Release 2026.08.02-1

SQLite replaces Postgres, and two fixes from using the thing.

- The database is a file under ./storage instead of a second container. Ten
  members never needed a database server, and the driver is pure Go, so the
  build stays CGO_ENABLED=0 and the dependency count is unchanged. One bind
  mount is now the whole backup: no pgdata, no healthcheck-gated depends_on,
  no startup retry loop. Timestamps are UTC text, idle_ttl is seconds, the
  divisive/unified boards carry their own stddev, and foreign keys are on by
  pragma. Tests get a database file each and run without any setup
- Invites are copied, not clicked. An invite is something to send, and the
  anchor opened the join form in the admin's own browser
- Feedback asks for more than faults: the footer reads "Ongelmia? Ideoita?
  Palautetta?" and the page behind it invites ideas rather than only bugs
- Kuuntele YouTubessa opens in a new tab, so a half-typed review survives it

.dockerignore

@@ -1,9 +0,0 @@
-# The build needs the source and nothing else. storage/ holds the live database and audio, .env
-# holds the admin password, and pgdata is a leftover from the Postgres era that the build cannot
-# even read.
-.git
-.env
-storage/
-pgdata/
-levyraati
-levyraati26-go

.env.example

@@ -1,14 +1,10 @@
-# Copy to .env and edit.
-
-# The first account. Only read when the database has no users: the app creates that account,
-# marks it admin, and ignores these afterwards. Everyone else joins by invite.
-ADMIN_EMAIL=
+# Copy to .env and edit. The admin password has no default.
+ADMIN_USER=admin
 ADMIN_PASSWORD=
-ADMIN_NAME=Ylläpito
 
 # Set to false only for local development over plain HTTP.
 SECURE_COOKIES=true
 
-# Public address of the site. Used to build pasteable invite links on the admin page.
+# Public address of the member site. Used to build pasteable invite links in the admin panel.
 # Unset falls back to a relative link, which is fine locally.
 PUBLIC_URL=https://levyraati.example.com

CONTEXT.md

@@ -13,9 +13,9 @@ A person with an account. Every account is a member; there is no other kind.
 _Avoid_: user, käyttäjä, account
 
 **Admin** — _ylläpitäjä_:
-A member who also operates the installation. The same account, the same session, one extra flag —
-so an admin submits and reviews like anyone else and does appear in lists of people.
-_Avoid_: superuser, role, admin account (there is no separate account)
+The operator of the installation. Not a member and not an account — a set of credentials on a
+separate surface. Never submits, reviews, or appears in any list of people.
+_Avoid_: admin user, superuser, role
 
 **Invite** — _kutsu_ / **invite code** — _kutsukoodi_:
 A one-time code that permits one registration. Spent only by a registration that succeeds.

Dockerfile

@@ -1,11 +1,11 @@
-FROM golang:1.27-alpine AS build
+FROM golang:1.26-alpine AS build
 # CalVer, injected at build so no file needs bumping by hand: docker build --build-arg VERSION=…
 ARG VERSION=dev
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
-RUN CGO_ENABLED=0 go build -ldflags "-X main.version=${VERSION}" -o /levyraati ./src
+RUN CGO_ENABLED=0 go build -ldflags "-X main.version=${VERSION}" -o /levyraati .
 
 FROM alpine:3.24
 # yt-dlp rots against YouTube. Alpine's active branch tracks it closely (3.24 carries the current

Makefile

@@ -1,63 +0,0 @@
-# `make` is everything that has to pass before a commit. The rest are the workflows that were
-# otherwise copy-pasted out of README.md and docs/deployment.md.
-#
-# gofmt needs a wrapper because it reports offending files on stdout and still exits 0.
-.PHONY: check fmt vet test fix build run image db backup clean
-
-# Overridable, so a target never bakes in one person's environment.
-BIN     ?= levyraati26-go
-ADDR    ?= 127.0.0.1:8080
-STORAGE ?= ./storage
-
-check: fmt vet test
-
-fmt:
-	@out=$$(gofmt -l .); test -z "$$out" || { echo "not gofmt'd:"; echo "$$out"; exit 1; }
-
-vet:
-	go vet ./...
-
-test:
-	go test ./...
-
-# Suggestions only. go fix rewrites files in place without -diff, and it is not always right —
-# read the hunks before applying any of them.
-fix:
-	@go fix -diff ./... || true
-
-# -o is required, not stylistic: the package lives in ./src, and without it `go build` would try to
-# write a binary named "src" over the directory.
-build:
-	go build -o $(BIN) ./src
-
-# Templates, static files and migrations are embedded, so seeing a change means rebuilding.
-# The admin credentials seed the first account on an empty database and are ignored after that.
-run: build
-	ADMIN_EMAIL=$${ADMIN_EMAIL:[email protected]} \
-	ADMIN_PASSWORD=$${ADMIN_PASSWORD:-dev} \
-	SECURE_COOKIES=false STORAGE_DIR=$(STORAGE) ADDR=$(ADDR) ./$(BIN)
-
-# A release image. VERSION comes from the tag, because that is the only way it reaches the binary
-# and /healthz must not claim a version that was never tagged. IMAGE names the registry and stays
-# out of this file: pass it in, or put it in the .env this reads nothing from.
-#
-#   make image IMAGE=registry.example.com/owner/levyraati26-go
-image:
-	@test -n "$(IMAGE)" || { echo "set IMAGE, e.g. make image IMAGE=registry.example.com/owner/levyraati26-go"; exit 1; }
-	@v=$$(git describe --tags --exact-match 2>/dev/null) || { echo "HEAD is not tagged; tag the release first"; exit 1; }; \
-	podman build --build-arg VERSION=$$v -t $(IMAGE):$$v -t $(IMAGE):latest . && \
-	echo "built $(IMAGE):$$v — push with: podman push $(IMAGE):$$v"
-
-# Operations against the running container, straight out of docs/deployment.md.
-db:
-	docker compose exec app sqlite3 /storage/levyraati.db
-
-# Copying the file while the app runs is not a backup: WAL keeps recent writes in a sidecar.
-backup:
-	docker compose exec app sqlite3 /storage/levyraati.db ".backup '/storage/tmp/backup.db'"
-	gzip -c $(STORAGE)/tmp/backup.db > backup-$$(date +%F).db.gz
-	rm $(STORAGE)/tmp/backup.db
-	@echo "wrote backup-$$(date +%F).db.gz"
-
-clean:
-	rm -f $(BIN)

README.md

@@ -18,7 +18,6 @@ Invite-only, no public registration. Built for about ten friends.
 | [docs/decisions.md](docs/decisions.md) | Why it is that way. Append-only |
 | [docs/theme.md](docs/theme.md) | The visual language: tokens, type, and what differs from the theme handoff |
 | [docs/later.md](docs/later.md) | Deliberately not in v1, with the reasoning kept |
-| [docs/deployment.md](docs/deployment.md) | Running it on a server: the compose file, releases, upgrades, backups |
 
 ## Branches and releases
 
@@ -56,66 +55,60 @@ build stays `CGO_ENABLED=0`. No Node, no npm, no bundler.
 ## Running it
 
 ```sh
-cp .env.example .env      # then edit — set ADMIN_EMAIL and ADMIN_PASSWORD before the first start
+cp .env.example .env      # then edit — ADMIN_PASSWORD has no default and the app won't start without it
 docker compose up -d
 ```
 
-Migrations apply themselves at startup, before the server accepts connections. On an empty database
-the first launch creates one account from `ADMIN_EMAIL` / `ADMIN_PASSWORD` and marks it admin; log
-in as that account and mint invites for everyone else. The two variables are read only while the
-`users` table is empty, so once that account exists they do nothing and can leave the environment.
+Migrations apply themselves at startup, before the server accepts connections. The first launch
+creates no users: log into the admin panel and mint an invite.
 
