feat: automatically generate context ignore paths

.env.example

@@ -220,23 +220,6 @@ TINYAUTH_LDAP_AUTHCERT=
 TINYAUTH_LDAP_AUTHKEY=
 # Cache duration for LDAP group membership in seconds.
 TINYAUTH_LDAP_GROUPCACHETTL=900
-
-# experimental config
-
-# Enable Tailscale integration.
-TINYAUTH_EXPERIMENTAL_TAILSCALE_ENABLED=false
-# Tailscale state directory.
-TINYAUTH_EXPERIMENTAL_TAILSCALE_DIR="./tailscale_state"
-# Tailscale hostname.
-TINYAUTH_EXPERIMENTAL_TAILSCALE_HOSTNAME=
-# Tailscale auth key.
-TINYAUTH_EXPERIMENTAL_TAILSCALE_AUTHKEY=
-# Use ephemeral Tailscale node.
-TINYAUTH_EXPERIMENTAL_TAILSCALE_EPHEMERAL=false
-# Enable Tailscale Funnel.
-TINYAUTH_EXPERIMENTAL_TAILSCALE_FUNNEL=false
-# Listen on the Tailscale address instead of standard address.
-TINYAUTH_EXPERIMENTAL_TAILSCALE_LISTEN=false
 # Label provider to use for ACLs (auto, docker, kubernetes or none to disable). auto detects the environment.
 TINYAUTH_LABELPROVIDER="auto"
 
@@ -258,3 +241,20 @@ TINYAUTH_LOG_STREAMS_APP_LEVEL=
 TINYAUTH_LOG_STREAMS_AUDIT_ENABLED=false
 # Log level for this stream. Use global if empty.
 TINYAUTH_LOG_STREAMS_AUDIT_LEVEL=
+
+# tailscale config
+
+# Enable Tailscale integration.
+TINYAUTH_TAILSCALE_ENABLED=false
+# Tailscale state directory.
+TINYAUTH_TAILSCALE_DIR="./tailscale_state"
+# Tailscale hostname.
+TINYAUTH_TAILSCALE_HOSTNAME=
+# Tailscale auth key.
+TINYAUTH_TAILSCALE_AUTHKEY=
+# Use ephemeral Tailscale node.
+TINYAUTH_TAILSCALE_EPHEMERAL=false
+# Enable Tailscale Funnel.
+TINYAUTH_TAILSCALE_FUNNEL=false
+# Listen on the Tailscale address instead of standard address.
+TINYAUTH_TAILSCALE_LISTEN=false

.github/workflows/ci.yml

@@ -38,7 +38,7 @@ jobs:
           sqlc generate
           go generate ./...
           git diff --exit-code
-          git status --porcelain | grep -q . && echo "untracked files code gen files" && exit 1 || true
+          git status --porcelain | grep -q . && echo "untracked files in git diff" && exit 1 || true
 
       - name: Install frontend dependencies
         working-directory: ./frontend

.gitignore

@@ -51,6 +51,3 @@ config.certify.yml
 
 # deepsec
 /.deepsec
-
-# jetbrains
-/.idea/

Dockerfile

@@ -52,17 +52,15 @@ WORKDIR /tinyauth
 
 COPY --from=builder /tinyauth/tinyauth ./
 
-EXPOSE 3000
+RUN mkdir -p /data
 
-# Make the data directory with a non-root user
+EXPOSE 3000
-RUN addgroup tinyauth && adduser -DH tinyauth -G tinyauth
-RUN mkdir -p /data/resources /data/oidc /data/tailscale
-RUN chown -R tinyauth:tinyauth /data
 
 VOLUME ["/data"]
 
-# Tell tinyauth that it's running in a container and where to find the data directory
+ENV TINYAUTH_DATABASE_PATH=/data/tinyauth.db
-ENV RUNTIME_ENV=docker
+
+ENV TINYAUTH_RESOURCES_PATH=/data/resources
 
 ENV PATH=$PATH:/tinyauth
 

Dockerfile.distroless

@@ -40,16 +40,13 @@ COPY ./cmd ./cmd
 COPY ./internal ./internal
 COPY --from=frontend-builder /frontend/dist ./internal/assets/dist
 
+RUN mkdir -p data
+
 RUN CGO_ENABLED=0 go build -ldflags "${LDFLAGS} \
     -X github.com/tinyauthapp/tinyauth/internal/model.Version=${VERSION} \
     -X github.com/tinyauthapp/tinyauth/internal/model.CommitHash=${COMMIT_HASH} \
     -X github.com/tinyauthapp/tinyauth/internal/model.BuildTimestamp=${BUILD_TIMESTAMP}" ./cmd/tinyauth
 
-# Make the data directory with a non-root user
-RUN addgroup tinyauth && adduser -DH tinyauth -G tinyauth
-RUN mkdir -p /data/resources /data/oidc /data/tailscale
-RUN chown -R tinyauth:tinyauth /data
-
 # Runner
 FROM gcr.io/distroless/static-debian12:latest AS runner
 
@@ -58,14 +55,15 @@ WORKDIR /tinyauth
 COPY --from=builder /tinyauth/tinyauth ./
 
 # Since it's distroless, we need to copy the data directory from the builder stage
-COPY --from=builder /data /data
+COPY --from=builder /tinyauth/data /data
 
 EXPOSE 3000
 
 VOLUME ["/data"]
 
-# Tell tinyauth that it's running in a container and where to find the data directory
+ENV TINYAUTH_DATABASE_PATH=/data/tinyauth.db
-ENV RUNTIME_ENV=docker
+
+ENV TINYAUTH_RESOURCES_PATH=/data/resources
 
 ENV PATH=$PATH:/tinyauth
 

Makefile

@@ -16,8 +16,6 @@ PROD_COMPOSE := $(shell test -f "docker-compose.test.prod.yml" && echo "docker-c
 
 .DEFAULT_GOAL := binary
 
-.PHONY: deps clean-data clean-webui webui binary binary-linux-amd64 binary-linux-arm64 test vet test-race dev dev-infisical prod prod-infisical sql generate docker docker-distroless
-
 # Deps
 deps:
 	cd frontend && pnpm ci
@@ -60,10 +58,12 @@ binary-linux-arm64:
 	$(MAKE) binary
 
 # Go test
+.PHONY: test
 test:
 	go test -v ./...
 
 # Go vet
+.PHONY: vet
 vet:
 	go vet ./...
 
@@ -88,17 +88,10 @@ prod-infisical:
 	infisical run --env=dev -- docker compose -f $(PROD_COMPOSE) up --force-recreate --pull=always --remove-orphans
 
 # SQL
+.PHONY: sql
 sql:
 	sqlc generate
 
 # Go gen
 generate:
 	go generate ./...
-
-# Docker image
-docker:
-	docker buildx build -t tinyauthapp/tinyauth:dev --build-arg=VERSION=$(TAG_NAME) --build-arg=COMMIT_HASH=$(COMMIT_HASH) --build-arg=BUILD_TIMESTAMP=$(BUILD_TIMESTAMP) -f Dockerfile .
-
-# Docker image distroless
-docker-distroless:
-	docker buildx build -t tinyauthapp/tinyauth:dev-distroless --build-arg=VERSION=$(TAG_NAME) --build-arg=COMMIT_HASH=$(COMMIT_HASH) --build-arg=BUILD_TIMESTAMP=$(BUILD_TIMESTAMP) -f Dockerfile.distroless .

cmd/tinyauth/config.go

@@ -1,32 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"strings"
-
-	"github.com/tinyauthapp/paerser/cli"
-	"github.com/tinyauthapp/tinyauth/internal/model"
-)
-
-func configCmd(tconfig *model.Config, loaders []cli.ResourceLoader) *cli.Command {
-	return &cli.Command{
-		Name:          "config",
-		Description:   "Dump the current configuration in YAML format, useful for debugging",
-		Configuration: tconfig,
-		Resources:     loaders,
-		Run: func(_ []string) error {
-			buf := strings.Builder{}
-
-			fmt.Fprint(&buf, "Your current configuration in YAML is:\n\n")
-
-			err := renderYamlToBuf(&buf, tconfig)
-
-			if err != nil {
-				return fmt.Errorf("failed to render yaml config: %w", err)
-			}
-
-			fmt.Print(buf.String())
-			return nil
-		},
-	}
-}

cmd/tinyauth/create_oidc_client.go

@@ -7,9 +7,8 @@ import (
 	"strings"
 
 	"github.com/google/uuid"
-	"github.com/tinyauthapp/paerser/cli"
-	"github.com/tinyauthapp/tinyauth/internal/model"
 	"github.com/tinyauthapp/tinyauth/internal/utils"
+	"github.com/tinyauthapp/paerser/cli"
 )
 
 func createOidcClientCmd() *cli.Command {
@@ -32,84 +31,40 @@ func createOidcClientCmd() *cli.Command {
 				return errors.New("client name can only contain alphanumeric characters and hyphens")
 			}
 
-			u := uuid.New()
+			uuid := uuid.New()
-			clientId := u.String()
+			clientId := uuid.String()
 			clientSecret := "ta-" + utils.GenerateString(61)
 
 			uclientName := strings.ToUpper(clientName)
 			lclientName := strings.ToLower(clientName)
 
-			buf := strings.Builder{}
+			builder := strings.Builder{}
 
 			// header
-			fmt.Fprintf(&buf, "Created '%s' OIDC client.\n\n", clientName)
+			fmt.Fprintf(&builder, "Created credentials for client %s\n\n", clientName)
 
 			// credentials
-			fmt.Fprintf(&buf, "Credentials:\n\n")
+			fmt.Fprintf(&builder, "Client Name: %s\n", clientName)
-			fmt.Fprintf(&buf, "Client Name: %s\n", clientName)
+			fmt.Fprintf(&builder, "Client ID: %s\n", clientId)
-			fmt.Fprintf(&buf, "Client ID: %s\n", clientId)
+			fmt.Fprintf(&builder, "Client Secret: %s\n\n", clientSecret)
-			fmt.Fprintf(&buf, "Client Secret: %s\n\n", clientSecret)
 
-			// end variables
+			// env variables
-			fmt.Fprintf(&buf, "Environment variables:\n\n")
+			fmt.Fprint(&builder, "Environment variables:\n\n")
-			renderToBuf(&buf, []kv{
+			fmt.Fprintf(&builder, "TINYAUTH_OIDC_CLIENTS_%s_CLIENTID=%s\n", uclientName, clientId)
-				{
+			fmt.Fprintf(&builder, "TINYAUTH_OIDC_CLIENTS_%s_CLIENTSECRET=%s\n", uclientName, clientSecret)
-					k: fmt.Sprintf("TINYAUTH_OIDC_CLIENTS_%s_CLIENTID", uclientName),
+			fmt.Fprintf(&builder, "TINYAUTH_OIDC_CLIENTS_%s_NAME=%s\n\n", uclientName, utils.Capitalize(lclientName))
-					v: clientId,
-				},
-				{
-					k: fmt.Sprintf("TINYAUTH_OIDC_CLIENTS_%s_CLIENTSECRET", uclientName),
-					v: clientSecret,
-				},
-				{
-					k: fmt.Sprintf("TINYAUTH_OIDC_CLIENTS_%s_NAME", uclientName),
-					v: utils.Capitalize(lclientName),
-				},
-			}, "=")
-			fmt.Fprintf(&buf, "\n")
 
