Lab 10 Submission

.github/pull_request_template.md

@@ -0,0 +1,13 @@
+## Goal
+<!-- What does this PR accomplish? 1 sentence. -->
+
+## Changes
+- 
+
+## Testing
+<!-- How did you verify it? -->
+
+## Checklist
+- [ ] Title is a clear sentence (≤ 70 chars)
+- [ ] Commits are signed (`git log --show-signature`)
+- [ ] `submissions/labN.md` updated

.github/workflows/ci.yml

@@ -0,0 +1,115 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "app/**"
+      - ".github/workflows/**"
+
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "app/**"
+      - ".github/workflows/**"
+
+permissions:
+  contents: read
+
+jobs:
+  vet:
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        go-version: ["1.23", "1.24"]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Setup Go
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with:
+          go-version: ${{ matrix.go-version }}
+          cache: true
+          cache-dependency-path: app/go.mod
+
+      - name: Go Vet
+        working-directory: app
+        run: go vet ./...
+
+  test:
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        go-version: ["1.23", "1.24"]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Setup Go
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with:
+          go-version: ${{ matrix.go-version }}
+          cache: true
+          cache-dependency-path: app/go.mod
+
+      - name: Go Test
+        working-directory: app
+        run: go test -race -count=1 ./...
+
+  lint:
+    runs-on: ubuntu-24.04
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Setup Go
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with:
+          go-version: "1.24"
+          cache: true
+          cache-dependency-path: app/go.mod
+
+      - name: GolangCI-Lint
+        uses: golangci/golangci-lint-action@25e2cdc5eb1d7a04fdc45ff538f1a00e960ae128 # v8.0.0
+        with:
+          version: v2.5.0
+          working-directory: app
+
+  # Lab 9 (bonus): reachability-based vulnerability gate.
+  govulncheck:
+    runs-on: ubuntu-24.04
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Setup Go
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with:
+          go-version: "1.26"
+          cache: true
+          cache-dependency-path: app/go.mod
+
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4
+
+      - name: Run govulncheck
+        working-directory: app
+        run: govulncheck ./...
+
+  ci-ok:
+    if: always()
+    needs: [vet, test, lint, govulncheck]
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Verify all checks passed
+        run: |
+          test "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "false"

.github/workflows/release.yml

@@ -0,0 +1,50 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  release:
+    runs-on: ubuntu-24.04
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+      - name: Log in to GHCR
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Derive image tags and labels
+        id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        with:
+          images: ghcr.io/${{ github.repository }}/quicknotes
+          tags: |
+            type=semver,pattern=v{{version}}
+            type=raw,value=latest
+
+      - name: Build and push
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: ./app
+          file: ./app/Dockerfile
+          platforms: linux/amd64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          provenance: false
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

app/Dockerfile

@@ -0,0 +1,22 @@
+FROM golang:1.26-alpine AS builder
+
+WORKDIR /build
+
+COPY go.mod ./
+RUN go mod download
+
+COPY . .
+RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags='-s -w' -o /out/quicknotes . && \
+    CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags='-s -w' -o /out/healthcheck ./healthcheck/ && \
+    mkdir -p /out/data
+
+FROM gcr.io/distroless/static:nonroot
+
+COPY --from=builder /out/quicknotes /quicknotes
+COPY --from=builder /out/healthcheck /healthcheck
+COPY --from=builder /build/seed.json /seed.json
+COPY --chown=65532:65532 --from=builder /out/data /data
+
+USER nonroot
+EXPOSE 8080
+ENTRYPOINT ["/quicknotes"]

app/healthcheck/main.go

@@ -0,0 +1,13 @@
+package main
+
+import (
+	"net/http"
+	"os"
+)
+
+func main() {
+	resp, err := http.Get("http://localhost:8080/health")
+	if err != nil || resp.StatusCode != http.StatusOK {
+		os.Exit(1)
+	}
+}

app/main.go

@@ -28,7 +28,7 @@ func main() {
 	server := NewServer(store)
 	srv := &http.Server{
 		Addr:              addr,
-		Handler:           server.Routes(),
+		Handler:           server.Handler(),
 		ReadHeaderTimeout: 5 * time.Second,
 	}
 

app/middleware.go

@@ -0,0 +1,18 @@
+package main
+
+import "net/http"
+
+func securityHeaders(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		h := w.Header()
+		h.Set("X-Content-Type-Options", "nosniff")
+		h.Set("X-Frame-Options", "DENY")
+		h.Set("Content-Security-Policy", "default-src 'none'; frame-ancestors 'none'")
+		h.Set("Referrer-Policy", "no-referrer")
+		next.ServeHTTP(w, r)
+	})
+}
+
+func (s *Server) Handler() http.Handler {
+	return securityHeaders(s.Routes())
+}

