merge main into dev

2025-01-20 11:47:38 +00:00 · 2025-01-20 11:47:38 +00:00 · 35d3ce5c5d
parent ea3a386601 cdcc7466e5
commit 35d3ce5c5d
31 changed files with 423 additions and 174 deletions
--- a/.air.toml
+++ b/.air.toml
@ -7,7 +7,7 @@ tmp_dir = "tmp"
  bin = "./tmp/main"
  cmd = "go build -o ./tmp/main ."
  delay = 1000
-  exclude_dir = ["admin/static", "public", "uploads", "test", "db"]
+  exclude_dir = ["admin/static", "admin\\static", "public", "uploads", "test", "db", "res"]
  exclude_file = []
  exclude_regex = ["_test.go"]
  exclude_unchanged = false
--- a/.gitignore
+++ b/.gitignore
@ -4,4 +4,6 @@ db/
 tmp/
 test/
 uploads/
-docker-compose-test.yml
+docker-compose*.yml
+!docker-compose.example.yml
+config*.toml
--- a/README.md
+++ b/README.md
@ -4,25 +4,36 @@ home to your local SPACEGIRL! 💫

 ---

-built up from the initial [static](https://git.arimelody.me/ari/arimelody.me-static) branch, this powerful, server-side rendered version comes complete with live updates, powered by a new database and super handy admin panel!
+built up from the initial [static](https://git.arimelody.me/ari/arimelody.me-static)
+branch, this powerful, server-side rendered version comes complete with live
+updates, powered by a new database and handy admin panel!

-the admin panel currently facilitates live updating of my music discography, though i plan to expand it towards art portfolio and blog posts in the future. if all goes well, i'd like to later separate these components into their own library for others to use in their own sites. exciting stuff!
+the admin panel currently facilitates live updating of my music discography,
+though i plan to expand it towards art portfolio and blog posts in the future.
+if all goes well, i'd like to later separate these components into their own
+library for others to use in their own sites. exciting stuff!

 ## build

-easy! just `git clone` this repo and `go build` from the root. `arimelody-web(.exe)` should be generated.
+- `git clone` this repo, and `cd` into it.
+- `go build -o arimelody-web .`

 ## running

-the webserver depends on some environment variables (don't worry about forgetting some; it'll be sure to bug you about them):
+the server should be run once to generate a default `config.toml` file.
+configure as needed. note that a valid DB connection is required, and the admin
+panel will be disabled without valid discord app credentials (this can however
+be bypassed by running the server with `-adminBypass`).

- `HTTP_DOMAIN`: the domain the webserver will use for generating oauth redirect URIs (default `https://arimelody.me`)
- `DISCORD_ADMIN`[^1]: the user ID of your discord account (discord auth is intended to be temporary, and will be replaced with its own auth system later)
- `DISCORD_CLIENT`[^1]: the client ID of your discord OAuth application.
- `DISCORD_SECRET`[^1]: the client secret of your discord OAuth application.
+the configuration may be overridden using environment variables in the format
+`ARIMELODY_<SECTION_NAME>_<KEY_NAME>`. for example, `db.host` in the config may
+be overridden with `ARIMELODY_DB_HOST`.

-[^1]: not required, but the admin panel will be **disabled** if these are not provided.
+the location of the configuration file can also be overridden with
+`ARIMELODY_CONFIG`.

-the webserver requires a database to run. in this case, postgres.
+## database

-the [docker compose script](docker-compose.yml) contains the basic requirements to get you up and running, though it does not currently initialise the schema on first run. you'll need to `docker compose exec -it arimelody.me-db-1` to access the database container while it's running, run `psql -U arimelody` to get a postgres shell, and copy/paste the contents of [schema.sql](schema.sql) to initialise the database. i'll build an automated initialisation script later ;p
+the server requires a postgres database to run. you can use the
+[schema.sql](schema.sql) provided in this repo to generate the required tables.
+automatic schema building/migration may come in a future update.
--- a/admin/admin.go
+++ b/admin/admin.go
@ -3,7 +3,6 @@ package admin
 import (
 	"fmt"
 	"math/rand"
-	"os"
 	"time"

 	"arimelody-web/global"
@ -28,20 +27,12 @@ var ADMIN_BYPASS = func() bool {
    return false
 }()

