Added the HTTP server and serve command, with proxy, CSRF, TLS and security header config; wsserve is now ws serve, alongside a new ws dial

The serve command runs internal/server: the API under /api (health, and
the CSRF token endpoint) and the WebSocket hub under /ws, over HTTP or TLS,
with an optional HTTP to HTTPS redirect, the PROXY protocol from trusted
sources and a graceful shutdown that closes WebSockets first. Its middleware
covers the client IP behind trusted proxies, request IDs, request logging,
panic recovery, global and API rate limits, Host and body size checks,
security response headers, compression, CSRF protection (cross-origin
checks and signed double-submit tokens) and JSON-only API bodies. Middleware
that logs takes a WithLogger option.

New server config sections: proxy, csrf, tls, headers and frontend (not
used yet), plus max_header_bytes, max_body_bytes, global and API rate limits
and HTTP read, write and idle timeouts. Every setting documents what 0 or
empty means, and internal/config/README.md is reorganised by section.
server.timeouts.read_header must be greater than 0, and a header or idle
timeout of 0 means no limit rather than the read timeout.

WebSocket upgrades are protected by the Origin check: the server's own
origin, or one of csrf.cross_origin_protection.trusted_origins, which the
hub now takes with WithTrustedOrigins.

wsserve becomes "ws serve". "ws dial" opens a WebSocket on /ws to test it:
--ping sends a ping and waits for the pong, --message sends messages and
prints the replies, --origin tests the Origin check, and with neither
--ping nor --message each line of stdin is sent until Ctrl+C.

internal/config/README.md

@@ -23,47 +23,195 @@ environment variables, merged through [Viper](https://github.com/spf13/viper).
    previous value is kept.
 
 When more than one place sets a key, environment variables win over the
-config file, which wins over the defaults. A `debug` or `error` log level
-already set on `conf` before `Init` (from the `--debug` and `--quiet` flags)
-is kept.
+config file, which wins over the defaults.
 
 
-## Keys
+## Configuration Keys
+
+Configuration is managed in sections:
+
+| Key | Section description |
+|---|---|
+| `logging` | Paths to log files and log level control |
+| `database` | Database connection/file details |
+| `sources` | Opportunity source settings |
+| `server` | Server configuration including CSRF protection, Websockets, Proxy handling and rate limits |
+
+### Logging
 
 | Key | Type | Default | Notes |
 |---|---|---|---|
 | `logging.level` | string | `warn` | One of `debug`, `info`, `warn`, `error` |
-| `logging.file` | string | | Log file for `fetch service` (unless `--foreground`); other commands log to the terminal. Empty: log to the terminal |
-| `database.file` | string | | Path to the SQLite database file, used by the `migrate` commands. Empty: commands that need the database fail |
+| `logging.file` | string | | Log file (JSON lines) for long-running commands such as `fetch service`. Empty: log to the terminal |
+
+Logging always starts on the terminal. Long-running commands switch to the file
+in `logging.file` once the configuration is loaded, unless it is empty (they
+then stay on the terminal, with a warning) or `--foreground` is passed.
+All other commands log to the terminal.
+
+The `--debug` and `--quiet` flags force the log level to `debug` and `error`
+respectively, ignoring the `logging.level` configuration. `--debug` takes
+priority over `--quiet`.
+
+### Database
+
+| Key | Type | Default | Notes |
+|---|---|---|---|
+| `database.file` | string | | Path to the SQLite database file. Empty: commands that need the database fail |
+
+Database is currently restricted to SQLite v3. At this point, no other engine is
+supported.
+
+
+### Opportunity Sources
+
+| Key | Type | Default | Notes |
+|---|---|---|---|
 | `sources.<source>.enabled` | bool | `false` | For every source |
 | `sources.<source>.interval` | duration | `10m` | For every source; e.g. `30s`, `1h`. Must be greater than 0; turn a source off with `enabled` |
 | `sources.find_a_tender.api_root` | string | `https://www.find-tender.service.gov.uk/api/1.0` | URL of the Find a Tender API. Empty: the source fails to start if enabled, and `fetch once` fails |
 | `sources.fts_mock.api_root` | string | | URL of the mock FTS server (see `internal/mock`). Empty: the source fails to start if enabled |
 | `sources.sleeper.block_shutdown` | bool | `false` | Test source: if true, its sleep ignores shutdown |
-| `server.host` | string | `127.0.0.1` | Address to listen on; empty: every interface |
-| `server.port` | int | `9393` | Port to listen on; `0`: any free port |
-| `server.timeouts.shutdown` | duration | `15s` | How long shutdown waits for clients to close; `0s`: until they have |
-| `server.rate_limits.idle_ttl` | duration | `10m` | How long a client's rate limiter is kept after its last request; `0s`: for ever |
-| `server.websocket.enable_compression` | bool | `false` | permessage-deflate |
-| `server.websocket.max_message_size` | byte size | `32KiB` | Largest message read from a client; `0B` for 32KiB. `-1` (no limit) is rejected, as a client could then exhaust the server's memory |
-| `server.websocket.connection_limit.*` | | | A rate limit rule for new connections from each client IP, WebSocket and plain TCP alike; limiters are kept for `server.rate_limits.idle_ttl` |
-| `server.websocket.message_rate_limit.*` | | | A rate limit rule for messages from each connection |
-| `server.websocket.*.enabled` | bool | `false` | In a rate limit rule: whether it applies |
-| `server.websocket.*.per_second` | int | `50` | In a rate limit rule: sustained rate. `0` or less: the rule is off |
-| `server.websocket.*.burst` | int | `100` | In a rate limit rule: largest burst. Below `1`: 1 |
-| `server.websocket.write_timeout` | duration | `10s` | `0s` for none |
-| `server.websocket.ping_interval` | duration | `30s` | How long a connection may be idle before it is pinged; `0s`: no pings |
-| `server.websocket.pong_timeout` | duration | `10s` | `0s` for none |
 
 The current sources are `find_a_tender`, `fts_mock` and `sleeper`. See
 "Addition of a new opportunities source" in the top level README for how to add
 a new source.
 
