.forgejo/workflows/release.yml

@@ -10,22 +10,28 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: golang:1.27
-      volumes:
-        - /opt/runner/keys:/keys:ro
 
     steps:
-      - name: Install packaging tools
+      - name: Install tools
         run: |
           apt-get update
           apt-get install -y dpkg-dev git curl openssh-client
 
       - name: Setup SSH
+        env:
+          FORGEJO_SSH_KEY: ${{ secrets.FORGEJO_SSH_KEY }}
         run: |
-          test -r /keys/forgejo_runner || { echo "Deploy key /keys/forgejo_runner chybi"; exit 1; }
+          mkdir -p ~/.ssh
-          install -m 600 /keys/forgejo_runner /tmp/forgejo_runner
+          printf '%s\n' "${FORGEJO_SSH_KEY}" > ~/.ssh/forgejo_runner
-          echo "GIT_SSH_COMMAND=ssh -p 554 -i /tmp/forgejo_runner -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR" >> "$GITHUB_ENV"
+          chmod 600 ~/.ssh/forgejo_runner
+          # Accept Forgejo SSH host key without prompting.
+          ssh-keyscan -p 554 git-ssh.janvete.com >> ~/.ssh/known_hosts 2>/dev/null || \
+            ssh-keyscan git-ssh.janvete.com >> ~/.ssh/known_hosts 2>/dev/null || true
+          echo "GIT_SSH_COMMAND=ssh -i ~/.ssh/forgejo_runner -o StrictHostKeyChecking=no -o UserKnownHostsFile=~/.ssh/known_hosts" >> "$GITHUB_ENV"
 
       - name: Checkout source
+        env:
+          GIT_SSH_COMMAND: ssh -i ~/.ssh/forgejo_runner -o StrictHostKeyChecking=no -o UserKnownHostsFile=~/.ssh/known_hosts
         run: |
           git clone ssh://git@git-ssh.janvete.com:554/seth/Caddyview.git src
           cd src
@@ -119,6 +125,8 @@ jobs:
 
       - name: Update Homebrew tap
         working-directory: src
+        env:
+          GIT_SSH_COMMAND: ssh -i ~/.ssh/forgejo_runner -o StrictHostKeyChecking=no -o UserKnownHostsFile=~/.ssh/known_hosts
         run: |
           VERSION=${{ github.ref_name }}
           VER=${VERSION#v}
@@ -171,6 +179,8 @@ jobs:
 
       - name: Update APT repository
         working-directory: src
+        env:
+          GIT_SSH_COMMAND: ssh -i ~/.ssh/forgejo_runner -o StrictHostKeyChecking=no -o UserKnownHostsFile=~/.ssh/known_hosts
         run: |
           VERSION=${{ github.ref_name }}
           VER=${VERSION#v}
@@ -179,10 +189,6 @@ jobs:
           cp "dist/caddyview_${VER}_amd64.deb" apt-repo/
 
           cd apt-repo
-          # repo muze byt uplne prazdny (bez commitu a bez branche)
-          if ! git rev-parse --verify HEAD >/dev/null 2>&1; then
-            git checkout -b main
-          fi
           dpkg-scanpackages . > Packages
           gzip -k -f Packages
 
@@ -211,4 +217,4 @@ jobs:
           git config user.name "forgejo-actions[bot]"
           git add -A
           git commit -m "chore: add caddyview ${VERSION}"
-          git push -u origin HEAD
+          git push

cmd/ssh.go

@@ -4,8 +4,8 @@ import (
 	"fmt"
 	"os"
 
-	"git.janvete.com/seth/caddyview/internal/sshclient"
+	"github.com/janvete/caddyview/internal/sshclient"
-	"git.janvete.com/seth/caddyview/internal/tui"
+	"github.com/janvete/caddyview/internal/tui"
 	"github.com/spf13/cobra"
 )
 

go.mod

@@ -1,4 +1,4 @@
-module git.janvete.com/seth/caddyview
+module github.com/janvete/caddyview
 
 go 1.26.4
 
@@ -7,7 +7,6 @@ require (
 	github.com/charmbracelet/lipgloss v1.1.0
 	github.com/spf13/cobra v1.10.2
 	golang.org/x/crypto v0.53.0
-	golang.org/x/term v0.47.0
 )
 
 require (
@@ -28,6 +27,6 @@ require (
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/spf13/pflag v1.0.9 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
-	golang.org/x/sys v0.49.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
 	golang.org/x/text v0.38.0 // indirect
 )

