sneak
eb6ef01742
All checks were successful
check / check (push) Successful in 3m1s
The plaintext listener bound `:PORT`, so it answered on every interface with no way to say otherwise. That published the admin UI and the unauthenticated receiver in cleartext beside whatever TLS proxy was in front of them, reachable from any host that could route to the machine. BIND_ADDRESS now selects the address, defaulting to 127.0.0.1. Loopback is the only default that does not silently expose that listener; reaching webhooker from another host becomes a deliberate act. A container must set BIND_ADDRESS=0.0.0.0, since a loopback bind inside a network namespace is unreachable even with -p, and the documented `docker run` does. Only IP address literals are accepted: hostnames, host:port and CIDR blocks abort startup naming the variable and the value, and a literal that is not an address of this host fails at listen and exits non-zero. The http.Server is now built in New rather than in the serving goroutine. Two goroutines reached that field with nothing ordering them — the serving goroutine assigning it, the fx stop hook calling Shutdown on it — which is a data race the race detector reports as soon as anything starts and stops the server, and a nil dereference if a stop arrived first. README gains a "Deployment behind a reverse proxy" section: a working nginx server block, and the five things that are silent when wrong — bind or firewall the app port, WEBHOOKER_ENVIRONMENT=prod, TRUSTED_PROXIES, Host as $http_host rather than $host, and keeping the proxy's access log because webhooker's own records only the proxy.
63 lines
1.9 KiB
Go
63 lines
1.9 KiB
Go
package config
|
|
|
|
import "log/slog"
|
|
|
|
// This file exposes the unexported environment parsing helpers to
|
|
// the external config_test package so each helper can be covered by
|
|
// its own table-driven test without weakening the package API.
|
|
|
|
// WarnSharedRateLimitBucketForTest loads a Config from the current
|
|
// environment and emits its startup warnings to log. The real logger
|
|
// writes to stdout, so this lets the warning's firing condition be
|
|
// asserted against a handler the test controls.
|
|
func WarnSharedRateLimitBucketForTest(log *slog.Logger) error {
|
|
c, err := loadFromEnv()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
c.warnSharedRateLimitBucket(log)
|
|
|
|
return nil
|
|
}
|
|
|
|
// WarnEgressAllowlistForTest loads a Config from the current
|
|
// environment and emits its egress-allowlist startup warning to
|
|
// log, so a test can assert both that the warning fires only when
|
|
// the list is non-empty and that it names the blocks it opened.
|
|
func WarnEgressAllowlistForTest(log *slog.Logger) error {
|
|
c, err := loadFromEnv()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
c.warnEgressAllowlist(log)
|
|
|
|
return nil
|
|
}
|
|
|
|
// EnvBoolForTest exposes envBool.
|
|
func EnvBoolForTest(key string, defaultValue bool) (bool, error) {
|
|
return envBool(key, defaultValue)
|
|
}
|
|
|
|
// EnvPositiveIntForTest exposes envPositiveInt.
|
|
func EnvPositiveIntForTest(key string, defaultValue int) (int, error) {
|
|
return envPositiveInt(key, defaultValue)
|
|
}
|
|
|
|
// EnvPortForTest exposes envPort.
|
|
func EnvPortForTest(key string, defaultValue int) (int, error) {
|
|
return envPort(key, defaultValue)
|
|
}
|
|
|
|
// EnvBindAddressForTest exposes envBindAddress.
|
|
func EnvBindAddressForTest(key, defaultValue string) (string, error) {
|
|
return envBindAddress(key, defaultValue)
|
|
}
|
|
|
|
// DefaultBindAddressForTest exposes the compiled-in BIND_ADDRESS
|
|
// default, so a test pins the documented value rather than repeating
|
|
// a literal that could drift from it.
|
|
const DefaultBindAddressForTest = defaultBindAddress
|