 ### Configuration
 
 | Variable | Default | Notes |
 |---|---|---|
 | `DB_PATH` | `$STORAGE_DIR/levyraati.db` | The SQLite file. Created on first start |
-| `ADMIN_EMAIL` | — | Login address of the first account. Required on an empty database, ignored afterwards |
-| `ADMIN_PASSWORD` | — | Password for that account. Required on an empty database, ignored afterwards |
-| `ADMIN_NAME` | `Ylläpito` | Display name for that account |
-| `ADDR` | `:8080` | The only listener |
+| `ADMIN_USER` | `admin` | Admin panel username |
+| `ADMIN_PASSWORD` | — | **Required.** No default; the app refuses to start without it |
+| `ADDR` | `:8080` | Member-facing listener |
+| `ADMIN_ADDR` | `127.0.0.1:8081` | Admin listener. Keep it on loopback. Under Compose it binds `:8081` inside the container and is published only to the host's loopback |
 | `STORAGE_DIR` | `./storage` | Audio, avatars, in-flight conversions |
 | `SECURE_COOKIES` | `true` | Set `false` for local development over plain HTTP |
-| `PUBLIC_URL` | — | Public address of the site, e.g. `https://levyraati.example.com`. Used to build invite links on the admin page; unset gives relative links |
+| `PUBLIC_URL` | — | Public address of the member site, e.g. `https://levyraati.example.com`. Used to build invite links in the admin panel; unset gives relative links |
 
 ### Local development
 
 ```sh
-export ADMIN_EMAIL=[email protected] ADMIN_PASSWORD=dev SECURE_COOKIES=false
-go run ./src
+export ADMIN_PASSWORD=dev SECURE_COOKIES=false
+go run .
 ```
 
-The package lives in `src/`, together with the `templates/`, `static/` and `migrations/` it embeds —
-`//go:embed` cannot reach outside its own directory, so the assets live beside the code that reads
-them. `storage/` stays at the root, since it is runtime data rather than source.
-
-Requires Go 1.27+, plus `ffmpeg`, `ffprobe`, and `yt-dlp` on `PATH`. There is nothing to start first:
+Requires Go 1.25+, plus `ffmpeg`, `ffprobe`, and `yt-dlp` on `PATH`. There is nothing to start first:
 the database is a file under `./storage`, created on the first run.
 
-Tests get a fresh database file in a temp directory each, so they need no setup and touch nothing.
-`make` is everything that has to pass before a commit — formatting, `go vet`, and the tests:
+Tests get a fresh database file in a temp directory each, so they need no setup and touch nothing:
 
 ```sh
-make            # gofmt -l, go vet, go test
-make test       # just the tests
+go test ./...
 ```
 
 Templates, stylesheet, and migrations are embedded with `embed.FS`, so a rebuild is needed to see
-template changes. `make run` is the loop.
+template changes. `go build && ./levyraati` is the loop.
 
-## Admin page
+## Admin panel
 
-An admin is **an ordinary member with `is_admin` set** — the same account, the same login, the same
-session cookie. Admins submit and review like anyone else; the flag adds a Ylläpito link to the nav
-and unlocks `/admin` on the normal listener. A signed-in member without the flag gets a 404 there.
+The admin is **not a user account**. It exists only as `ADMIN_USER` / `ADMIN_PASSWORD`, authenticates
+with HTTP Basic Auth, and is bound to loopback so it is not reachable from the internet. Reach it
+through an SSH tunnel:
 
-From `/admin`: mint invites, reset member passwords, ban members, delete songs, read issue reports.
+```sh
+ssh -L 8081:127.0.0.1:8081 you@server
+# then open http://localhost:8081
+```
 
-An admin cannot ban themselves, since banning drops every session for the target and nothing would
-be left to undo it.
+From there: mint invites, reset member passwords, ban members, delete songs, read issue reports.
 
-**Lost the admin password?** There is no recovery endpoint and no recovery key. Reset the hash
-directly in the SQLite file, the same as for any locked-out member.
+**Lost the admin password?** Edit `.env` and `docker compose restart app`. There is no recovery
+endpoint and no recovery key — the credentials are the environment.
 
 ## Operations
 
@@ -162,23 +155,11 @@ docker compose exec app sqlite3 /storage/levyraati.db
 
 ## Layout
 
-`src/` is the whole program: one flat `package main`, with the assets it embeds beside it, because
-`//go:embed` cannot reach outside its own directory. `templates/` and `static/` are those assets,
-`migrations/` holds numbered `.sql` files applied in order at startup, and `testdata/` holds the
-golden JSON files that guard the API contract, plus `ytdlp-noose.json` — a real `yt-dlp -J` dump of
-an ordinary upload, used to test metadata prefill against a video that has no `track`, `artist` or
-`album` at all.
-
-The root keeps what is not source: `docs/`, the container and compose files, the `Makefile`, and
-`storage/` once the app has run.
-
-| Command | Does |
-|---|---|
-| `make` | gofmt, `go vet`, `go test` — everything that must pass before a commit |
-| `make run` | Build and start on `127.0.0.1:8080` with development defaults |
-| `make fix` | Show `go fix` modernizer suggestions as a diff, without applying them |
-| `make image IMAGE=…` | Build a release image tagged from `git describe`; refuses an untagged HEAD |
-| `make db` / `make backup` | SQLite shell, and a WAL-safe snapshot, against the running container |
+Go source is flat at the repository root, one package. Beyond that: `templates/` and `static/` are
+embedded assets, `migrations/` holds numbered `.sql` files applied in order at startup, and
+`testdata/` holds the golden JSON files that guard the API contract, plus `ytdlp-noose.json` — a real
+`yt-dlp -J` dump of an ordinary upload, used to test metadata prefill against a video that has no
+`track`, `artist` or `album` at all.
 
 ## Notes
 

admin.go

@@ -135,13 +135,6 @@ func (a *app) toggleBan(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "not found", http.StatusNotFound)
 		return
 	}
-	// Banning drops every session for the target, so an admin doing it to themselves would be
-	// locked out with nothing left that could unban them. The only route back is the database.
-	if me := memberFrom(r.Context()); me != nil && me.ID == id {
-		a.flash(w, "Et voi estää itseäsi.")
-		http.Redirect(w, r, "/admin", http.StatusSeeOther)
-		return
-	}
 	var banned bool
 	err = a.db.QueryRowContext(r.Context(),
 		`update users set banned = not banned where id = $1 returning banned`, id).Scan(&banned)

auth.go

@@ -30,17 +30,15 @@ type member struct {
 	Email     string
 	Avatar    *string
 	Banned    bool
-	IsAdmin   bool
 	CreatedAt time.Time
 }
 
 // Initials for the avatar circle: no default image on disk, no identicon generator.
 func (m *member) Initials() string {
-	out, n := "", 0
+	out := ""
 	for _, f := range strings.Fields(m.Name) {
 		out += strings.ToUpper(string([]rune(f)[0]))
-		// ponytail: count runes taken, not bytes — "Ä" is 2 bytes and used to end the loop early.
-		if n++; n == 2 {
+		if len(out) == 2 {
 			break
 		}
 	}
@@ -110,10 +108,10 @@ func (a *app) session(w http.ResponseWriter, r *http.Request) *member {
 	)
 	err := a.db.QueryRowContext(r.Context(), `
 		select s.expires_at, s.idle_ttl,
-		       u.id, u.name, u.email, u.avatar, u.banned, u.is_admin, u.created_at
+		       u.id, u.name, u.email, u.avatar, u.banned, u.created_at
 		  from sessions s join users u on u.id = s.user_id
 		 where s.token = $1 and s.expires_at > datetime('now')`, tok).
-		Scan(&expires, &ttlSeconds, &m.ID, &m.Name, &m.Email, &m.Avatar, &m.Banned, &m.IsAdmin, &m.CreatedAt)
+		Scan(&expires, &ttlSeconds, &m.ID, &m.Name, &m.Email, &m.Avatar, &m.Banned, &m.CreatedAt)
 	if err != nil {
 		if !errors.Is(err, sql.ErrNoRows) {
 			slog.Error("session lookup", "ctx", "auth", "error", err)

auth_test.go

@@ -25,22 +25,13 @@ func testApp(t *testing.T) *app {
 	if err := migrate(ctx, db); err != nil {
 		t.Fatal(err)
 	}
-	return &app{db: db}
+	return &app{cfg: config{adminUser: "admin", adminPass: "s3cret"}, db: db}
 }
 
 func post(t *testing.T, h http.Handler, path string, form url.Values) *httptest.ResponseRecorder {
-	t.Helper()
-	return postAs(t, h, path, form, "")
-}
-
-// postAs is post with a session cookie, which is now the only way to reach an admin route.
-func postAs(t *testing.T, h http.Handler, path string, form url.Values, token string) *httptest.ResponseRecorder {
 	t.Helper()
 	r := httptest.NewRequest("POST", path, strings.NewReader(form.Encode()))
 	r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-	if token != "" {
-		r.AddCookie(&http.Cookie{Name: sessionCookie, Value: token})
-	}
 	w := httptest.NewRecorder()
 	h.ServeHTTP(w, r)
 	return w
@@ -141,21 +132,6 @@ func (a *app) seedMember(t *testing.T, email string) int64 {
 	return id
 }
 