+### Server
+
+The `server` section is split into a number of sub-sections:
+
+| Key | Section description |
+|---|---|
+| `server` | Top level server configuration settings |
+| `server.timeouts` | HTTP read, write and idle timeouts, and the shutdown timeout |
+| `server.rate_limits` | Global (every request) and API rate limits. Also see `server.websocket.connection_limit` for WebSocket and plain TCP connection limits |
+| `server.proxy` | PROXY protocol and proxy header settings |
+| `server.csrf` | CSRF and cross-origin protection settings |
+| `server.tls` | TLS certificate, minimum version and HTTP redirect |
+| `server.headers` | HTTP header settings including policy headers |
+| `server.frontend` | How the frontend is served (not used yet) |
+| `server.websocket` | Websocket configuration |
+
+#### Server
+
+| Key | Type | Default | Notes |
+|---|---|---|---|
+| `server.host` | string | `127.0.0.1` | Address to listen on; empty: every interface |
+| `server.port` | int | `9393` | Port to listen on; `0`: any free port |
+| `server.max_header_bytes` | byte size | `8KB` | Largest request header block; `0B` for 8KB. `-1` (no limit) is rejected, as the HTTP server always has one |
+| `server.max_body_bytes` | byte size | `1MB` | Largest request body; `0B` for 1MB, `-1` for no limit |
+
+#### Timeouts
+
+| Key | Type | Default | Notes |
+|---|---|---|---|
+| `server.timeouts.read_header` | duration | `5s` | Reading a request's headers. Must be greater than 0, as a client could otherwise hold a connection open for ever |
+| `server.timeouts.read` | duration | `15s` | Reading a whole request; `0s` for none |
+| `server.timeouts.write` | duration | `30s` | Writing a response; `0s` for none |
+| `server.timeouts.idle` | duration | `2m` | Waiting for the next request on a keep-alive connection; `0s` for none |
+| `server.timeouts.shutdown` | duration | `15s` | How long shutdown waits for open requests; `0s`: until they finish |
+
+#### Rate Limits
+
+| Key | Type | Default | Notes |
+|---|---|---|---|
+| `server.rate_limits.<rule>.enabled` | bool | `false` | `<rule>` is `global` or `api` (see rate limit rules below) |
+| `server.rate_limits.<rule>.per_second` | int | `50` | Sustained requests per second per client IP. `0` or less: the rule is off |
+| `server.rate_limits.<rule>.burst` | int | `100` | Requests allowed in a burst. Below `1`: 1 |
+| `server.rate_limits.idle_ttl` | duration | `10m` | How long a client's limiter is kept after its last request; `0s`: for ever |
+
+#### PROXY Protocol and Proxy Headers
+
+| Key | Type | Default | Notes |
+|---|---|---|---|
+| `server.proxy.trusted` | list | `127.0.0.1/32` | IP addresses and CIDR ranges of proxies whose forwarding headers are trusted; empty: none |
+| `server.proxy.client_ip_headers` | list | `X-Forwarded-For, Forwarded, X-Real-IP` | Headers read for the client IP from a trusted proxy, in priority order; empty: always the connection's address |
+| `server.proxy.strip_untrusted` | bool | `true` | Remove forwarding headers from requests not from a trusted proxy |
+| `server.proxy.proxy_protocol.enabled` | bool | `false` | Accept the PROXY protocol from trusted sources |
+| `server.proxy.proxy_protocol.trusted_sources` | list | | Addresses and CIDR ranges allowed to send a PROXY header; empty: `server.proxy.trusted` |
+| `server.proxy.proxy_protocol.required` | bool | `false` | Reject connections from trusted sources without a PROXY header |
+| `server.proxy.proxy_protocol.read_header_timeout` | duration | `5s` | How long to wait for the PROXY header; `0s` for none |
+
+#### CSRF & Cross-Origin Protection
+
+| Key | Type | Default | Notes |
+|---|---|---|---|
+| `server.csrf.cross_origin_protection.enabled` | bool | `true` | Reject cross-origin unsafe requests (`Sec-Fetch-Site`/`Origin`) |
+| `server.csrf.cross_origin_protection.trusted_origins` | list | | Extra origins (`https://admin.example.com`) allowed to make them, and to open WebSockets; empty: none |
+| `server.csrf.tokens.enabled` | bool | `true` | Require a signed double-submit token on unsafe requests |
+| `server.csrf.tokens.key` | string | | Hex HMAC key; empty: a random per-process key, so tokens don't survive a restart |
+| `server.csrf.tokens.cookie_name` | string | `js_csrf` | Empty: `js_csrf` |
+| `server.csrf.tokens.header_name` | string | `X-CSRF-Token` | Empty: `X-CSRF-Token` |
+| `server.csrf.tokens.token_ttl` | duration | `12h` | `0s`: 12h |
+| `server.csrf.exempt_paths` | list | | ServeMux-style patterns skipped by both CSRF layers (e.g. `/api/webhooks/`); empty: none |
+
+#### TLS
+
+| Key | Type | Default | Notes |
+|---|---|---|---|
+| `server.tls.enabled` | bool | `false` | Serve HTTPS |
+| `server.tls.cert_file` | string | | Certificate file; must be set when TLS is enabled |
+| `server.tls.key_file` | string | | Private key file; must be set when TLS is enabled |
+| `server.tls.min_version` | string | `1.3` | `1.2` or `1.3`; anything else, including empty, means 1.2 |
+| `server.tls.redirect_http_port` | int | | Port of a plain HTTP listener that redirects to HTTPS; `0`: none |
+
+#### Headers
+
+| Key | Type | Default | Notes |
+|---|---|---|---|
+| `server.headers.allowed_hosts` | list | | Allowed `Host` headers, `*.example.com` supported; empty disables the check |
+| `server.headers.content_security_policy` | string | | Security response headers; empty leaves the header unset |
+| `server.headers.frame_options` | string | | |
+| `server.headers.referrer_policy` | string | | |
+| `server.headers.permissions_policy` | string | | |
+| `server.headers.cross_origin_opener_policy` | string | | |
+| `server.headers.cross_origin_resource_policy` | string | | |
+| `server.headers.extra_response_headers` | list of objects | | Extra headers set on every response, each `{header: ..., value: ...}`. `header` must be a valid header name and `value` must not contain a line break |
+| `server.headers.remove_response_headers` | list | | Headers stripped from every response (e.g. `Server`); empty: none |
+| `server.headers.hsts.enabled` | bool | `false` | Send `Strict-Transport-Security` on HTTPS requests |
+| `server.headers.hsts.max_age` | duration | `8760h` | `0s`: the header isn't sent |
+| `server.headers.hsts.include_subdomains` | bool | `true` | |
+| `server.headers.hsts.preload` | bool | `false` | |
+
+#### Frontend
+
+Not used yet.
+
+| Key | Type | Default | Notes |
+|---|---|---|---|
+| `server.frontend.dir` | string | | Serve the frontend from this directory; empty: the embedded build |
+| `server.frontend.immutable_prefix` | string | | Where Vite emits content-hashed files |
+| `server.frontend.index_cache_control` | string | | `Cache-Control` of HTML and other files without a hash; empty: none |
+
+#### Websockets
+
+| Key | Type | Default | Notes |
+|---|---|---|---|
+| `server.websocket.enable_compression` | bool | `false` | permessage-deflate |
+| `server.websocket.max_message_size` | byte size | `32KiB` | Largest message read from a client; `0B` for 32KiB. `-1` (no limit) is rejected, as a client could then exhaust the server's memory |
+| `server.websocket.connection_limit.*` | | | A rate limit rule for new connections from each client IP, WebSocket and plain TCP alike; limiters are kept for `server.rate_limits.idle_ttl` |
+| `server.websocket.message_rate_limit.*` | | | A rate limit rule for messages from each connection |
+| `server.websocket.write_timeout` | duration | `10s` | `0s` for none |
+| `server.websocket.ping_interval` | duration | `30s` | How long a connection may be idle before it is pinged; `0s`: no pings |
+| `server.websocket.pong_timeout` | duration | `10s` | `0s` for none |
+
+## Complex Types
+
 A rate limit rule (`JSCRateLimitRule`) has `enabled`, `per_second` and `burst`.
 It is off unless `enabled` and `per_second` is greater than 0; a `burst` below
-1 means 1.
-It is used under `server.websocket.connection_limit` and
-`server.websocket.message_rate_limit`.
+1 means 1. It is used under several keys: `server.rate_limits.global`,
+`server.rate_limits.api`, `server.websocket.connection_limit` and
+`server.websocket.message_rate_limit`. Rate limits are implemented using the
+token bucket algorithm.
+
+Lists can be given as YAML/JSON lists or as a comma-separated string (e.g. in
+an environment variable). A list of objects such as `server.headers.extra_response_headers`
+is a YAML/JSON list of objects in a config file, or a JSON array in an
+environment variable or `config set`:
+`'[{"header":"X-Robots-Tag","value":"noindex"}]'`.
+
+## Example Configuration
 
 Example `config.yaml`:
 ```yaml
@@ -80,6 +228,25 @@ sources:
         enabled: false
         interval: 1m
         api_root: http://localhost:8080/api/1.0
+server:
+    host: 0.0.0.0
+    port: 9393
+    max_body_bytes: 2MB
+    proxy:
+        trusted: [10.0.0.0/8]
+    rate_limits:
+        api:
+            enabled: true
+            per_second: 20
+            burst: 40
+    headers:
+        allowed_hosts: [jobs.example.com]
+        extra_response_headers:
+            - header: X-Robots-Tag
+              value: noindex
+        remove_response_headers: [Server]
+        hsts:
+            enabled: true
 ```
 
 
@@ -99,23 +266,42 @@ per key:
   `time.Duration` or a duration string in `SetValue`, and are given out as
   strings (`"10m0s"`) by `Map`, `Flatten` and `ValueOf`, and so by `JSON`,
   `YAML` and `String` too.
-- `util.ByteSize` fields work the same way, with size strings such as `"32KiB"`
-  or `"1MB"` (KB, MB, ... are powers of 1000; KiB, MiB, ... powers of 1024),
-  and are given out exactly in the largest unit that divides them (`"1MB"`).
-  `-1` means no limit (`util.ByteSizeNoLimit`); no other size may be
-  negative. A setting for which no limit is unsafe rejects `-1`.
+- `util.ByteSize` fields work the same way, with size strings such as
+  `"32KiB"` or `"1MB"` (KB, MB, ... are powers of 1000; KiB, MiB, ... powers
+  of 1024), and are given out exactly in the largest unit that divides them
+  (`"1MB"`). `-1` means no limit (`util.ByteSizeNoLimit`); no other size may
+  be negative. A setting for which no limit is unsafe rejects `-1`.
+- `[]string` fields report `reflect.Slice` from `TypeOf` and accept either a
+  `[]string` or a comma-separated string such as `"a, b"` in `SetValue` (and so
+  in default tags). An empty list is stored as `nil`.
+- A list of sections, `[]S` for a section struct `S` (e.g. `[]JSCServerHeadersExtra`),
+  is a single key reporting `reflect.Slice`. It is given out as a
+  `[]map[string]any`, one map per item, and `SetValue` accepts a `[]S`, a list
+  of maps (as Viper reads a YAML/JSON list of objects) or a JSON array string.
+  Each item starts from its defaults and its keys are set as `SetValue` sets
+  them. `S` implements `Section` and, like a type used under several keys, has
+  no `JSCK*` constant.
 - A section can reject values by implementing `validate(key, value) error` on
-  its pointer type. `JSCLogging` does this for `level`, and
-  `JSCServerWebSocket` for `max_message_size` (rejecting `-1`).
+  its pointer type. `JSCLogging` does this for `level`, `JSCSourcesSource` for
+  `interval`, `JSCServer` for `max_header_bytes`, `JSCServerTimeouts` for
+  `read_header` (rejecting 0 or less) and `JSCServerWebSocket` for
+  `max_message_size` (rejecting `-1`), and `JSCServerHeadersExtra` for
+  `header` and `value`. Each item in a list of
+  sections is validated whole, so a key left out of an item is checked too.
 
 Every section implements the `Section` interface defined in `section.go`:
 `Map`, `Flatten`, `TypeOf`, `ValueOf` and `SetValue`, each a one-line call into
 `section.go` (some sections also have `Keys`). The methods sit under a
 `// ---------- Section methods (see Section) ----------` banner in each
-section's file. `TestSections` walks `JobSearchConfig` and checks every
+section's file. A section's `Flatten` keys are prefixed with its `JSCK*`
+constant, except for a section type used under several keys, such as
+`JSCRateLimitRule`: it has no constant and its keys are unprefixed.
+`TestSections` walks `JobSearchConfig` and checks every
 section, including embedded ones, implements `Section` and that its
-`Flatten` keys match its `cfg` tag, so a new section is checked without being
-listed anywhere.
+`Flatten` keys match its `cfg` tag, and that its `Map`, `TypeOf`, `ValueOf`
+and `SetValue` agree with the whole configuration's view of the same keys (the
+items of a list of sections are checked the same way), so a new section is
+checked without being listed anywhere.
 
 
 ## Adding a key or section
@@ -126,7 +312,8 @@ else is needed for it to be loaded, printed, and read or written by the
 To add a new section:
 1. Create a `conf_*.go` file with the section struct, a `JSCK*` constant for
    its key, and an implementation of `Section` (copy an existing section's
-   methods).
+   methods). A type that will be used under several keys, like
+   `JSCRateLimitRule`, has no constant and passes `""` to `flattenOf`.
 2. Add the struct as a tagged field of its parent: `JobSearchConfig` in
    `config.go`, or `JSCSources` in `conf_sources.go` for a source,
    etc. The field's `cfg` tag must match the `JSCK*` constant.
@@ -165,7 +352,7 @@ Nothing in `section.go` needs changing.
 | `conf_sources.go` | `sources` section and the shared source fields |
 | `conf_source_*.go` | One file per source section |
 | `conf_server.go` | `server` section |
-| `conf_server_*.go` | One file per `server` sub-section (`rate_limits`, `timeouts`, `websocket`) |
+| `conf_server_*.go` | One file per `server` sub-section (`csrf`, `frontend`, `headers`, `proxy`, `rate_limits`, `timeouts`, `tls`, `websocket`) |
 | `conf_ratelimitrule.go` | `JSCRateLimitRule`, the rate limit rule shared by several keys |
 | `print.go`, `debug.go` | Printing and debug logging of the configuration |
 

internal/config/conf_sections_test.go

@@ -372,6 +372,18 @@ func TestSerialisedRoundTrip(t *testing.T) {
 	orig.Sources.FTSMock.Enabled = true
 	orig.Sources.FTSMock.APIRoot = "http://mock"
 	orig.Server.WebSocket.MaxMessageSize = 64 << 10
+	orig.Server.MaxBodyBytes = 2 << 20
+	orig.Server.Headers.ExtraResponseHeaders = []JSCServerHeadersExtra{
+		{
+			Header: "X-Robots-Tag",
+			Value:  "noindex",
+		},
+		{
+			Header: "Cache-Control",
+			Value:  "no-store, max-age=0",
+		},
+	}
+	orig.Server.Headers.RemoveResponseHeaders = []string{"Server", "X-Powered-By"}
 
 	for _, format := range []string{"json", "yaml"} {
 		t.Run(format, func(t *testing.T) {
@@ -449,6 +461,12 @@ func TestViperRoundTrip(t *testing.T) {
 	orig.Logging.Level = "error"
 	orig.Sources.FindATender.Enabled = true
 	orig.Sources.FindATender.Interval = 45 * time.Second
+	orig.Server.Headers.ExtraResponseHeaders = []JSCServerHeadersExtra{
+		{
+			Header: "X-Robots-Tag",
+			Value:  "noindex",
+		},
+	}
 	LoadToViper(orig)
 
 	var got JobSearchConfig
@@ -458,6 +476,98 @@ func TestViperRoundTrip(t *testing.T) {
 	}
 }
 
+// A list of sections can be given as a JSON array string, as it would be in
+// an environment variable.
+func TestLoadFromViperSectionListString(t *testing.T) {
+	resetViper(t)
+	viper.Set(
+		"server.headers.extra_response_headers",
+		`[{"header": "X-Robots-Tag", "value": "noindex"}]`,
+	)
+	conf := defaultConfig(t)
+	LoadFromViper(&conf)
+
+	want := []JSCServerHeadersExtra{
+		{
+			Header: "X-Robots-Tag",
+			Value:  "noindex",
+		},
+	}
+	if !reflect.DeepEqual(conf.Server.Headers.ExtraResponseHeaders, want) {
+		t.Errorf(
+			"ExtraResponseHeaders = %+v; want %+v",
+			conf.Server.Headers.ExtraResponseHeaders,
+			want,
+		)
+	}
+}
+
+func TestHeadersExtraValidation(t *testing.T) {
+	var c JSCServerHeadersExtra
+	for _, h := range []string{"X-Robots-Tag", "x-a", "A1!#$%&'*+-.^_`|~"} {
+		if err := c.SetValue("header", h); err != nil || c.Header != h {
+			t.Errorf("SetValue(header, %q) = %v, Header = %q", h, err, c.Header)
+		}
+	}
+	for _, h := range []string{
+		"", "X Robots", "X-A:", "X-A\r\nX-B", "Ünicode", "(x)",
+	} {
+		if err := c.SetValue("header", h); err == nil ||
+			!strings.Contains(err.Error(), "invalid header name") {
+			t.Errorf("SetValue(header, %q) = %v; want invalid header name", h, err)
+		}
+	}
+	if err := c.SetValue("value", "no-store, max-age=0"); err != nil {
+		t.Errorf("SetValue(value): %v", err)
+	}
+	for _, v := range []string{"a\nb", "a\rb", "a\r\nX-Evil: 1"} {
+		if err := c.SetValue("value", v); err == nil ||
+			!strings.Contains(err.Error(), "invalid header value") {
+			t.Errorf("SetValue(value, %q) = %v; want invalid header value", v, err)
+		}
+	}
+
+	// Items in the list are validated whole, so a missing header is rejected
+	// too, and the list is left as it was.
+	const key = "server.headers.extra_response_headers"
+	conf := defaultConfig(t)
+	for _, value := range []any{
+		`[{"value": "noindex"}]`,
+		`[{"header": "X-A", "value": "1"}, {"header": "bad name", "value": "2"}]`,
+		`[{"header": "X-A", "value": "a\nb"}]`,
+		[]JSCServerHeadersExtra{
+			{
+				Value: "noindex",
+			},
+		},
+	} {
+		if err := conf.SetValue(key, value); err == nil ||
+			!strings.Contains(err.Error(), "invalid header") {
+			t.Errorf("SetValue(%s, %#v) = %v; want invalid header", key, value, err)
+		}
+		if conf.Server.Headers.ExtraResponseHeaders != nil {
+			t.Errorf(
+				"rejected list was stored: %+v",
+				conf.Server.Headers.ExtraResponseHeaders,
+			)
+		}
+	}
+
+	// From Viper, an invalid list is skipped with a warning.
+	resetViper(t)
+	logs := captureLogs(t, slog.LevelWarn)
+	viper.Set(key, []any{map[string]any{"value": "noindex"}})
+	LoadFromViper(&conf)
+	if conf.Server.Headers.ExtraResponseHeaders != nil ||
+		!strings.Contains(logs.String(), "key="+key) {
+		t.Errorf(
+			"invalid list from Viper: stored %+v, logs %s",
+			conf.Server.Headers.ExtraResponseHeaders,
+			logs,
+		)
+	}
+}
+
 // Invalid values from Viper are skipped with a warning, leaving the existing
 // value.
 func TestLoadFromViperInvalidValues(t *testing.T) {
@@ -620,3 +730,26 @@ func TestSourceIntervalMustBePositive(t *testing.T) {
 		)
 	}
 }
+
+// server.timeouts.read_header must be greater than 0; the other server
+// timeouts accept 0 (no limit).
+func TestServerReadHeaderTimeoutMustBePositive(t *testing.T) {
+	conf := defaultConfig(t)
+	for _, value := range []string{"0s", "-1s"} {
+		err := conf.SetValue("server.timeouts.read_header", value)
+		if err == nil || !strings.Contains(err.Error(), "greater than 0") {
+			t.Errorf("SetValue(read_header, %s) = %v; want rejected", value, err)
+		}
+	}
+	if conf.Server.Timeouts.ReadHeaderTimeout != 5*time.Second {
+		t.Errorf(
+			"rejected read_header was stored: %v",
+			conf.Server.Timeouts.ReadHeaderTimeout,
+		)
+	}
+	for _, key := range []string{"read", "write", "idle", "shutdown"} {
+		if err := conf.SetValue("server.timeouts."+key, "0s"); err != nil {
+			t.Errorf("SetValue(%s, 0s): %v", key, err)
+		}
+	}
+}

internal/config/conf_server.go

@@ -1,7 +1,10 @@
 package config
 
 import (
+	"errors"
 	"reflect"
+
+	"git.avsdev.uk/Go/job-search/internal/util"
 )
 
 // JSCKServer is the server section's configuration key.
@@ -9,13 +12,22 @@ const JSCKServer string = "server"
 