go.sum

@@ -48,10 +48,10 @@ golang.org/x/exp v0.0.0-20220909182711-5c715a9e8561 h1:MDc5xs78ZrZr3HMQugiXOAkSZ
 golang.org/x/exp v0.0.0-20220909182711-5c715a9e8561/go.mod h1:cyybsKvd6eL0RnXn6p/Grxp8F5bW7iYuBgsNCOHpMYE=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
-golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
-golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
 golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
 golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

internal/parser/caddy.go

@@ -304,14 +304,13 @@ func ParseAggregatedOutput(raw string) (*AggregatedHistory, error) {
 			if len(parts) < 6 {
 				continue
 			}
-			// Caddy logs ts as a float (unix seconds with fractional part).
+			ts, err := strconv.ParseInt(parts[0], 10, 64)
-			tsFloat, err := strconv.ParseFloat(parts[0], 64)
 			if err != nil {
 				continue
 			}
 			status, _ := strconv.Atoi(parts[1])
 			h.Errors = append(h.Errors, ErrorEntry{
-				Time:     time.Unix(int64(tsFloat), 0),
+				Time:     time.Unix(ts, 0),
 				Status:   status,
 				Method:   parts[2],
 				URI:      parts[3],

internal/sshclient/bcryptpbkdf.go

@@ -1,95 +0,0 @@
-// Copyright 2014 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found at https://go.dev/LICENSE.
-//
-// Adapted from golang.org/x/crypto/ssh/internal/bcrypt_pbkdf, which is not
-// importable (internal package). Implements bcrypt_pbkdf(3) from OpenBSD.
-//
-// See https://flak.tedunangst.com/post/bcrypt-pbkdf and
-// https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libutil/bcrypt_pbkdf.c.
-package sshclient
-
-import (
-	"crypto/sha512"
-	"errors"
-
-	"golang.org/x/crypto/blowfish"
-)
-
-const bcryptBlockSize = 32
-
-// bcryptPBKDF derives a key from the password, salt and rounds count,
-// returning a []byte of length keyLen that can be used as cryptographic key.
-func bcryptPBKDF(password, salt []byte, rounds, keyLen int) ([]byte, error) {
-	if rounds < 1 {
-		return nil, errors.New("bcrypt_pbkdf: number of rounds is too small")
-	}
-	if len(password) == 0 {
-		return nil, errors.New("bcrypt_pbkdf: empty password")
-	}
-	if len(salt) == 0 || len(salt) > 1<<20 {
-		return nil, errors.New("bcrypt_pbkdf: bad salt length")
-	}
-	if keyLen > 1024 {
-		return nil, errors.New("bcrypt_pbkdf: keyLen is too large")
-	}
-
-	numBlocks := (keyLen + bcryptBlockSize - 1) / bcryptBlockSize
-	key := make([]byte, numBlocks*bcryptBlockSize)
-
-	h := sha512.New()
-	h.Write(password)
-	shapass := h.Sum(nil)
-
-	shasalt := make([]byte, 0, sha512.Size)
-	cnt, tmp := make([]byte, 4), make([]byte, bcryptBlockSize)
-	for block := 1; block <= numBlocks; block++ {
-		h.Reset()
-		h.Write(salt)
-		cnt[0] = byte(block >> 24)
-		cnt[1] = byte(block >> 16)
-		cnt[2] = byte(block >> 8)
-		cnt[3] = byte(block)
-		h.Write(cnt)
-		bcryptHash(tmp, shapass, h.Sum(shasalt))
-
-		out := make([]byte, bcryptBlockSize)
-		copy(out, tmp)
-		for i := 2; i <= rounds; i++ {
-			h.Reset()
-			h.Write(tmp)
-			bcryptHash(tmp, shapass, h.Sum(shasalt))
-			for j := 0; j < len(out); j++ {
-				out[j] ^= tmp[j]
-			}
-		}
-
-		for i, v := range out {
-			key[i*numBlocks+(block-1)] = v
-		}
-	}
-	return key[:keyLen], nil
-}
-
-var bcryptMagic = []byte("OxychromaticBlowfishSwatDynamite")
-
-func bcryptHash(out, shapass, shasalt []byte) {
-	c, err := blowfish.NewSaltedCipher(shapass, shasalt)
-	if err != nil {
-		panic(err)
-	}
-	for i := 0; i < 64; i++ {
-		blowfish.ExpandKey(shasalt, c)
-		blowfish.ExpandKey(shapass, c)
-	}
-	copy(out, bcryptMagic)
-	for i := 0; i < 32; i += 8 {
-		for j := 0; j < 64; j++ {
-			c.Encrypt(out[i:i+8], out[i:i+8])
-		}
-	}
-	// Swap bytes due to different endianness.
-	for i := 0; i < 32; i += 4 {
-		out[i+3], out[i+2], out[i+1], out[i] = out[i], out[i+1], out[i+2], out[i+3]
-	}
-}

internal/sshclient/client.go

@@ -2,17 +2,15 @@ package sshclient
 
 import (
 	"bufio"
-	"errors"
 	"fmt"
 	"net"
 	"os"
 	"path/filepath"
 	"strings"
 
