Esa Kataja
cf2cb0ce0a
check / check (push) Successful in 46s
BREAKING CHANGE: PASSWORD is gone and AUTH and CERTRESOLVER are required. The server's compose.yaml and .env must be updated in the same deploy — the new image ignores PASSWORD, and the old one refuses to start without it. Authelia now sits in front of Traefik, so the app was asking for a second password at the same door. Two prompts, and the weaker of the two was the one holding a single shared secret with no sessions, no MFA and no revocation. Deleting it is the whole change: Authelia already does this properly, once, for every service on the host. Gone: auth(), challenge(), the whole of throttle.go and its tests, and golang.org/x/time with them. routes() returns the bare mux, /healthz is an ordinary route on it, and the smoke script drops sixty -u flags. Roughly 230 lines removed and nothing written to replace them. What holds the app up now, both asserted in compose.yaml: - The router names the Authelia middleware through AUTH. Traefik takes a router out of service when its middleware does not resolve, so a typo or an unset variable fails shut rather than serving the app open. - The container still publishes no ports, so the proxy is the only thing that can reach it. Publishing 8080 would now bypass authentication outright, not merely TLS — the comment there says so. certresolver replaces the bare tls=true, parameterised as CERTRESOLVER: the server had been carrying that label by hand since the first deploy. Naming a resolver implies tls=true, so it stays one label. TestAuth and TestHealthzSkipsAuth are replaced by one test asserting every route answers without credentials — a 401 from here would now mean auth had crept back in.
72 lines
2.1 KiB
Makefile
72 lines
2.1 KiB
Makefile
# Foodster. Run `make` for the target list.
|
|
|
|
COMPOSE ?= podman compose
|
|
BIN := foodster
|
|
PKG := ./cmd/foodster
|
|
|
|
# Registry coordinates, hostname, TZ. Gitignored.
|
|
ifneq (,$(wildcard .env))
|
|
include .env
|
|
export
|
|
endif
|
|
|
|
# Generated templ output is excluded — it is not ours to format.
|
|
GOFILES = $(shell find . -name '*.go' -not -name '*_templ.go' 2>/dev/null)
|
|
|
|
.DEFAULT_GOAL := help
|
|
.PHONY: help generate build run test smoke check lint fix up down logs clean
|
|
|
|
help: ## Show this help
|
|
@grep -hE '^[a-zA-Z_-]+:.*## ' $(MAKEFILE_LIST) \
|
|
| awk -F':.*## ' '{printf " \033[1m%-9s\033[0m %s\n", $$1, $$2}'
|
|
|
|
generate: ## Generate Go from .templ files
|
|
go tool templ generate
|
|
|
|
build: generate ## Build ./foodster
|
|
CGO_ENABLED=0 go build -trimpath \
|
|
-ldflags="-s -w -X main.version=dev" -o $(BIN) $(PKG)
|
|
|
|
run: generate ## Run locally on :8080 (database in ./data)
|
|
ENV=dev go run $(PKG)
|
|
|
|
test: generate ## Run unit tests
|
|
go test ./...
|
|
|
|
smoke: generate ## End-to-end check: auth, static assets, bundle import
|
|
./scripts/smoke.sh
|
|
|
|
# Sub-makes rather than prerequisites: these must run in order even under
|
|
# `make -j`, and a parallel run vets generated code that is being rewritten.
|
|
check: ## Everything that must pass before a commit
|
|
@$(MAKE) --no-print-directory lint
|
|
@$(MAKE) --no-print-directory test
|
|
@$(MAKE) --no-print-directory smoke
|
|
@echo "check: all passed"
|
|
|
|
lint: generate ## go vet, gofmt check, golangci-lint when installed
|
|
go vet ./...
|
|
@bad=$$(gofmt -l $(GOFILES) 2>/dev/null); \
|
|
if [ -n "$$bad" ]; then echo "gofmt needed:"; echo "$$bad"; exit 1; fi
|
|
@if command -v golangci-lint >/dev/null 2>&1; then golangci-lint run; \
|
|
else echo "golangci-lint not installed - skipped"; fi
|
|
|
|
fix: ## Format Go and templ sources, tidy go.mod
|
|
@if [ -n "$(GOFILES)" ]; then gofmt -w $(GOFILES); fi
|
|
go tool templ fmt .
|
|
go mod tidy
|
|
|
|
up: ## Start the stack
|
|
@mkdir -p data # or the engine creates it root-owned and the app cannot write
|
|
$(COMPOSE) up -d
|
|
|
|
down: ## Stop the stack
|
|
$(COMPOSE) down
|
|
|
|
logs: ## Follow app logs
|
|
$(COMPOSE) logs -f app
|
|
|
|
clean: ## Remove the binary and generated templates
|
|
rm -f $(BIN)
|
|
find . -name '*_templ.go' -delete
|