httpserver

func HealthOnly ¶

func HealthOnly(health HealthCheck, logger *slog.Logger) http.Handler

HealthOnly is the handler of pure worker/scheduler modes: the port serves nothing but /api/v1/health (instance-config §6.1 step 6).

func New ¶

func New(port int, handler http.Handler) *http.Server

New builds the HTTP server for the given port and handler.

func SecurityHeaders ¶

func SecurityHeaders(hsts bool) func(http.Handler) http.Handler

SecurityHeaders hardens every response of the single control-plane port: the dashboard, /auth, the API and /metrics all pass through here.

The policy is written for the dashboard (the only HTML this port serves) and is harmless on JSON: a Content-Security-Policy on an API response constrains nothing — unless a bug ever makes the API reflect HTML, at which point it is exactly the net we want under it.

hsts is derived from the instance FQDN being set, like the Secure cookie flag: promising browsers "always HTTPS" on a plain-HTTP instance would lock the operator out of their own dashboard for the header's max-age.