-// seedAdminMember returns an admin account and a live session token for it.
-func (a *app) seedAdminMember(t *testing.T, email string) (int64, string) {
-	t.Helper()
-	id := a.seedMember(t, email)
-	if _, err := a.db.ExecContext(context.Background(),
-		`update users set is_admin = 1 where id = $1`, id); err != nil {
-		t.Fatal(err)
-	}
-	tok, _, err := a.startSession(context.Background(), id, false)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return id, tok
-}
-
 func (a *app) sessionFor(t *testing.T, token string) *member {
 	t.Helper()
 	r := httptest.NewRequest("GET", "/", nil)
@@ -226,8 +202,8 @@ func TestBanDropsSessionsAndBlocksLogin(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	_, adminTok := a.seedAdminMember(t, "[email protected]")
-	if w := postAs(t, mux, fmt.Sprintf("/admin/users/%d/ban", id), nil, adminTok); w.Code != http.StatusSeeOther {
+	adminMux := a.adminMux()
+	if w := post(t, adminMux, fmt.Sprintf("/admin/users/%d/ban", id), nil); w.Code != http.StatusSeeOther {
 		t.Fatalf("ban: status = %d, want 303", w.Code)
 	}
 
@@ -246,7 +222,7 @@ func TestBanDropsSessionsAndBlocksLogin(t *testing.T) {
 	}
 
 	// Reversible: unban, and the same credentials work again.
-	if w := postAs(t, mux, fmt.Sprintf("/admin/users/%d/ban", id), nil, adminTok); w.Code != http.StatusSeeOther {
+	if w := post(t, adminMux, fmt.Sprintf("/admin/users/%d/ban", id), nil); w.Code != http.StatusSeeOther {
 		t.Fatalf("unban: status = %d, want 303", w.Code)
 	}
 	w = post(t, mux, "/login", url.Values{"email": {"[email protected]"}, "password": {"salasana1"}})
@@ -254,52 +230,3 @@ func TestBanDropsSessionsAndBlocksLogin(t *testing.T) {
 		t.Fatalf("login after unban: status = %d, want 303", w.Code)
 	}
 }
-
-// Self-banning drops your own sessions, and only an admin could undo it. Refuse.
-func TestAdminCannotBanSelf(t *testing.T) {
-	a := testApp(t)
-	mux := a.withMember(a.memberMux())
-	adminID, adminTok := a.seedAdminMember(t, "[email protected]")
-
-	if w := postAs(t, mux, fmt.Sprintf("/admin/users/%d/ban", adminID), nil, adminTok); w.Code != http.StatusSeeOther {
-		t.Fatalf("self-ban: status = %d, want 303", w.Code)
-	}
-	var banned bool
-	if err := a.db.QueryRowContext(context.Background(),
-		`select banned from users where id = $1`, adminID).Scan(&banned); err != nil {
-		t.Fatal(err)
-	}
-	if banned {
-		t.Fatal("admin banned themselves")
-	}
-}
-
-// A signed-in member who is not an admin must not be able to ban anyone.
-func TestMemberCannotReachAdminRoutes(t *testing.T) {
-	a := testApp(t)
-	mux := a.withMember(a.memberMux())
-	victim := a.seedMember(t, "[email protected]")
-
-	plain := a.seedMember(t, "[email protected]")
-	tok, _, err := a.startSession(context.Background(), plain, false)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if w := postAs(t, mux, fmt.Sprintf("/admin/users/%d/ban", victim), nil, tok); w.Code != http.StatusNotFound {
-		t.Fatalf("member ban: status = %d, want 404", w.Code)
-	}
-}
-
-func TestInitials(t *testing.T) {
-	for name, want := range map[string]string{
-		"Esa Kataja":  "EK",
-		"Ärväs Öhman": "ÄÖ", // multi-byte initials must not end the loop early
-		"Åke":         "Å",
-		"":            "",
-		"a b c":       "AB",
-	} {
-		if got := (&member{Name: name}).Initials(); got != want {
-			t.Errorf("Initials(%q) = %q, want %q", name, got, want)
-		}
-	}
-}

docker-compose.yml

@@ -5,11 +5,12 @@ services:
       args:
         VERSION: ${VERSION:-dev}
     environment:
-      # Only used to create the first account on an empty database; inert after that.
-      ADMIN_EMAIL: ${ADMIN_EMAIL:-}
-      ADMIN_PASSWORD: ${ADMIN_PASSWORD:-}
-      ADMIN_NAME: ${ADMIN_NAME:-Ylläpito}
+      ADMIN_USER: ${ADMIN_USER:-admin}
+      ADMIN_PASSWORD: ${ADMIN_PASSWORD:?set ADMIN_PASSWORD in .env}
       ADDR: ":8080"
+      # Inside the container the admin listener must bind the container's own interface; it is not
+      # published below, so it stays unreachable from outside without a tunnel or the proxy.
+      ADMIN_ADDR: ":8081"
       SECURE_COOKIES: ${SECURE_COOKIES:-true}
       PUBLIC_URL: ${PUBLIC_URL:-}
     # The SQLite file sits in here beside the audio, so this one mount is the whole backup.
@@ -17,4 +18,5 @@ services:
       - ./storage:/storage
     ports:
       - "8080:8080"
+      - "8081:8081"
     restart: unless-stopped

docs/decisions.md

@@ -33,21 +33,15 @@ and `storage` was test data, so **the schema has no legacy to respect.**
    retention `DELETE`, a table and a filtered page — ~150 lines to avoid `docker compose logs`. If
    in-app visibility is ever wanted, build an *audit* view of domain events instead; those are
    queries over tables that already exist.
-8. **The admin is a member with `is_admin` set.** ~~The admin is not a user.~~ *Reversed.* The
-   original call — env credentials, Basic Auth, its own loopback listener — bought network isolation
-   at the price of a second port to tunnel and proxy, and a second credential in the password
-   manager. Basic Auth also sat outside the `SameSite` protection the member cookie already had, and
-   left admin actions with no actor to log. One boolean column reuses the session, the login rate
-   limiter, the ban-drops-sessions path and CSRF protection that all existed anyway. The costs the
-   original entry named are real but small here: seeding is `seedAdmin` on an empty database, and
-   the only lockout rule is that an admin cannot ban themselves. Banning a *second* admin is allowed
-   — with one admin per installation there is no last-admin case to protect.
-9. **No moderator tier.** A four-level role enum was considered and dropped: nothing in the admin
-   surface distinguishes a superadmin from an admin, and moderator is a second column on the day
-   somebody needs to resolve reports without also being able to reset passwords.
+8. **The admin is not a user.** Env credentials, Basic Auth, its own loopback listener. This deletes
+   the `role` column, first-launch seeding, admin sessions, the "cannot ban the last admin" rules,
+   and every "exclude the admin" clause that would otherwise appear in user and stats queries.
+9. **Same process, two listeners** — not a second binary. A management binary would need its own
+   deploy and would race the startup migrations. Two listeners give the network isolation, which was
+   the only real benefit.
 10. **The admin recovery endpoint is dropped.** The old app had a key-gated credential reset with a
-    `qwerty123` default in `docker-compose.yml`. There is no route, no key and no default: an admin
-    who loses their password is reset from the database, the same as any locked-out member.
+    `qwerty123` default in `docker-compose.yml`. The password is an env var now, so recovery is
+    editing it and restarting. No route, no key, no default.
 11. **Conversion runs in the background; nothing enters `songs` until it succeeds and the submitter
     confirms.** Costs a `submissions` table, buys a `songs` table where every row is a real song and
     no query filters on readiness.