 // JSCServer configures the outward server. Host is the address to listen
 // on (empty means every interface) and Port the port (0 means any free
-// port).
+// port). MaxHeaderBytes is the largest request header block; 0 means the
+// default (8KB), and -1 (no limit) is rejected (see validate). MaxBodyBytes is
+// the largest request body; 0 means the default (1MB) and -1 no limit.
 type JSCServer struct {
-	Host       string              `cfg:"host"        default:"127.0.0.1"`
-	Port       int                 `cfg:"port"        default:"9393"`
-	Timeouts   JSCServerTimeouts   `cfg:"timeouts"`
-	RateLimits JSCServerRateLimits `cfg:"rate_limits"`
-	WebSocket  JSCServerWebSocket  `cfg:"websocket"`
+	Host           string              `cfg:"host"             default:"127.0.0.1"`
+	Port           int                 `cfg:"port"             default:"9393"`
+	MaxHeaderBytes util.ByteSize       `cfg:"max_header_bytes" default:"8KB"`
+	MaxBodyBytes   util.ByteSize       `cfg:"max_body_bytes"   default:"1MB"`
+	Timeouts       JSCServerTimeouts   `cfg:"timeouts"`
+	RateLimits     JSCServerRateLimits `cfg:"rate_limits"`
+	Proxy          JSCServerProxy      `cfg:"proxy"`
+	CSRF           JSCServerCSRF       `cfg:"csrf"`
+	TLS            JSCServerTLS        `cfg:"tls"`
+	Headers        JSCServerHeaders    `cfg:"headers"`
+	Frontend       JSCServerFrontend   `cfg:"frontend"`
+	WebSocket      JSCServerWebSocket  `cfg:"websocket"`
 }
 
 // ---------- Section methods (see Section) ----------
@@ -42,3 +54,18 @@ func (c JSCServer) ValueOf(key string) (any, error) {
 func (c *JSCServer) SetValue(key string, value any) error {
 	return setValue(c, key, value)
 }
+
+// ---------- Section specific methods ----------
+
+// validate checks values before they are stored (see validator).
+// max_header_bytes can't be -1 (no limit): the HTTP server always limits the
+// header block, so -1 would quietly mean its own default instead.
+func (c *JSCServer) validate(key string, value any) error {
+	if key == "max_header_bytes" &&
+		value.(util.ByteSize) == util.ByteSizeNoLimit {
+		return errors.New(
+			"config: max_header_bytes can't be -1 (no limit): set an explicit size, or 0 for the default",
+		)
+	}
+	return nil
+}

internal/config/conf_server_csrf.go

@@ -0,0 +1,124 @@
+package config
+
+import (
+	"reflect"
+	"time"
+)
+
+// JSCKServerCSRF is the server CSRF section's configuration key.
+const JSCKServerCSRF string = "csrf"
+
+// JSCServerCSRF configures the server's CSRF protection: its cross-origin
+// check and its tokens. ExemptPaths are ServeMux-style patterns skipped by
+// both (e.g. "/api/webhooks/"); empty means none are skipped.
+type JSCServerCSRF struct {
+	CrossOriginProtection JSCServerCSRFCrossOrigin `cfg:"cross_origin_protection"`
+	Tokens                JSCServerCSRFTokens      `cfg:"tokens"`
+	ExemptPaths           []string                 `cfg:"exempt_paths"`
+}
+
+// ---------- Section methods (see Section) ----------
+
+// Map implements Section.
+func (c JSCServerCSRF) Map() map[string]any { return mapOf(c) }
+
+// Flatten implements Section.
+func (c JSCServerCSRF) Flatten() map[string]any {
+	return flattenOf(JSCKServerCSRF, c)
+}
+
+// TypeOf implements Section.
+func (c JSCServerCSRF) TypeOf(key string) (reflect.Kind, error) {
+	return typeOf(c, key)
+}
+
+// ValueOf implements Section.
+func (c JSCServerCSRF) ValueOf(key string) (any, error) {
+	return valueOf(c, key)
+}
+
+// SetValue implements Section.
+func (c *JSCServerCSRF) SetValue(key string, value any) error {
+	return setValue(c, key, value)
+}
+
+// ========== Cross-Origin Protection ==========
+
+// JSCKServerCSRFCrossOrigin is the server CSRF cross-origin protection
+// section's configuration key.
+const JSCKServerCSRFCrossOrigin string = "cross_origin_protection"
+
+// JSCServerCSRFCrossOrigin configures CSRF protection by checking requests'
+// origin. TrustedOrigins are extra origins ("https://admin.example.com")
+// allowed to make cross-origin unsafe requests; empty means none.
+type JSCServerCSRFCrossOrigin struct {
+	Enabled        bool     `cfg:"enabled"         default:"true"`
+	TrustedOrigins []string `cfg:"trusted_origins"`
+}
+
+// ---------- Section methods (see Section) ----------
+
+// Map implements Section.
+func (c JSCServerCSRFCrossOrigin) Map() map[string]any { return mapOf(c) }
+
+// Flatten implements Section.
+func (c JSCServerCSRFCrossOrigin) Flatten() map[string]any {
+	return flattenOf(JSCKServerCSRFCrossOrigin, c)
+}
+
+// TypeOf implements Section.
+func (c JSCServerCSRFCrossOrigin) TypeOf(key string) (reflect.Kind, error) {
+	return typeOf(c, key)
+}
+
+// ValueOf implements Section.
+func (c JSCServerCSRFCrossOrigin) ValueOf(key string) (any, error) {
+	return valueOf(c, key)
+}
+
+// SetValue implements Section.
+func (c *JSCServerCSRFCrossOrigin) SetValue(key string, value any) error {
+	return setValue(c, key, value)
+}
+
+// ========== CSRF Tokens ==========
+
+// JSCKServerCSRFTokens is the server CSRF tokens section's configuration key.
+const JSCKServerCSRFTokens string = "tokens"
+
+// JSCServerCSRFTokens configures CSRF protection by tokens. Key is the hex
+// HMAC key tokens are signed with; empty means a random key for the process,
+// so tokens don't survive a restart. An empty CookieName or HeaderName, or a
+// TokenTTL of 0 or less, means the default.
+type JSCServerCSRFTokens struct {
+	Enabled    bool          `cfg:"enabled"     default:"true"`
+	Key        string        `cfg:"key"`
+	CookieName string        `cfg:"cookie_name" default:"js_csrf"`
+	HeaderName string        `cfg:"header_name" default:"X-CSRF-Token"`
+	TokenTTL   time.Duration `cfg:"token_ttl"   default:"12h"`
+}
+
+// ---------- Section methods (see Section) ----------
+
+// Map implements Section.
+func (c JSCServerCSRFTokens) Map() map[string]any { return mapOf(c) }
+
+// Flatten implements Section.
+func (c JSCServerCSRFTokens) Flatten() map[string]any {
+	return flattenOf(JSCKServerCSRFTokens, c)
+}
+
+// TypeOf implements Section.
+func (c JSCServerCSRFTokens) TypeOf(key string) (reflect.Kind, error) {
+	return typeOf(c, key)
+}
+
+// ValueOf implements Section.
+func (c JSCServerCSRFTokens) ValueOf(key string) (any, error) {
+	return valueOf(c, key)
+}
+
+// SetValue implements Section.
+func (c *JSCServerCSRFTokens) SetValue(key string, value any) error {
+	return setValue(c, key, value)
+}

