objects: improve support for our s3 deployment
Not sure how well this generalizes but we can improve it when someone
complains.
Switch from minio to AWS SDK S3 client
Moves s3 => objects to avoid conflicting with the AWS module.
server: log GraphQL queries if running in debug mode
auth: fix remote IP determination for audit log
This is probably isolated to dev or other small environments, but I had
two issues with the remote IP determination, breaking the audit log
display in my dev env after fairly standard usage.
The gist is that the audit log is designed to contain clean IP addresses
only. However, the algorithm starts out with `r.RemoteAddr`, which may
contain a port (usually 127.0.0.1:xxxxx). The port removal is already
performed at the beginning of the function, so simply re-use the result
of this.
Furthermore, the initial value (containing the port leading to breakage)
landed in the audit log because I was using a private IP (it's my dev
evn). We correctly trust private IPs, but that means if no public IP
ever shows up in the X-Forwarded-For header, the last private IP was the
one that actually made the request.
I am not entirely sure why this showed up now. I already had a bunch of
oder audit log entries that had the correct private-but-not-localhost
addresses. But in the current state, e.g. simply updating my profile
would cause the bad IP:port notation to be written to the audit log.
server: handle CORS in server
Currently CORS is handled in nginx in front of the API. That setup is
not very suitable for Kubernetes. Instead, handle CORS here, so we do
not need any intermediaries between the ingress and the APIs.
The CORS settings are taken from sr.ht-nginx/graphql.conf [1]
[1] https://git.sr.ht/~sircmpwn/sr.ht-nginx/tree/master/item/graphql.conf
.builds/alpine.yml: upgrade to 3.22
Update ProtonMail/go-crypto to v1.3.0
Add sourcehut-migrate, a unified DB migration tool
This tool will replace both the old `srht-migrate` as well as all
`<SERVICE>-migrate` tools, but services need to be migrated over to it
one by one. This tool is based on brant [1].
Invocation in both production and development can be as simple as:
sourcehut-migrate <SERVICE> up
The tool will read a config like a regular service (first in ., then
/etc/sr.ht, etc.). The database connection details are taken from the
config. To facilitate development, the tool will check if a folder
./migrations exists; if it does, migrations will be loaded from there.
If no ./migrations folder was found, it will look for migrations in
`<ASSETS>/migrations/<SERVICE>`, where <ASSETS> is also taken from the
config, with a default of `/usr/share/sourcehut`.
For an explanation of the available commands, see brant [1].
This tool also supports a simple command to initialize a newly created
database to the current version (much like the `<SERVICE>-initdb` tools
used to):
sourcehut-migrate <SERVICE> stamp head
will automatically set the database version to whatever the latest
available migration version is.
[1]: https://git.sr.ht/~bitfehler/brant
server: disable logging for release mode
This was partially implemented a while ago but we missed the main point
where it matters.
config: add GetBool convenience method
It's the boolean equivalent of `GetInt()`. The value handling is taken
from the Python version (`srht.config.cfgb()`).
errors: Fix ErrUnsupported error code
errors.Field: return the error
server: add pprof endpoint
This adds a pprof endpoint to all SourceHut APIs. It picks an
OS-assigned port on localhost to run it on and prints this port to
stdout. This ensures a unique port is selected even if several APIs are
running on a single host.
Allow unix scheme for redis url
Recently, the logic for creating redis client
has been changed and mistakenly unix scheme
has been removed from supported schemes.
errors: add ERR_UNSUPPORTED
server: enable request logging only in debug mode
To improve the signal:noise ratio in the production logs.