 			// cli flags
-			fmt.Fprintf(&buf, "CLI flags:\n\n")
+			fmt.Fprint(&builder, "CLI flags:\n\n")
-			renderToBuf(&buf, []kv{
+			fmt.Fprintf(&builder, "--oidc.clients.%s.clientid=%s\n", lclientName, clientId)
-				{
+			fmt.Fprintf(&builder, "--oidc.clients.%s.clientsecret=%s\n", lclientName, clientSecret)
-					k: fmt.Sprintf("--oidc.clients.%s.clientid", lclientName),
+			fmt.Fprintf(&builder, "--oidc.clients.%s.name=%s\n\n", lclientName, utils.Capitalize(lclientName))
-					v: clientId,
-				},
-				{
-					k: fmt.Sprintf("--oidc.clients.%s.clientsecret", lclientName),
-					v: clientSecret,
-				},
-				{
-					k: fmt.Sprintf("--oidc.clients.%s.name", lclientName),
-					v: utils.Capitalize(lclientName),
-				},
-			}, "=")
-			fmt.Fprintf(&buf, "\n")
-
-			// yaml config
-			fmt.Fprintf(&buf, "YAML config:\n\n")
-
-			err = renderYamlToBuf(&buf, &model.OIDCConfig{
-				Clients: map[string]model.OIDCClientConfig{
-					lclientName: {
-						ClientID:     clientId,
-						ClientSecret: clientSecret,
-						Name:         utils.Capitalize(lclientName),
-					},
-				},
-			})
-
-			if err != nil {
-				return fmt.Errorf("failed to render yaml config: %w", err)
-			}
-
-			buf.WriteString("\n")
 
 			// footer
-			fmt.Fprintln(&buf, "You can use any of the above options to configure your OIDC client. Make sure to save these credentials as there is no way to regenerate them.")
+			fmt.Fprintln(&builder, "You can use either option to configure your OIDC client. Make sure to save these credentials as there is no way to regenerate them.")
 
 			// print
-			out := buf.String()
+			out := builder.String()
 			fmt.Print(out)
 			return nil
 		},

cmd/tinyauth/create_user.go

@@ -3,12 +3,11 @@ package main
 import (
 	"errors"
 	"fmt"
-	"os"
 	"strings"
 
 	"charm.land/huh/v2"
 	"github.com/tinyauthapp/paerser/cli"
-	"github.com/tinyauthapp/tinyauth/internal/model"
+	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
 	"golang.org/x/crypto/bcrypt"
 )
 
@@ -35,107 +34,62 @@ func createUserCmd() *cli.Command {
 		&cli.FlagLoader{},
 	}
 
-	cmd := &cli.Command{
+	return &cli.Command{
 		Name:          "create",
 		Description:   "Create a user",
 		Configuration: tCfg,
 		Resources:     loaders,
-	}
+		Run: func(_ []string) error {
+			log := logger.NewLogger().WithSimpleConfig()
+			log.Init()
 
-	cmd.Run = func(_ []string) error {
+			if tCfg.Interactive {
-		if tCfg.Interactive {
+				form := huh.NewForm(
-			form := huh.NewForm(
+					huh.NewGroup(
-				huh.NewGroup(
+						huh.NewInput().Title("Username").Value(&tCfg.Username).Validate((func(s string) error {
-					huh.NewInput().Title("Username").Value(&tCfg.Username).Validate(func(s string) error {
+							if s == "" {
-						if s == "" {
+								return errors.New("username cannot be empty")
-							return errors.New("username cannot be empty")
+							}
-						}
+							return nil
-						if strings.Contains(s, ":") {
+						})),
-							return errors.New("username cannot contain ':'")
+						huh.NewInput().Title("Password").Value(&tCfg.Password).Validate((func(s string) error {
-						}
+							if s == "" {
-						return nil
+								return errors.New("password cannot be empty")
-					}),
+							}
-					huh.NewInput().Title("Password").Value(&tCfg.Password).Validate(func(s string) error {
+							return nil
-						if s == "" {
+						})),
-							return errors.New("password cannot be empty")
+						huh.NewSelect[bool]().Title("Format the output for Docker?").Options(huh.NewOption("Yes", true), huh.NewOption("No", false)).Value(&tCfg.Docker),
-						}
+					),
-						return nil
+				)
-					}),
-					huh.NewSelect[bool]().Title("Format the output for Docker?").Options(huh.NewOption("Yes", true), huh.NewOption("No", false)).Value(&tCfg.Docker),
-				),
-			)
 
-			theme := new(themeBase)
+				theme := new(themeBase)
+				err := form.WithTheme(theme).Run()
 
-			err := form.WithTheme(theme).Run()
+				if err != nil {
-			if err != nil {
+					return fmt.Errorf("failed to run interactive prompt: %w", err)
-				return fmt.Errorf("failed to run interactive prompt: %w", err)
+				}
 			}
-		}
 
-		if tCfg.Username == "" || tCfg.Password == "" {
+			if tCfg.Username == "" || tCfg.Password == "" {
-			cmd.PrintHelp(os.Stdout)
+				return errors.New("username and password cannot be empty")
-			return errors.New("username and password cannot be empty")
+			}
-		}
 
-		if strings.Contains(tCfg.Username, ":") {
+			log.App.Info().Str("username", tCfg.Username).Msg("Creating user")
-			return errors.New("username cannot contain ':'")
-		}
 
-		passwd, err := bcrypt.GenerateFromPassword([]byte(tCfg.Password), bcrypt.DefaultCost)
+			passwd, err := bcrypt.GenerateFromPassword([]byte(tCfg.Password), bcrypt.DefaultCost)
-		if err != nil {
+			if err != nil {
-			return fmt.Errorf("failed to hash password: %w", err)
+				return fmt.Errorf("failed to hash password: %w", err)
-		}
+			}
 
-		// Only the docker compose output needs $ escaped, the raw hash is correct everywhere else
+			// If docker format is enabled, escape the dollar sign
-		passwdStr := string(passwd)
+			passwdStr := string(passwd)
-		outputStr := passwdStr
+			if tCfg.Docker {
+				passwdStr = strings.ReplaceAll(passwdStr, "$", "$$")
+			}
 
-		if tCfg.Docker {
+			log.App.Info().Str("user", fmt.Sprintf("%s:%s", tCfg.Username, passwdStr)).Msg("User created")
-			outputStr = strings.ReplaceAll(passwdStr, "$", "$$")
-		}
 
-		user := fmt.Sprintf("%s:%s", tCfg.Username, passwdStr)
+			return nil
-		escapedUser := fmt.Sprintf("%s:%s", tCfg.Username, outputStr)
+		},
-
-		buf := strings.Builder{}
-
-		// header
-		fmt.Fprintf(&buf, "Created user '%s'.\n\n", tCfg.Username)
-
-		// environment variable
-		fmt.Fprint(&buf, "Environment variable:\n\n")
-		renderToBuf(&buf, []kv{
-			{"TINYAUTH_AUTH_USERS", escapedUser},
-		}, "=")
-
-		// cli flags
-		fmt.Fprint(&buf, "\nCLI flags:\n\n")
-		renderToBuf(&buf, []kv{
-			{"--auth.users", user},
-		}, "=")
-
-		// yaml config
-		fmt.Fprint(&buf, "\nYAML config:\n\n")
-
-		err = renderYamlToBuf(&buf, &model.Config{
-			Auth: model.AuthConfig{
-				Users: []string{user},
-			},
-		})
-
-		if err != nil {
-			return fmt.Errorf("failed to render yaml config: %w", err)
-		}
-
-		buf.WriteString("\n")
-
-		// footer
-		fmt.Fprint(&buf, "Use your config option of choice to add the user to Tinyauth and then restart.")
-
-		fmt.Println(buf.String())
-		return nil
 	}
-
-	return cmd
 }

cmd/tinyauth/generate_totp.go

@@ -7,6 +7,7 @@ import (
 	"strings"
 
 	"github.com/tinyauthapp/tinyauth/internal/utils"
+	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
 
 	"charm.land/huh/v2"
 	"github.com/mdp/qrterminal/v3"
@@ -33,98 +34,85 @@ func generateTotpCmd() *cli.Command {
 		&cli.FlagLoader{},
 	}
 
-	cmd := &cli.Command{
+	return &cli.Command{
 		Name:          "generate",
 		Description:   "Generate a TOTP secret",
 		Configuration: tCfg,
 		Resources:     loaders,
-	}
+		Run: func(_ []string) error {
+			log := logger.NewLogger().WithSimpleConfig()
+			log.Init()
 
-	cmd.Run = func(_ []string) error {
+			if tCfg.Interactive {
-		colors := getColors()
+				form := huh.NewForm(
+					huh.NewGroup(
+						huh.NewInput().Title("Current user (username:hash)").Value(&tCfg.User).Validate((func(s string) error {
+							if s == "" {
+								return errors.New("user cannot be empty")
+							}
+							return nil
+						})),
+					),
+				)
 
-		if tCfg.Interactive {
+				theme := new(themeBase)
-			form := huh.NewForm(
+				err := form.WithTheme(theme).Run()
-				huh.NewGroup(
-					huh.NewInput().Title("Current user (username:hash)").Value(&tCfg.User).Validate((func(s string) error {
-						if s == "" {
-							return errors.New("user cannot be empty")
-						}
-						return nil
-					})),
-				),
-			)
 
-			theme := new(themeBase)
+				if err != nil {
-			err := form.WithTheme(theme).Run()
+					return fmt.Errorf("failed to run interactive prompt: %w", err)
+				}
+			}
+
+			user, err := utils.ParseUser(tCfg.User)
 
 			if err != nil {
-				return fmt.Errorf("failed to run interactive prompt: %w", err)
+				return fmt.Errorf("failed to parse user: %w", err)
 			}
-		}
 
-		if tCfg.User == "" {
+			docker := false
-			cmd.PrintHelp(os.Stdout)
+			if strings.Contains(tCfg.User, "$$") {
-			return fmt.Errorf("user is required")
+				docker = true
-		}
+			}
 
-		user, err := utils.ParseUser(tCfg.User)
+			if user.TOTPSecret != "" {
+				return fmt.Errorf("user already has a TOTP secret")
+			}
 
-		if err != nil {
+			key, err := totp.Generate(totp.GenerateOpts{
-			return fmt.Errorf("failed to parse user: %w", err)
+				Issuer:      "Tinyauth",
-		}
+				AccountName: user.Username,
+			})
 
-		docker := false
+			if err != nil {
-		if strings.Contains(tCfg.User, "$$") {
+				return fmt.Errorf("failed to generate TOTP secret: %w", err)
-			docker = true
+			}
-		}
 