-var ADMIN_ID_DISCORD = func() string {
-    id := os.Getenv("DISCORD_ADMIN")
-    if id == "" {
-        // fmt.Printf("WARN: Discord admin ID (DISCORD_ADMIN) was not provided.\n")
-    }
-    return id
-}()
-
 var sessions []*Session

-func createSession(username string, expires time.Time) Session {
+func createSession(userID string, expires time.Time) Session {
    return Session{
        Token: string(generateToken()),
-        UserID: username,
+        UserID: userID,
        Expires: expires,
    }
 }
--- a/admin/http.go
+++ b/admin/http.go
@ -8,11 +8,13 @@ import (
 	"path/filepath"
 	"strings"
 	"time"
+    "encoding/json"

-	"arimelody-web/discord"
 	"arimelody-web/global"
 	"arimelody-web/controller"
 	"arimelody-web/model"
+
+	"golang.org/x/crypto/bcrypt"
 )

 type loginData struct {
@ -149,52 +151,57 @@ func GetSession(r *http.Request) *Session {

 func LoginHandler() http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-        if !discord.CREDENTIALS_PROVIDED || ADMIN_ID_DISCORD == "" {
-            http.Error(w, http.StatusText(http.StatusServiceUnavailable), http.StatusServiceUnavailable)
-            return
-        }
-
-        fmt.Println(discord.CLIENT_ID)
-        fmt.Println(discord.API_ENDPOINT)
-        fmt.Println(discord.REDIRECT_URI)
-
-        code := r.URL.Query().Get("code")
-
-        if code == "" {
-            pages["login"].Execute(w, loginData{DiscordURI: discord.REDIRECT_URI})
-            return
-        }
-
-        auth_token, err := discord.GetOAuthTokenFromCode(code)
+        if r.Method == http.MethodGet {
+            err := pages["login"].Execute(w, nil)
            if err != nil {
-            fmt.Printf("Failed to retrieve discord access token: %s\n", err)
+                fmt.Printf("Error rendering admin login page: %s\n", err)
                http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
                return
            }
+            return
+        }

-        discord_user, err := discord.GetDiscordUserFromAuth(auth_token)
+        if r.Method != http.MethodPost {
+            http.NotFound(w, r);
+            return
+        }
+
+        type LoginRequest struct {
+            Username string `json:"username"`
+            Password string `json:"password"`
+            TOTP string `json:"totp"`
+        }
+
+        data := LoginRequest{}
+        err := json.NewDecoder(r.Body).Decode(&data)
        if err != nil {
-            fmt.Printf("Failed to retrieve discord user information: %s\n", err)
-            http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
+            http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest)
            return
        }

-        if discord_user.ID != ADMIN_ID_DISCORD {
-            // TODO: unauthorized user; revoke the token
-            fmt.Printf("Unauthorized login attempted: %s\n", discord_user.ID)
-            http.Error(w, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
+        account, err := controller.GetAccount(global.DB, data.Username)
+        if err != nil {
+            http.Error(w, "No account exists with this username and password.", http.StatusBadRequest)
            return
        }

+        err = bcrypt.CompareHashAndPassword(account.Password, []byte(data.Password))
+        if err != nil {
+            http.Error(w, "No account exists with this username and password.", http.StatusBadRequest)
+            return
+        }
+
+        // TODO: check TOTP
+
        // login success!
-        session := createSession(discord_user.Username, time.Now().Add(24 * time.Hour))
+        session := createSession(account.ID, time.Now().Add(24 * time.Hour))
        sessions = append(sessions, &session)

        cookie := http.Cookie{}
        cookie.Name = "token"
        cookie.Value = session.Token
        cookie.Expires = time.Now().Add(24 * time.Hour)
-        if strings.HasPrefix(global.HTTP_DOMAIN, "https") {
+        if strings.HasPrefix(global.Config.BaseUrl, "https") {
            cookie.Secure = true
        }
        cookie.HttpOnly = true
--- a/api/artist.go
+++ b/api/artist.go
@ -27,7 +27,9 @@ func ServeAllArtists() http.Handler {
 		}

 		w.Header().Add("Content-Type", "application/json")
-        err = json.NewEncoder(w).Encode(artists)
+        encoder := json.NewEncoder(w)
+        encoder.SetIndent("", "\t")
+        err = encoder.Encode(artists)
 		if err != nil {
 			http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
 		}
@ -74,7 +76,9 @@ func ServeArtist(artist *model.Artist) http.Handler {
        }

 		w.Header().Add("Content-Type", "application/json")
-        err = json.NewEncoder(w).Encode(artistJSON{
+        encoder := json.NewEncoder(w)
+        encoder.SetIndent("", "\t")
+        err = encoder.Encode(artistJSON{
            Artist: artist,
            Credits: credits,
        })
--- a/api/release.go
+++ b/api/release.go
@ -104,7 +104,9 @@ func ServeRelease(release *model.Release) http.Handler {
        }

 		w.Header().Add("Content-Type", "application/json")
-        err := json.NewEncoder(w).Encode(response)
+        encoder := json.NewEncoder(w)
+        encoder.SetIndent("", "\t")
+        err := encoder.Encode(response)
 		if err != nil {
 			http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
 			return
@ -155,7 +157,9 @@ func ServeCatalog() http.Handler {
        }

        w.Header().Add("Content-Type", "application/json")
-        err = json.NewEncoder(w).Encode(catalog)
+        encoder := json.NewEncoder(w)
+        encoder.SetIndent("", "\t")
+        err = encoder.Encode(catalog)
        if err != nil {
            http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
            return
@ -204,7 +208,9 @@ func CreateRelease() http.Handler {

        w.Header().Add("Content-Type", "application/json")
        w.WriteHeader(http.StatusCreated)
-        err = json.NewEncoder(w).Encode(release)
+        encoder := json.NewEncoder(w)
+        encoder.SetIndent("", "\t")
+        err = encoder.Encode(release)
        if err != nil {
            fmt.Printf("WARN: Release %s created, but failed to send JSON response: %s\n", release.ID, err)
            http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
--- a/api/track.go
+++ b/api/track.go
@ -40,7 +40,9 @@ func ServeAllTracks() http.Handler {
        }

 		w.Header().Add("Content-Type", "application/json")
-        err = json.NewEncoder(w).Encode(tracks)
+        encoder := json.NewEncoder(w)
+        encoder.SetIndent("", "\t")
+        err = encoder.Encode(tracks)
 		if err != nil {
            fmt.Printf("FATAL: Failed to serve all tracks: %s\n", err)
 			http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
@ -62,7 +64,9 @@ func ServeTrack(track *model.Track) http.Handler {
        }

 		w.Header().Add("Content-Type", "application/json")
-        err = json.NewEncoder(w).Encode(Track{ track, releases })
+        encoder := json.NewEncoder(w)
+        encoder.SetIndent("", "\t")
+        err = encoder.Encode(Track{ track, releases })
 		if err != nil {
            fmt.Printf("FATAL: Failed to serve track %s: %s\n", track.ID, err)
 			http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
@ -128,7 +132,9 @@ func UpdateTrack(track *model.Track) http.Handler {
        }

        w.Header().Add("Content-Type", "application/json")
-        err = json.NewEncoder(w).Encode(track)
+        encoder := json.NewEncoder(w)
+        encoder.SetIndent("", "\t")
+        err = encoder.Encode(track)
        if err != nil {
            http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
        }
--- a/api/uploads.go
+++ b/api/uploads.go
@ -1,6 +1,7 @@
 package api

 import (
+	"arimelody-web/global"
 	"bufio"
 	"encoding/base64"
 	"errors"
@ -15,6 +16,7 @@ func HandleImageUpload(data *string, directory string, filename string) (string,
 	header := split[0]
 	imageData, err := base64.StdEncoding.DecodeString(split[1])
 	ext, _ := strings.CutPrefix(header, "data:image/")
+    directory = filepath.Join(global.Config.DataDirectory, directory)

 	switch ext {
 	case "png":
--- a/bundle.sh
+++ b/bundle.sh
@ -0,0 +1,9 @@
+#!/bin/bash
+# simple script to pack up arimelody.me for production distribution
+
+if [ ! -f arimelody-web ]; then
+    echo "[FATAL] ./arimelody-web not found! please run \`go build -o arimelody-web\` first."
+    exit 1
+fi
+
+tar czvf arimelody-web.tar.gz arimelody-web admin/components/ admin/views/ admin/static/ views/ public/
--- a/discord/discord.go
+++ b/discord/discord.go
@ -6,7 +6,6 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
-	"os"
 	"strings"

 	"arimelody-web/global"
@ -16,7 +15,7 @@ const API_ENDPOINT = "https://discord.com/api/v10"

 var CREDENTIALS_PROVIDED = true
 var CLIENT_ID = func() string {
-    id := os.Getenv("DISCORD_CLIENT")
+    id := global.Config.Discord.ClientID
    if id == "" {
        // fmt.Printf("WARN: Discord client ID (DISCORD_CLIENT) was not provided.\n")
        CREDENTIALS_PROVIDED = false
@ -24,14 +23,14 @@ var CLIENT_ID = func() string {
    return id
 }()
 var CLIENT_SECRET = func() string {
-    secret := os.Getenv("DISCORD_SECRET")
+    secret := global.Config.Discord.Secret
    if secret == "" {
        // fmt.Printf("WARN: Discord secret (DISCORD_SECRET) was not provided.\n")
        CREDENTIALS_PROVIDED = false
    }
    return secret
 }()
-var OAUTH_CALLBACK_URI = fmt.Sprintf("%s/admin/login", global.HTTP_DOMAIN)
+var OAUTH_CALLBACK_URI = fmt.Sprintf("%s/admin/login", global.Config.BaseUrl)
 var REDIRECT_URI = fmt.Sprintf("https://discord.com/oauth2/authorize?client_id=%s&response_type=code&redirect_uri=%s&scope=identify", CLIENT_ID, OAUTH_CALLBACK_URI)