app/middleware_test.go

@@ -0,0 +1,42 @@
+package main
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+// wantSecurityHeaders is the exact set the securityHeaders middleware must apply to
+// every response. If the middleware is removed from Server.Handler, none of these are
+// present and this test fails.
+var wantSecurityHeaders = map[string]string{
+	"X-Content-Type-Options":  "nosniff",
+	"X-Frame-Options":         "DENY",
+	"Content-Security-Policy": "default-src 'none'; frame-ancestors 'none'",
+	"Referrer-Policy":         "no-referrer",
+}
+
+func TestSecurityHeaders_PresentOnAllRoutes(t *testing.T) {
+	srv := newTestServer(t)
+	handler := srv.Handler()
+
+	// Exercise a real route, an error route, and an unregistered path to prove the
+	// middleware wraps the whole router and not just the happy path.
+	routes := []struct{ method, target string }{
+		{http.MethodGet, "/health"},
+		{http.MethodGet, "/notes"},
+		{http.MethodGet, "/notes/999"},     // 404 from a handler
+		{http.MethodGet, "/does-not-exist"}, // 404 from the mux itself
+	}
+
+	for _, rt := range routes {
+		req := httptest.NewRequest(rt.method, rt.target, nil)
+		rec := httptest.NewRecorder()
+		handler.ServeHTTP(rec, req)
+		for name, want := range wantSecurityHeaders {
+			if got := rec.Header().Get(name); got != want {
+				t.Errorf("%s %s: header %q = %q, want %q", rt.method, rt.target, name, got, want)
+			}
+		}
+	}
+}

cloud/hf-space/Dockerfile

@@ -0,0 +1,14 @@
+# QuickNotes on Hugging Face Spaces (Docker SDK).
+#
+# We PULL the exact immutable image published to GHCR in Task 1 instead of
+# rebuilding from app/ source. Rationale:
+#   - the Space serves the identical, already-tested artifact (same digest),
+#   - it builds in seconds (no Go toolchain, no module download),
+#   - one source of truth for the release (GHCR), no drift.
+# Trade-off (design question f): less in-Space debuggability and a hard
+# dependency on GHCR being reachable at Space build time.
+FROM ghcr.io/g-akleh/devops-intro/quicknotes:v0.1.0
+
+# QuickNotes listens on :8080; HF routes to it via `app_port: 8080` in README.md.
+# ENTRYPOINT ["/quicknotes"] and USER nonroot are inherited from the base image.
+EXPOSE 8080

cloud/hf-space/README.md

@@ -0,0 +1,31 @@
+---
+title: QuickNotes
+emoji: 📝
+colorFrom: blue
+colorTo: indigo
+sdk: docker
+app_port: 8080
+pinned: false
+---
+
+# QuickNotes
+
+A tiny Go notes API deployed as a **Docker Space** for DevOps Lab 10. The Space
+pulls its image from `ghcr.io/g-akleh/devops-intro/quicknotes:v0.1.0`, published
+by CI in Task 1.
+
+## Why `app_port: 8080`
+
+Hugging Face routes external traffic to port **7860** by default. QuickNotes
+listens on **8080**, so the Space frontmatter sets `app_port: 8080` to point HF
+at the right port. The app itself is unchanged.
+
+## Endpoints
+
+- `GET /health` — liveness + note count
+- `GET /notes` — list notes
+- `GET /notes/{id}` — single note
+- `POST /notes` — create a note
+- `DELETE /notes/{id}` — delete a note
+
+Source: <https://github.com/G-Akleh/DevOps-Intro>

cloud/teardown.md

@@ -0,0 +1,18 @@
+# Lab 10 Teardown
+
+## Hugging Face Space
+
+Space page -> **Settings** tab -> **Delete this Space** (Danger Zone). Or leave
+it: on the free tier it sleeps after ~30 min idle and costs nothing.
+
+## GHCR package
+
+**Not** torn down on purpose: the public, pullable image is the Task 1
+deliverable and must stay available. To remove it you would go to the package
+page -> **Package settings** -> **Delete package**.
+
+## Cloudflare quick tunnel (bonus)
+
+Ephemeral by design: `Ctrl-C` the `cloudflared` process and the
+`*.trycloudflare.com` URL stops resolving immediately. Nothing persists and
+there is no account state to clean up.

compose.yaml

@@ -0,0 +1,40 @@
+services:
+  volume-init:
+    image: busybox:1.36-musl
+    volumes:
+      - quicknotes-data:/data
+    command: ["sh", "-c", "chown 65532:65532 /data"]
+    restart: "no"
+
+  quicknotes:
+    build:
+      context: ./app
+    image: quicknotes:lab6
+    depends_on:
+      volume-init:
+        condition: service_completed_successfully
+    ports:
+      - "8080:8080"
+    environment:
+      ADDR: ":8080"
+      DATA_PATH: "/data/notes.json"
+      SEED_PATH: "/seed.json"
+    volumes:
+      - quicknotes-data:/data
+    healthcheck:
+      test: ["CMD", "/healthcheck"]
+      interval: 10s
+      timeout: 3s
+      retries: 3
+      start_period: 5s
+    restart: unless-stopped
+    read_only: true
+    tmpfs:
+      - /tmp:size=16m,mode=1777
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+
+volumes:
+  quicknotes-data: