Critical fixes:
- Fix Dockerfile: reorder stages so frontend assets embed into Go binary
- Fix Go version 1.25 (nonexistent) to 1.24 across Dockerfile, go.mod, CI
- Add graceful game server shutdown on SIGTERM/SIGINT
- Order startup tasks: updates complete before auto-start
- Fix TOCTOU race in UpdateSettings with atomic Update() method
Security:
- Add optional AUTH_TOKEN bearer auth middleware on API/WS routes
- Fix path traversal in DeleteMod using filepath.Rel instead of HasPrefix
- Add input validation for IPPort, ServerParameters, ScheduledUpdate
Memory safety:
- Cap RPT buffer allocation to 64KB to prevent OOM on large logs
- Cap GetLog file read to 10MB
- Fix context cancel leak in SteamCmdManager.run()
- Remove data-raced cancel field in steamcmd.go
- Atomic file writes (write-temp-then-rename) across all managers
Reliability:
- Log save errors in ProcessManager.Stop()
- Atomic file writes prevent corruption on crash
Tests:
- Add mod_manager_test.go (12 tests: ListWorkshopMods, ListLocalMods,
BuildUsageMap, RemoveMod, dirSize)
- Add scheduler_test.go (6 tests: Start/Stop, Refresh with empty,
invalid, valid, and replaced cron expressions)
- Add TestRestart to server_process_test.go
CI/Docs:
- Add -race flag to go test in CI and Makefile
- Add npm lint step to CI
- Add Go/npm module caching to CI
- Update README: prerequisites, AUTH_TOKEN/GIN_MODE/SERVERS_DIR docs,
fix manual quickstart to use make build
- Add winePath helper that prepends Z: when platform is windows on Linux
- Thread platform through buildModPath, buildAutoArgs, and Start()
- Apply Z: prefix to -config=, -mod=, -profiles=, and %command% binary paths
- Add tests for winePath, buildAutoArgs, and buildModPath with platform param
- Fix formatting across services package with gofmt
- Include all prior bug fixes from this branch
- Go binary defaults DATA_DIR=./data, SERVERFILE_DIR=./serverfiles
(relative to cwd) — just copy the binary and run
- MODS_DIR, CFG_DIR, PROFILES_DIR are derived from SERVERFILE_DIR
- Removed DEV_DEPLOY_DIR indirection (was only used for development)
- Makefile expands defaults to ../dev-deploy/... directly for dev
- FileFromFS with http.FS(embedFS) returned 301 redirects due to
Gin setting c.Request.URL.Path to a relative path for http.FileServer
- Replace with direct fs.ReadFile + Gin c.Data, determining content
type via mime.TypeByExtension
- Supports all asset types (JS, CSS, SVG, HTML) and SPA fallback
- New backend/embed package embeds frontend dist/ via //go:embed
- Go binary serves frontend from embedded FS (no external files needed)
- Dev mode uses placeholder dir (dev.txt) so Go compiles; Vite handles
frontend in dev mode
- Makefile copies frontend/dist/ to backend/embed/dist/ during build
- Removed FRONTEND_DIR env var and filesystem serving fallback
- Removed frontend path from Health API response and Status page frontend
section (only Served boolean remains)
- Removed frontendDir from Handler struct/constructor (unused)
Backend:
- New /api/server/health endpoint returning server, paths, disk,
mods, steamcmd, and frontend status
- Health endpoint checks directory existence/writability, disk usage,
server binary, and frontend dist availability
Frontend:
- New Status page (route /status) with sections for Server, SteamCMD,
Mods, Frontend, Directories (with exists/writable badges), and
Disk Usage (with size formatting and used-percent coloring)
- Paths are clickable to copy and use start-truncation (ellipsis on
the left) with native hover tooltip
- Health API client integration with 10s auto-refresh
Misc:
- Update .gitignore and Makefile, minor Layout nav addition
MrFastwind