 type (
--- a/docker-compose.example.yml
+++ b/docker-compose.example.yml
@ -0,0 +1,23 @@
+services:
+  web:
+    image: docker.arimelody.me/arimelody.me:latest
+    build: .
+    ports:
+      - 8080:8080
+    volumes:
+      - ./uploads:/app/uploads
+      - ./config.toml:/app/config.toml
+    environment:
+      ARIMELODY_CONFIG: config.toml
+  db:
+    image: postgres:16.1-alpine3.18
+    volumes:
+      - arimelody-db:/var/lib/postgresql/data
+    environment:
+      POSTGRES_DB: # your database name here!
+      POSTGRES_USER: # your database user here!
+      POSTGRES_PASSWORD: # your database password here!
+
+volumes:
+  arimelody-db:
+    external: true
--- a/docker-compose.yml
+++ b/docker-compose.yml
@ -1,26 +0,0 @@
-services:
-  web:
-    image: docker.arimelody.me/arimelody.me:latest
-    build: .
-    ports:
-      - 8080:8080
-    volumes:
-      - ./uploads:/app/uploads
-    environment:
-      HTTP_DOMAIN: "https://arimelody.me"
-      ARIMELODY_DB_HOST: db
-      DISCORD_ADMIN: # your discord user ID.
-      DISCORD_CLIENT: # your discord OAuth client ID.
-      DISCORD_SECRET: # your discord OAuth secret.
-    depends_on:
-      - db
-    restart: unless-stopped
-  db:
-    image: postgres:16.1-alpine3.18
-    volumes:
-      - ./db:/var/lib/postgresql/data
-    environment:
-      POSTGRES_DB: arimelody
-      POSTGRES_USER: arimelody
-      POSTGRES_PASSWORD: fuckingpassword
-    restart: unless-stopped
--- a/global/config.go
+++ b/global/config.go
@ -0,0 +1,121 @@
+package global
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+
+	"github.com/jmoiron/sqlx"
+	"github.com/pelletier/go-toml/v2"
+)
+
+type (
+    dbConfig struct {
+        Host string `toml:"host"`
+        Name string `toml:"name"`
+        User string `toml:"user"`
+        Pass string `toml:"pass"`
+    }
+
+    discordConfig struct {
+        AdminID string `toml:"admin_id" comment:"NOTE: admin_id to be deprecated in favour of local accounts and SSO."`
+        ClientID string `toml:"client_id"`
+        Secret string `toml:"secret"`
+    }
+
+    config struct {
+        BaseUrl string `toml:"base_url" comment:"Used for OAuth redirects."`
+        Port int64 `toml:"port"`
+        DataDirectory string `toml:"data_dir"`
+        DB dbConfig `toml:"db"`
+        Discord discordConfig `toml:"discord"`
+    }
+)
+
+var Config = func() config {
+    configFile := os.Getenv("ARIMELODY_CONFIG")
+    if configFile == "" {
+        configFile = "config.toml"
+    }
+
+    config := config{
+        BaseUrl: "https://arimelody.me",
+        Port: 8080,
+    }
+
+    data, err := os.ReadFile(configFile)
+    if err != nil {
+        configOut, _ := toml.Marshal(&config)
+        os.WriteFile(configFile, configOut, os.ModePerm)
+        fmt.Printf(
+            "A default config.toml has been created. " +
+            "Please configure before running again!\n")
+        os.Exit(0)
+    }
+
+    err = toml.Unmarshal([]byte(data), &config)
+    if err != nil {
+        fmt.Fprintf(os.Stderr, "FATAL: Failed to parse configuration file: %s\n", err.Error())
+        os.Exit(1)
+    }
+
+    err = handleConfigOverrides(&config)
+    if err != nil {
+        fmt.Fprintf(os.Stderr, "FATAL: Failed to parse environment variable %s\n", err.Error())
+        os.Exit(1)
+    }
+
+    return config
+}()
+
+func handleConfigOverrides(config *config) error {
+    var err error
+
+    if env, has := os.LookupEnv("ARIMELODY_BASE_URL"); has { config.BaseUrl = env }
+    if env, has := os.LookupEnv("ARIMELODY_PORT"); has {
+        config.Port, err = strconv.ParseInt(env, 10, 0)
+        if err != nil { return errors.New("ARIMELODY_PORT: " + err.Error()) }
+    }
+    if env, has := os.LookupEnv("ARIMELODY_DATA_DIR"); has { config.DataDirectory = env }
+
+    if env, has := os.LookupEnv("ARIMELODY_DB_HOST"); has { config.DB.Host = env }
+    if env, has := os.LookupEnv("ARIMELODY_DB_NAME"); has { config.DB.Name = env }
+    if env, has := os.LookupEnv("ARIMELODY_DB_USER"); has { config.DB.User = env }
+    if env, has := os.LookupEnv("ARIMELODY_DB_PASS"); has { config.DB.Pass = env }
+
+    if env, has := os.LookupEnv("ARIMELODY_DISCORD_ADMIN_ID"); has { config.Discord.AdminID = env }
+    if env, has := os.LookupEnv("ARIMELODY_DISCORD_CLIENT_ID"); has { config.Discord.ClientID = env }
+    if env, has := os.LookupEnv("ARIMELODY_DISCORD_SECRET"); has { config.Discord.Secret = env }
+
+    return nil
+}
+
+var Args = func() map[string]string {
+    args := map[string]string{}
+    
+    index := 0
+    for index < len(os.Args[1:]) {
+        arg := os.Args[index + 1]
+        if !strings.HasPrefix(arg, "-") {
+            fmt.Printf("FATAL: Parameters must follow an argument (%s).\n", arg)
+            os.Exit(1)
+        }
+
+        if index + 3 > len(os.Args) || strings.HasPrefix(os.Args[index + 2], "-") {
+            args[arg[1:]] = "true"
+            index += 1
+            continue
+        }
+
+        val := os.Args[index + 2]
+        args[arg[1:]] = val
+        // fmt.Printf("%s: %s\n", arg[1:], val)
+        index += 2
+    }
+
+    return args
+}()
+
+var DB *sqlx.DB
--- a/global/data.go
+++ b/global/data.go
@ -1,54 +0,0 @@
-package global
-
-import (
-	"fmt"
-	"os"
-	"strings"
-
-	"github.com/jmoiron/sqlx"
-)
-
-var Args = func() map[string]string {
-    args := map[string]string{}
-    
-    index := 0
-    for index < len(os.Args[1:]) {
-        arg := os.Args[index + 1]
-        if !strings.HasPrefix(arg, "-") {
-            fmt.Printf("FATAL: Parameters must follow an argument (%s).\n", arg)
-            os.Exit(1)
-        }
-
-        if index + 3 > len(os.Args) || strings.HasPrefix(os.Args[index + 2], "-") {
-            args[arg[1:]] = "true"
-            index += 1
-            continue
-        }
-
-        val := os.Args[index + 2]
-        args[arg[1:]] = val
-        // fmt.Printf("%s: %s\n", arg[1:], val)
-        index += 2
-    }
-
-    return args
-}()
-
-var HTTP_DOMAIN = func() string {
-    domain := os.Getenv("HTTP_DOMAIN")
-    if domain == "" {
-        return "https://arimelody.me"
-    }
-    return domain
-}()
-
-var APP_SECRET = func() string {
-    secret := os.Getenv("ARIMELODY_SECRET")
-    if secret == "" {
-        fmt.Fprintln(os.Stderr, "FATAL: ARIMELODY_SECRET was not provided. Cannot continue.")
-        os.Exit(1)
-    }
-    return secret
-}()
-
-var DB *sqlx.DB
--- a/global/funcs.go
+++ b/global/funcs.go
@ -2,6 +2,7 @@ package global