-		if user.TOTPSecret != "" {
+			secret := key.Secret()
-			return fmt.Errorf("user already has a TOTP secret")
-		}
 
-		key, err := totp.Generate(totp.GenerateOpts{
+			log.App.Info().Str("secret", secret).Msg("Generated TOTP secret")
-			Issuer:      "Tinyauth",
-			AccountName: user.Username,
-		})
 
-		if err != nil {
+			log.App.Info().Msg("Generated QR code")
-			return fmt.Errorf("failed to generate TOTP secret: %w", err)
-		}
 
-		secret := key.Secret()
+			config := qrterminal.Config{
+				Level:     qrterminal.L,
+				Writer:    os.Stdout,
+				BlackChar: qrterminal.BLACK,
+				WhiteChar: qrterminal.WHITE,
+				QuietZone: 2,
+			}
 
-		fmt.Printf("Scan the following QR code with your authenticator app (e.g., Google Authenticator, 2fauth, Microsoft Authenticator):\n\n")
+			qrterminal.GenerateWithConfig(key.URL(), config)
 
-		config := qrterminal.Config{
+			user.TOTPSecret = secret
-			Level:     qrterminal.L,
-			Writer:    os.Stdout,
-			BlackChar: qrterminal.BLACK,
-			WhiteChar: qrterminal.WHITE,
-			QuietZone: 2,
-		}
 
-		qrterminal.GenerateWithConfig(key.URL(), config)
+			// If using docker escape re-escape it
+			if docker {
+				user.Password = strings.ReplaceAll(user.Password, "$", "$$")
+			}
 
-		user.TOTPSecret = secret
+			log.App.Info().Str("user", fmt.Sprintf("%s:%s:%s", user.Username, user.Password, user.TOTPSecret)).Msg("Add the totp secret to your authenticator app then use the verify command to ensure everything is working correctly.")
 
-		// If using docker escape re-escape it
+			return nil
-		if docker {
+		},
-			user.Password = strings.ReplaceAll(user.Password, "$", "$$")
-		}
-
-		userStr := fmt.Sprintf("%s:%s:%s", user.Username, user.Password, user.TOTPSecret)
-
-		fmt.Print("\nOr add the following TOTP secret to your authenticator app: ")
-		fmt.Print(colors.green.Render(secret))
-		fmt.Print("\n\n")
-
-		fmt.Printf("Finally, add your user '%s' back to your configuration: ", user.Username)
-		fmt.Print(colors.green.Render(userStr))
-		fmt.Print("\n")
-
-		return nil
 	}
-
-	return cmd
 }

cmd/tinyauth/tinyauth.go

@@ -2,23 +2,18 @@ package main
 
 import (
 	"fmt"
-	"os"
-	"reflect"
-	"strings"
 
 	"charm.land/huh/v2"
-	"charm.land/lipgloss/v2"
 	"github.com/tinyauthapp/tinyauth/internal/bootstrap"
 	"github.com/tinyauthapp/tinyauth/internal/model"
 	"github.com/tinyauthapp/tinyauth/internal/utils/loaders"
-	"gopkg.in/yaml.v3"
 
+	"github.com/rs/zerolog/log"
 	"github.com/tinyauthapp/paerser/cli"
 )
 
 func main() {
-	env := model.DetectRuntimeEnv()
+	tConfig := model.NewDefaultConfiguration()
-	tConfig := model.NewDefaultConfiguration(env)
 
 	loaders := []cli.ResourceLoader{
 		&loaders.FileLoader{},
@@ -32,114 +27,83 @@ func main() {
 		Configuration: tConfig,
 		Resources:     loaders,
 		Run: func(_ []string) error {
-			if !reflect.DeepEqual(model.NewDefaultConfiguration(env).Experimental, tConfig.Experimental) {
-				colors := getColors()
-				fmt.Println(colors.yellow.Render("⚠") + " Experimental features are enabled, use with caution. Experimental features may change with each release.")
-			}
 			return runCmd(*tConfig)
 		},
 	}
 
 	cmdUser := &cli.Command{
 		Name:        "user",
-		Description: "Manage users",
+		Description: "Manage Tinyauth users",
 	}
 
 	cmdTotp := &cli.Command{
 		Name:        "totp",
-		Description: "Manage TOTP users",
+		Description: "Manage Tinyauth TOTP users",
 	}
 
 	cmdOidc := &cli.Command{
 		Name:        "oidc",
-		Description: "Manage OIDC clients",
+		Description: "Manage Tinyauth OIDC clients",
 	}
 
-	helpCmd := &cli.Command{
+	err := cmdTinyauth.AddCommand(versionCmd())
-		Name:        "help",
-		Description: "Show the help message",
-		Run: func(_ []string) error {
-			return cmdTinyauth.PrintHelp(os.Stdout)
-		},
-	}
-
-	err := cmdTinyauth.AddCommand(helpCmd)
 
 	if err != nil {
-		fatalf(err, "Failed to add help command")
+		log.Fatal().Err(err).Msg("Failed to add version command")
-	}
-
-	err = cmdTinyauth.AddCommand(versionCmd())
-
-	if err != nil {
-		fatalf(err, "Failed to add version command")
-	}
-
-	err = cmdTinyauth.AddCommand(configCmd(tConfig, loaders))
-
-	if err != nil {
-		fatalf(err, "Failed to add config command")
 	}
 
 	err = cmdUser.AddCommand(verifyUserCmd())
 
 	if err != nil {
-		fatalf(err, "Failed to add user verify command")
+		log.Fatal().Err(err).Msg("Failed to add verify command")
 	}
 
 	err = cmdTinyauth.AddCommand(healthcheckCmd())
 
 	if err != nil {
-		fatalf(err, "Failed to add healthcheck command")
+		log.Fatal().Err(err).Msg("Failed to add healthcheck command")
 	}
 
 	err = cmdTotp.AddCommand(generateTotpCmd())
 
 	if err != nil {
-		fatalf(err, "Failed to add totp generate command")
+		log.Fatal().Err(err).Msg("Failed to add generate command")
 	}
 
 	err = cmdUser.AddCommand(createUserCmd())
 
 	if err != nil {
-		fatalf(err, "Failed to add create user command")
+		log.Fatal().Err(err).Msg("Failed to add create command")
 	}
 
 	err = cmdOidc.AddCommand(createOidcClientCmd())
 
 	if err != nil {
-		fatalf(err, "Failed to add create oidc client command")
+		log.Fatal().Err(err).Msg("Failed to add create command")
 	}
 
 	err = cmdTinyauth.AddCommand(cmdUser)
 
 	if err != nil {
-		fatalf(err, "Failed to add user command")
+		log.Fatal().Err(err).Msg("Failed to add user command")
 	}
 
 	err = cmdTinyauth.AddCommand(cmdTotp)
 
 	if err != nil {
-		fatalf(err, "Failed to add totp command")
+		log.Fatal().Err(err).Msg("Failed to add totp command")
 	}
 
 	err = cmdTinyauth.AddCommand(cmdOidc)
 
 	if err != nil {
-		fatalf(err, "Failed to add oidc command")
+		log.Fatal().Err(err).Msg("Failed to add oidc command")
 	}
 
 	err = cli.Execute(cmdTinyauth)
 
 	if err != nil {
-		if strings.Contains(err.Error(), "command not found") {
+		log.Fatal().Err(err).Msg("Failed to execute command")
-			fmt.Println("Command not found. Use 'tinyauth help' to see available commands.")
-			return
-		}
-		if strings.Contains(err.Error(), "is not runnable") {
-			return
-		}
-		fatalf(err, "Failed to execute command")
 	}
 }
 
@@ -160,98 +124,3 @@ type themeBase struct{}
 func (t *themeBase) Theme(isDark bool) *huh.Styles {
 	return huh.ThemeBase(isDark)
 }
-
-type colors struct {
-	blue      lipgloss.Style
-	gray      lipgloss.Style
-	lightGray lipgloss.Style
-	green     lipgloss.Style
-	yellow    lipgloss.Style
-}
-
-func getColors() colors {
-	noColor := os.Getenv("NO_COLOR")
-	forceColor := os.Getenv("FORCE_COLOR")
-
-	colorOut := colors{
-		green:     lipgloss.NewStyle().Foreground(lipgloss.ANSIColor(34)),
-		gray:      lipgloss.NewStyle().Foreground(lipgloss.ANSIColor(245)),
-		yellow:    lipgloss.NewStyle().Foreground(lipgloss.ANSIColor(214)),
-		blue:      lipgloss.NewStyle().Foreground(lipgloss.ANSIColor(75)),
-		lightGray: lipgloss.NewStyle().Foreground(lipgloss.ANSIColor(250)),
-	}
-
-	noColorOut := colors{
-		green:     lipgloss.NewStyle(),
-		gray:      lipgloss.NewStyle(),
-		yellow:    lipgloss.NewStyle(),
-		blue:      lipgloss.NewStyle(),
-		lightGray: lipgloss.NewStyle(),
-	}
-
-	useColors := true
-
-	if noColor == "true" || noColor == "1" {
-		useColors = false
-	}
-
-	if forceColor == "true" || forceColor == "1" {
-		useColors = true
-	}
-
-	if !useColors {
-		return noColorOut
-	}
-
-	return colorOut
-}
-
-func fatalf(err error, msg string) {
-	fmt.Printf("%s: %v\n", msg, err)
-	os.Exit(1)
-}
-
-type kv struct {
-	k string
-	v string
-}
-
-func renderToBuf(buf *strings.Builder, kv []kv, sep string) {
-	colors := getColors()
-	for _, i := range kv {
-		buf.WriteString(colors.blue.Render(i.k))
-		buf.WriteString(colors.gray.Render(sep))
-		buf.WriteString(colors.lightGray.Render(i.v))
-		buf.WriteString("\n")
-	}
-}
-
-func renderYamlToBuf(buf *strings.Builder, i any) error {
-	colors := getColors()
-
-	yout, err := yaml.Marshal(i)
-
-	if err != nil {
-		return fmt.Errorf("failed to marshal yaml: %w", err)
-	}
-
-	for l := range strings.SplitSeq(string(yout), "\n") {
-		if l == "" {
-			continue
-		}
-		if strings.HasPrefix(strings.TrimLeft(l, " "), "- ") {
-			buf.WriteString(colors.lightGray.Render(l))
-			buf.WriteString("\n")
-			continue
-		}
-		lp := strings.SplitN(l, ":", 2)
-		buf.WriteString(colors.blue.Render(lp[0]))
-		buf.WriteString(colors.gray.Render(":"))
-		if len(lp) == 2 {
-			buf.WriteString(colors.lightGray.Render(lp[1]))
-		}
-		buf.WriteString("\n")
-	}
-
-	return nil
-}

cmd/tinyauth/verify_user.go

@@ -3,9 +3,9 @@ package main
 import (
 	"errors"
 	"fmt"
-	"os"
 