docs/deployment.md

@@ -1,274 +0,0 @@
-# Deployment
-
-How Levyraati gets onto a server and how it is changed once it is there. Configuration variables are
-tabulated in the [README](../README.md#configuration); this file is the procedures.
-
-The whole deployment is **one container and one directory**. There is no database server, no
-migration step to run by hand, and no build on the target machine.
-
----
-
-## The server's compose file
-
-The `docker-compose.yml` in the repository root **builds from source** — that is the development
-one, and it is what you want on a machine that has the code checked out. A server has no source, so
-it runs a published image instead. Keep this second file on the server; it is not in the repository
-because it describes one particular deployment rather than the app.
-
-```yaml
-services:
-  app:
-    # Registry included. Pin a release tag, never :latest — a restart must not quietly change the
-    # running version. Kept in .env so this file carries no host of yours.
-    image: ${IMAGE:?set IMAGE in .env}
-    environment:
-      # Only read while the users table is empty: they create the first account and are ignored
-      # from then on. Safe to remove once that account exists.
-      ADMIN_EMAIL: ${ADMIN_EMAIL:-}
-      ADMIN_PASSWORD: ${ADMIN_PASSWORD:-}
-      ADMIN_NAME: ${ADMIN_NAME:-Ylläpito}
-      ADDR: ":8080"
-      SECURE_COOKIES: ${SECURE_COOKIES:-true}
-      PUBLIC_URL: ${PUBLIC_URL:-}
-    # The SQLite file sits in here beside the audio, so this one mount is the whole backup.
-    volumes:
-      - ./storage:/storage
-    ports:
-      - "8080:8080"
-    restart: unless-stopped
-```
-
-Two differences from the development file, and the reason for each:
-
-| | Development | Server |
-|---|---|---|
-| Source of the binary | `build:` from the checkout | `image:` pulled from the registry |
-| Version | `VERSION` build arg, `dev` by default | baked into the tagged image |
-
-There is one port. `/admin` rides the member listener behind the same session cookie as everything
-else, so there is nothing extra to publish, tunnel or firewall.
-
-Alongside it, a `.env` — same variables as [.env.example](../.env.example), plus the image:
-
-```sh
-IMAGE=registry.example.com/owner/levyraati26-go:2026.08.02-1
-ADMIN_EMAIL=…          # first start only
-ADMIN_PASSWORD=…       # first start only
-SECURE_COOKIES=true
-PUBLIC_URL=https://levyraati.example.com
-```
-
----
-
-## What the server needs
-
-- Docker with the Compose plugin, or Podman with `podman-compose`.
-- Credentials for the registry holding the image (`docker login <registry>`), unless it is public.
-- A reverse proxy terminating TLS in front of port 8080. Cookies are `Secure`, so the members' site
-  over plain HTTP will not keep anyone logged in.
-- Outbound network access: yt-dlp reaches YouTube, and the lyrics lookup reaches LRCLIB. Neither is
-  fatal to lose — submissions fail with a visible message and lyrics stay empty.
-
-Nothing else. No Go toolchain, no ffmpeg on the host — those live in the image.
-
----
-
-## Building and publishing a release
-
-Done from a checkout, not on the server. The version reaches the binary only through the build arg,
-so it must match the tag or `/healthz` will lie about what is deployed:
-
-```sh
-git switch main && git merge dev
-git tag 2026.08.02-1
-podman build --build-arg VERSION=2026.08.02-1 \
-  -t registry.example.com/owner/levyraati26-go:2026.08.02-1 \
-  -t registry.example.com/owner/levyraati26-go:latest .
-podman push registry.example.com/owner/levyraati26-go:2026.08.02-1
-podman push registry.example.com/owner/levyraati26-go:latest
-```
-
-Check before pushing that the tag took: `podman run --rm -p 8099:8080 -e ADMIN_PASSWORD=x IMAGE`
-then `curl localhost:8099/healthz` should answer `ok 2026.08.02-1`, not `ok dev`.
-
----
-
-## First deployment
-
-Two files go on the server — the compose file above and `.env`. **Not** a git clone; the source is
-not needed to run this.
-
-```sh
-mkdir -p /srv/levyraati && cd /srv/levyraati
-# put docker-compose.yml and .env here
-chmod 600 .env        # it holds the only admin credential there is
-docker compose pull
-docker compose up -d
-docker compose logs -f app     # watch the migrations apply
-```
-
-The first start creates `./storage` with `audio/`, `avatars/`, `tmp/` and `levyraati.db`, applies
-every migration, and only then accepts connections. It creates **no users** — nobody can register
-until you mint an invite.
-
-Confirm it is alive, and that the version is the one you meant to deploy:
-
-```sh
-curl -s localhost:8080/healthz     # -> ok 2026.08.02-1
-```
-
-### Reverse proxy
-
-Proxy your public hostname to `127.0.0.1:8080`. Two things matter beyond the defaults:
-
-- **Upload size.** Submissions are capped at 50 MB by the app; a proxy with a 1 MB default body
-  limit rejects them first, and the error is not the app's clear one. Raise it past 50 MB
-  (`client_max_body_size 64m` in nginx, `MaxRequestBodySize` in Caddy).
-- **Response buffering off**, or at least generous timeouts, for `/audio/{id}` — it serves Range
-  requests so the player can seek.
-
-### Admin access
-
-Log in as your own account and open `/admin`. Nothing to tunnel, nothing extra to proxy: the page is
-part of the site and is gated on the `is_admin` flag on your user row. A signed-in member without the
-flag gets a 404 there, so the page does not advertise itself.
-
-TLS at the proxy is what makes the invite *Kopioi* button work — the clipboard API needs a secure
-context, and `https://` is one. Over plain HTTP on a real hostname the button will not fire.
-
-From the page: mint invites, reset passwords, ban members, delete songs, read feedback.
-
-**First start.** On an empty database the app creates one account from `ADMIN_EMAIL` /
-`ADMIN_PASSWORD` and marks it admin. Once it exists those variables do nothing; drop them from
-`.env` if you would rather not keep a password there.
-
-**Lost the admin password?** There is no recovery endpoint and no recovery key. Set a new bcrypt
-hash directly in the SQLite file — re-running the app with `ADMIN_PASSWORD` will not help, because
-seeding only fires on an empty `users` table.
-
----
-
-## Upgrading
-
-```sh
-cd /srv/levyraati
-# back up first — see below; it takes a second and this is exactly when you want it
-$EDITOR .env                   # point IMAGE at the new tag
-docker compose pull
-docker compose up -d
-curl -s localhost:8080/healthz # confirm the new version is answering
-```
-
-Migrations run at startup, inside the new container, before it serves. There is no separate step.
-
-**Expect a few seconds of downtime.** One container, one SQLite file, no rolling deploy — and a
-restart deliberately fails every in-flight submission. Deploy when nobody is mid-review.
-
-### Rolling back
-
-Point `IMAGE` at the previous tag and `docker compose up -d`. **Only safe if the release you are
-leaving added no migration** — migrations are forward-only and the old binary will not understand a
-schema it has never seen. Check `migrations/` between the two tags first; if one landed, restore the
-backup taken before the upgrade instead.
-
-### What a restart does to work in progress
-
-Conversions run as goroutines inside the process, so a restart kills them. This is handled, not
-ignored: the startup sweep marks every submission still `queued`, `downloading` or `converting` as
-`failed` with "interrupted by restart", so nothing is stuck saying "converting" forever. The
-submitter sees the failure and can retry a URL submission or re-upload a file. Published songs and
-reviews are untouched.
-
----
-
-## Backups
-
-`./storage` holds everything — audio, avatars, and `levyraati.db`.
-
-**Do not just copy the database file while the app is running.** WAL mode means recent writes live
-in `levyraati.db-wal`, and a bare copy can miss them or catch a torn state. Ask SQLite for a
-consistent snapshot instead — it is safe against a live, writing database:
-
-```sh
-cd /srv/levyraati
-docker compose exec app sqlite3 /storage/levyraati.db ".backup '/storage/tmp/backup.db'"
-gzip -c storage/tmp/backup.db > /backups/levyraati-$(date +%F).db.gz
-rm storage/tmp/backup.db
-tar czf /backups/levyraati-audio-$(date +%F).tar.gz -C storage audio avatars
-```
-
-`storage/tmp/` is in-flight conversions and is safe to skip; it is cleared at startup anyway.
-
-A daily cron of those four lines is a complete backup strategy for this app.
-
-### Restoring
-
-```sh
-docker compose down
-gunzip -c /backups/levyraati-2026-08-02.db.gz > storage/levyraati.db
-rm -f storage/levyraati.db-wal storage/levyraati.db-shm   # stale sidecars of the old file
-tar xzf /backups/levyraati-audio-2026-08-02.tar.gz -C storage
-docker compose up -d
-```
-
-Deleting the `-wal` and `-shm` files matters: left behind, they belong to the database you just
-replaced, and SQLite will try to apply them to the restored one.
-
-Audio and rows are backed up separately but must be restored together — a song row whose `.ogg` is
-missing gives a broken player, and an orphan `.ogg` is invisible to everyone.
-
----
-
-## Operations
-
-### Logs
-
-```sh
-docker compose logs -f app
-```
-
-JSON to stdout, nothing else. Every line carries a `ctx` field (`startup`, `auth`, `songs`,
-`submissions`, `invites`, `reports`) to filter on.
-
-Two startup warnings are worth reading rather than skipping: `submissions interrupted by restart`
-says the sweep cleaned up after a restart, and `failed submissions present` is often the first sign
-that yt-dlp has gone stale.
-
-### yt-dlp goes stale
-
-yt-dlp rots against YouTube — routine maintenance, not an incident. It comes from Alpine's community
-repository in the image, so **the fix is a rebuild**, which means publishing a new image rather than
-anything on the server. Rebuild monthly. Failures show the yt-dlp error to the submitter, so members
-usually notice before you read a log.
-
-### Database shell
-
-```sh
-docker compose exec app sqlite3 /storage/levyraati.db
-```
-
-Writes here are unaudited and unvalidated — the schema holds the constraints, but the app's rules
-(the review window, the reveal rule, the lock) are in Go. Prefer the admin panel.
-
-### Disk
-
-Audio is Opus at 96 kbps: roughly 2–3 MB per song, so a hundred songs is a few hundred megabytes.
-`storage/tmp/` briefly holds a 50 MB upload plus its converted copy per in-flight submission,
-bounded by the two conversion slots.
-
----
-
-## Troubleshooting
-
-| Symptom | Cause |
-|---|---|
-| Container exits immediately on a first start | `ADMIN_EMAIL` or `ADMIN_PASSWORD` unset on an empty database. The log says so; a site nobody can log into is worse than one that will not boot |
-| `set IMAGE in .env` | Compose has no image to run; `IMAGE` is required and unset |
-| `/healthz` says `ok dev` | The image was built without `--build-arg VERSION`, so what is deployed cannot be identified |
-| Login never sticks | Plain HTTP with `SECURE_COOKIES=true`. Terminate TLS, or set it `false` for a local test |
-| Uploads fail near 50 MB | The reverse proxy's body limit, not the app's |
-| Invite links are relative | `PUBLIC_URL` unset |
-| Everything 500s after a restore | `-wal`/`-shm` sidecars from the replaced database were left in place |
-| Submissions all fail at download | yt-dlp is stale; rebuild and publish the image |
-| `/admin` returns 404 while logged in | That account has no `is_admin`. Set it in the database; nothing in the UI grants it |
-| Setting `ADMIN_PASSWORD` again changes nothing | Seeding only fires on an empty `users` table. Reset the hash in the database instead |

