Production

Wahoo is work in progress. Do not use it in production yet.

Build And Test

Run these commands from the application root:

npm ci --prefix web
npm test --prefix web
npm run typecheck --prefix web
npm run build --prefix web
npm run test:ssr --prefix web
go test ./...
go test -race ./...
go vet ./...
go build -o bin/app .

The generated lockfile pins frontend dependencies. Do not use npm install in CI or Docker builds.

Runtime

The Go server owns public HTTP. The Node SSR worker binds only to 127.0.0.1:4173. In production, NODE_ENV=production makes SSR worker failures fail closed instead of serving a development fallback.

The generated Docker image runs tini and a Node supervisor. The supervisor stops the container if either Go or the SSR worker exits. Its health check requires both GET /healthz and private worker readiness.

docker build -f Dockerfile.example -t acme .
docker run --rm -p 8080:8080 acme

Use separate web and worker workloads when background work has independent scaling or retry requirements.

Visible Security Policy

internal/config sets a basic response-header policy and 1 MiB JSON body limit. Review and extend it for the application. Wahoo does not infer TLS, HSTS, trusted proxies, CORS, cookie settings, CSRF policy, or distributed rate-limit storage.

Use server.RateLimit with an application-defined key and shared limiter in multi-instance production. ratelimit.Memory is bounded and process-local only.

Health And Readiness

GET /healthz confirms that Go accepts requests. GET /readyz calls an application-owned readiness function with a 250 ms context deadline. Add bounded database and dependency checks before your deployment uses it.

Realtime, Webhooks, And Integrations

Do not expose generated realtime, upload, mail, audit, webhook, entitlement, or billing stubs. Add authentication, tenant authorization, rate limits, payload limits, provider adapters, and idempotency first.

Webhook signature verification proves authenticity and bounded freshness only. Store delivery IDs atomically and process each provider event idempotently.

CI

Wahoo CI runs Go tests, race tests, vet, generated-project tests, frontend tests/typechecking/build, Docker build, runtime health/readiness, OpenAPI, fail-closed routes, and SSR-worker-loss behavior. Require the CI / verify check before merging.

Release Verification

The current release installer requires an explicit release tag and GPG. It verifies a signed checksums.txt before extraction.

curl --fail --location --silent --show-error https://raw.githubusercontent.com/bjarneo/wahoo/v0.3.0/install.sh --output /tmp/wahoo-install.sh
WAHOO_VERSION=v0.3.0 sh /tmp/wahoo-install.sh

Use a versioned installer URL. Do not pipe a mutable branch into a shell.