 	"github.com/tinyauthapp/tinyauth/internal/utils"
+	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
 
 	"charm.land/huh/v2"
 	"github.com/pquerna/otp/totp"
@@ -38,87 +38,81 @@ func verifyUserCmd() *cli.Command {
 		&cli.FlagLoader{},
 	}
 
-	cmd := &cli.Command{
+	return &cli.Command{
 		Name:          "verify",
 		Description:   "Verify a user is set up correctly",
 		Configuration: tCfg,
 		Resources:     loaders,
-	}
+		Run: func(_ []string) error {
+			log := logger.NewLogger().WithSimpleConfig()
+			log.Init()
 
-	cmd.Run = func(_ []string) error {
+			if tCfg.Interactive {
-		colors := getColors()
+				form := huh.NewForm(
+					huh.NewGroup(
+						huh.NewInput().Title("User (username:hash:totp)").Value(&tCfg.User).Validate((func(s string) error {
+							if s == "" {
+								return errors.New("user cannot be empty")
+							}
+							return nil
+						})),
+						huh.NewInput().Title("Username").Value(&tCfg.Username).Validate((func(s string) error {
+							if s == "" {
+								return errors.New("username cannot be empty")
+							}
+							return nil
+						})),
+						huh.NewInput().Title("Password").Value(&tCfg.Password).Validate((func(s string) error {
+							if s == "" {
+								return errors.New("password cannot be empty")
+							}
+							return nil
+						})),
+						huh.NewInput().Title("TOTP Code (optional)").Value(&tCfg.Totp),
+					),
+				)
 
-		if tCfg.Interactive {
+				theme := new(themeBase)
-			form := huh.NewForm(
+				err := form.WithTheme(theme).Run()
-				huh.NewGroup(
-					huh.NewInput().Title("User (username:hash:totp)").Value(&tCfg.User).Validate((func(s string) error {
-						if s == "" {
-							return errors.New("user cannot be empty")
-						}
-						return nil
-					})),
-					huh.NewInput().Title("Username").Value(&tCfg.Username).Validate((func(s string) error {
-						if s == "" {
-							return errors.New("username cannot be empty")
-						}
-						return nil
-					})),
-					huh.NewInput().Title("Password").Value(&tCfg.Password).Validate((func(s string) error {
-						if s == "" {
-							return errors.New("password cannot be empty")
-						}
-						return nil
-					})),
-					huh.NewInput().Title("TOTP Code (optional)").Value(&tCfg.Totp),
-				),
-			)
 
-			theme := new(themeBase)
+				if err != nil {
-			err := form.WithTheme(theme).Run()
+					return fmt.Errorf("failed to run interactive prompt: %w", err)
+				}
+			}
+
+			user, err := utils.ParseUser(tCfg.User)
 
 			if err != nil {
-				return fmt.Errorf("failed to run interactive prompt: %w", err)
+				return fmt.Errorf("failed to parse user: %w", err)
 			}
-		}
 
-		if tCfg.User == "" || tCfg.Username == "" || tCfg.Password == "" {
+			if user.Username != tCfg.Username {
-			cmd.PrintHelp(os.Stdout)
+				return fmt.Errorf("username is incorrect")
-			return fmt.Errorf("user, username, and password are required")
-		}
-
-		user, err := utils.ParseUser(tCfg.User)
-
-		if err != nil {
-			return fmt.Errorf("failed to parse user: %w", err)
-		}
-
-		if user.Username != tCfg.Username {
-			return fmt.Errorf("username is incorrect")
-		}
-
-		err = bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(tCfg.Password))
-
-		if err != nil {
-			return fmt.Errorf("password is incorrect: %w", err)
-		}
-
-		if user.TOTPSecret == "" {
-			if tCfg.Totp != "" {
-				fmt.Println(colors.yellow.Render("⚠") + " TOTP code provided but user does not have TOTP enabled")
 			}
-			fmt.Println(colors.green.Render("✓") + " User verified")
+
+			err = bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(tCfg.Password))
+
+			if err != nil {
+				return fmt.Errorf("password is incorrect: %w", err)
+			}
+
+			if user.TOTPSecret == "" {
+				if tCfg.Totp != "" {
+					log.App.Warn().Msg("User does not have TOTP secret")
+				}
+				log.App.Info().Msg("User verified")
+				return nil
+			}
+
+			ok := totp.Validate(tCfg.Totp, user.TOTPSecret)
+
+			if !ok {
+				return fmt.Errorf("TOTP code incorrect")
+			}
+
+			log.App.Info().Msg("User verified")
+
 			return nil
-		}
+		},
-
-		ok := totp.Validate(tCfg.Totp, user.TOTPSecret)
-		if !ok {
-			return fmt.Errorf("TOTP code incorrect")
-		}
-
-		fmt.Println(colors.green.Render("✓") + " User verified")
-
-		return nil
 	}
-
-	return cmd
 }

cmd/tinyauth/version.go

@@ -14,10 +14,9 @@ func versionCmd() *cli.Command {
 		Configuration: nil,
 		Resources:     nil,
 		Run: func(_ []string) error {
-			colors := getColors()
+			fmt.Printf("Version: %s\n", model.Version)
-			fmt.Printf("Version: %s\n", colors.blue.Render(model.Version))
+			fmt.Printf("Commit Hash: %s\n", model.CommitHash)
-			fmt.Printf("Commit Hash: %s\n", colors.blue.Render(model.CommitHash))
+			fmt.Printf("Build Timestamp: %s\n", model.BuildTimestamp)
-			fmt.Printf("Build Timestamp: %s\n", colors.blue.Render(model.BuildTimestamp))
 			return nil
 		},
 	}

frontend/package.json

@@ -51,6 +51,7 @@
     "eslint-plugin-react-hooks": "^7.0.1",
     "eslint-plugin-react-refresh": "^0.5.2",
     "globals": "^17.5.0",
+    "prettier": "3.8.2",
     "rollup-plugin-visualizer": "^7.0.1",
     "tw-animate-css": "^1.4.0",
     "typescript": "~6.0.2",

frontend/pnpm-lock.yaml

@@ -120,6 +120,9 @@ importers:
       globals:
         specifier: ^17.5.0
         version: 17.6.0
+      prettier:
+        specifier: 3.8.2
+        version: 3.8.2
       rollup-plugin-visualizer:
         specifier: ^7.0.1
         version: 7.0.1(rolldown@1.0.1)
@@ -2145,6 +2148,11 @@ packages:
     resolution: {integrity: sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==}
     engines: {node: '>= 0.8.0'}
 
+  prettier@3.8.2:
+    resolution: {integrity: sha512-8c3mgTe0ASwWAJK+78dpviD+A8EqhndQPUBpNUIPt6+xWlIigCwfN01lWr9MAede4uqXGTEKeQWTvzb3vjia0Q==}
+    engines: {node: '>=14'}
+    hasBin: true
+
   property-information@7.1.0:
     resolution: {integrity: sha512-TwEZ+X+yCJmYfL7TPUOcvBZ4QfoT5YenQiJuX//0th53DE6w0xxLEtfK3iyryQFddXuvkIk51EEgrJQ0WJkOmQ==}
 
@@ -4650,6 +4658,8 @@ snapshots:
 
   prelude-ls@1.2.1: {}
 
+  prettier@3.8.2: {}
+
   property-information@7.1.0: {}
 
   proxy-from-env@2.1.0: {}

frontend/pnpm-workspace.yaml

@@ -1,3 +1,4 @@
 dangerouslyAllowAllBuilds: false
 blockExoticSubdeps: true
-minimumReleaseAge: 1440 # 1 day
+minimumReleaseAge: 1440 # 1 day
+trustPolicy: no-downgrade

gen/context_paths/context_paths.go

@@ -0,0 +1,131 @@
+// gen/context_paths generates the ignore paths for the user context since
+// gin will not less apply the middleware to only specific paths.
+//
+// The generator reads every controller and looks for the //context:ignore comment.
+// The format for the context ignore comment is:
+//
+// //contxt:ignore /api/mypath GET,POST
+package main
+
+import (
+	"bytes"
+	"fmt"
+	"go/format"
+	"os"
+	"strings"
+	"text/template"
+
+	_ "embed"
+
+	"golang.org/x/tools/go/packages"
+)
+
+//go:embed paths.tmpl
+var pathsTmplSrc string
+
+var pathsTmpl = template.Must(template.New("paths").Parse(pathsTmplSrc))
+
+func main() {
+	if err := run(); err != nil {
+		fmt.Printf("Failed to generate: %s", err.Error())
+		os.Exit(1)
+	}
+}
+
+func run() error {
+	// load pkg
+	pkgConfig := &packages.Config{
+		Mode: packages.NeedFiles,
+	}
+
+	pkgs, err := packages.Load(pkgConfig, "github.com/tinyauthapp/tinyauth/internal/controller")
+
+	if err != nil {
+		return fmt.Errorf("failed to load pkg: %w", err)
+	}
+
+	if len(pkgs) == 0 {
+		return fmt.Errorf("failed to get controllers package")
+	}
+
+	pkg := pkgs[0]
+
+	// for each file we check the comments and either add or remove the context
+	var contextIgnorePaths []string
+
+	for _, gofile := range pkg.GoFiles {
+		// read the file
+		file, err := os.ReadFile(gofile)
+
+		if err != nil {
+			fmt.Printf("Failed to read %s, ignoring", gofile)
+			continue
+		}
+
+		// get the comment lines
+		lines := strings.SplitSeq(string(file), "\n")
+
+		for line := range lines {
+			if !strings.HasPrefix(strings.TrimSpace(line), "//context:ignore") {
+				continue
+			}
+
+			path, methods, ok := parseContextIgnoreLine(line)
+
+			if !ok {
+				fmt.Printf("Failed to parse %s rule, ignore", line)
+				continue
+			}
+
+			for _, m := range methods {
+				contextIgnorePaths = append(contextIgnorePaths, m+" "+path)
+			}
+		}
+	}
+
+	// generate out
+	type tmplData struct {
+		IgnorePaths []string
+	}
+
+	var buf bytes.Buffer
+
+	if err := pathsTmpl.Execute(&buf, tmplData{
+		IgnorePaths: contextIgnorePaths,
+	}); err != nil {
+		return err
+	}
+
+	formatted, err := format.Source(buf.Bytes())
+
+	if err != nil {
+		return fmt.Errorf("gofmt failed: %w", err)
+	}
+
+	// write out
+	err = os.WriteFile("context_paths.go", formatted, 0666)
+
+	if err != nil {
+		return fmt.Errorf("failed to write out: %w", err)
+	}
+
+	return nil
+}
+
+func parseContextIgnoreLine(line string) (string, []string, bool) {
+	line = strings.TrimPrefix(line, "//context:ignore ")
+	path, methodStr, ok := strings.Cut(line, " ")
+	if !ok {
+		return "", []string{}, false
+	}
+	var methodsParsed []string
+	methodParts := strings.SplitSeq(methodStr, ",")
+	for m := range methodParts {
+		if strings.TrimSpace(m) == "" {
+			continue
+		}
+		m = strings.ToUpper(m)
+		methodsParsed = append(methodsParsed, m)
+	}
+	return path, methodsParsed, true
+}

