Finished changing structure to modules:

- ntfy
- keyserver
- webhook
- webserver
functional modules.

modules/keyserver/keyserver.go

@@ -0,0 +1,36 @@
+package keyserver
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/gorilla/mux"
+
+	"varde/internal/middleware"
+)
+
+type Config struct {
+	Enabled bool
+	KeysDir string
+}
+
+type Module struct {
+	cfg Config
+}
+
+func New(cfg Config) *Module {
+	return &Module{cfg: cfg}
+}
+
+func (m *Module) Name() string { return "keyserver" }
+
+func (m *Module) RegisterRoutes(r *mux.Router) {
+	fs := http.FileServer(http.Dir(m.cfg.KeysDir))
+	wkd := r.PathPrefix("/.well-known/").Subrouter()
+	wkd.Use(middleware.NoListing)
+	wkd.Use(middleware.WKDHeaders)
+	wkd.PathPrefix("/").Handler(fs)
+}
+
+func (m *Module) Start(ctx context.Context) error { return nil }
+func (m *Module) Stop(ctx context.Context) error  { return nil }

modules/webhook/webhook.go

@@ -0,0 +1,138 @@
+package webhook
+
+import (
+	"context"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"io"
+	"log"
+	"net/http"
+	"os"
+	"time"
+
+	"github.com/go-git/go-git/v5"
+	githttp "github.com/go-git/go-git/v5/plumbing/transport/http"
+	"github.com/gorilla/mux"
+	"golang.org/x/time/rate"
+
+	"varde/internal/middleware"
+	"varde/internal/ntfy"
+)
+
+type Config struct {
+	Enabled       bool
+	ContentDir    string
+	RepoURL       string
+	RepoToken     string
+	WebhookSecret string
+}
+
+type Module struct {
+	cfg     Config
+	ntfyCfg ntfy.Config
+	repo    *git.Repository
+	limiter *rate.Limiter
+}
+
+func New(cfg Config, ntfyCfg ntfy.Config) *Module {
+	return &Module{
+		cfg:     cfg,
+		ntfyCfg: ntfyCfg,
+		limiter: rate.NewLimiter(rate.Every(10*time.Second), 1),
+	}
+}
+
+func (m *Module) Name() string { return "webhook" }
+
+func (m *Module) RegisterRoutes(r *mux.Router) {
+	r.Handle("/webhook", middleware.RateLimit(m.limiter)(http.HandlerFunc(m.handleWebhook))).Methods("POST")
+}
+
+// Start clones or opens the content repo. Returns an error instead of
+// calling log.Fatalf directly — a failing webhook module should not
+// necessarily bring down other, unrelated modules in the same process.
+func (m *Module) Start(ctx context.Context) error {
+	return m.cloneOrOpen()
+}
+
+func (m *Module) Stop(ctx context.Context) error { return nil }
+
+func (m *Module) cloneOrOpen() error {
+	auth := &githttp.BasicAuth{
+		Username: "x-token",
+		Password: m.cfg.RepoToken,
+	}
+
+	if _, err := os.Stat(m.cfg.ContentDir + "/.git"); os.IsNotExist(err) {
+		log.Println("webhook: cloning repo...")
+		r, err := git.PlainClone(m.cfg.ContentDir, false, &git.CloneOptions{
+			URL:  m.cfg.RepoURL,
+			Auth: auth,
+		})
+		if err != nil {
+			ntfy.Notify(m.ntfyCfg, "webhook clone failed", err)
+			return err
+		}
+		m.repo = r
+		return nil
+	}
+
+	log.Println("webhook: opening existing repo...")
+	r, err := git.PlainOpen(m.cfg.ContentDir)
+	if err != nil {
+		ntfy.Notify(m.ntfyCfg, "webhook open failed", err)
+		return err
+	}
+	m.repo = r
+	return nil
+}
+
+func (m *Module) pull() error {
+	w, err := m.repo.Worktree()
+	if err != nil {
+		return err
+	}
+	err = w.Pull(&git.PullOptions{
+		Auth: &githttp.BasicAuth{
+			Username: "x-token",
+			Password: m.cfg.RepoToken,
+		},
+	})
+	if err == git.NoErrAlreadyUpToDate {
+		return nil
+	}
+	return err
+}
+
+func validateSignature(secret, signature string, body []byte) bool {
+	mac := hmac.New(sha256.New, []byte(secret))
+	mac.Write(body)
+	expected := hex.EncodeToString(mac.Sum(nil))
+	return hmac.Equal([]byte(expected), []byte(signature))
+}
+
+func (m *Module) handleWebhook(w http.ResponseWriter, r *http.Request) {
+	body, err := io.ReadAll(r.Body)
+	if err != nil {
+		w.WriteHeader(http.StatusBadRequest)
+		return
+	}
+
+	sig := r.Header.Get("X-Gitea-Signature")
+	if !validateSignature(m.cfg.WebhookSecret, sig, body) {
+		log.Println("webhook: invalid signature")
+		w.WriteHeader(http.StatusUnauthorized)
+		return
+	}
+
+	if err := m.pull(); err != nil {
+		ntfy.Notify(m.ntfyCfg, "webhook pull failed", err)
+		log.Printf("webhook: pull failed: %v", err)
+		w.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+
+	log.Println("webhook: pulled new content")
+	w.WriteHeader(http.StatusOK)
+}

modules/webserver/webserver.go

@@ -0,0 +1,34 @@
+package webserver
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/gorilla/mux"
+)
+
+type Config struct {
+	Enabled    bool
+	ContentDir string
+}
+
+type Module struct {
+	cfg Config
+}
+
+func New(cfg Config) *Module {
+	return &Module{cfg: cfg}
+}
+
+func (m *Module) Name() string { return "webserver" }
+
+// RegisterRoutes uses a catch-all "/" handler — must be registered
+// LAST in main.go, after any more specific routes (keyserver, webhook),
+// since gorilla/mux matches in registration order.
+func (m *Module) RegisterRoutes(r *mux.Router) {
+	fs := http.FileServer(http.Dir(m.cfg.ContentDir))
+	r.PathPrefix("/").Handler(fs)
+}
+
+func (m *Module) Start(ctx context.Context) error { return nil }
+func (m *Module) Stop(ctx context.Context) error  { return nil }