-	"git.janvete.com/seth/caddyview/internal/parser"
+	"github.com/janvete/caddyview/internal/parser"
 	"golang.org/x/crypto/ssh"
 	"golang.org/x/crypto/ssh/agent"
-	"golang.org/x/term"
 )
 
 type Client struct {
@@ -151,7 +149,6 @@ func buildAuthMethods(keyPath string) ([]ssh.AuthMethod, error) {
 			candidates = append(candidates, filepath.Join(home, ".ssh", name))
 		}
 	}
-	var problems []string
 	for _, p := range candidates {
 		data, err := os.ReadFile(p)
 		if err != nil {
@@ -159,58 +156,17 @@ func buildAuthMethods(keyPath string) ([]ssh.AuthMethod, error) {
 		}
 		signer, err := ssh.ParsePrivateKey(data)
 		if err != nil {
-			var passErr *ssh.PassphraseMissingError
+			continue
-			if errors.As(err, &passErr) {
-				signer, err = unlockWithPassphrase(p, data)
-			}
-			if err != nil {
-				problems = append(problems, fmt.Sprintf("%s (%v)", p, err))
-				continue
-			}
 		}
 		methods = append(methods, ssh.PublicKeys(signer))
 	}
 
 	if len(methods) == 0 {
-		if len(problems) > 0 {
-			return nil, fmt.Errorf("key files found but could not be loaded: %s", strings.Join(problems, "; "))
-		}
 		return nil, fmt.Errorf("no SSH auth method available — no agent (SSH_AUTH_SOCK) and no key files found in %v", candidates)
 	}
 	return methods, nil
 }
 
-// unlockWithPassphrase prompts for the passphrase of an encrypted private key.
-// It runs before the TUI starts, so stdin is still a normal terminal.
-func unlockWithPassphrase(path string, data []byte) (ssh.Signer, error) {
-	if !term.IsTerminal(int(os.Stdin.Fd())) {
-		return nil, fmt.Errorf("key is passphrase-protected and stdin is not a terminal")
-	}
-	for attempt := 0; attempt < 3; attempt++ {
-		fmt.Fprintf(os.Stderr, "Enter passphrase for %s: ", path)
-		pass, err := term.ReadPassword(int(os.Stdin.Fd()))
-		fmt.Fprintln(os.Stderr)
-		if err != nil {
-			return nil, err
-		}
-		signer, err := parsePrivateKeyWithPassphrase(data, pass)
-		if err == nil {
-			return signer, nil
-		}
-		fmt.Fprintf(os.Stderr, "caddyview: cannot decrypt key: %v\n", err)
-	}
-	return nil, fmt.Errorf("could not decrypt key in 3 attempts")
-}
-
-// parsePrivateKeyWithPassphrase handles ciphers beyond what x/crypto/ssh
-// supports (aes256-gcm@openssh.com, e.g. 1Password key exports).
-func parsePrivateKeyWithPassphrase(data, pass []byte) (ssh.Signer, error) {
-	if isGCMEncryptedKey(data) {
-		return parseGCMKey(data, pass)
-	}
-	return ssh.ParsePrivateKeyWithPassphrase(data, pass)
-}
-
 // agentAuth returns an auth method backed by the SSH agent if SSH_AUTH_SOCK is set.
 func agentAuth() ssh.AuthMethod {
 	sock := os.Getenv("SSH_AUTH_SOCK")