gen/context_paths/paths.tmpl

@@ -0,0 +1,6 @@
+// Code generated by gen/context_paths. DO NOT EDIT.
+package middleware
+
+var contextSkipPathsPrefix = []string{
+{{range .IgnorePaths}}"{{.}}",
+{{end}}}

gen/docs/docs_gen.go

@@ -1,3 +1,9 @@
+// gen/docs generates the .env.example and config.gen.md
+// files for the configuration of Tinyauth. Run via:
+//
+// The generator reads the Tinyauth configuration package and using reflection it generates the
+// example files. The .env.example is used in this repo while the config.gen.md is used in the
+// documentaton alongside some warnings that are added later.
 package main
 
 import (

gen/docs/gen_env.go

@@ -20,7 +20,7 @@ type EnvEntry struct {
 }
 
 func generateExampleEnv() {
-	cfg := model.NewDefaultConfiguration(model.RuntimeEnvUnknown)
+	cfg := model.NewDefaultConfiguration()
 	entries := make([]EnvEntry, 0)
 
 	root := reflect.TypeOf(cfg).Elem()

gen/docs/gen_md.go

@@ -21,7 +21,7 @@ type MarkdownEntry struct {
 }
 
 func generateMarkdown() {
-	cfg := model.NewDefaultConfiguration(model.RuntimeEnvUnknown)
+	cfg := model.NewDefaultConfiguration()
 	entries := make([]MarkdownEntry, 0)
 
 	root := reflect.TypeOf(cfg).Elem()

gen/sqlc_wrapper/sqlc_wrapper.go

@@ -1,7 +1,5 @@
 // gen/sqlc_wrapper generates store.go wrapper files for each sqlc driver package under
-// internal/repository/<driver>/. Run via:
+// internal/repository/<driver>/.
-//
-//	go generate ./internal/repository/...
 //
 // The generator introspects *Queries methods and the model/params types in the
 // driver package, then emits a store.go that wraps *Queries so it satisfies
@@ -32,7 +30,7 @@ import (
 var storeSrc string
 
 func main() {
-	fmt.Println("sqlc_wrapper: generating store.go files for sqlc driver packages...")
+	fmt.Println("sqlc-wrapper: generating store.go files for sqlc driver packages...")
 	if err := run(); err != nil {
 		log.Fatal(err)
 	}

gen/sqlc_wrapper/store.tmpl

@@ -1,4 +1,4 @@
-// Code generated by cmd/gen/sqlc-wrapper. DO NOT EDIT.
+// Code generated by cmd/gen/sqlc_wrapper. DO NOT EDIT.
 package {{.PkgName}}
 
 import (

generate.go

@@ -1,3 +1,3 @@
-package tinyauth
+package docs
 
 //go:generate go run github.com/tinyauthapp/tinyauth/gen/docs

internal/bootstrap/app_bootstrap.go

@@ -279,7 +279,7 @@ func (app *BootstrapApp) Setup() error {
 	app.runtime.ConfiguredProviders = configuredProviders
 
 	// if tailscale is enabled and listening, replace the app url with the tailscale hostname
-	if app.services.tailscaleService != nil && app.config.Experimental.Tailscale.Listen {
+	if app.services.tailscaleService != nil && app.config.Tailscale.Listen {
 		tailscaleUrl := "https://" + app.services.tailscaleService.GetHostname()
 
 		// if the tailscale url is different from the app url, replace it

internal/bootstrap/router_bootstrap.go

@@ -130,9 +130,9 @@ func (app *BootstrapApp) setupRouter() error {
 // 2. Unix socket (if server.socketPath)
 // 3. HTTP - default
 func (app *BootstrapApp) getListenerFunc() (func(ctx context.Context) error, error) {
-	if app.config.Experimental.Tailscale.Listen {
+	if app.config.Tailscale.Listen {
 		if app.services.tailscaleService == nil {
-			return nil, fmt.Errorf("experimental.tailscale.listen is enabled but tailscale service is not initialized")
+			return nil, fmt.Errorf("tailscale.listen is enabled but tailscale service is not initialized")
 		}
 		return app.serveTailscale, nil
 	}
@@ -227,6 +227,7 @@ func (app *BootstrapApp) serve(listener net.Listener, server *http.Server, ctx c
 	err := server.Serve(listener)
 
 	if err != nil && !errors.Is(err, http.ErrServerClosed) {
+		shutdown()
 		return fmt.Errorf("failed to start %s listener: %w", name, err)
 	}
 

internal/controller/context_controller.go

@@ -147,6 +147,7 @@ func (controller *ContextController) userContextHandler(c *gin.Context) {
 	c.JSON(200, userContext)
 }
 
+//context:ignore /api/context/app GET
 func (controller *ContextController) appContextHandler(c *gin.Context) {
 	c.JSON(200, AppContextResponse{
 		Status:  200,

internal/controller/health_controller.go

@@ -23,6 +23,7 @@ func NewHealthController(i HealthControllerInput) *HealthController {
 	return controller
 }
 
+//context:ignore /api/healthz GET,HEAD
 func (controller *HealthController) healthHandler(c *gin.Context) {
 	c.JSON(200, gin.H{
 		"status":  200,

internal/controller/oauth_controller.go

@@ -54,6 +54,7 @@ func NewOAuthController(i OAuthControllerInput) *OAuthController {
 	return controller
 }
 
+//context:ignore /api/oauth/url GET
 func (controller *OAuthController) oauthURLHandler(c *gin.Context) {
 	var req OAuthRequest
 
@@ -118,6 +119,7 @@ func (controller *OAuthController) oauthURLHandler(c *gin.Context) {
 	})
 }
 
+//context:ignore /api/oauth/callback GET
 func (controller *OAuthController) oauthCallbackHandler(c *gin.Context) {
 	var req OAuthRequest
 

internal/controller/oidc_controller.go

@@ -367,6 +367,7 @@ func (controller *OIDCController) authorizeComplete(c *gin.Context) {
 	})
 }
 
+//context:ignore /api/oidc/token POST
 func (controller *OIDCController) Token(c *gin.Context) {
 	if controller.oidc == nil {
 		controller.log.App.Warn().Msg("Received OIDC request but OIDC server is not configured")
@@ -538,6 +539,7 @@ func (controller *OIDCController) Token(c *gin.Context) {
 	c.JSON(200, tokenResponse)
 }
 
+//context:ignore /api/oidc/userinfo GET,POST
 func (controller *OIDCController) Userinfo(c *gin.Context) {
 	if controller.oidc == nil {
 		controller.log.App.Warn().Msg("Received OIDC userinfo request but OIDC server is not configured")

internal/controller/resources_controller.go

@@ -33,6 +33,7 @@ func NewResourcesController(i ResourcesControllerInput) *ResourcesController {
 	return controller
 }
 
+//context:ignore /resources GET
 func (controller *ResourcesController) resourcesHandler(c *gin.Context) {
 	if controller.config.Resources.Path == "" {
 		c.JSON(404, gin.H{

internal/controller/user_controller.go

@@ -57,6 +57,7 @@ func NewUserController(i UserControllerInput) *UserController {
 	return controller
 }
 
+//context:ignore /api/user/login POST
 func (controller *UserController) loginHandler(c *gin.Context) {
 	var req LoginRequest
 

internal/controller/well_known_controller.go

@@ -65,6 +65,7 @@ func NewWellKnownController(i WellKnownControllerInput) *WellKnownController {
 	return controller
 }
 
+//context:ignore /.well-known/openid-configuration GET
 func (controller *WellKnownController) OpenIDConnectConfiguration(c *gin.Context) {
 	if controller.oidc == nil {
 		c.JSON(500, gin.H{
@@ -94,6 +95,7 @@ func (controller *WellKnownController) OpenIDConnectConfiguration(c *gin.Context
 	})
 }
 
+//context:ignore /.well-known/jwks.json GET
 func (controller *WellKnownController) JWKS(c *gin.Context) {
 	if controller.oidc == nil {
 		c.JSON(500, gin.H{
@@ -122,6 +124,7 @@ func (controller *WellKnownController) JWKS(c *gin.Context) {
 	c.Status(http.StatusOK)
 }
 
+//context:ignore /.well-known/webfinger GET
 func (controller *WellKnownController) WebFinger(c *gin.Context) {
 	c.Header("Content-Type", "application/jrd+json")
 	c.Header("Access-Control-Allow-Origin", "*")

internal/middleware/context_middleware.go

@@ -16,26 +16,6 @@ import (
 	"github.com/gin-gonic/gin"
 )
 
-// Gin won't let us set a middleware on a specific route (at least it doesn't work,
-// see https://github.com/gin-gonic/gin/issues/531) so we have to do some hackery
-var (
-	contextSkipPathsPrefix = []string{
-		"GET /api/context/app",
-		"GET /api/healthz",
-		"HEAD /api/healthz",
-		"GET /api/oauth/url",
-		"GET /api/oauth/callback",
-		"GET /api/oidc/clients",
-		"POST /api/oidc/token",
-		"GET /api/oidc/userinfo",
-		"POST /api/oidc/userinfo",
-		"GET /resources",
-		"POST /api/user/login",
-		"GET /.well-known/openid-configuration",
-		"GET /.well-known/jwks.json",
-	}
-)
-
 type ContextMiddleware struct {
 	log       *logger.Logger
 	runtime   *model.RuntimeConfig

internal/middleware/context_paths.go

@@ -0,0 +1,18 @@
+// Code generated by gen/context_paths. DO NOT EDIT.
+package middleware
+
+var contextSkipPathsPrefix = []string{
+	"GET /api/context/app",
+	"GET /api/healthz",
+	"HEAD /api/healthz",
+	"GET /api/oauth/url",
+	"GET /api/oauth/callback",
+	"POST /api/oidc/token",
+	"GET /api/oidc/userinfo",
+	"POST /api/oidc/userinfo",
+	"GET /resources",
+	"POST /api/user/login",
+	"GET /.well-known/openid-configuration",
+	"GET /.well-known/jwks.json",
+	"GET /.well-known/webfinger",
+}

internal/middleware/generate.go

@@ -0,0 +1,3 @@
+package middleware
+
+//go:generate go run github.com/tinyauthapp/tinyauth/gen/context_paths