docs/spec.md

@@ -4,8 +4,7 @@ What the app does. This file and the code must never disagree; when behaviour ch
 with it. Terms are defined in [CONTEXT.md](../CONTEXT.md), decisions and their reasons in
 [decisions.md](./decisions.md), and anything explicitly not in v1 in [later.md](./later.md).
 
-Stack and configuration are in the [README](../README.md); running it on a server is in
-[deployment.md](./deployment.md).
+Stack, configuration, and operations are in the [README](../README.md).
 
 ---
 
@@ -364,58 +363,56 @@ template renders a circle with the member's initials, in CSS. No default image o
 
 ## 6. Admin
 
-**An admin is a member with `is_admin` set.** One boolean column on `users`, no role enum. They
-submit and review like anyone else and appear in every list and leaderboard, so no query has to
-exclude them. The admin UI is Finnish, like everything else.
+**The admin is not a user.** They never submit, never review, and never see the member-facing site.
+No `role` column, no admin row, no admin session, no admin login page, no first-launch seeding — and
+no query anywhere has to exclude the admin from a list, a leaderboard, or an aggregate. The admin UI
+is Finnish, like everything else.
 
 ```go
-// ponytail: one flag, no roles. A moderator tier is a second column on the day someone needs to
-// resolve reports without also being able to reset passwords.
-func (a *app) requireAdmin(next http.HandlerFunc) http.HandlerFunc {
-	return func(w http.ResponseWriter, r *http.Request) {
-		m := memberFrom(r.Context())
-		if m == nil {
-			http.Redirect(w, r, "/login", http.StatusSeeOther)
+// ponytail: Basic Auth, no admin session, no admin row. Ceiling: one admin, no logout
+// (close the browser). Add a cookie session if a second admin ever needs one.
+func requireAdmin(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		u, p, ok := r.BasicAuth()
+		if !ok || subtle.ConstantTimeCompare([]byte(u), []byte(adminUser)) != 1 ||
+			subtle.ConstantTimeCompare([]byte(p), []byte(adminPass)) != 1 {
+			w.Header().Set("WWW-Authenticate", `Basic realm="levyraati admin"`)
+			http.Error(w, "unauthorized", http.StatusUnauthorized)
 			return
 		}
-		if !m.IsAdmin {
-			http.NotFound(w, r)
-			return
-		}
-		next(w, r)
-	}
+		next.ServeHTTP(w, r)
+	})
 }
 ```
 
-A signed-in member who is not an admin gets **404, not 403**: the admin pages are none of their
-business, and "forbidden" confirms there is something to be forbidden from. Everything else — the
-session cookie, `SameSite` CSRF protection, the login rate limiter, ban-drops-sessions — is reused
-rather than reimplemented, which is the whole point of the flag.
+No bcrypt here: hashing protects *stored* passwords against a database leak, and this one lives in
+the env file already. The constant-time compare is the part that
+matters. **Fatal at startup if `ADMIN_PASSWORD` is unset** — an admin panel that silently opens is
+worse than one that will not boot.
 
 ```go
-// One listener. /admin is a route on the member mux, gated per-route.
-log.Fatal(http.ListenAndServe(":8080", a.withMember(a.memberMux())))
+// ponytail: two listeners, one process. Admin is loopback-only — reach it over an SSH tunnel
+// or the reverse proxy. A separate binary would need its own deploy and would race the
+// startup migrations; it buys nothing else.
+go func() { log.Fatal(http.ListenAndServe("127.0.0.1:8081", requireAdmin(adminMux))) }()
+log.Fatal(http.ListenAndServe(":8080", memberMux))
 ```
 
-**Bootstrap:** registration needs an invite and invites are minted from `/admin`, so an empty
-database cannot grow a first user on its own. `seedAdmin` breaks the circle exactly once — on an
-empty `users` table it creates account number one from `ADMIN_EMAIL` / `ADMIN_PASSWORD` and sets
-`is_admin`. Against a populated database it does nothing, which is what makes it safe to leave in
-the boot sequence. **Fatal at startup if those are unset on an empty database** — a site nobody can
-log into is worse than one that will not boot.
+**Bootstrap:** the admin logs in with the env credentials and mints the first invite. That is the
+entire first-launch story. Losing the password is an edit to `.env` and a restart.
 
-**Routes:** `GET /admin` dashboard, `POST /admin/invites`, `POST /admin/users/{id}/password`,
-`POST /admin/users/{id}/ban`, `POST /admin/songs/{id}/delete`, `GET /admin/reports`,
-`POST /admin/reports/{id}/resolve`. There is no `/admin/audio/{id}`: an admin is a member, so
-`GET /audio/{id}` already works for them.
+**Routes** (all on the loopback listener): `GET /admin` dashboard, `POST /admin/invites`,
+`POST /admin/users/{id}/password`, `POST /admin/users/{id}/ban`, `POST /admin/songs/{id}/delete`,
+`GET /admin/reports`, `POST /admin/reports/{id}/resolve`, and `GET /admin/audio/{id}` — moderating a
+complaint means listening to the song, and a separate audio route avoids branching auth inside the
+member handler.
 
 **Ban** is a reversible toggle. It refuses login and deletes the member's sessions immediately.
 Their songs and reviews stay, keep counting in the stats, and keep their name on them: a ban ends
-participation, it does not rewrite history. An admin cannot ban *themselves* — the sessions would go
-with it and nothing would be left to undo it.
+participation, it does not rewrite history.
 
-**The admin surface has no API.** No client but a browser, so JSON would be contract surface with no
-consumer.
+**The admin surface has no API.** Basic Auth on loopback with no client but a browser — JSON would
+be contract surface with no consumer.
 
 ---
 
@@ -733,7 +730,7 @@ panel, so the admin surface comes first — before a single member can exist.
 