internal/sshclient/gcmkey.go

@@ -1,122 +0,0 @@
-package sshclient
-
-import (
-	"crypto/aes"
-	"crypto/cipher"
-	"encoding/pem"
-	"errors"
-	"fmt"
-
-	"golang.org/x/crypto/ssh"
-)
-
-// aes256-gcm@openssh.com is a cipher OpenSSH (and 1Password key exports) may
-// use for private key files. golang.org/x/crypto/ssh only supports aes256-ctr
-// and aes256-cbc, so these keys are decrypted here and re-marshalled as
-// unencrypted openssh-key-v1 blobs that ssh.ParsePrivateKey accepts.
-const (
-	opensshKeyMagic  = "openssh-key-v1\x00"
-	opensshGCMCipher = "aes256-gcm@openssh.com"
-	gcmTagSize       = 16
-)
-
-type opensshPrivateKeyHeader struct {
-	CipherName   string
-	KdfName      string
-	KdfOpts      string
-	NumKeys      uint32
-	PubKey       []byte
-	PrivKeyBlock []byte
-	// For AEAD ciphers (aes256-gcm@openssh.com) OpenSSH stores the 16-byte
-	// auth tag as raw bytes after the encrypted block, not inside it.
-	Rest []byte `ssh:"rest"`
-}
-
-// isGCMEncryptedKey reports whether data is an OpenSSH private key encrypted
-// with aes256-gcm@openssh.com.
-func isGCMEncryptedKey(data []byte) bool {
-	block, _ := pem.Decode(data)
-	if block == nil || block.Type != "OPENSSH PRIVATE KEY" {
-		return false
-	}
-	if len(block.Bytes) < len(opensshKeyMagic) || string(block.Bytes[:len(opensshKeyMagic)]) != opensshKeyMagic {
-		return false
-	}
-	var header struct {
-		CipherName string
-		Rest       []byte `ssh:"rest"`
-	}
-	if err := ssh.Unmarshal(block.Bytes[len(opensshKeyMagic):], &header); err != nil {
-		return false
-	}
-	return header.CipherName == opensshGCMCipher
-}
-
-// parseGCMKey decrypts an aes256-gcm@openssh.com encrypted OpenSSH private
-// key with passphrase and returns the signer.
-func parseGCMKey(data, passphrase []byte) (ssh.Signer, error) {
-	block, _ := pem.Decode(data)
-	if block == nil || len(block.Bytes) < len(opensshKeyMagic) {
-		return nil, errors.New("invalid OpenSSH private key PEM")
-	}
-	var w opensshPrivateKeyHeader
-	if err := ssh.Unmarshal(block.Bytes[len(opensshKeyMagic):], &w); err != nil {
-		return nil, err
-	}
-	if w.NumKeys != 1 {
-		return nil, errors.New("multi-key files are not supported")
-	}
-	if w.KdfName != "bcrypt" {
-		return nil, fmt.Errorf("unknown KDF %q, only supports %q", w.KdfName, "bcrypt")
-	}
-	var kdfOpts struct {
-		Salt   string
-		Rounds uint32
-	}
-	if err := ssh.Unmarshal([]byte(w.KdfOpts), &kdfOpts); err != nil {
-		return nil, err
-	}
-	// Same cap as x/crypto/ssh so a hostile file cannot tie up the caller.
-	const maxRounds = 1 << 11
-	if kdfOpts.Rounds > maxRounds {
-		return nil, fmt.Errorf("bcrypt KDF rounds %d exceed maximum %d", kdfOpts.Rounds, maxRounds)
-	}
-
-	// AES-256-GCM: 32-byte key + 12-byte nonce derived by bcrypt_pbkdf.
-	// The 16-byte auth tag follows the encrypted block as raw bytes;
-	// gcm.Open expects it appended to the ciphertext.
-	if len(w.Rest) != gcmTagSize {
-		return nil, fmt.Errorf("unexpected GCM tag length %d", len(w.Rest))
-	}
-	k, err := bcryptPBKDF(passphrase, []byte(kdfOpts.Salt), int(kdfOpts.Rounds), 32+12)
-	if err != nil {
-		return nil, err
-	}
-	aesCipher, err := aes.NewCipher(k[:32])
-	if err != nil {
-		return nil, err
-	}
-	gcm, err := cipher.NewGCM(aesCipher)
-	if err != nil {
-		return nil, err
-	}
-	sealed := make([]byte, 0, len(w.PrivKeyBlock)+gcmTagSize)
-	sealed = append(sealed, w.PrivKeyBlock...)
-	sealed = append(sealed, w.Rest...)
-	plain, err := gcm.Open(nil, k[32:], sealed, nil)
-	if err != nil {
-		return nil, err
-	}
-
-	// Re-marshal as an unencrypted key (tag dropped). The plaintext keeps
-	// its original OpenSSH padding, which ssh.ParsePrivateKey validates.
-	w.CipherName = "none"
-	w.KdfName = "none"
-	w.KdfOpts = ""
-	w.PrivKeyBlock = plain
-	w.Rest = nil
-	raw := make([]byte, 0, len(opensshKeyMagic)+len(plain)+128)
-	raw = append(raw, opensshKeyMagic...)
-	raw = append(raw, ssh.Marshal(&w)...)
-	return ssh.ParsePrivateKey(pem.EncodeToMemory(&pem.Block{Type: "OPENSSH PRIVATE KEY", Bytes: raw}))
-}