internal/model/config.go

@@ -1,27 +1,8 @@
 package model
 
-import "os"
-
-type RuntimeEnv int
-
-const (
-	RuntimeEnvUnknown RuntimeEnv = iota
-	RuntimeEnvDocker
-)
-
-func DetectRuntimeEnv() RuntimeEnv {
-	env := os.Getenv("RUNTIME_ENV")
-	switch env {
-	case "docker":
-		return RuntimeEnvDocker
-	default:
-		return RuntimeEnvUnknown
-	}
-}
-
 // Default configuration
-func NewDefaultConfiguration(runtimeEnv RuntimeEnv) *Config {
+func NewDefaultConfiguration() *Config {
-	cfg := &Config{
+	return &Config{
 		Database: DatabaseConfig{
 			Driver: "sqlite",
 			Path:   "./tinyauth.db",
@@ -81,259 +62,246 @@ func NewDefaultConfiguration(runtimeEnv RuntimeEnv) *Config {
 			PrivateKeyPath: "./tinyauth_oidc_key",
 			PublicKeyPath:  "./tinyauth_oidc_key.pub",
 		},
-		Experimental: ExperimentalConfig{
+		Tailscale: TailscaleConfig{
-			Tailscale: TailscaleConfig{
+			Dir: "./tailscale_state",
-				Dir: "./tailscale_state",
-			},
 		},
 		LabelProvider: "auto",
 	}
-
-	// apply path overrides for docker runtime
-	if runtimeEnv == RuntimeEnvDocker {
-		cfg.Database.Path = "/data/tinyauth.db"
-		cfg.Resources.Path = "/data/resources"
-		cfg.OIDC.PrivateKeyPath = "/data/oidc/key.pem"
-		cfg.OIDC.PublicKeyPath = "/data/oidc/key.pub"
-		cfg.Experimental.Tailscale.Dir = "/data/tailscale"
-	}
-
-	return cfg
 }
 
 type Config struct {
-	AppURL        string             `description:"The base URL where the app is hosted." yaml:"appUrl,omitempty"`
+	AppURL        string             `description:"The base URL where the app is hosted." yaml:"appUrl"`
-	Database      DatabaseConfig     `description:"Database configuration." yaml:"database,omitempty"`
+	Database      DatabaseConfig     `description:"Database configuration." yaml:"database"`
-	Analytics     AnalyticsConfig    `description:"Analytics configuration." yaml:"analytics,omitempty"`
+	Analytics     AnalyticsConfig    `description:"Analytics configuration." yaml:"analytics"`
-	Resources     ResourcesConfig    `description:"Resources configuration." yaml:"resources,omitempty"`
+	Resources     ResourcesConfig    `description:"Resources configuration." yaml:"resources"`
-	Server        ServerConfig       `description:"Server configuration." yaml:"server,omitempty"`
+	Server        ServerConfig       `description:"Server configuration." yaml:"server"`
-	Auth          AuthConfig         `description:"Authentication configuration." yaml:"auth,omitempty"`
+	Auth          AuthConfig         `description:"Authentication configuration." yaml:"auth"`
-	Apps          map[string]App     `description:"Application ACLs configuration." yaml:"apps,omitempty"`
+	Apps          map[string]App     `description:"Application ACLs configuration." yaml:"apps"`
-	OAuth         OAuthConfig        `description:"OAuth configuration." yaml:"oauth,omitempty"`
+	OAuth         OAuthConfig        `description:"OAuth configuration." yaml:"oauth"`
-	OIDC          OIDCConfig         `description:"OIDC configuration." yaml:"oidc,omitempty"`
+	OIDC          OIDCConfig         `description:"OIDC configuration." yaml:"oidc"`
-	UI            UIConfig           `description:"UI customization." yaml:"ui,omitempty"`
+	UI            UIConfig           `description:"UI customization." yaml:"ui"`
-	LDAP          LDAPConfig         `description:"LDAP configuration." yaml:"ldap,omitempty"`
+	LDAP          LDAPConfig         `description:"LDAP configuration." yaml:"ldap"`
-	Experimental  ExperimentalConfig `description:"Experimental features, use with caution." yaml:"experimental,omitempty"`
+	Experimental  ExperimentalConfig `description:"Experimental features, use with caution." yaml:"experimental"`
-	LabelProvider string             `description:"Label provider to use for ACLs (auto, docker, kubernetes or none to disable). auto detects the environment." yaml:"labelProvider,omitempty"`
+	LabelProvider string             `description:"Label provider to use for ACLs (auto, docker, kubernetes or none to disable). auto detects the environment." yaml:"labelProvider"`
-	Log           LogConfig          `description:"Logging configuration." yaml:"log,omitempty"`
+	Log           LogConfig          `description:"Logging configuration." yaml:"log"`
+	Tailscale     TailscaleConfig    `description:"Tailscale configuration." yaml:"tailscale"`
 	ConfigFile    string             `description:"Path to config file." yaml:"-"`
 }
 
 type DatabaseConfig struct {
-	Driver string `description:"The database driver to use. Valid values: sqlite, postgres, memory." yaml:"driver,omitempty"`
+	Driver string `description:"The database driver to use. Valid values: sqlite, postgres, memory." yaml:"driver"`
-	Path   string `description:"The path to the SQLite database file, or connection URL when driver is postgres." yaml:"path,omitempty"`
+	Path   string `description:"The path to the SQLite database file, or connection URL when driver is postgres." yaml:"path"`
 }
 
 type AnalyticsConfig struct {
-	Enabled bool `description:"Enable periodic version information collection." yaml:"enabled,omitempty"`
+	Enabled bool `description:"Enable periodic version information collection." yaml:"enabled"`
 }
 
 type ResourcesConfig struct {
-	Enabled bool   `description:"Enable the resources server." yaml:"enabled,omitempty"`
+	Enabled bool   `description:"Enable the resources server." yaml:"enabled"`
-	Path    string `description:"The directory where resources are stored." yaml:"path,omitempty"`
+	Path    string `description:"The directory where resources are stored." yaml:"path"`
 }
 
 type ServerConfig struct {
-	Port       int    `description:"The port on which the server listens." yaml:"port,omitempty"`
+	Port       int    `description:"The port on which the server listens." yaml:"port"`
-	Address    string `description:"The address on which the server listens." yaml:"address,omitempty"`
+	Address    string `description:"The address on which the server listens." yaml:"address"`
-	SocketPath string `description:"The path to the Unix socket." yaml:"socketPath,omitempty"`
+	SocketPath string `description:"The path to the Unix socket." yaml:"socketPath"`
 }
 
 type AuthConfig struct {
-	IP                 IPConfig                  `description:"IP whitelisting config options." yaml:"ip,omitempty"`
+	IP                 IPConfig                  `description:"IP whitelisting config options." yaml:"ip"`
-	Users              []string                  `description:"Comma-separated list of users (username:hashed_password)." yaml:"users,omitempty"`
+	Users              []string                  `description:"Comma-separated list of users (username:hashed_password)." yaml:"users"`
-	SubdomainsEnabled  bool                      `description:"Enable subdomains support." yaml:"subdomainsEnabled,omitempty"`
+	SubdomainsEnabled  bool                      `description:"Enable subdomains support." yaml:"subdomainsEnabled"`
-	UserAttributes     map[string]UserAttributes `description:"Map of per-user OIDC attributes (username -> attributes)." yaml:"userAttributes,omitempty"`
+	UserAttributes     map[string]UserAttributes `description:"Map of per-user OIDC attributes (username -> attributes)." yaml:"userAttributes"`
-	UsersFile          string                    `description:"Path to the users file." yaml:"usersFile,omitempty"`
+	UsersFile          string                    `description:"Path to the users file." yaml:"usersFile"`
-	SecureCookie       bool                      `description:"Enable secure cookies." yaml:"secureCookie,omitempty"`
+	SecureCookie       bool                      `description:"Enable secure cookies." yaml:"secureCookie"`
-	SessionExpiry      int                       `description:"Session expiry time in seconds." yaml:"sessionExpiry,omitempty"`
+	SessionExpiry      int                       `description:"Session expiry time in seconds." yaml:"sessionExpiry"`
-	SessionMaxLifetime int                       `description:"Maximum session lifetime in seconds." yaml:"sessionMaxLifetime,omitempty"`
+	SessionMaxLifetime int                       `description:"Maximum session lifetime in seconds." yaml:"sessionMaxLifetime"`
-	LoginTimeout       int                       `description:"Login timeout in seconds." yaml:"loginTimeout,omitempty"`
+	LoginTimeout       int                       `description:"Login timeout in seconds." yaml:"loginTimeout"`
-	LoginMaxRetries    int                       `description:"Maximum login retries." yaml:"loginMaxRetries,omitempty"`
+	LoginMaxRetries    int                       `description:"Maximum login retries." yaml:"loginMaxRetries"`
-	LockdownEnabled    bool                      `description:"Enable lockdown mode after maximum login retries. Lockdown mode limit is calculated automatically." yaml:"lockdownEnabled,omitempty"`
+	LockdownEnabled    bool                      `description:"Enable lockdown mode after maximum login retries. Lockdown mode limit is calculated automatically." yaml:"lockdownEnabled"`
-	TrustedProxies     []string                  `description:"Comma-separated list of trusted proxy addresses." yaml:"trustedProxies,omitempty"`
+	TrustedProxies     []string                  `description:"Comma-separated list of trusted proxy addresses." yaml:"trustedProxies"`
-	ACLs               ACLsConfig                `description:"ACLs configuration." yaml:"acls,omitempty"`
+	ACLs               ACLsConfig                `description:"ACLs configuration." yaml:"acls"`
 }
 
 type UserAttributes struct {
-	Name        string       `description:"Full name of the user." yaml:"name,omitempty"`
+	Name        string       `description:"Full name of the user." yaml:"name"`
-	GivenName   string       `description:"Given (first) name of the user." yaml:"givenName,omitempty"`
+	GivenName   string       `description:"Given (first) name of the user." yaml:"givenName"`
-	FamilyName  string       `description:"Family (last) name of the user." yaml:"familyName,omitempty"`
+	FamilyName  string       `description:"Family (last) name of the user." yaml:"familyName"`
-	MiddleName  string       `description:"Middle name of the user." yaml:"middleName,omitempty"`
+	MiddleName  string       `description:"Middle name of the user." yaml:"middleName"`
-	Nickname    string       `description:"Nickname of the user." yaml:"nickname,omitempty"`
+	Nickname    string       `description:"Nickname of the user." yaml:"nickname"`
-	Profile     string       `description:"URL of the user's profile page." yaml:"profile,omitempty"`
+	Profile     string       `description:"URL of the user's profile page." yaml:"profile"`
-	Picture     string       `description:"URL of the user's profile picture." yaml:"picture,omitempty"`
+	Picture     string       `description:"URL of the user's profile picture." yaml:"picture"`
-	Website     string       `description:"URL of the user's website." yaml:"website,omitempty"`
+	Website     string       `description:"URL of the user's website." yaml:"website"`
-	Email       string       `description:"Email address of the user." yaml:"email,omitempty"`
+	Email       string       `description:"Email address of the user." yaml:"email"`
-	Gender      string       `description:"Gender of the user." yaml:"gender,omitempty"`
+	Gender      string       `description:"Gender of the user." yaml:"gender"`
-	Birthdate   string       `description:"Birthdate of the user (YYYY-MM-DD)." yaml:"birthdate,omitempty"`
+	Birthdate   string       `description:"Birthdate of the user (YYYY-MM-DD)." yaml:"birthdate"`
-	Zoneinfo    string       `description:"Time zone of the user (e.g. Europe/Athens)." yaml:"zoneinfo,omitempty"`
+	Zoneinfo    string       `description:"Time zone of the user (e.g. Europe/Athens)." yaml:"zoneinfo"`
-	Locale      string       `description:"Locale of the user (e.g. en-US)." yaml:"locale,omitempty"`
+	Locale      string       `description:"Locale of the user (e.g. en-US)." yaml:"locale"`
-	PhoneNumber string       `description:"Phone number of the user." yaml:"phoneNumber,omitempty"`
+	PhoneNumber string       `description:"Phone number of the user." yaml:"phoneNumber"`
-	Address     AddressClaim `description:"Address of the user." yaml:"address,omitempty"`
+	Address     AddressClaim `description:"Address of the user." yaml:"address"`
 }
 
