Merge pull request #233 from umputun/maint/deps-update-nov2025

Maintenance: update dependencies and fix linter warnings

Author: umputun

.github/workflows/ci.yml

@@ -11,14 +11,21 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - name: set up go 1.24
-        uses: actions/setup-go@v5
+      - name: free disk space
+        run: |
+          sudo rm -rf /usr/share/dotnet
+          sudo rm -rf /opt/ghc
+          sudo rm -rf /usr/local/share/boost
+          docker system prune -af
+
+      - name: set up go 1.25
+        uses: actions/setup-go@v6
         with:
-          go-version: "1.24"
+          go-version: "1.25"
         id: go
 
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: build and test
         run: |
@@ -38,14 +45,14 @@ jobs:
           TZ: "America/Chicago"
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v7
+        uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.1.1
+          version: latest
 
       - name: golangci-lint on example directory
-        uses: golangci/golangci-lint-action@v7
+        uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.1.1
+          version: latest
           args: --config ../../.golangci.yml
           working-directory: examples/plugin
 

.golangci.yml

@@ -17,6 +17,10 @@ linters:
     - unconvert
     - unparam
     - unused
+    - nestif
+    - testifylint
+    - wrapcheck
+    - errorlint
   settings:
     goconst:
       min-len: 2

CLAUDE.md

@@ -0,0 +1,95 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+Reproxy is a simple edge HTTP(s) reverse proxy supporting multiple providers (docker, static, file, consul catalog). It handles automatic SSL termination with Let's Encrypt, load balancing, health checks, and optional plugin support via RPC.
+
+## Build and Test Commands
+
+```bash
+# run all tests
+cd app && go test ./...
+
+# run tests with race detection
+cd app && go test -race -timeout=60s -count 1 ./...
+
+# run specific test
+cd app && go test -run TestName ./...
+
+# run tests with coverage
+cd app && go test -cover ./...
+
+# build binary (from repo root)
+make build
+
+# build docker image
+make docker
+
+# run linter (from repo root)
+golangci-lint run
+```
+
+## Architecture
+
+### Core Components
+
+- **app/main.go** - CLI entry point with all configuration options (flags, environment variables). Wires together providers, proxy server, and management services.
+
+- **app/discovery/** - Service discovery layer
+  - `discovery.go` - `Service` aggregates multiple providers, merges URL mappers, handles health checks
+  - `provider/` - Provider implementations (docker, file, static, consul-catalog)
+  - `URLMapper` - Core routing rule struct containing server, source regex, destination, health ping URL, match type
+
+- **app/proxy/** - HTTP/HTTPS proxy server
+  - `proxy.go` - `Http` struct is the main proxy server, handles both http and https modes
+  - `handlers.go` - Middleware handlers (throttling, auth, logging, headers)
+  - `ssl.go` - SSL/TLS configuration and ACME (Let's Encrypt) autocert management
+  - `health.go` - Health check endpoint handlers
+  - `lb_selector.go` - Load balancer strategies (random, failover, roundrobin)
+  - `only_from.go` - IP-based access control middleware
+
+- **app/mgmt/** - Management API
+  - `server.go` - Exposes `/routes` and `/metrics` endpoints
+  - `metrics.go` - Prometheus metrics middleware
+
+- **app/plugin/** - Plugin system
+  - `conductor.go` - RPC server for plugin registration and middleware chain
+
+- **lib/** - Plugin development library
+  - Used by external plugins to implement custom middleware via RPC
+
+### Request Flow
+
+1. Request hits `proxy.Http.Run()` which sets up middleware chain
+2. `matchHandler` middleware matches request to `URLMapper` via `discovery.Service.Match()`
+3. Match result stored in request context
+4. `proxyHandler` routes to either:
+   - `httputil.ReverseProxy` for proxy matches (MTProxy)
+   - File server for static matches (MTStatic)
+   - Assets handler for default static files
+
+### Provider Priority
+
+Providers are processed in order: static → file → docker → consul-catalog. Earlier providers take precedence for conflicting rules.
+
+### SSL Modes
+
+- `SSLNone` - HTTP only
+- `SSLStatic` - User-provided certificates
+- `SSLAuto` - ACME/Let's Encrypt automatic certificates with DNS-01 or HTTP-01 challenges
+
+## Key Patterns
+
+- Configuration via `github.com/umputun/go-flags` with struct tags for CLI/env options
+- Logging via `github.com/go-pkgz/lgr`
+- Middleware chain built with `github.com/go-pkgz/rest.Wrap()`
+- Mocks generated with moq, stored in same package with `_mock.go` suffix
+- Tests use testify assertions
+
+## Environment Detection
+
+Reproxy auto-detects docker environment via `REPROXY_IN_DOCKER` env var and adjusts default ports:
+- Docker: `0.0.0.0:8080` (http) / `0.0.0.0:8443` (https)
+- Non-docker: `127.0.0.1:80` (http) / `127.0.0.1:443` (https)

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.24-alpine AS backend
+FROM golang:1.25-alpine AS backend
 