 1. **Skeleton** — `main.go`, embedded migrations at startup, `database/sql`, slog, Docker Compose,
    the two listeners.
-2. **Admin, invites, auth** — seed the first admin, mint an invite, register, log in, sessions, ban.
+2. **Admin, invites, auth** — Basic Auth listener, mint an invite, register, log in, sessions, ban.
 3. **Submission pipeline, upload path only** — submit, convert, waiting page, publish. No yt-dlp yet,
    so the hard parts (worker, publish transaction, restart recovery) are proven without a network
    dependency.

go.mod

@@ -1,6 +1,6 @@
 module git.kessinen.com/kessinen/levyraati26-go
 
-go 1.27.0
+go 1.25.0
 
 require (
 	golang.org/x/crypto v0.32.0

lyrics.go

@@ -67,7 +67,7 @@ func parseLRC(s string) []lyricLine {
 		return nil
 	}
 	var out []lyricLine
-	for raw := range strings.SplitSeq(s, "\n") {
+	for _, raw := range strings.Split(s, "\n") {
 		stamps := lrcOne.FindAllStringSubmatch(raw, -1)
 		if len(stamps) == 0 {
 			continue

main.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"crypto/subtle"
 	"database/sql"
 	"fmt"
 	"log/slog"
@@ -10,7 +11,6 @@ import (
 	"path/filepath"
 	"strings"
 
-	"golang.org/x/crypto/bcrypt"
 	_ "modernc.org/sqlite"
 )
 
@@ -18,31 +18,34 @@ import (
 var version = "dev"
 
 type config struct {
-	dbPath string
-	// Only read when the database has no users at all: seedAdmin turns these into account number
-	// one. Once that account exists they are dead weight and can leave the environment.
-	adminEmail    string
-	adminName     string
+	dbPath        string
+	adminUser     string
 	adminPass     string
 	addr          string
+	adminAddr     string
 	storageDir    string
 	secureCookies bool
-	// Public address of the site, so invite links are pasteable out of the admin page.
+	// Public address of the member site, so admin-side invite links are pasteable. The admin
+	// listener's own Host is a tunnel, not the site, so it cannot be derived.
 	publicURL string
 }
 
 func loadConfig() config {
 	c := config{
-		adminEmail:    os.Getenv("ADMIN_EMAIL"),
-		adminName:     env("ADMIN_NAME", "Ylläpito"),
+		adminUser:     env("ADMIN_USER", "admin"),
 		adminPass:     os.Getenv("ADMIN_PASSWORD"),
 		addr:          env("ADDR", ":8080"),
+		adminAddr:     env("ADMIN_ADDR", "127.0.0.1:8081"),
 		storageDir:    env("STORAGE_DIR", "./storage"),
 		secureCookies: env("SECURE_COOKIES", "true") != "false",
 		publicURL:     strings.TrimRight(os.Getenv("PUBLIC_URL"), "/"),
 	}
 	// The database lives beside the audio, so one volume is the whole backup.
 	c.dbPath = env("DB_PATH", filepath.Join(c.storageDir, "levyraati.db"))
+	// An admin panel that silently opens is worse than one that won't boot.
+	if c.adminPass == "" {
+		fatal("ADMIN_PASSWORD is not set")
+	}
 	return c
 }
 
@@ -119,48 +122,22 @@ func main() {
 	if err := sweep(ctx, db); err != nil {
 		fatal("startup sweep", "error", err)
 	}
-	if err := seedAdmin(ctx, db, cfg); err != nil {
-		fatal("seed admin", "error", err)
-	}
 
 	a := &app{cfg: cfg, db: db}
 
+	// ponytail: two listeners, one process. Admin is loopback-only — reach it over an SSH tunnel
+	// or the reverse proxy. A separate binary would need its own deploy and would race the
+	// startup migrations; it buys nothing else.
+	go func() {
+		slog.Info("admin listening", "ctx", "startup", "addr", cfg.adminAddr)
+		err := http.ListenAndServe(cfg.adminAddr, a.requireAdmin(a.adminMux()))
+		fatal("admin listener", "error", err)
+	}()
+
 	slog.Info("listening", "ctx", "startup", "addr", cfg.addr)
 	fatal("listener", "error", http.ListenAndServe(cfg.addr, a.withMember(a.memberMux())))
 }
 
-// Registration needs an invite and invites are minted from the admin page, so a database with no
-// users has no way to grow one. seedAdmin breaks that circle exactly once: on an empty users table
-// it creates account number one from the environment and marks it admin. Every account after it
-// arrives through an invite like anyone else.
-//
-// ponytail: no promote-existing-user path and no password reset here. Re-running against a
-// populated database does nothing, which is what makes it safe to leave in the boot sequence.
-func seedAdmin(ctx context.Context, db *sql.DB, cfg config) error {
-	var users int
-	if err := db.QueryRowContext(ctx, `select count(*) from users`).Scan(&users); err != nil {
-		return err
-	}
-	if users > 0 {
-		return nil
-	}
-	if cfg.adminEmail == "" || cfg.adminPass == "" {
-		// A site nobody can log into is worse than one that won't boot.
-		fatal("empty database: set ADMIN_EMAIL and ADMIN_PASSWORD to create the first account")
-	}
-	hash, err := bcrypt.GenerateFromPassword([]byte(cfg.adminPass), bcrypt.DefaultCost)
-	if err != nil {
-		return err
-	}
-	if _, err := db.ExecContext(ctx,
-		`insert into users (name, email, password_hash, is_admin) values ($1, $2, $3, 1)`,
-		cfg.adminName, strings.ToLower(cfg.adminEmail), string(hash)); err != nil {
-		return err
-	}
-	slog.Info("first admin created", "ctx", "startup", "email", cfg.adminEmail)
-	return nil
-}
-
 func (a *app) memberMux() *http.ServeMux {
 	mux := http.NewServeMux()
 	mux.Handle("GET /static/", http.FileServerFS(assetFS))
@@ -210,40 +187,41 @@ func (a *app) memberMux() *http.ServeMux {
 	mux.HandleFunc("POST /submit/{id}/lyrics", a.requireMember(a.suggestLyrics))
 	mux.HandleFunc("POST /submit/{id}/retry", a.requireMember(a.retry))
 	mux.HandleFunc("POST /submit/{id}/discard", a.requireMember(a.discard))
-
-	a.adminRoutes(mux)
 	return mux
 }
 
-// The admin pages sit on the same mux and the same session as everything else; only the guard
-// differs. There is no /admin/audio: requireAdmin members can reach GET /audio/{id} like anyone.
-func (a *app) adminRoutes(mux *http.ServeMux) {
-	mux.HandleFunc("GET /admin", a.requireAdmin(a.adminDashboard))
-	mux.HandleFunc("POST /admin/invites", a.requireAdmin(a.createInvite))
-	mux.HandleFunc("POST /admin/users/{id}/ban", a.requireAdmin(a.toggleBan))
-	mux.HandleFunc("POST /admin/users/{id}/password", a.requireAdmin(a.resetPassword))
-	mux.HandleFunc("POST /admin/songs/{id}/delete", a.requireAdmin(a.adminDeleteSong))
-	mux.HandleFunc("GET /admin/reports", a.requireAdmin(a.adminReports))
-	mux.HandleFunc("POST /admin/reports/{id}/resolve", a.requireAdmin(a.resolveReport))
+func (a *app) adminMux() *http.ServeMux {
+	mux := http.NewServeMux()
+	mux.Handle("GET /static/", http.FileServerFS(assetFS))
+	mux.HandleFunc("GET /admin", a.adminDashboard)
+	mux.HandleFunc("POST /admin/invites", a.createInvite)
+	mux.HandleFunc("POST /admin/users/{id}/ban", a.toggleBan)
+	mux.HandleFunc("POST /admin/users/{id}/password", a.resetPassword)
+	mux.HandleFunc("POST /admin/songs/{id}/delete", a.adminDeleteSong)
+	mux.HandleFunc("GET /admin/reports", a.adminReports)
+	mux.HandleFunc("POST /admin/reports/{id}/resolve", a.resolveReport)
+	mux.HandleFunc("GET /admin/audio/{id}", a.adminAudio)
+	mux.HandleFunc("GET /{$}", func(w http.ResponseWriter, r *http.Request) {
+		http.Redirect(w, r, "/admin", http.StatusSeeOther)
+	})
+	return mux
 }
 
