docs: instructions for go install [ci skip]

elaborate on cloud server API URL [ci skip]

.github/workflows/ci.yml

@@ -1,16 +1,39 @@
-name: 'Mayhem for API'
-
+name: ci
 on:
   push:
-    branches: [master]
+    branches: [ master ]
   pull_request:
-    branches: [master]
+    branches: [ master ]
 
 jobs:
   test:
+    name: 'Unit- & API tests'
+    runs-on: ubuntu-latest
+    steps:
+
+    - name: Set up Go 1.x
+      uses: actions/setup-go@v2
+      with:
+        go-version: ^1.18
+      id: go
+
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@v2
+
+    - name: Get dependencies
+      run: go get
+
+    - name: Unit Tests
+      run: go test ./... -run ./...
+
+    - name: API Tests
+      run: |
+        npm -g install newman
+        ./testing/run_api_tests.sh
+
+  mapi:
+    name: 'Automated pen-tests with Mayhem for API'
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: true
     steps:
     - name: Set up Go 1.x
       uses: actions/setup-go@v2
@@ -50,3 +73,28 @@ jobs:
       uses: github/codeql-action/upload-sarif@v1
       with:
         sarif_file: mapi.sarif
+
+  build:
+    name: 'Build (Win, Linux, Mac)'
+
+    strategy:
+      matrix:
+        platform: [ubuntu-latest, macos-latest, windows-latest]
+
+    runs-on: ${{ matrix.platform }}
+    steps:
+
+    - name: Set up Go 1.x
+      uses: actions/setup-go@v2
+      with:
+        go-version: ^1.18
+      id: go
+
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@v2
+
+    - name: Get dependencies
+      run: go get
+
+    - name: Build
+      run: go build -v .

.github/workflows/docker.yml

@@ -8,6 +8,7 @@ on:
 
 jobs:
   docker-publish:
+    name: 'Build and publish Docker image'
     runs-on: ubuntu-latest
     steps:
       - name: Set up QEMU

.github/workflows/release.yml

@@ -1,21 +1,25 @@
 name: Release
 
 on:
-  push:
-    branches:
-  pull_request:
   release:
     types:
       - published
 
 jobs:
-  build-and-release:
-    name: Build & Release
+  release:
+    name: 'Build, package and release to GitHub'
+
     strategy:
       fail-fast: false
       matrix:
         platform: [ubuntu-latest, macos-latest, windows-latest]
-        alias: [linux, mac, win]
+        include:
+          - platform: ubuntu-latest
+            alias: linux
+          - platform: macos-latest
+            alias: mac
+          - platform: windows-latest
+            alias: win
 
     runs-on: ${{ matrix.platform }}
     steps:
@@ -30,20 +34,7 @@ jobs:
       uses: actions/checkout@v2
 
     - name: Get dependencies
-      run: |
-        go get
-
-    - name: Enable Go 1.11 modules
-      if: runner.os == 'Windows'
-      run: cmd /c "set GO111MODULE=on"
-
-    - name: Unit Tests
-      run: go test ./... -run ./...
-
-    - name: API Tests
-      run: |
-        npm -g install newman
-        ./testing/run_api_tests.sh
+      run: go get
 
     - name: Build
       run: go build -v .
@@ -52,20 +43,14 @@ jobs:
       if: runner.os == 'Windows'
       run: |
         cp .\config.default.yml .\config.yml
-        Compress-Archive -Path .\wakapi.exe, .\config.yml -DestinationPath release.zip
+        Compress-Archive -Path .\wakapi.exe, .\config.yml -DestinationPath wakapi_${{ matrix.alias }}_amd64.zip
     - name: Compress working folder on Unix
       if: runner.os != 'Windows'
       run: |
         cp config.default.yml config.yml
-        zip -9 release.zip wakapi config.yml
+        zip -9 wakapi_${{ matrix.alias }}_amd64.zip wakapi config.yml
 
     - name: Upload built executable to Release
-      if: github.event_name == 'release'
-      uses: actions/upload-release-asset@v1.0.2
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      uses: softprops/action-gh-release@v1
       with:
-        upload_url: ${{ github.event.release.upload_url }}
-        asset_path: release.zip
-        asset_name: wakapi_${{ matrix.alias }}_amd64.zip
-        asset_content_type: application/gzip
+        files: wakapi_${{ matrix.alias }}_amd64.zip

README.md

@@ -100,19 +100,22 @@ If you want to run Wakapi on **Kubernetes**, there is [wakapi-helm-chart](https:
 #### Compile & run
 
 ```bash
-# Build the executable
-$ go build -o wakapi
+# Build and install
+# Alternatively: go build -o wakapi
+$ go install github.com/muety/wakapi@latest
 
-# Adapt config to your needs
-$ cp config.default.yml config.yml
-$ vi config.yml
+# Get default config and customize
+$ curl -o wakapi.yml https://raw.githubusercontent.com/muety/wakapi/master/config.default.yml
+$ vi wakapi.yml
 
 # Run it
-$ ./wakapi
+$ ./wakapi -config wakapi.yml
 ```
 
 **Note:** Check the comments in `config.yml` for best practices regarding security configuration and more.
 
+💡 When running Wakapi standalone (without Docker), it is recommended to run it as a [SystemD service](etc/wakapi.service). 
+
 ### 💻 Client setup
 