 ARG GIT_BRANCH
 ARG GITHUB_SHA
@@ -19,7 +19,7 @@ RUN \
     cd app && go build -o /build/reproxy -ldflags "-X main.revision=${version} -s -w"
 
 
-FROM ghcr.io/umputun/baseimage/app:v1.15.0 AS base
+FROM ghcr.io/umputun/baseimage/app:latest AS base
 
 FROM scratch
 LABEL org.opencontainers.image.source="https://github.com/umputun/reproxy"

app/discovery/discovery.go

@@ -127,7 +127,7 @@ func (s *Service) Run(ctx context.Context) error {
 	for {
 		select {
 		case <-ctx.Done():
-			return ctx.Err()
+			return fmt.Errorf("discovery service interrupted: %w", ctx.Err())
 		case ev := <-ch:
 			log.Printf("[DEBUG] new update event received, %s", ev)
 			evRecv = true
@@ -548,7 +548,7 @@ func (m URLMapper) ping() (string, error) {
 		return errMsg, fmt.Errorf("%s %s: %s, %s", m.Server, m.SrcMatch.String(), m.PingURL, resp.Status)
 	}
 
-	return "", err
+	return "", nil
 }
 
 // Contains checks if the input string (e) in the given slice

app/discovery/discovery_test.go

@@ -59,20 +59,20 @@ func TestService_Run(t *testing.T) {
 
 	err := svc.Run(ctx)
 	require.Error(t, err)
-	assert.Equal(t, context.DeadlineExceeded, err)
+	require.ErrorIs(t, err, context.DeadlineExceeded)
 	mappers := svc.Mappers()
-	assert.Equal(t, 3, len(mappers))
+	assert.Len(t, mappers, 3)
 	assert.Equal(t, PIDocker, mappers[0].ProviderID)
 	assert.Equal(t, "localhost", mappers[0].Server)
 	assert.Equal(t, "/api/svc3/xyz", mappers[0].SrcMatch.String())
 	assert.Equal(t, "http://127.0.0.3:8080/blah3/xyz", mappers[0].Dst)
 	assert.Equal(t, []string{"127.0.0.1"}, mappers[0].OnlyFromIPs)
 
-	assert.Equal(t, 1, len(p1.EventsCalls()))
-	assert.Equal(t, 1, len(p2.EventsCalls()))
+	assert.Len(t, p1.EventsCalls(), 1)
+	assert.Len(t, p2.EventsCalls(), 1)
 
-	assert.Equal(t, 1, len(p1.ListCalls()))
-	assert.Equal(t, 1, len(p2.ListCalls()))
+	assert.Len(t, p1.ListCalls(), 1)
+	assert.Len(t, p2.ListCalls(), 1)
 }
 
 func TestService_Match(t *testing.T) {
@@ -125,8 +125,8 @@ func TestService_Match(t *testing.T) {
 
 	err := svc.Run(ctx)
 	require.Error(t, err)
-	assert.Equal(t, context.DeadlineExceeded, err)
-	assert.Equal(t, 12, len(svc.Mappers()))
+	require.ErrorIs(t, err, context.DeadlineExceeded)
+	assert.Len(t, svc.Mappers(), 12)
 
 	tbl := []struct {
 		server, src string
@@ -166,7 +166,7 @@ func TestService_Match(t *testing.T) {
 	for i, tt := range tbl {
 		t.Run(strconv.Itoa(i)+"-"+tt.server, func(t *testing.T) {
 			res := svc.Match(tt.server, tt.src)
-			require.Equal(t, len(tt.res.Routes), len(res.Routes), res.Routes)
+			require.Len(t, res.Routes, len(tt.res.Routes), res.Routes)
 			for i := 0; i < len(res.Routes); i++ {
 				assert.Equal(t, tt.res.Routes[i].Alive, res.Routes[i].Alive)
 				assert.Equal(t, tt.res.Routes[i].Destination, res.Routes[i].Destination)
@@ -212,7 +212,7 @@ func TestService_MatchServerRegex(t *testing.T) {
 
 	err := svc.Run(ctx)
 	require.Error(t, err)
-	assert.Equal(t, context.DeadlineExceeded, err)
+	require.ErrorIs(t, err, context.DeadlineExceeded)
 
 	tbl := []struct {
 		name        string
@@ -266,7 +266,7 @@ func TestService_MatchServerRegex(t *testing.T) {
 	for i, tt := range tbl {
 		t.Run(strconv.Itoa(i)+"-"+tt.server, func(t *testing.T) {
 			res := svc.Match(tt.server, tt.src)
-			require.Equal(t, len(tt.res.Routes), len(res.Routes), res.Routes)
+			require.Len(t, res.Routes, len(tt.res.Routes), res.Routes)
 			for i := 0; i < len(res.Routes); i++ {
 				assert.Equal(t, tt.res.Routes[i].Alive, res.Routes[i].Alive)
 				assert.Equal(t, tt.res.Routes[i].Destination, res.Routes[i].Destination)
@@ -296,7 +296,7 @@ func TestService_MatchServerRegexInvalidateCache(t *testing.T) {
 