 import (
 	"fmt"
+	"math/rand"
 	"net/http"
 	"strconv"
 	"time"
@ -9,10 +10,48 @@ import (
 	"arimelody-web/colour"
 )

+var PoweredByStrings = []string{
+    "nerd rage",
+    "estrogen",
+    "your mother",
+    "awesome powers beyond comprehension",
+    "jared",
+    "the weight of my sins",
+    "the arc reactor",
+    "AA batteries",
+    "15 euro solar panel from ebay",
+    "magnets, how do they work",
+    "a fax machine",
+    "dell optiplex",
+    "a trans girl's nintendo wii",
+    "BASS",
+    "electricity, duh",
+    "seven hamsters in a big wheel",
+    "girls",
+    "mzungu hosting",
+    "golang",
+    "the state of the world right now",
+    "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)",
+    "the good folks at aperture science",
+    "free2play CDs",
+    "aridoodle",
+    "the love of creating",
+    "not for the sake of art; not for the sake of money; we like painting naked people",
+    "30 billion dollars in VC funding",
+}
+
 func DefaultHeaders(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        w.Header().Add("Server", "arimelody.me")
-        w.Header().Add("Cache-Control", "max-age=2592000")
+        w.Header().Add("Do-Not-Stab", "1")
+        w.Header().Add("X-Clacks-Overhead", "GNU Terry Pratchett")
+        w.Header().Add("X-Hacker", "spare me please")
+        w.Header().Add("X-Robots-TXT", "'; DROP TABLE pages;")
+        w.Header().Add("X-Thinking-With", "Portals")
+        w.Header().Add(
+            "X-Powered-By",
+            PoweredByStrings[rand.Intn(len(PoweredByStrings))],
+        )
        next.ServeHTTP(w, r)
    })
 }
--- a/go.mod
+++ b/go.mod
@ -8,3 +8,4 @@ require (
 )

 require golang.org/x/crypto v0.27.0 // indirect
+require github.com/pelletier/go-toml/v2 v2.2.3 // indirect
--- a/go.sum
+++ b/go.sum
@ -10,3 +10,5 @@ github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o
 github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A=
 golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=
+github.com/pelletier/go-toml/v2 v2.2.3 h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNHvL12M=
+github.com/pelletier/go-toml/v2 v2.2.3/go.mod h1:MfCQTFTvCcUyyvvwm1+G6H/jORL20Xlb6rzQu9GuUkc=
--- a/main.go
+++ b/main.go
@ -20,15 +20,42 @@ import (
 	_ "github.com/lib/pq"
 )