 Wakapi relies on the open-source [WakaTime](https://github.com/wakatime/wakatime) client tools. In order to collect statistics for Wakapi, you need to set them up.
@@ -123,8 +126,8 @@ Wakapi relies on the open-source [WakaTime](https://github.com/wakatime/wakatime
 ```ini
 [settings]
 
-# Your Wakapi server URL or 'https://wakapi.dev' when using the cloud server
-api_url = http://localhost:3000/api/heartbeat
+# Your Wakapi server URL or 'https://wakapi.dev/api' when using the cloud server
+api_url = http://localhost:3000/api
 
 # Your Wakapi API key (get it from the web interface after having created an account)
 api_key = 406fe41f-6d69-4183-a4cc-121e0c524c2b
@@ -145,7 +148,7 @@ You can specify configuration options either via a config file (default: `config
 | `app.inactive_days` /<br>`WAKAPI_INACTIVE_DAYS`                              | `7`                                              | Number of days after which to consider a user inactive (only for metrics)                                                                                                |
 | `app.heartbeat_max_age /`<br>`WAKAPI_HEARTBEAT_MAX_AGE`                      | `4320h`                                          | Maximum acceptable age of a heartbeat (see [`ParseDuration`](https://pkg.go.dev/time#ParseDuration))                                                                     |
 | `app.custom_languages`                                                       | -                                                | Map from file endings to language names                                                                                                                                  |
-| `app.avatar_url_template`                                                    | (see [`config.default.yml`](config.default.yml)) | URL template for external user avatar images (e.g. from [Dicebear](https://dicebear.com) or [Gravatar](https://gravatar.com))                                            |
+| `app.avatar_url_template` /<br>`WAKAPI_AVATAR_URL_TEMPLATE`                  | (see [`config.default.yml`](config.default.yml)) | URL template for external user avatar images (e.g. from [Dicebear](https://dicebear.com) or [Gravatar](https://gravatar.com))                                            |
 | `server.port` /<br> `WAKAPI_PORT`                                            | `3000`                                           | Port to listen on                                                                                                                                                        |
 | `server.listen_ipv4` /<br> `WAKAPI_LISTEN_IPV4`                              | `127.0.0.1`                                      | IPv4 network address to listen on (leave blank to disable IPv4)                                                                                                          |
 | `server.listen_ipv6` /<br> `WAKAPI_LISTEN_IPV6`                              | `::1`                                            | IPv6 network address to listen on (leave blank to disable IPv6)                                                                                                          |

config/config.go

@@ -70,7 +70,7 @@ type appConfig struct {
 	InactiveDays      int                          `yaml:"inactive_days" default:"7" env:"WAKAPI_INACTIVE_DAYS"`
 	HeartbeatMaxAge   string                       `yaml:"heartbeat_max_age" default:"4320h" env:"WAKAPI_HEARTBEAT_MAX_AGE"`
 	CountCacheTTLMin  int                          `yaml:"count_cache_ttl_min" default:"30" env:"WAKAPI_COUNT_CACHE_TTL_MIN"`
-	AvatarURLTemplate string                       `yaml:"avatar_url_template" default:"api/avatar/{username_hash}.svg"`
+	AvatarURLTemplate string                       `yaml:"avatar_url_template" default:"api/avatar/{username_hash}.svg" env:"WAKAPI_AVATAR_URL_TEMPLATE"`
 	CustomLanguages   map[string]string            `yaml:"custom_languages"`
 	Colors            map[string]map[string]string `yaml:"-"`
 }

etc/wakapi.service

@@ -0,0 +1,53 @@
+[Unit]
+Description=Wakapi
+StartLimitIntervalSec=400
+StartLimitBurst=3
+
+# Optional, in case you're running MySQL / Postgres with Systemd, too
+Requires=mysql.service
+After=mysql.service
+
+[Service]
+Type=simple
+
+# Assuming Wakapi executable is under /opt/wakapi and config file at /etc
+# Feel free to change this
+WorkingDirectory=/opt/wakapi
+ExecStart=/opt/wakapi/wakapi -config /etc/wakapi.yml
+
+# Environment variables, see README for more
+Environment=WAKAPI_DB_HOST=localhost
+Environment=WAKAPI_DB_USER=wakapi
+Environment=WAKAPI_DB_NAME=wakapi
+Environment=WAKAPI_DB_PASSWORD=secretpassword
+Environment=WAKAPI_PASSWORD_SALT=somerandomstring
+
+# TODO: Use Systemd's credentials management (https://systemd.io/CREDENTIALS/) introduced in v247 (%d syntax in v250) once more established
+
+# sudo groupadd wakapi
+# sudo useradd -g wakapi wakapi
+User=wakapi
+Group=wakapi
+
+Restart=on-failure
+RestartSec=90
+
+# Security hardening
+PrivateTmp=true
+PrivateUsers=true
+NoNewPrivileges=true
+ProtectSystem=full
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+PrivateDevices=true
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+ProtectClock=true
+RestrictSUIDSGID=true
+ProtectHostname=true
+ProtectProc=invisible
+
+[Install]
+WantedBy=multi-user.target