-// ponytail: one flag, no roles. A moderator tier is a second column on the day someone needs to
-// resolve reports without also being able to reset passwords.
+// ponytail: Basic Auth, no admin session, no admin row. Ceiling: one admin, no logout
+// (close the browser). Add a cookie session if a second admin ever needs one.
 //
-// A signed-out visitor is sent to log in, the same as any member page. A signed-in member who is
-// not an admin gets 404 rather than 403: the admin pages are none of their business, and saying
-// "forbidden" confirms there is something there to be forbidden from.
-func (a *app) requireAdmin(next http.HandlerFunc) http.HandlerFunc {
-	return func(w http.ResponseWriter, r *http.Request) {
-		m := memberFrom(r.Context())
-		if m == nil {
-			http.Redirect(w, r, "/login", http.StatusSeeOther)
+// No bcrypt: hashing protects stored passwords against a database leak, and this one lives in the
+// env file already. The constant-time compare is the part that matters.
+func (a *app) requireAdmin(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		u, p, ok := r.BasicAuth()
+		userOK := subtle.ConstantTimeCompare([]byte(u), []byte(a.cfg.adminUser)) == 1
+		passOK := subtle.ConstantTimeCompare([]byte(p), []byte(a.cfg.adminPass)) == 1
+		if !ok || !userOK || !passOK {
+			w.Header().Set("WWW-Authenticate", `Basic realm="levyraati admin"`)
+			http.Error(w, "unauthorized", http.StatusUnauthorized)
 			return
 		}
-		if !m.IsAdmin {
-			http.NotFound(w, r)
-			return
-		}
-		next(w, r)
-	}
+		next.ServeHTTP(w, r)
+	})
 }

main_test.go

@@ -0,0 +1,58 @@
+package main
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestRequireAdmin(t *testing.T) {
+	a := &app{cfg: config{adminUser: "admin", adminPass: "s3cret"}}
+	h := a.requireAdmin(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusTeapot)
+	}))
+
+	for _, tc := range []struct {
+		name, user, pass string
+		auth             bool
+		want             int
+	}{
+		{name: "no credentials", want: http.StatusUnauthorized},
+		{name: "wrong password", user: "admin", pass: "hunter2", auth: true, want: http.StatusUnauthorized},
+		{name: "wrong user", user: "root", pass: "s3cret", auth: true, want: http.StatusUnauthorized},
+		{name: "correct", user: "admin", pass: "s3cret", auth: true, want: http.StatusTeapot},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			r := httptest.NewRequest("GET", "/admin", nil)
+			if tc.auth {
+				r.SetBasicAuth(tc.user, tc.pass)
+			}
+			w := httptest.NewRecorder()
+			h.ServeHTTP(w, r)
+			if w.Code != tc.want {
+				t.Fatalf("status = %d, want %d", w.Code, tc.want)
+			}
+		})
+	}
+}
+
+func TestMigrateIsIdempotent(t *testing.T) {
+	ctx := context.Background()
+	a := testApp(t) // already migrated once
+
+	if err := migrate(ctx, a.db); err != nil {
+		t.Fatalf("second migrate: %v", err)
+	}
+	if err := sweep(ctx, a.db); err != nil {
+		t.Fatalf("sweep: %v", err)
+	}
+
+	var n int
+	if err := a.db.QueryRowContext(ctx, `select count(*) from schema_migrations`).Scan(&n); err != nil {
+		t.Fatal(err)
+	}
+	if n != 1 {
+		t.Fatalf("applied migrations = %d, want 1", n)
+	}
+}

reports.go

@@ -190,3 +190,9 @@ func (a *app) adminSongs(ctx context.Context) ([]adminSong, error) {
 	}
 	return out, rows.Err()
 }
+
+// Moderating a complaint means listening to the song, so the admin surface has its own audio route
+// rather than branching auth inside the member handler.
+func (a *app) adminAudio(w http.ResponseWriter, r *http.Request) {
+	a.audio(w, r)
+}

songs.go

@@ -295,7 +295,7 @@ func (a *app) editSong(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	if affected(res) == 0 {
-		a.flash(w, "Kappaletta on jo arvosteltu, joten sitä ei voi muokata.")
+		a.flash(w, "Kappaletta ei voi enää muokata — sitä on jo arvosteltu.")
 	} else {
 		a.flash(w, "Tiedot tallennettu.")
 	}
@@ -319,7 +319,7 @@ func (a *app) deleteSong(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	if affected(res) == 0 {
-		a.flash(w, "Kappaletta on jo arvosteltu, joten sitä ei voi poistaa.")
+		a.flash(w, "Kappaletta ei voi enää poistaa — sitä on jo arvosteltu.")
 		http.Redirect(w, r, fmt.Sprintf("/songs/%d", id), http.StatusSeeOther)
 		return
 	}

src/main_test.go

@@ -1,95 +0,0 @@
-package main
-
-import (
-	"context"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-)
-
-// A plain member must not be able to tell that /admin exists, and a stranger must be sent to log in.
-func TestRequireAdmin(t *testing.T) {
-	a := &app{}
-	h := a.requireAdmin(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusTeapot)
-	})
-
-	for _, tc := range []struct {
-		name string
-		as   *member
-		want int
-	}{
-		{name: "signed out", as: nil, want: http.StatusSeeOther},
-		{name: "member", as: &member{ID: 1}, want: http.StatusNotFound},
-		{name: "admin", as: &member{ID: 1, IsAdmin: true}, want: http.StatusTeapot},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			r := httptest.NewRequest("GET", "/admin", nil)
-			if tc.as != nil {
-				r = r.WithContext(context.WithValue(r.Context(), memberKey, tc.as))
-			}
-			w := httptest.NewRecorder()
-			h(w, r)
-			if w.Code != tc.want {
-				t.Fatalf("status = %d, want %d", w.Code, tc.want)
-			}
-		})
-	}
-}
-
-// The first account cannot arrive by invite, because minting an invite needs an admin.
-func TestSeedAdminOnlyOnEmptyDatabase(t *testing.T) {
-	a := testApp(t)
-	ctx := context.Background()
-	cfg := config{adminEmail: "[email protected]", adminName: "Ylläpito", adminPass: "salasana1"}
-
-	if err := seedAdmin(ctx, a.db, cfg); err != nil {
-		t.Fatal(err)
-	}
-	var name, email string
-	var isAdmin bool
-	if err := a.db.QueryRowContext(ctx,
-		`select name, email, is_admin from users`).Scan(&name, &email, &isAdmin); err != nil {
-		t.Fatal(err)
-	}
-	if !isAdmin || name != "Ylläpito" {
-		t.Fatalf("seeded %q is_admin=%v, want Ylläpito admin", name, isAdmin)
-	}
-	// Login is by lowercased email, so the seed must not smuggle in a capital.
-	if email != "[email protected]" {
-		t.Fatalf("email = %q, want lowercased", email)
-	}
-
-	// Re-running on a populated database must not add a second account or reset the first.
-	cfg.adminEmail = "[email protected]"
-	if err := seedAdmin(ctx, a.db, cfg); err != nil {
-		t.Fatal(err)
-	}
-	var n int
-	if err := a.db.QueryRowContext(ctx, `select count(*) from users`).Scan(&n); err != nil {
-		t.Fatal(err)
-	}
-	if n != 1 {
-		t.Fatalf("users = %d, want 1", n)
-	}
-}
-
-func TestMigrateIsIdempotent(t *testing.T) {
-	ctx := context.Background()
-	a := testApp(t) // already migrated once
-
-	if err := migrate(ctx, a.db); err != nil {
-		t.Fatalf("second migrate: %v", err)
-	}
-	if err := sweep(ctx, a.db); err != nil {
-		t.Fatalf("sweep: %v", err)
-	}
-
-	var n int
-	if err := a.db.QueryRowContext(ctx, `select count(*) from schema_migrations`).Scan(&n); err != nil {
-		t.Fatal(err)
-	}
-	if n != 2 {
-		t.Fatalf("applied migrations = %d, want 2", n)
-	}
-}

src/migrations/002_users_is_admin.sql

@@ -1,8 +0,0 @@
--- The admin became an ordinary account with a flag, so the separate Basic Auth listener could go.
--- Same integer-as-boolean convention as `banned` above it.
-alter table users add column is_admin integer not null default 0;
-
--- An existing database already has its admin sitting in row one: the person who was handed the
--- first invite from the old panel. A fresh database has no rows, so this is a no-op there and
--- seedAdmin creates the account from the environment instead.
-update users set is_admin = 1 where id = (select min(id) from users);

templates/admin.html

@@ -27,8 +27,8 @@
       {{end}}
     </tbody>
   </table>
-  <p class="muted small">Lähetä linkki kaverille. Koodi on valmiiksi täytettynä.
-    Lista näyttää käyttämättömät kutsut{{if .Data.SpentCount}}; käytettyjä on
+  <p class="muted small">Lähetä linkki kaverille — se avaa liittymislomakkeen koodi valmiiksi
+    täytettynä. Lista näyttää käyttämättömät kutsut{{if .Data.SpentCount}}; käytettyjä on
     {{.Data.SpentCount}}{{end}}.</p>
   </div>
 </section>
@@ -75,7 +75,7 @@
           <td>{{.Reviews}}</td>
           <td class="nowrap">{{fidate .CreatedAt}}</td>
           <td class="actions">
-            <a href="/audio/{{.ID}}">Kuuntele</a>
+            <a href="/admin/audio/{{.ID}}">Kuuntele</a>
             <form method="post" action="/admin/songs/{{.ID}}/delete"
                   onsubmit="return confirm('Poistetaanko kappale ja kaikki sen arvostelut?')">
               <button type="submit" class="ghost danger">Poista</button>

templates/layout.html

@@ -16,14 +16,15 @@
     <div class="topbar-inner">
       <a class="brand" href="/">Levyraati{{if .Admin}} <span class="badge admin">ylläpito</span>{{end}}</a>
 