 	go func() {
 		err := svc.Run(ctx)
-		require.Error(t, err)
+		assert.Error(t, err)
 	}()
 
 	res <- PIFile
@@ -314,7 +314,7 @@ func TestService_MatchServerRegexInvalidateCache(t *testing.T) {
 	time.Sleep(50 * time.Millisecond)
 
 	match = svc.Match("test-server", "/")
-	assert.Len(t, match.Routes, 0)
+	assert.Empty(t, match.Routes)
 }
 
 func TestService_MatchConflictRegex(t *testing.T) {
@@ -339,8 +339,8 @@ func TestService_MatchConflictRegex(t *testing.T) {
 
 	err := svc.Run(ctx)
 	require.Error(t, err)
-	assert.Equal(t, context.DeadlineExceeded, err)
-	assert.Equal(t, 3, len(svc.Mappers()))
+	require.ErrorIs(t, err, context.DeadlineExceeded)
+	assert.Len(t, svc.Mappers(), 3)
 
 	tbl := []struct {
 		server, src string
@@ -360,7 +360,7 @@ func TestService_MatchConflictRegex(t *testing.T) {
 		tt := tt
 		t.Run(strconv.Itoa(i), func(t *testing.T) {
 			res := svc.Match(tt.server, tt.src)
-			require.Equal(t, len(tt.res.Routes), len(res.Routes), res.Routes)
+			require.Len(t, res.Routes, len(tt.res.Routes), res.Routes)
 			for i := 0; i < len(res.Routes); i++ {
 				assert.Equal(t, tt.res.Routes[i].Alive, res.Routes[i].Alive)
 				assert.Equal(t, tt.res.Routes[i].Destination, res.Routes[i].Destination)
@@ -408,8 +408,8 @@ func TestService_Match192(t *testing.T) {
 
 	err := svc.Run(ctx)
 	require.Error(t, err)
-	assert.Equal(t, context.DeadlineExceeded, err)
-	assert.Equal(t, 3, len(svc.Mappers()))
+	require.ErrorIs(t, err, context.DeadlineExceeded)
+	assert.Len(t, svc.Mappers(), 3)
 
 	tbl := []struct {
 		server, src string
@@ -427,7 +427,7 @@ func TestService_Match192(t *testing.T) {
 		tt := tt
 		t.Run(strconv.Itoa(i), func(t *testing.T) {
 			res := svc.Match(tt.server, tt.src)
-			require.Equal(t, len(tt.res.Routes), len(res.Routes), res.Routes)
+			require.Len(t, res.Routes, len(tt.res.Routes), res.Routes)
 			for i := 0; i < len(res.Routes); i++ {
 				assert.Equal(t, tt.res.Routes[i].Alive, res.Routes[i].Alive)
 				assert.Equal(t, tt.res.Routes[i].Destination, res.Routes[i].Destination)
@@ -469,8 +469,8 @@ func TestService_Servers(t *testing.T) {
 	svc := NewService([]Provider{p1, p2}, time.Millisecond*100)
 	err := svc.Run(ctx)
 	require.Error(t, err)
-	assert.Equal(t, context.DeadlineExceeded, err)
-	assert.Equal(t, 3, len(svc.mappers))
+	require.ErrorIs(t, err, context.DeadlineExceeded)
+	assert.Len(t, svc.mappers, 3)
 
 	servers := svc.Servers()
 	assert.Equal(t, []string{"m.example.com", "xx.reproxy.io"}, servers)
@@ -601,18 +601,18 @@ func TestService_ScheduleHealthCheck(t *testing.T) {
 
 	err := svc.Run(ctx)
 	require.Error(t, err)
-	assert.Equal(t, context.DeadlineExceeded, err)
+	require.ErrorIs(t, err, context.DeadlineExceeded)
 	mappers := svc.Mappers()
-	assert.Equal(t, 3, len(mappers))
+	assert.Len(t, mappers, 3)
 	assert.Equal(t, wantMappers, mappers)
 
 	svc.ScheduleHealthCheck(context.Background(), time.Microsecond*2)
 	time.Sleep(time.Millisecond * 10)
 
 	mappers = svc.Mappers()
-	assert.Equal(t, false, mappers[0].dead)
-	assert.Equal(t, true, mappers[1].dead)
-	assert.Equal(t, false, mappers[2].dead)
+	assert.False(t, mappers[0].dead)
+	assert.True(t, mappers[1].dead)
+	assert.False(t, mappers[2].dead)
 }
 
 func Test_ping(t *testing.T) {
@@ -709,8 +709,8 @@ func TestCheckHealth(t *testing.T) {
 	t.Logf("mappers: %v", mappers)
 
 	res := svc.CheckHealth()
-	assert.Equal(t, 3, len(res))
-	assert.Error(t, res[failPingULR])
+	assert.Len(t, res, 3)
+	require.Error(t, res[failPingULR])
 	assert.NoError(t, res[ts.URL])
 	assert.NoError(t, res[ts2.URL])
 }