 type AddressClaim struct {
-	Formatted     string `description:"Full mailing address, formatted for display." yaml:"formatted,omitempty" json:"formatted,omitempty"`
+	Formatted     string `description:"Full mailing address, formatted for display." yaml:"formatted" json:"formatted,omitempty"`
-	StreetAddress string `description:"Street address." yaml:"streetAddress,omitempty" json:"street_address,omitempty"`
+	StreetAddress string `description:"Street address." yaml:"streetAddress" json:"street_address,omitempty"`
-	Locality      string `description:"City or locality." yaml:"locality,omitempty" json:"locality,omitempty"`
+	Locality      string `description:"City or locality." yaml:"locality" json:"locality,omitempty"`
-	Region        string `description:"State, province, or region." yaml:"region,omitempty" json:"region,omitempty"`
+	Region        string `description:"State, province, or region." yaml:"region" json:"region,omitempty"`
-	PostalCode    string `description:"Zip or postal code." yaml:"postalCode,omitempty" json:"postal_code,omitempty"`
+	PostalCode    string `description:"Zip or postal code." yaml:"postalCode" json:"postal_code,omitempty"`
-	Country       string `description:"Country." yaml:"country,omitempty" json:"country,omitempty"`
+	Country       string `description:"Country." yaml:"country" json:"country,omitempty"`
 }
 
 type IPConfig struct {
-	Allow  []string `description:"List of allowed IPs or CIDR ranges." yaml:"allow,omitempty"`
+	Allow  []string `description:"List of allowed IPs or CIDR ranges." yaml:"allow"`
-	Block  []string `description:"List of blocked IPs or CIDR ranges." yaml:"block,omitempty"`
+	Block  []string `description:"List of blocked IPs or CIDR ranges." yaml:"block"`
-	Bypass []string `description:"List of IPs or CIDR ranges that bypass authentication entirely." yaml:"bypass,omitempty"`
+	Bypass []string `description:"List of IPs or CIDR ranges that bypass authentication entirely." yaml:"bypass"`
 }
 
 type OAuthConfig struct {
-	Whitelist     []string                      `description:"Comma-separated list of allowed OAuth domains." yaml:"whitelist,omitempty"`
+	Whitelist     []string                      `description:"Comma-separated list of allowed OAuth domains." yaml:"whitelist"`
-	WhitelistFile string                        `description:"Path to the OAuth whitelist file." yaml:"whitelistFile,omitempty"`
+	WhitelistFile string                        `description:"Path to the OAuth whitelist file." yaml:"whitelistFile"`
-	AutoRedirect  string                        `description:"The OAuth provider to use for automatic redirection." yaml:"autoRedirect,omitempty"`
+	AutoRedirect  string                        `description:"The OAuth provider to use for automatic redirection." yaml:"autoRedirect"`
-	Providers     map[string]OAuthServiceConfig `description:"OAuth providers configuration." yaml:"providers,omitempty"`
+	Providers     map[string]OAuthServiceConfig `description:"OAuth providers configuration." yaml:"providers"`
 }
 
 type OIDCConfig struct {
-	PrivateKeyPath string                      `description:"Path to the private key file, including file name." yaml:"privateKeyPath,omitempty"`
+	PrivateKeyPath string                      `description:"Path to the private key file, including file name." yaml:"privateKeyPath"`
-	PublicKeyPath  string                      `description:"Path to the public key file, including file name." yaml:"publicKeyPath,omitempty"`
+	PublicKeyPath  string                      `description:"Path to the public key file, including file name." yaml:"publicKeyPath"`
-	Clients        map[string]OIDCClientConfig `description:"OIDC clients configuration." yaml:"clients,omitempty"`
+	Clients        map[string]OIDCClientConfig `description:"OIDC clients configuration." yaml:"clients"`
 }
 
 type UIConfig struct {
-	Title                 string `description:"The title of the UI." yaml:"title,omitempty"`
+	Title                 string `description:"The title of the UI." yaml:"title"`
-	ForgotPasswordMessage string `description:"Message displayed on the forgot password page." yaml:"forgotPasswordMessage,omitempty"`
+	ForgotPasswordMessage string `description:"Message displayed on the forgot password page." yaml:"forgotPasswordMessage"`
-	BackgroundImage       string `description:"Path to the background image." yaml:"backgroundImage,omitempty"`
+	BackgroundImage       string `description:"Path to the background image." yaml:"backgroundImage"`
-	WarningsEnabled       bool   `description:"Enable UI warnings." yaml:"warningsEnabled,omitempty"`
+	WarningsEnabled       bool   `description:"Enable UI warnings." yaml:"warningsEnabled"`
 }
 
 type LDAPConfig struct {
-	Address          string `description:"LDAP server address." yaml:"address,omitempty"`
+	Address          string `description:"LDAP server address." yaml:"address"`
-	BindDN           string `description:"Bind DN for LDAP authentication." yaml:"bindDn,omitempty"`
+	BindDN           string `description:"Bind DN for LDAP authentication." yaml:"bindDn"`
-	BindPassword     string `description:"Bind password for LDAP authentication." yaml:"bindPassword,omitempty"`
+	BindPassword     string `description:"Bind password for LDAP authentication." yaml:"bindPassword"`
-	BindPasswordFile string `description:"Path to the Bind password." yaml:"bindPasswordFile,omitempty"`
+	BindPasswordFile string `description:"Path to the Bind password." yaml:"bindPasswordFile"`
-	BaseDN           string `description:"Base DN for LDAP searches." yaml:"baseDn,omitempty"`
+	BaseDN           string `description:"Base DN for LDAP searches." yaml:"baseDn"`
-	Insecure         bool   `description:"Allow insecure LDAP connections." yaml:"insecure,omitempty"`
+	Insecure         bool   `description:"Allow insecure LDAP connections." yaml:"insecure"`
-	SearchFilter     string `description:"LDAP search filter." yaml:"searchFilter,omitempty"`
+	SearchFilter     string `description:"LDAP search filter." yaml:"searchFilter"`
-	AuthCert         string `description:"Certificate for mTLS authentication." yaml:"authCert,omitempty"`
+	AuthCert         string `description:"Certificate for mTLS authentication." yaml:"authCert"`
-	AuthKey          string `description:"Certificate key for mTLS authentication." yaml:"authKey,omitempty"`
+	AuthKey          string `description:"Certificate key for mTLS authentication." yaml:"authKey"`
-	GroupCacheTTL    int    `description:"Cache duration for LDAP group membership in seconds." yaml:"groupCacheTTL,omitempty"`
+	GroupCacheTTL    int    `description:"Cache duration for LDAP group membership in seconds." yaml:"groupCacheTTL"`
 }
 
 type LogConfig struct {
-	Level   string     `description:"Log level (trace, debug, info, warn, error)." yaml:"level,omitempty"`
+	Level   string     `description:"Log level (trace, debug, info, warn, error)." yaml:"level"`
-	Json    bool       `description:"Enable JSON formatted logs." yaml:"json,omitempty"`
+	Json    bool       `description:"Enable JSON formatted logs." yaml:"json"`
-	Streams LogStreams `description:"Configuration for specific log streams." yaml:"streams,omitempty"`
+	Streams LogStreams `description:"Configuration for specific log streams." yaml:"streams"`
 }
 
 type LogStreams struct {
-	HTTP  LogStreamConfig `description:"HTTP request logging." yaml:"http,omitempty"`
+	HTTP  LogStreamConfig `description:"HTTP request logging." yaml:"http"`
-	App   LogStreamConfig `description:"Application logging." yaml:"app,omitempty"`
+	App   LogStreamConfig `description:"Application logging." yaml:"app"`
-	Audit LogStreamConfig `description:"Audit logging." yaml:"audit,omitempty"`
+	Audit LogStreamConfig `description:"Audit logging." yaml:"audit"`
 }
 
 type LogStreamConfig struct {
-	Enabled bool   `description:"Enable this log stream." yaml:"enabled,omitempty"`
+	Enabled bool   `description:"Enable this log stream." yaml:"enabled"`
-	Level   string `description:"Log level for this stream. Use global if empty." yaml:"level,omitempty"`
+	Level   string `description:"Log level for this stream. Use global if empty." yaml:"level"`
 }
 
-type ExperimentalConfig struct {
+// no experimental features
-	Tailscale TailscaleConfig `description:"Tailscale configuration." yaml:"tailscale"`
+type ExperimentalConfig struct{}
-}
 
 type TailscaleConfig struct {
-	Enabled   bool   `description:"Enable Tailscale integration." yaml:"enabled,omitempty"`
+	Enabled   bool   `description:"Enable Tailscale integration." yaml:"enabled"`
-	Dir       string `description:"Tailscale state directory." yaml:"dir,omitempty"`
+	Dir       string `description:"Tailscale state directory." yaml:"dir"`
-	Hostname  string `description:"Tailscale hostname." yaml:"hostname,omitempty"`
+	Hostname  string `description:"Tailscale hostname." yaml:"hostname"`
-	AuthKey   string `description:"Tailscale auth key." yaml:"authKey,omitempty"`
+	AuthKey   string `description:"Tailscale auth key." yaml:"authKey"`
-	Ephemeral bool   `description:"Use ephemeral Tailscale node." yaml:"ephemeral,omitempty"`
+	Ephemeral bool   `description:"Use ephemeral Tailscale node." yaml:"ephemeral"`
-	Funnel    bool   `description:"Enable Tailscale Funnel." yaml:"funnel,omitempty"`
+	Funnel    bool   `description:"Enable Tailscale Funnel." yaml:"funnel"`
-	Listen    bool   `description:"Listen on the Tailscale address instead of standard address." yaml:"listen,omitempty"`
+	Listen    bool   `description:"Listen on the Tailscale address instead of standard address." yaml:"listen"`
 }
 