internal/config/conf_server_frontend.go

@@ -0,0 +1,44 @@
+package config
+
+import (
+	"reflect"
+)
+
+// JSCKServerFrontend is the frontend section's configuration key.
+const JSCKServerFrontend string = "frontend"
+
+// JSCServerFrontend configures how the server serves the frontend. Nothing
+// reads it yet. Dir serves the frontend from disk instead of the embedded
+// build; empty means the embedded build. ImmutablePrefix is where Vite emits
+// content-hashed files, and IndexCacheControl the Cache-Control of HTML and
+// other files without a hash; empty means none.
+type JSCServerFrontend struct {
+	Dir               string `cfg:"dir"`
+	ImmutablePrefix   string `cfg:"immutable_prefix"`
+	IndexCacheControl string `cfg:"index_cache_control"`
+}
+
+// ---------- Section methods (see Section) ----------
+
+// Map implements Section.
+func (c JSCServerFrontend) Map() map[string]any { return mapOf(c) }
+
+// Flatten implements Section.
+func (c JSCServerFrontend) Flatten() map[string]any {
+	return flattenOf(JSCKServerFrontend, c)
+}
+
+// TypeOf implements Section.
+func (c JSCServerFrontend) TypeOf(key string) (reflect.Kind, error) {
+	return typeOf(c, key)
+}
+
+// ValueOf implements Section.
+func (c JSCServerFrontend) ValueOf(key string) (any, error) {
+	return valueOf(c, key)
+}
+
+// SetValue implements Section.
+func (c *JSCServerFrontend) SetValue(key string, value any) error {
+	return setValue(c, key, value)
+}

internal/config/conf_server_headers.go

@@ -0,0 +1,176 @@
+package config
+
+import (
+	"errors"
+	"reflect"
+	"strings"
+	"time"
+)
+
+// JSCKServerHeaders is the server headers section's configuration key.
+const JSCKServerHeaders string = "headers"
+
+// JSCServerHeaders configures the server's request checks and security
+// response headers. AllowedHosts restricts the Host header, and supports
+// "*.example.com"; empty disables the check. Each policy header is sent with
+// its configured value; empty means it isn't sent. ExtraResponseHeaders are
+// set on every response, and RemoveResponseHeaders stripped from every
+// response before it is sent; empty means none.
+type JSCServerHeaders struct {
+	AllowedHosts []string `cfg:"allowed_hosts"`
+
+	ContentSecurityPolicy     string               `cfg:"content_security_policy"`
+	FrameOptions              string               `cfg:"frame_options"`
+	ReferrerPolicy            string               `cfg:"referrer_policy"`
+	PermissionsPolicy         string               `cfg:"permissions_policy"`
+	CrossOriginOpenerPolicy   string               `cfg:"cross_origin_opener_policy"`
+	CrossOriginResourcePolicy string               `cfg:"cross_origin_resource_policy"`
+	HSTS                      JSCServerHeadersHSTS `cfg:"hsts"`
+
+	ExtraResponseHeaders  []JSCServerHeadersExtra `cfg:"extra_response_headers"`
+	RemoveResponseHeaders []string                `cfg:"remove_response_headers"`
+}
+
+// ---------- Section methods (see Section) ----------
+
+// Map implements Section.
+func (c JSCServerHeaders) Map() map[string]any { return mapOf(c) }
+
+// Flatten implements Section.
+func (c JSCServerHeaders) Flatten() map[string]any {
+	return flattenOf(JSCKServerHeaders, c)
+}
+
+// TypeOf implements Section.
+func (c JSCServerHeaders) TypeOf(key string) (reflect.Kind, error) {
+	return typeOf(c, key)
+}
+
+// ValueOf implements Section.
+func (c JSCServerHeaders) ValueOf(key string) (any, error) {
+	return valueOf(c, key)
+}
+
+// SetValue implements Section.
+func (c *JSCServerHeaders) SetValue(key string, value any) error {
+	return setValue(c, key, value)
+}
+
+// ========== HSTS Headers ==========
+
+// JSCKServerHeadersHSTS is the HSTS section's configuration key.
+const JSCKServerHeadersHSTS string = "hsts"
+
+// JSCServerHeadersHSTS configures the Strict-Transport-Security header, sent
+// on HTTPS requests when enabled. A MaxAge of 0 or less means the header
+// isn't sent.
+type JSCServerHeadersHSTS struct {
+	Enabled           bool          `cfg:"enabled"            default:"false"`
+	MaxAge            time.Duration `cfg:"max_age"            default:"8760h"`
+	IncludeSubdomains bool          `cfg:"include_subdomains" default:"true"`
+	Preload           bool          `cfg:"preload"            default:"false"`
+}
+
+// ---------- Section methods (see Section) ----------
+
+// Map implements Section.
+func (c JSCServerHeadersHSTS) Map() map[string]any { return mapOf(c) }
+
+// Flatten implements Section.
+func (c JSCServerHeadersHSTS) Flatten() map[string]any {
+	return flattenOf(JSCKServerHeadersHSTS, c)
+}
+
+// TypeOf implements Section.
+func (c JSCServerHeadersHSTS) TypeOf(key string) (reflect.Kind, error) {
+	return typeOf(c, key)
+}
+
+// ValueOf implements Section.
+func (c JSCServerHeadersHSTS) ValueOf(key string) (any, error) {
+	return valueOf(c, key)
+}
+
+// SetValue implements Section.
+func (c *JSCServerHeadersHSTS) SetValue(key string, value any) error {
+	return setValue(c, key, value)
+}
+
+// ========== Extra Headers ==========
+
+// JSCServerHeadersExtra configures one extra response header. It is used as
+// the items of the extra_response_headers list, so it has no JSCK* constant
+// and its Flatten keys are not prefixed. Header must be a valid header name,
+// and Value must not hold a line break (see validate); an empty Value means
+// the header isn't sent.
+type JSCServerHeadersExtra struct {
+	Header string `cfg:"header"`
+	Value  string `cfg:"value"`
+}
+
+// ---------- Section methods (see Section) ----------
+
+// Map implements Section.
+func (c JSCServerHeadersExtra) Map() map[string]any { return mapOf(c) }
+
+// Flatten implements Section.
+func (c JSCServerHeadersExtra) Flatten() map[string]any {
+	return flattenOf("", c)
+}
+
+// TypeOf implements Section.
+func (c JSCServerHeadersExtra) TypeOf(key string) (reflect.Kind, error) {
+	return typeOf(c, key)
+}
+
+// ValueOf implements Section.
+func (c JSCServerHeadersExtra) ValueOf(key string) (any, error) {
+	return valueOf(c, key)
+}
+
+// SetValue implements Section.
+func (c *JSCServerHeadersExtra) SetValue(key string, value any) error {
+	return setValue(c, key, value)
+}
+
+// ---------- Section specific methods ----------
+
+// validate checks values before they are stored (see validator). header must
+// be a valid header field name (an RFC 9110 token) and value must not hold a
+// line break, so neither can break the response's header block.
+func (c *JSCServerHeadersExtra) validate(key string, value any) error {
+	switch key {
+	case "header":
+		if !isHeaderToken(value.(string)) {
+			return errors.New(
+				"config: invalid header name: must be a non-empty token such as X-Robots-Tag",
+			)
+		}
+	case "value":
+		if strings.ContainsAny(value.(string), "\r\n") {
+			return errors.New(
+				"config: invalid header value: must not contain a line break",
+			)
+		}
+	}
+	return nil
+}
+
+// isHeaderToken reports whether name is a non-empty RFC 9110 token, the syntax
+// of a header field name.
+func isHeaderToken(name string) bool {
+	if name == "" {
+		return false
+	}
+	for _, char := range name {
+		switch {
+		case char >= 'a' && char <= 'z',
+			char >= 'A' && char <= 'Z',
+			char >= '0' && char <= '9':
+		case strings.ContainsRune("!#$%&'*+-.^_`|~", char):
+		default:
+			return false
+		}
+	}
+	return true
+}