-      {{if .Member}}
+      {{if .Admin}}
+        <nav class="navlinks"><a href="/admin" aria-current="page">Ylläpito</a></nav>
+        <span></span>
+      {{else if .Member}}
         <nav class="navlinks">
           <a href="/" {{if eq .Path "/"}}aria-current="page"{{end}}>Jono{{if .Queued}} <span class="count">{{.Queued}}</span>{{end}}</a>
           <a href="/songs" {{if eq .Path "/songs"}}aria-current="page"{{end}}>Kappaleet</a>
           <a href="/submit" {{if eq .Path "/submit"}}aria-current="page"{{end}}>Lähetä</a>
           <a href="/stats" {{if eq .Path "/stats"}}aria-current="page"{{end}}>Tilastot</a>
-          <!-- An admin is a member first: the same nav, with one link the others do not get. -->
-          {{if .Member.IsAdmin}}<a href="/admin" {{if .Admin}}aria-current="page"{{end}}>Ylläpito</a>{{end}}
         </nav>
         <div class="userblock">
           <span class="lines">
@@ -44,7 +45,6 @@
               <a href="/songs">Kappaleet</a>
               <a href="/submit">Lähetä</a>
               <a href="/stats">Tilastot</a>
-              {{if .Member.IsAdmin}}<a href="/admin">Ylläpito</a>{{end}}
               <a href="/profile">Oma profiili</a>
               <form method="post" action="/logout"><button type="submit">Kirjaudu ulos</button></form>
             </div>
@@ -62,7 +62,7 @@
   <footer class="sitefooter">
     {{if .Member}}
       <!-- The server already knows where they were, so the path travels in the link — no JS. -->
-      <a href="/report?from={{.Path}}">Anna palautetta</a> ·
+      <a href="/report?from={{.Path}}">Ongelmia? Ideoita? Palautetta?</a> ·
     {{end}}
     <span class="slogan">We know good music, baby!</span>
     <span class="copyright">© Kessinen</span>

templates/partials/player.html

@@ -11,7 +11,7 @@
   </div>
   <label class="follow">
     <input type="checkbox" checked> Seuraa kappaletta
-    <span class="muted small">(sivu ei vieri)</span>
+    <span class="muted small">— korostus jatkuu, sivu ei vieri</span>
   </label>
 {{else}}
   <div class="lyricsbox plain" data-duration="{{.Duration}}" data-song="{{.ID}}">
@@ -36,7 +36,7 @@
 {{define "songcard"}}
 <a class="songcard{{if and (not .Own) (not .Reviewed)}} unreviewed{{end}}" href="/songs/{{.ID}}">
   {{if .Average}}<span class="scorebadge">{{score .Average}}</span>
-  {{else if .ReviewCount}}<span class="scorebadge sealed" title="Muiden pisteet paljastuvat kun tallennat omasi"></span>{{end}}
+  {{else if .ReviewCount}}<span class="scorebadge sealed" title="Pisteet paljastuvat kun arvostelet"></span>{{end}}
   <span class="title">{{.Title}}</span>
   <span class="artist">{{.Artist}}</span>
   <span class="meta">

templates/queue.html

@@ -2,8 +2,8 @@
 <h1>Jono</h1>
 
 {{if .Data.Items}}
-  <p class="muted">Arvostelemattomat kappaleet, vanhimmasta uusimpaan. Muiden pisteet paljastuvat
-    kun tallennat omasi.</p>
+  <p class="muted">Arvostelemattomat kappaleet, vanhimmasta uusimpaan. Pisteet paljastuvat kun
+    olet kirjoittanut oman arvostelusi.</p>
   <div class="songgrid">
     {{range .Data.Items}}{{template "songcard" .}}{{end}}
   </div>

templates/report.html

@@ -1,6 +1,7 @@
 {{define "content"}}
 <h1>Palaute</h1>
-<p class="muted">Ongelmat, ideat ja kaikki muu palaute samaan paikkaan. Yksi virke riittää.</p>
+<p class="muted">Ongelmat, ideat ja kaikki muu palaute samaan paikkaan. Ei kategorioita eikä
+  prioriteetteja — yksi virke riittää.</p>
 
 <form method="post" action="/report" class="stack">
   <input type="hidden" name="from" value="{{.Data.From}}">

templates/song.html

@@ -81,7 +81,7 @@
 <!-- Only when the review strip is not already showing them: while reviewing, the lyrics live in
      the left pane. This panel is for reading afterwards and for the submitter's edits. -->
 <details class="lyrics">
-  <summary>Sanoitukset{{if not $s.Lyrics}} <span class="muted small">(ei vielä lisätty)</span>{{end}}</summary>
+  <summary>Sanoitukset{{if not $s.Lyrics}} <span class="muted small">— ei vielä lisätty</span>{{end}}</summary>
   {{if $s.Lyrics}}<pre class="lyricstext">{{lyricstext $s.Lyrics}}</pre>{{end}}
   {{if $s.Own}}
     <form method="post" action="/songs/{{$s.ID}}/lyrics" class="stack">
@@ -168,7 +168,7 @@
   {{else}}
     <p class="sealed-note">
       <span class="sealed" aria-hidden="true"></span>
-      Muiden pisteet paljastuvat kun tallennat omasi.
+      Muiden pisteet ja arvostelut paljastuvat kun kirjoitat omasi.
       {{if $s.ReviewCount}}Arvosteluja on {{$s.ReviewCount}}.{{end}}
     </p>
   {{end}}

templates/stats.html

@@ -49,7 +49,7 @@
 {{define "content"}}
 <h1>Tilastot</h1>
 <p class="muted">Kappale pääsee listoille kun sillä on vähintään {{.Data.MinReviews}} arvostelua.
-  Tilastot näkyvät kaikille.</p>
+  Tilastot näkyvät kaikille — täällä pisteitä ei piiloteta.</p>
 
 <div class="boards">
   {{template "songboard" dict "Title" "Parhaat" "Items" .Data.TopSongs}}

templates/submission.html

@@ -24,7 +24,7 @@
     <!-- Outside the form and attached to it with form=, so one button both submits the metadata
          and publishes. Disabled until the audio has finished converting. -->
     <button type="submit" form="meta" {{if not .Ready}}disabled{{end}}>Julkaise</button>
-    {{if not .Ready}}<p class="muted small">Julkaise aukeaa kun lähetys on valmis.</p>{{end}}
+    {{if not .Ready}}<p class="muted small">Julkaise aukeaa kun muunnos on valmis.</p>{{end}}
   {{end}}
 </div>
 {{end}}
@@ -45,7 +45,7 @@
             hx-post="/submit/{{.ID}}/lyrics"
             hx-include="[name='title'], [name='artist']"
             hx-target="#lyricsfield" hx-swap="outerHTML">Hae sanoitukset</button>
-    {{if .Found}}<span class="muted small">Löytyi. Tarkista teksti.</span>{{end}}
+    {{if .Found}}<span class="muted small">Löytyi — tarkista ja muokkaa tarvittaessa.</span>{{end}}
     {{if .Searched}}{{if not .Found}}
       <span class="muted small">Ei löytynyt. Tarkista nimi ja esittäjä tai liitä sanoitukset itse.</span>
     {{end}}{{end}}
@@ -84,7 +84,8 @@
   {{template "saved" ""}}
 </form>
 
-<p class="muted">Nimi, esittäjä ja genre tarvitaan ennen julkaisua.</p>
+<p class="muted">Tiedot tallentuvat itsestään kirjoittaessasi. Nimi, esittäjä ja genre tarvitaan
+  ennen julkaisua.</p>
 
 {{template "submission-status" .Data}}
 {{end}}

templates/submit.html

@@ -32,10 +32,13 @@
       {{end}}
     </tbody>
   </table>
+  <p class="muted small">Valmis lähetys odottaa Julkaise-painallusta — vasta se tuo kappaleen
+    muiden nähtäville.</p>
 </section>
 {{end}}
 
-<p class="muted">Enintään 50 MB ja 15 minuuttia.</p>
+<p class="muted">Enintään 50 MB ja 15 minuuttia. Tiedosto muunnetaan Opus-muotoon, ja pääset
+  kirjoittamaan esittelyn odotellessa. Kappale julkaistaan vasta kun painat Julkaise.</p>
 
 <script>
   // The native control can't be relabelled or styled, so it is hidden behind this one — which