysBlockedNetworks_PinnedSet(t *testing.T) {
 		// Oracle Cloud Classic metadata, inside the blocked
 		// 192.0.0.0/24.
 		"192.0.0.192/32",
-		// The IPv4 and IPv6 unspecified addresses, each of
-		// which reaches this host's loopback on Linux.
-		"0.0.0.0/32",
-		"::/128",
 		// 169.254.169.254 as an IPv4-compatible IPv6 address.
 		"::a9fe:a9fe/128",
 		// 169.254.169.254 behind the NAT64 well-known prefix.
@@ -580,8 +556,7 @@ func TestDefaultBlocklist_PinnedSet(t *testing.T) {
 		{cidr: "172.16.0.0/12", reopenable: true},
 		{cidr: "192.168.0.0/16", reopenable: true},
 		{cidr: linkLocalIPv4, reopenable: false},
-		// Its first address, 0.0.0.0, is in the unconditional set.
-		{cidr: "0.0.0.0/8", reopenable: false},
+		{cidr: "0.0.0.0/8", reopenable: true},
 		{cidr: "100.64.0.0/10", reopenable: true},
 		{cidr: "192.0.0.0/24", reopenable: true},
 		{cidr: "192.0.2.0/24", reopenable: true},
@@ -591,11 +566,8 @@ func TestDefaultBlocklist_PinnedSet(t *testing.T) {
 		{cidr: "224.0.0.0/4", reopenable: true},
 		{cidr: "240.0.0.0/4", reopenable: true},
 		{cidr: "::1/128", reopenable: true},
-		{cidr: "::/128", reopenable: false},
 		{cidr: "fc00::/7", reopenable: true},
 		{cidr: "fe80::/10", reopenable: false},
-		{cidr: "ff00::/8", reopenable: true},
-		{cidr: "2001:db8::/32", reopenable: true},
 		{cidr: "168.63.129.16/32", public: true, reopenable: true},
 	}

@@ -101,42 +101,6 @@ func TestValidateTargetURL_Blocked(t *testing.T) {
 	}
 }

-// TestDefaultGuard_RefusesUnspecifiedMulticastAndDocumentation
-// covers the unspecified addresses and the IPv6 multicast and
-// documentation ranges: with no allowlist set, each is refused
-// both when a target is created and when a delivery dials it.
-func TestDefaultGuard_RefusesUnspecifiedMulticastAndDocumentation(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	guard := delivery.NewTestGuard()
-
-	targets := []string{
-		// The unspecified addresses. On Linux a connection to
-		// either reaches this host's loopback.
-		"http://0.0.0.0:8080/hook",
-		"http://[::]:8080/hook",
-		// IPv6 multicast, all nodes.
-		"http://[ff02::1]/hook",
-		// IPv6 documentation.
-		"http://[2001:db8::1]/hook",
-	}
-
-	for _, target := range targets {
-		t.Run(target, func(t *testing.T) {
-			t.Parallel()
-
-			require.Error(t,
-				guard.ValidateTargetURL(context.Background(), target),
-				"%s must be refused at target creation", target,
-			)
-
-			assertDialRefused(t, guard, target)
-		})
-	}
-}
-
 func TestValidateTargetURL_Allowed(t *testing.T) {
 	t.Parallel()

@@ -137,10 +137,6 @@ func bootAtDebug(t *testing.T, dataDir string) string {

 	app := fxtest.New(
 		t,
-		// fx's own log is discarded, not sent to t.Logf: a hook still
-		// running after a start or stop timeout would write there after
-		// the test has returned.
-		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,
@@ -86,10 +86,6 @@ func newTestApp(

 	return fxtest.New(
 		t,
-		// fx's own log is discarded, not sent to t.Logf: a hook still
-		// running after a start or stop timeout would write there after
-		// the test has returned.
-		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,
@@ -1560,11 +1560,10 @@ func (h *Handlers) validateTargetURL(
 		msg := "Invalid target URL: " + err.Error()

 		// Only a private or reserved address's refusal says how
-		// to allow it. Other refusals never do: link-local, the
-		// unspecified addresses and the unconditional metadata
-		// addresses cannot be opened, and the default
-		// blocklist's public addresses, which listing does open,
-		// hand out credentials.
+		// to allow it. Metadata refusals never do: link-local and
+		// the other unconditional metadata addresses cannot be
+		// opened, and the default blocklist's public addresses,
+		// which listing does open, hand out credentials.
 		if errors.Is(err, delivery.ErrBlockedPrivateOrReservedIP) {
 			msg += ". Private and reserved addresses are refused " +
 				"by default; the server's ALLOWED_EGRESS_CIDRS " +
@@ -233,6 +233,13 @@ func (lrw *loggingResponseWriter) WriteHeader(code int) {
 	lrw.ResponseWriter.WriteHeader(code)
 }