-const DEFAULT_PORT int = 8080
+const DEFAULT_PORT int64 = 8080

 func main() {
    // initialise database connection
-    var dbHost = os.Getenv("ARIMELODY_DB_HOST")
-    if dbHost == "" { dbHost = "127.0.0.1" }
+    if env := os.Getenv("ARIMELODY_DB_HOST"); env != "" { global.Config.DB.Host = env }
+    if env := os.Getenv("ARIMELODY_DB_NAME"); env != "" { global.Config.DB.Name = env }
+    if env := os.Getenv("ARIMELODY_DB_USER"); env != "" { global.Config.DB.User = env }
+    if env := os.Getenv("ARIMELODY_DB_PASS"); env != "" { global.Config.DB.Pass = env }
+    if global.Config.DB.Host == "" {
+        fmt.Fprintf(os.Stderr, "FATAL: db.host not provided! Exiting...\n")
+        os.Exit(1)
+    }
+    if global.Config.DB.Name == "" {
+        fmt.Fprintf(os.Stderr, "FATAL: db.name not provided! Exiting...\n")
+        os.Exit(1)
+    }
+    if global.Config.DB.User == "" {
+        fmt.Fprintf(os.Stderr, "FATAL: db.user not provided! Exiting...\n")
+        os.Exit(1)
+    }
+    if global.Config.DB.Pass == "" {
+        fmt.Fprintf(os.Stderr, "FATAL: db.pass not provided! Exiting...\n")
+        os.Exit(1)
+    }

    var err error
-    global.DB, err = initDB("postgres", "host=" + dbHost + " user=arimelody dbname=arimelody password=fuckingpassword sslmode=disable")
+    global.DB, err = sqlx.Connect(
+        "postgres",
+        fmt.Sprintf(
+            "host=%s user=%s dbname=%s password='%s' sslmode=disable",
+            global.Config.DB.Host,
+            global.Config.DB.User,
+            global.Config.DB.Name,
+            global.Config.DB.Pass,
+        ),
+    )
    if err != nil {
        fmt.Fprintf(os.Stderr, "FATAL: Unable to initialise database: %v\n", err)
        os.Exit(1)
@ -75,9 +102,11 @@ func main() {

    // start the web server!
    mux := createServeMux()
-    port := DEFAULT_PORT
-    fmt.Printf("Now serving at http://127.0.0.1:%d\n", port)
-    log.Fatal(http.ListenAndServe(fmt.Sprintf(":%d", port), global.HTTPLog(mux)))
+    fmt.Printf("Now serving at http://127.0.0.1:%d\n", global.Config.Port)
+    log.Fatal(
+        http.ListenAndServe(fmt.Sprintf(":%d", global.Config.Port), 
+        global.HTTPLog(global.DefaultHeaders(mux)),
+    ))
 }

 func initDB(driverName string, dataSourceName string) (*sqlx.DB, error) {
@ -211,8 +240,13 @@ func createServeMux() *http.ServeMux {
    mux.Handle("/admin/", http.StripPrefix("/admin", admin.Handler()))
    mux.Handle("/api/", http.StripPrefix("/api", api.Handler()))
    mux.Handle("/music/", http.StripPrefix("/music", view.MusicHandler()))
-    mux.Handle("/uploads/", http.StripPrefix("/uploads", staticHandler("uploads")))
+    mux.Handle("/uploads/", http.StripPrefix("/uploads", staticHandler(filepath.Join(global.Config.DataDirectory, "uploads"))))
    mux.Handle("/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+        if r.Method == http.MethodHead {
+            w.WriteHeader(http.StatusOK)
+            return
+        }
+
        if r.URL.Path == "/" || r.URL.Path == "/index.html" {
            err := templates.Pages["index"].Execute(w, nil)
            if err != nil {
--- a/public/img/buttons/aikoyori.gif
+++ b/public/img/buttons/aikoyori.gif
--- a/public/img/buttons/ioletsgo.gif
+++ b/public/img/buttons/ioletsgo.gif
--- a/public/img/buttons/ipg.png
+++ b/public/img/buttons/ipg.png
--- a/public/img/buttons/isabelroses.gif
+++ b/public/img/buttons/isabelroses.gif
--- a/public/img/buttons/itzzen.png
+++ b/public/img/buttons/itzzen.png
--- a/public/img/buttons/notnite.png
+++ b/public/img/buttons/notnite.png
--- a/public/img/buttons/retr0id_now.gif
+++ b/public/img/buttons/retr0id_now.gif
--- a/public/img/buttons/stardust.png
+++ b/public/img/buttons/stardust.png
--- a/public/img/buttons/xenia.png
+++ b/public/img/buttons/xenia.png
--- a/public/style/index.css
+++ b/public/style/index.css
@ -107,7 +107,7 @@ ul.links li {
 }