internal/config/conf_server_proxy.go

@@ -0,0 +1,88 @@
+package config
+
+import (
+	"reflect"
+	"time"
+)
+
+// JSCKServerProxy is the server proxy section's configuration key.
+const JSCKServerProxy string = "proxy"
+
+// JSCServerProxy configures which proxies the server trusts and how it finds
+// the client's address behind them. TrustedProxies are IP addresses and CIDR
+// ranges; empty means no proxy is trusted. ClientIPHeaders are the headers
+// read for the client's address from a trusted proxy, in priority order;
+// empty means the connection's own address is always used.
+type JSCServerProxy struct {
+	TrustedProxies  []string               `cfg:"trusted"           default:"127.0.0.1/32"`
+	ClientIPHeaders []string               `cfg:"client_ip_headers" default:"X-Forwarded-For, Forwarded, X-Real-IP"`
+	StripUntrusted  bool                   `cfg:"strip_untrusted"   default:"true"`
+	ProxyProtocol   JSCServerProxyProtocol `cfg:"proxy_protocol"`
+}
+
+// ---------- Section methods (see Section) ----------
+
+// Map implements Section.
+func (c JSCServerProxy) Map() map[string]any { return mapOf(c) }
+
+// Flatten implements Section.
+func (c JSCServerProxy) Flatten() map[string]any {
+	return flattenOf(JSCKServerProxy, c)
+}
+
+// TypeOf implements Section.
+func (c JSCServerProxy) TypeOf(key string) (reflect.Kind, error) {
+	return typeOf(c, key)
+}
+
+// ValueOf implements Section.
+func (c JSCServerProxy) ValueOf(key string) (any, error) {
+	return valueOf(c, key)
+}
+
+// SetValue implements Section.
+func (c *JSCServerProxy) SetValue(key string, value any) error {
+	return setValue(c, key, value)
+}
+
+// ========== PROXY protocol ==========
+
+// JSCKServerProxyProtocol is the server proxy PROXY protocol section's
+// configuration key.
+const JSCKServerProxyProtocol string = "proxy_protocol"
+
+// JSCServerProxyProtocol configures accepting the PROXY protocol from
+// trusted proxies. TrustedSources may send PROXY headers; empty means
+// Proxy.TrustedProxies. ReadHeaderTimeout is how long to wait for the PROXY
+// header; 0 or less means no limit.
+type JSCServerProxyProtocol struct {
+	Enabled           bool          `cfg:"enabled"             default:"false"`
+	TrustedSources    []string      `cfg:"trusted_sources"`
+	Required          bool          `cfg:"required"            default:"false"`
+	ReadHeaderTimeout time.Duration `cfg:"read_header_timeout" default:"5s"`
+}
+
+// ---------- Section methods (see Section) ----------
+
+// Map implements Section.
+func (c JSCServerProxyProtocol) Map() map[string]any { return mapOf(c) }
+
+// Flatten implements Section.
+func (c JSCServerProxyProtocol) Flatten() map[string]any {
+	return flattenOf(JSCKServerProxyProtocol, c)
+}
+
+// TypeOf implements Section.
+func (c JSCServerProxyProtocol) TypeOf(key string) (reflect.Kind, error) {
+	return typeOf(c, key)
+}
+
+// ValueOf implements Section.
+func (c JSCServerProxyProtocol) ValueOf(key string) (any, error) {
+	return valueOf(c, key)
+}
+
+// SetValue implements Section.
+func (c *JSCServerProxyProtocol) SetValue(key string, value any) error {
+	return setValue(c, key, value)
+}

internal/config/conf_server_ratelimits.go

@@ -8,11 +8,14 @@ import (
 // JSCKServerRateLimits is the server rate limits section's configuration key.
 const JSCKServerRateLimits string = "rate_limits"
 
-// JSCServerRateLimits configures the server's rate limiters. IdleTTL is how
-// long a client's limiter is kept after its last request; 0 or less means
-// limiters are never evicted.
+// JSCServerRateLimits configures the server's rate limits. Global limits
+// every request from each client, and API each client's API requests (see
+// JSCRateLimitRule). IdleTTL is how long a client's limiter is kept after its
+// last request; 0 or less means limiters are never evicted.
 type JSCServerRateLimits struct {
-	IdleTTL time.Duration `cfg:"idle_ttl" default:"10m"`
+	Global  JSCRateLimitRule `cfg:"global"`
+	API     JSCRateLimitRule `cfg:"api"`
+	IdleTTL time.Duration    `cfg:"idle_ttl" default:"10m"`
 }
 
 // ---------- Section methods (see Section) ----------

internal/config/conf_server_timeouts.go

@@ -1,6 +1,7 @@
 package config
 
 import (
+	"errors"
 	"reflect"
 	"time"
 )
@@ -8,11 +9,19 @@ import (
 // JSCKServerTimeouts is the server timeouts section's configuration key.
 const JSCKServerTimeouts string = "timeouts"
 
