From 508aa3038bd3f1a996c147938bb9bde7a33b9684 Mon Sep 17 00:00:00 2001 From: Tim Wundenberg Date: Tue, 31 Dec 2024 12:01:27 +0100 Subject: [PATCH] feat(observability): #360 remove umami to reduce complexity --- Readme.md | 2 +- handler/middleware/security_headers.go | 6 +++--- handler/render.go | 9 +++------ main.go | 2 +- main_test.go | 6 +++--- template/layout.templ | 5 +---- 6 files changed, 12 insertions(+), 18 deletions(-) diff --git a/Readme.md b/Readme.md index 88f83ba..360cfba 100644 --- a/Readme.md +++ b/Readme.md @@ -9,7 +9,7 @@ stackFAST includes everything you need to build your App. Focus yourself on deve The blueprint contains the following features: - Authentication: Users can login, logout, register and reset their password. For increased security TOTP is available aswell. -- Observability: The stack contains an Grafana+Prometheus instance for basic monitoring. You are able to add alerts and get notified on your phone. For web analytics umami is included, which is an lighweight self hosted alternative to google analytics. +- Observability: The stack contains an Grafana+Prometheus instance for basic monitoring. You are able to add alerts and get notified on your phone. - Mail: You are able to send mail with SMTP. You still need an external Mail Server, but a guide on how to set that up with a custom domain is included. - SSL: This is included by using traefik as reverse proxy. It handles SSL certificates automatically. Furthermore all services are accessible through subdomains. Best thing is, you can add your more with 3 lines of code - Actual Stack: SSG SvelteKit + Tailwindcss + DaisyUI + GO Backend for easy and fast feature development diff --git a/handler/middleware/security_headers.go b/handler/middleware/security_headers.go index 959cf74..7a5a2a5 100644 --- a/handler/middleware/security_headers.go +++ b/handler/middleware/security_headers.go @@ -15,14 +15,14 @@ func SecurityHeaders(serverSettings *types.Settings) func(http.Handler) http.Han w.Header().Set("Access-Control-Allow-Methods", "GET, POST, DELETE") w.Header().Set("Content-Security-Policy", "default-src 'none'; "+ - "script-src 'self' https://umami.me-fit.eu; "+ - "connect-src 'self' https://umami.me-fit.eu; "+ + "script-src 'self'; "+ + "connect-src 'self'; "+ "img-src 'self'; "+ "style-src 'self'; "+ "form-action 'self'; "+ "frame-ancestors 'none'; ", ) - w.Header().Set("Cross-Origin-Resource-Policy", "same-site") // same-site, as same origin prohibits umami + w.Header().Set("Cross-Origin-Resource-Policy", "same-origin") w.Header().Set("Cross-Origin-Opener-Policy", "same-origin") w.Header().Set("Cross-Origin-Embedder-Policy", "require-corp") w.Header().Set("Permissions-Policy", "geolocation=(), camera=(), microphone=(), interest-cohort=()") diff --git a/handler/render.go b/handler/render.go index 28cb3b9..717170c 100644 --- a/handler/render.go +++ b/handler/render.go @@ -12,13 +12,10 @@ import ( ) type Render struct { - settings *types.Settings } -func NewRender(settings *types.Settings) *Render { - return &Render{ - settings: settings, - } +func NewRender() *Render { + return &Render{} } func (render *Render) RenderWithStatus(r *http.Request, w http.ResponseWriter, comp templ.Component, status int) { @@ -41,7 +38,7 @@ func (render *Render) RenderLayout(r *http.Request, w http.ResponseWriter, slot func (render *Render) RenderLayoutWithStatus(r *http.Request, w http.ResponseWriter, slot templ.Component, user *types.User, status int) { userComp := render.getUserComp(user) - layout := template.Layout(slot, userComp, render.settings.Environment) + layout := template.Layout(slot, userComp) render.RenderWithStatus(r, w, layout, status) } diff --git a/main.go b/main.go index e2d8a90..92c4ffe 100644 --- a/main.go +++ b/main.go @@ -113,7 +113,7 @@ func createHandler(d *sql.DB, serverSettings *types.Settings) http.Handler { authService := service.NewAuthImpl(authDb, randomService, clockService, mailService, serverSettings) workoutService := service.NewWorkoutImpl(workoutDb, randomService, clockService, mailService, serverSettings) - render := handler.NewRender(serverSettings) + render := handler.NewRender() indexHandler := handler.NewIndex(authService, render) authHandler := handler.NewAuth(authService, render) workoutHandler := handler.NewWorkout(workoutService, authService, render) diff --git a/main_test.go b/main_test.go index cf1e9c3..b7f3f19 100644 --- a/main_test.go +++ b/main_test.go @@ -82,15 +82,15 @@ func TestIntegrationSecurityHeader(t *testing.T) { value = resp.Header.Get("Content-Security-Policy") assert.Equal(t, "default-src 'none'; "+ - "script-src 'self' https://umami.me-fit.eu; "+ - "connect-src 'self' https://umami.me-fit.eu; "+ + "script-src 'self'; "+ + "connect-src 'self'; "+ "img-src 'self'; "+ "style-src 'self'; "+ "form-action 'self'; "+ "frame-ancestors 'none';", value) value = resp.Header.Get("Cross-Origin-Resource-Policy") - assert.Equal(t, "same-site", value) + assert.Equal(t, "same-origin", value) value = resp.Header.Get("Cross-Origin-Opener-Policy") assert.Equal(t, "same-origin", value) diff --git a/template/layout.templ b/template/layout.templ index 78fe1f7..0f424b3 100644 --- a/template/layout.templ +++ b/template/layout.templ @@ -1,6 +1,6 @@ package template -templ Layout(slot templ.Component, user templ.Component, environment string) { +templ Layout(slot templ.Component, user templ.Component) { @@ -10,9 +10,6 @@ templ Layout(slot templ.Component, user templ.Component, environment string) { - if environment == "prod" { - - }