 // OAuth/OIDC config
 
 type OAuthServiceConfig struct {
-	ClientID         string   `description:"OAuth client ID." yaml:"clientId,omitempty"`
+	ClientID         string   `description:"OAuth client ID." yaml:"clientId"`
-	ClientSecret     string   `description:"OAuth client secret." yaml:"clientSecret,omitempty"`
+	ClientSecret     string   `description:"OAuth client secret." yaml:"clientSecret"`
-	ClientSecretFile string   `description:"Path to the file containing the OAuth client secret." yaml:"clientSecretFile,omitempty"`
+	ClientSecretFile string   `description:"Path to the file containing the OAuth client secret." yaml:"clientSecretFile"`
-	Whitelist        []string `description:"Comma-separated list of allowed OAuth domains for this provider." yaml:"whitelist,omitempty"`
+	Whitelist        []string `description:"Comma-separated list of allowed OAuth domains for this provider." yaml:"whitelist"`
-	WhitelistFile    string   `description:"Path to the OAuth whitelist file for this provider." yaml:"whitelistFile,omitempty"`
+	WhitelistFile    string   `description:"Path to the OAuth whitelist file for this provider." yaml:"whitelistFile"`
-	Scopes           []string `description:"OAuth scopes." yaml:"scopes,omitempty"`
+	Scopes           []string `description:"OAuth scopes." yaml:"scopes"`
-	RedirectURL      string   `description:"OAuth redirect URL." yaml:"redirectUrl,omitempty"`
+	RedirectURL      string   `description:"OAuth redirect URL." yaml:"redirectUrl"`
-	AuthURL          string   `description:"OAuth authorization URL." yaml:"authUrl,omitempty"`
+	AuthURL          string   `description:"OAuth authorization URL." yaml:"authUrl"`
-	TokenURL         string   `description:"OAuth token URL." yaml:"tokenUrl,omitempty"`
+	TokenURL         string   `description:"OAuth token URL." yaml:"tokenUrl"`
-	UserinfoURL      string   `description:"OAuth userinfo URL." yaml:"userinfoUrl,omitempty"`
+	UserinfoURL      string   `description:"OAuth userinfo URL." yaml:"userinfoUrl"`
-	Insecure         bool     `description:"Allow insecure OAuth connections." yaml:"insecure,omitempty"`
+	Insecure         bool     `description:"Allow insecure OAuth connections." yaml:"insecure"`
-	Name             string   `description:"Provider name in UI." yaml:"name,omitempty"`
+	Name             string   `description:"Provider name in UI." yaml:"name"`
 }
 
 type OIDCClientConfig struct {
 	ID                  string   `description:"OIDC client ID." yaml:"-"`
-	ClientID            string   `description:"OIDC client ID." yaml:"clientId,omitempty"`
+	ClientID            string   `description:"OIDC client ID." yaml:"clientId"`
-	ClientSecret        string   `description:"OIDC client secret." yaml:"clientSecret,omitempty"`
+	ClientSecret        string   `description:"OIDC client secret." yaml:"clientSecret"`
-	ClientSecretFile    string   `description:"Path to the file containing the OIDC client secret." yaml:"clientSecretFile,omitempty"`
+	ClientSecretFile    string   `description:"Path to the file containing the OIDC client secret." yaml:"clientSecretFile"`
-	TrustedRedirectURIs []string `description:"List of trusted redirect URIs." yaml:"trustedRedirectUris,omitempty"`
+	TrustedRedirectURIs []string `description:"List of trusted redirect URIs." yaml:"trustedRedirectUris"`
-	Name                string   `description:"Client name in UI." yaml:"name,omitempty"`
+	Name                string   `description:"Client name in UI." yaml:"name"`
 }
 
 type ACLsConfig struct {
-	Policy string `description:"ACL policy for allow-by-default or deny-by-default, available options are allow and deny, default is allow." yaml:"policy,omitempty"`
+	Policy string `description:"ACL policy for allow-by-default or deny-by-default, available options are allow and deny, default is allow." yaml:"policy"`
 }
 
 // ACLs
 
 type Apps struct {
-	Apps map[string]App `description:"App ACLs configuration." yaml:"apps,omitempty"`
+	Apps map[string]App `description:"App ACLs configuration." yaml:"apps"`
 }
 
 type App struct {
-	Config   AppConfig   `description:"App configuration." yaml:"config,omitempty"`
+	Config   AppConfig   `description:"App configuration." yaml:"config"`
-	Users    AppUsers    `description:"User access configuration." yaml:"users,omitempty"`
+	Users    AppUsers    `description:"User access configuration." yaml:"users"`
-	OAuth    AppOAuth    `description:"OAuth access configuration." yaml:"oauth,omitempty"`
+	OAuth    AppOAuth    `description:"OAuth access configuration." yaml:"oauth"`
-	IP       AppIP       `description:"IP access configuration." yaml:"ip,omitempty"`
+	IP       AppIP       `description:"IP access configuration." yaml:"ip"`
-	Response AppResponse `description:"Response customization." yaml:"response,omitempty"`
+	Response AppResponse `description:"Response customization." yaml:"response"`
-	Path     AppPath     `description:"Path access configuration." yaml:"path,omitempty"`
+	Path     AppPath     `description:"Path access configuration." yaml:"path"`
-	LDAP     AppLDAP     `description:"LDAP access configuration." yaml:"ldap,omitempty"`
+	LDAP     AppLDAP     `description:"LDAP access configuration." yaml:"ldap"`
 }
 
 type AppConfig struct {
-	Domain string `description:"The domain of the app." yaml:"domain,omitempty"`
+	Domain string `description:"The domain of the app." yaml:"domain"`
 }
 
 type AppUsers struct {
-	Allow string `description:"Comma-separated list of allowed users." yaml:"allow,omitempty"`
+	Allow string `description:"Comma-separated list of allowed users." yaml:"allow"`
-	Block string `description:"Comma-separated list of blocked users." yaml:"block,omitempty"`
+	Block string `description:"Comma-separated list of blocked users." yaml:"block"`
 }
 
 type AppOAuth struct {
-	Whitelist string `description:"Comma-separated list of allowed OAuth groups." yaml:"whitelist,omitempty"`
+	Whitelist string `description:"Comma-separated list of allowed OAuth groups." yaml:"whitelist"`
-	Groups    string `description:"Comma-separated list of required OAuth groups." yaml:"groups,omitempty"`
+	Groups    string `description:"Comma-separated list of required OAuth groups." yaml:"groups"`
 }
 
 type AppLDAP struct {
-	Groups string `description:"Comma-separated list of required LDAP groups." yaml:"groups,omitempty"`
+	Groups string `description:"Comma-separated list of required LDAP groups." yaml:"groups"`
 }
 
 type AppIP struct {
-	Allow  []string `description:"List of allowed IPs or CIDR ranges." yaml:"allow,omitempty"`
+	Allow  []string `description:"List of allowed IPs or CIDR ranges." yaml:"allow"`
-	Block  []string `description:"List of blocked IPs or CIDR ranges." yaml:"block,omitempty"`
+	Block  []string `description:"List of blocked IPs or CIDR ranges." yaml:"block"`
-	Bypass []string `description:"List of IPs or CIDR ranges that bypass authentication." yaml:"bypass,omitempty"`
+	Bypass []string `description:"List of IPs or CIDR ranges that bypass authentication." yaml:"bypass"`
 }
 
 type AppResponse struct {
-	Headers   []string     `description:"Custom headers to add to the response." yaml:"headers,omitempty"`
+	Headers   []string     `description:"Custom headers to add to the response." yaml:"headers"`
-	BasicAuth AppBasicAuth `description:"Basic authentication for the app." yaml:"basicAuth,omitempty"`
+	BasicAuth AppBasicAuth `description:"Basic authentication for the app." yaml:"basicAuth"`
 }
 
 type AppBasicAuth struct {
-	Username     string `description:"Basic auth username." yaml:"username,omitempty"`
+	Username     string `description:"Basic auth username." yaml:"username"`
-	Password     string `description:"Basic auth password." yaml:"password,omitempty"`
+	Password     string `description:"Basic auth password." yaml:"password"`
-	PasswordFile string `description:"Path to the file containing the basic auth password." yaml:"passwordFile,omitempty"`
+	PasswordFile string `description:"Path to the file containing the basic auth password." yaml:"passwordFile"`
 }
 
 type AppPath struct {
-	Allow string `description:"Comma-separated list of allowed paths." yaml:"allow,omitempty"`
+	Allow string `description:"Comma-separated list of allowed paths." yaml:"allow"`
-	Block string `description:"Comma-separated list of blocked paths." yaml:"block,omitempty"`
+	Block string `description:"Comma-separated list of blocked paths." yaml:"block"`
 }

internal/repository/postgres/store.go

@@ -1,4 +1,4 @@
-// Code generated by cmd/gen/sqlc-wrapper. DO NOT EDIT.
+// Code generated by cmd/gen/sqlc_wrapper. DO NOT EDIT.
 package postgres
 
 import (

internal/repository/sqlite/store.go

@@ -1,4 +1,4 @@
-// Code generated by cmd/gen/sqlc-wrapper. DO NOT EDIT.
+// Code generated by cmd/gen/sqlc_wrapper. DO NOT EDIT.
 package sqlite
 
 import (

internal/service/tailscale_service.go

@@ -45,17 +45,17 @@ type TailscaleServiceInput struct {
 }
 
 func NewTailscaleService(i TailscaleServiceInput) (*TailscaleService, error) {
-	if !i.Config.Experimental.Tailscale.Enabled {
+	if !i.Config.Tailscale.Enabled {
 		return nil, nil
 	}
 
 	srv := new(tsnet.Server)
 
 	// node options
-	srv.Dir = i.Config.Experimental.Tailscale.Dir
+	srv.Dir = i.Config.Tailscale.Dir
-	srv.Hostname = i.Config.Experimental.Tailscale.Hostname
+	srv.Hostname = i.Config.Tailscale.Hostname
-	srv.AuthKey = i.Config.Experimental.Tailscale.AuthKey
+	srv.AuthKey = i.Config.Tailscale.AuthKey
-	srv.Ephemeral = i.Config.Experimental.Tailscale.Ephemeral
+	srv.Ephemeral = i.Config.Tailscale.Ephemeral
 
 	// redirect logs to zerolog
 	srv.Logf = i.Log.App.Printf
@@ -94,7 +94,7 @@ func NewTailscaleService(i TailscaleServiceInput) (*TailscaleService, error) {
 
 	i.Ding.Go(service.watchAndClose, ding.RingMajor)
 
-	if i.Config.Experimental.Tailscale.Funnel && !i.Config.Experimental.Tailscale.Listen {
+	if i.Config.Tailscale.Funnel && !i.Config.Tailscale.Listen {
 		service.log.App.Warn().Msg("Tailscale Funnel is enabled but listen is disabled. Funnel will not work without listen enabled.")
 	}
 
@@ -153,7 +153,7 @@ func (ts *TailscaleService) CreateListener() (net.Listener, error) {
 		return *ts.ln, nil
 	}
 
-	if ts.config.Experimental.Tailscale.Funnel {
+	if ts.config.Tailscale.Funnel {
 		ln, err := ts.srv.ListenFunnel("tcp", ":443")
 		if err != nil {
 			return nil, err