internal/tui/app.go

@@ -9,8 +9,8 @@ import (
 
 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/charmbracelet/lipgloss"
-	"git.janvete.com/seth/caddyview/internal/parser"
+	"github.com/janvete/caddyview/internal/parser"
-	"git.janvete.com/seth/caddyview/internal/sshclient"
+	"github.com/janvete/caddyview/internal/sshclient"
 )
 
 // -- tabs ---------------------------------------------------------------------
@@ -132,8 +132,6 @@ type model struct {
 	width  int
 	height int
 	err    error
-
-	errorsScrollOffset int
 }
 
 func initialModel(client *sshclient.Client, logPath string) model {
@@ -235,18 +233,6 @@ func (m model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		m.width = msg.Width
 		m.height = msg.Height
 
-	case tea.MouseMsg:
-		if m.activeTab == tabErrors {
-			switch msg.Button {
-			case tea.MouseButtonWheelUp:
-				if m.errorsScrollOffset > 0 {
-					m.errorsScrollOffset--
-				}
-			case tea.MouseButtonWheelDown:
-				m.errorsScrollOffset++
-			}
-		}
-
 	case tea.KeyMsg:
 		switch msg.String() {
 		case "q", "ctrl+c":
@@ -254,18 +240,14 @@ func (m model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			return m, tea.Quit
 		case "1":
 			m.activeTab = tabLive
-			m.errorsScrollOffset = 0
 		case "2":
 			m.activeTab = tabDay
-			m.errorsScrollOffset = 0
 			return m, m.ensureHistory(tabDay)
 		case "3":
 			m.activeTab = tabWeek
-			m.errorsScrollOffset = 0
 			return m, m.ensureHistory(tabWeek)
 		case "4":
 			m.activeTab = tabErrors
-			m.errorsScrollOffset = 0
 			return m, m.ensureHistory(tabDay)
 		}
 
@@ -308,7 +290,6 @@ func (m model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			h.stats = msg.agg.ToStats()
 			h.buckets = msg.agg.ToBuckets(tabBucketSize(msg.tab))
 			h.errors = msg.agg.RecentErrors(100)
-			m.errorsScrollOffset = 0
 		}
 
 	case errMsg:
@@ -525,34 +506,8 @@ func (m model) renderErrors() string {
 		ipW, "REMOTE IP",
 		"URI",
 	)
-
-	// Fixed-height overhead: header + tab bar + title/header rows + footer/borders.
-	const overhead = 10
-	maxRows := m.height - overhead
-	if maxRows < 3 {
-		maxRows = 3
-	}
-
-	// Clamp scroll offset.
-	if m.errorsScrollOffset > len(errs)-maxRows {
-		if len(errs) > maxRows {
-			m.errorsScrollOffset = len(errs) - maxRows
-		} else {
-			m.errorsScrollOffset = 0
-		}
-	}
-	if m.errorsScrollOffset < 0 {
-		m.errorsScrollOffset = 0
-	}
-
-	end := m.errorsScrollOffset + maxRows
-	if end > len(errs) {
-		end = len(errs)
-	}
-	visible := errs[m.errorsScrollOffset:end]
-
 	rows := []string{styleHeader.Render(title), "", styleHeader.Render(header)}
-	for _, e := range visible {
+	for _, e := range errs {
 		statusStr := fmt.Sprintf("%d", e.Status)
 		var statusStyled string
 		if e.Status >= 500 {
@@ -777,7 +732,7 @@ func bucketSizeLabel(d time.Duration) string {
 // -- entry point --------------------------------------------------------------
 
 func Run(client *sshclient.Client, logPath string) error {
-	p := tea.NewProgram(initialModel(client, logPath), tea.WithAltScreen(), tea.WithMouseCellMotion())
+	p := tea.NewProgram(initialModel(client, logPath), tea.WithAltScreen())
 	_, err := p.Run()
 	return err
 }

main.go

@@ -1,6 +1,6 @@
 package main
 
-import "git.janvete.com/seth/caddyview/cmd"
+import "github.com/janvete/caddyview/cmd"
 
 func main() {
 	cmd.Execute()