-// JSCServerTimeouts configures the server's timeouts. ShutdownTimeout is how
-// long shutdown waits for clients to close; 0 or less means it waits until
-// they have.
+// JSCServerTimeouts configures the server's HTTP timeouts, as those of
+// http.Server: ReadHeaderTimeout for reading a request's headers,
+// ReadTimeout for the whole request, WriteTimeout for writing the response
+// and IdleTimeout for waiting for the next request on a keep-alive
+// connection. 0 or less means no limit, except that ReadHeaderTimeout must be
+// greater than 0 (see validate). ShutdownTimeout is how long shutdown waits
+// for clients to close; 0 or less means it waits until they have.
 type JSCServerTimeouts struct {
-	ShutdownTimeout time.Duration `cfg:"shutdown" default:"15s"`
+	ReadHeaderTimeout time.Duration `cfg:"read_header" default:"5s"`
+	ReadTimeout       time.Duration `cfg:"read"        default:"15s"`
+	WriteTimeout      time.Duration `cfg:"write"       default:"30s"`
+	IdleTimeout       time.Duration `cfg:"idle"        default:"2m"`
+	ShutdownTimeout   time.Duration `cfg:"shutdown"    default:"15s"`
 }
 
 // ---------- Section methods (see Section) ----------
@@ -39,3 +48,17 @@ func (c JSCServerTimeouts) ValueOf(key string) (any, error) {
 func (c *JSCServerTimeouts) SetValue(key string, value any) error {
 	return setValue(c, key, value)
 }
+
+// ---------- Section specific methods ----------
+
+// validate checks values before they are stored (see validator).
+// read_header must be greater than 0: without it a client could hold a
+// connection open for ever by sending its headers slowly (slowloris).
+func (c *JSCServerTimeouts) validate(key string, value any) error {
+	if key == "read_header" && value.(time.Duration) <= 0 {
+		return errors.New(
+			"config: read_header must be greater than 0, as a client could otherwise hold a connection open for ever",
+		)
+	}
+	return nil
+}

internal/config/conf_server_tls.go

@@ -0,0 +1,46 @@
+package config
+
+import (
+	"reflect"
+)
+
+// JSCKServerTLS is the TLS section's configuration key.
+const JSCKServerTLS string = "tls"
+
+// JSCServerTLS configures the server's TLS connections. CertFile and KeyFile
+// must be set when TLS is enabled. MinVersion is "1.2" or "1.3"; anything
+// else, including empty, means 1.2. RedirectHTTPPort, if set (e.g. 80),
+// starts a plain HTTP listener on that port that redirects everything to
+// HTTPS; 0 means none.
+type JSCServerTLS struct {
+	Enabled          bool   `cfg:"enabled"            default:"false"`
+	CertFile         string `cfg:"cert_file"`
+	KeyFile          string `cfg:"key_file"`
+	MinVersion       string `cfg:"min_version"        default:"1.3"`
+	RedirectHTTPPort int    `cfg:"redirect_http_port"`
+}
+
+// ---------- Section methods (see Section) ----------
+
+// Map implements Section.
+func (c JSCServerTLS) Map() map[string]any { return mapOf(c) }
+
+// Flatten implements Section.
+func (c JSCServerTLS) Flatten() map[string]any {
+	return flattenOf(JSCKServerTLS, c)
+}
+
+// TypeOf implements Section.
+func (c JSCServerTLS) TypeOf(key string) (reflect.Kind, error) {
+	return typeOf(c, key)
+}
+
+// ValueOf implements Section.
+func (c JSCServerTLS) ValueOf(key string) (any, error) {
+	return valueOf(c, key)
+}
+
+// SetValue implements Section.
+func (c *JSCServerTLS) SetValue(key string, value any) error {
+	return setValue(c, key, value)
+}

internal/config/conf_server_websocket.go

@@ -11,11 +11,12 @@ import (
 // JSCKServerWebSocket is the websocket section's configuration key.
 const JSCKServerWebSocket string = "websocket"
 
-// JSCServerWebSocket configures the server's websocket connections.
-// MaxMessageSize is the largest message read from a client; 0 means the
-// default (32KiB), and -1 (no limit) is rejected (see validate). A
-// WriteTimeout or PongTimeout of 0 or less means no limit, and a
-// PingInterval of 0 or less turns pings off.
+// JSCServerWebSocket configures the server's websocket connections. A
+// browser's upgrade must come from the server's own origin or one of
+// csrf.cross_origin_protection.trusted_origins. MaxMessageSize is the
+// largest message read from a client; 0 means the default (32KiB), and -1
+// (no limit) is rejected (see validate). A WriteTimeout or PongTimeout of 0
+// or less means no limit, and a PingInterval of 0 or less turns pings off.
 type JSCServerWebSocket struct {
 	EnableCompression bool             `cfg:"enable_compression" default:"false"`
 	MaxMessageSize    util.ByteSize    `cfg:"max_message_size"   default:"32KiB"`

internal/config/config_test.go

@@ -55,6 +55,13 @@ var sectionType = reflect.TypeOf((*Section)(nil)).Elem()
 // new section is checked without being listed anywhere.
 func TestSections(t *testing.T) {
 	conf := defaultConfig(t)
+	// An item in each list of sections, so the items' methods are checked.
+	conf.Server.Headers.ExtraResponseHeaders = []JSCServerHeadersExtra{
+		{
+			Header: "X-Robots-Tag",
+			Value:  "noindex",
+		},
+	}
 	if !reflect.PointerTo(reflect.TypeOf(conf)).Implements(sectionType) {
 		t.Error("*JobSearchConfig does not implement Section")
 	}

internal/config/modify_test.go

@@ -70,6 +70,48 @@ func TestStoreValue(t *testing.T) {
 	}
 }
 
+// A list of sections is given to StoreValue as a JSON array, written to the
+// file as a list of objects and read back from it.
+func TestStoreValueSectionList(t *testing.T) {
+	path := useConfigFile(t, "logging:\n  level: warn\n")
+	conf := defaultConfig(t)
+	const key = "server.headers.extra_response_headers"
+	_, kind, err := StoreValue(
+		&conf, key, `[{"header": "X-Robots-Tag", "value": "noindex"}]`,
+	)
+	if err != nil || kind != reflect.Slice {
+		t.Fatalf("StoreValue = <%s>, %v", kind, err)
+	}
+	want := []JSCServerHeadersExtra{
+		{
+			Header: "X-Robots-Tag",
+			Value:  "noindex",
+		},
+	}
+	if !reflect.DeepEqual(conf.Server.Headers.ExtraResponseHeaders, want) {
+		t.Errorf(
+			"conf has %+v; want %+v",
+			conf.Server.Headers.ExtraResponseHeaders,
+			want,
+		)
+	}
+
+	resetViper(t)
+	viper.SetConfigFile(path)
+	if err := viper.ReadInConfig(); err != nil {
+		t.Fatal(err)
+	}
+	reread := defaultConfig(t)
+	LoadFromViper(&reread)
+	if !reflect.DeepEqual(reread.Server.Headers.ExtraResponseHeaders, want) {
+		t.Errorf(
+			"file read back as %+v; want %+v",
+			reread.Server.Headers.ExtraResponseHeaders,
+			want,
+		)
+	}
+}
+
 func TestStoreValueKeepsOtherKeys(t *testing.T) {
 	path := useConfigFile(t, "logging:\n  level: warn\n  file: /tmp/js.log\n")
 	conf := defaultConfig(t)