Critical fixes:
- Fix Dockerfile: reorder stages so frontend assets embed into Go binary
- Fix Go version 1.25 (nonexistent) to 1.24 across Dockerfile, go.mod, CI
- Add graceful game server shutdown on SIGTERM/SIGINT
- Order startup tasks: updates complete before auto-start
- Fix TOCTOU race in UpdateSettings with atomic Update() method
Security:
- Add optional AUTH_TOKEN bearer auth middleware on API/WS routes
- Fix path traversal in DeleteMod using filepath.Rel instead of HasPrefix
- Add input validation for IPPort, ServerParameters, ScheduledUpdate
Memory safety:
- Cap RPT buffer allocation to 64KB to prevent OOM on large logs
- Cap GetLog file read to 10MB
- Fix context cancel leak in SteamCmdManager.run()
- Remove data-raced cancel field in steamcmd.go
- Atomic file writes (write-temp-then-rename) across all managers
Reliability:
- Log save errors in ProcessManager.Stop()
- Atomic file writes prevent corruption on crash
Tests:
- Add mod_manager_test.go (12 tests: ListWorkshopMods, ListLocalMods,
BuildUsageMap, RemoveMod, dirSize)
- Add scheduler_test.go (6 tests: Start/Stop, Refresh with empty,
invalid, valid, and replaced cron expressions)
- Add TestRestart to server_process_test.go
CI/Docs:
- Add -race flag to go test in CI and Makefile
- Add npm lint step to CI
- Add Go/npm module caching to CI
- Update README: prerequisites, AUTH_TOKEN/GIN_MODE/SERVERS_DIR docs,
fix manual quickstart to use make build
- Fix Subscribe overwriting channel without closing old one (goroutine leak)
- Add context.Context to Stream() for cancellation support
- Add WebSocket read pump to detect dead clients (StreamLogs, StreamSteamCMDLogs, StreamRPTLogs)
- Use defer f.Close() pattern in StreamRPTLogs file handling
- Fix findLatestRPT nil dereference on failed os.Stat
- Optimize findLatestRPT to collect stat results before sorting
- Apply gofmt formatting to modlists.go, settings.go
- Add winePath helper that prepends Z: when platform is windows on Linux
- Thread platform through buildModPath, buildAutoArgs, and Start()
- Apply Z: prefix to -config=, -mod=, -profiles=, and %command% binary paths
- Add tests for winePath, buildAutoArgs, and buildModPath with platform param
- Fix formatting across services package with gofmt
- Include all prior bug fixes from this branch
- New backend/embed package embeds frontend dist/ via //go:embed
- Go binary serves frontend from embedded FS (no external files needed)
- Dev mode uses placeholder dir (dev.txt) so Go compiles; Vite handles
frontend in dev mode
- Makefile copies frontend/dist/ to backend/embed/dist/ during build
- Removed FRONTEND_DIR env var and filesystem serving fallback
- Removed frontend path from Health API response and Status page frontend
section (only Served boolean remains)
- Removed frontendDir from Handler struct/constructor (unused)
Backend:
- New /api/server/health endpoint returning server, paths, disk,
mods, steamcmd, and frontend status
- Health endpoint checks directory existence/writability, disk usage,
server binary, and frontend dist availability
Frontend:
- New Status page (route /status) with sections for Server, SteamCMD,
Mods, Frontend, Directories (with exists/writable badges), and
Disk Usage (with size formatting and used-percent coloring)
- Paths are clickable to copy and use start-truncation (ellipsis on
the left) with native hover tooltip
- Health API client integration with 10s auto-refresh
Misc:
- Update .gitignore and Makefile, minor Layout nav addition
- RenderModlistHTML: generates compatible preset HTML from a modlist
- GET /api/modlists/:id/export: returns downloadable .html file
- Export button on ModlistEditor page
- Skips local mods (no workshop ID), includes only Steam workshop mods
MrFastwind