+// Unwrap lets http.ResponseController reach the writer underneath, so
+// a handler can still flush or set a write deadline through the access
+// log.
+func (lrw *loggingResponseWriter) Unwrap() http.ResponseWriter {
+	return lrw.ResponseWriter
+}
+
 // concreteLogURL renders the request's own URL for the access log
 // branches that keep it, with the query string replaced by a fixed
 // marker.
@@ -627,11 +627,9 @@ func TestRecovererIgnoresANonPanickingHandler(t *testing.T) {
 // net/http's own writer from http.ResponseController, so a handler
 // that flushes or sets a deadline starts failing.
 //
-// The recoverer is the only middleware in the chain here. The access
-// logger's own wrapper does not implement Unwrap, so a chain
-// containing it fails this regardless of what the recoverer does;
-// what is being pinned is that the recoverer adds no such opacity of
-// its own.
+// The recoverer is the only middleware in the chain here;
+// TestFlushThroughProductionRouter in internal/server covers the
+// shipped chain.
 func TestRecovererKeepsResponseControllerWorking(t *testing.T) {
 	t.Parallel()

@@ -152,10 +152,6 @@ func newServerApp(

 	app := fxtest.New(
 		t,
-		// fx's own log is discarded, not sent to t.Logf: a hook still
-		// running after a start or stop timeout would write there after
-		// the test has returned.
-		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,
@@ -0,0 +1,96 @@
+package server_test
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/webhooker/internal/config"
+	"sneak.berlin/go/webhooker/internal/server"
+)
+
+// TestFlushThroughProductionRouter drives http.ResponseController.Flush
+// through the shipped router and checks that the flush reaches the
+// writer the server handed in.
+//
+// Every middleware that wraps the writer has to pass a flush through,
+// with an Unwrap method or a Flush of its own. One that does neither
+// makes Flush return http.ErrNotSupported, or do nothing at all when
+// the wrapper outside it only looks for a Flush method, and the
+// handler that trips over it is far from the cause.
+//
+// It runs once with the defaults and once with metrics and Sentry on,
+// because those two add middleware to the chain, and through both the
+// global middleware and an admin page route group, which adds its own.
+func TestFlushThroughProductionRouter(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name          string
+		cfg           func(t *testing.T) *config.Config
+		sentryEnabled bool
+	}{
+		{
+			name: "defaults",
+			cfg: func(t *testing.T) *config.Config {
+				t.Helper()
+
+				return &config.Config{
+					DataDir:     t.TempDir(),
+					Environment: config.EnvironmentDev,
+				}
+			},
+		},
+		{
+			name: "metrics and Sentry on",
+			cfg: func(t *testing.T) *config.Config {
+				t.Helper()
+
+				return metricsConfig(t, metricsUser, metricsAuthValue)
+			},
+			sentryEnabled: true,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			env := newTestEnvWithConfig(t, tc.cfg(t))
+
+			var flushErr error
+
+			probe := func(w http.ResponseWriter, _ *http.Request) {
+				flushErr = http.NewResponseController(w).Flush()
+			}
+
+			routers := map[string]http.Handler{
+				server.ProbePattern: server.NewRouterWithProbeForTest(
+					env.log.Get(), env.cfg, env.mw, env.hnd,
+					tc.sentryEnabled, probe,
+				),
+				server.PageProbePattern: server.NewRouterWithPageProbeForTest(
+					env.log.Get(), env.cfg, env.mw, env.hnd,
+					tc.sentryEnabled, probe,
+				),
+			}
+
+			for path, router := range routers {
+				flushErr = nil
+
+				w := httptest.NewRecorder()
+				router.ServeHTTP(w, httptest.NewRequestWithContext(
+					t.Context(), http.MethodGet, path, nil,
+				))
+
+				require.NoError(t, flushErr, path)
+				assert.True(
+					t, w.Flushed,
+					"%s: the flush must reach the server's writer", path,
+				)
+			}
+		})
+	}
+}
@@ -61,16 +61,21 @@ func (s *Server) SetupRoutes() {
 func (s *Server) setupGlobalMiddleware() {
 	s.router.Use(middleware.RequestID)
 	s.router.Use(s.mw.SecurityHeaders())
-	s.router.Use(s.mw.Logging())

 	// Metrics recording middleware, registered only when the
 	// endpoint that exposes what it records is served. The
 	// condition is the same MetricsAuthEnabled the /metrics mount
 	// in setupRoutes reads.
+	//
+	// It goes outside Logging. go-http-metrics' writer passes a flush
+	// on only when the writer inside it has a Flush method, and the
+	// access log's writer has none, so inside Logging a handler's
+	// flush would silently do nothing.
 	if s.params.Config.MetricsAuthEnabled() {
 		s.router.Use(s.mw.Metrics())
 	}

+	s.router.Use(s.mw.Logging())
 	s.router.Use(s.mw.CORS())
 	s.router.Use(middleware.Timeout(requestTimeout))

@@ -104,10 +104,6 @@ func newTestEnvWithConfig(

 	app := fxtest.New(
 		t,
-		// fx's own log is discarded, not sent to t.Logf: a hook still
-		// running after a start or stop timeout would write there after
-		// the test has returned.
-		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,