 ul.links li a {
-        padding: .2em .5em;
+        padding: .4em .5em;
        border: 1px solid var(--links);
        color: var(--links);
        border-radius: 2px;
--- a/schema.sql
+++ b/schema.sql
@ -1,18 +1,61 @@
+CREATE SCHEMA arimelody AUTHORIZATION arimelody;
+
+--
+-- Acounts
+--
+CREATE TABLE arimelody.account (
+    id uuid DEFAULT gen_random_uuid(), 
+    username text NOT NULL UNIQUE, 
+    password text NOT NULL, 
+    email text, 
+    avatar_url text
+);
+ALTER TABLE arimelody.account ADD CONSTRAINT account_pk PRIMARY KEY (id);
+
+--
+-- Privilege
+--
+CREATE TABLE arimelody.privilege (
+    account uuid NOT NULL, 
+    privilege text NOT NULL
+);
+ALTER TABLE arimelody.privilege ADD CONSTRAINT privilege_pk PRIMARY KEY (account, privilege);
+
+--
+-- TOTP
+--
+CREATE TABLE arimelody.totp (
+    account uuid NOT NULL, 
+    name text NOT NULL, 
+    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+ALTER TABLE arimelody.totp ADD CONSTRAINT totp_pk PRIMARY KEY (account, name);
+
+--
+-- Invites
+--
+CREATE TABLE arimelody.invite (
+    code text NOT NULL, 
+    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP, 
+    expires_at TIMESTAMP NOT NULL
+);
+ALTER TABLE arimelody.invite ADD CONSTRAINT invite_pk PRIMARY KEY (code);
+
 --
 -- Artists (should be applicable to all art)
 --
-CREATE TABLE public.artist (
+CREATE TABLE arimelody.artist (
    id character varying(64),
    name text NOT NULL,
    website text,
    avatar text
 );
-ALTER TABLE public.artist ADD CONSTRAINT artist_pk PRIMARY KEY (id);
+ALTER TABLE arimelody.artist ADD CONSTRAINT artist_pk PRIMARY KEY (id);

 --
 -- Music releases
 --
-CREATE TABLE public.musicrelease (
+CREATE TABLE arimelody.musicrelease (
    id character varying(64) NOT NULL,
    visible bool DEFAULT false,
    title text NOT NULL,
@ -25,56 +68,59 @@ CREATE TABLE public.musicrelease (
    copyright text,
    copyrightURL text
 );
-ALTER TABLE public.musicrelease ADD CONSTRAINT musicrelease_pk PRIMARY KEY (id);
+ALTER TABLE arimelody.musicrelease ADD CONSTRAINT musicrelease_pk PRIMARY KEY (id);

 --
 -- Music links (external platform links under a release)
 --
-CREATE TABLE public.musiclink (
+CREATE TABLE arimelody.musiclink (
    release character varying(64) NOT NULL,
    name text NOT NULL,
    url text NOT NULL
 );
-ALTER TABLE public.musiclink ADD CONSTRAINT musiclink_pk PRIMARY KEY (release, name);
+ALTER TABLE arimelody.musiclink ADD CONSTRAINT musiclink_pk PRIMARY KEY (release, name);

 --
 -- Music credits (artist credits under a release)
 --
-CREATE TABLE public.musiccredit (
+CREATE TABLE arimelody.musiccredit (
    release character varying(64) NOT NULL,
    artist character varying(64) NOT NULL,
    role text NOT NULL,
    is_primary boolean DEFAULT false
 );
-ALTER TABLE public.musiccredit ADD CONSTRAINT musiccredit_pk PRIMARY KEY (release, artist);
+ALTER TABLE arimelody.musiccredit ADD CONSTRAINT musiccredit_pk PRIMARY KEY (release, artist);

 --
 -- Music tracks (tracks under a release)
 --
-CREATE TABLE public.musictrack (
+CREATE TABLE arimelody.musictrack (
    id uuid DEFAULT gen_random_uuid(),
    title text NOT NULL,
    description text,
    lyrics text,
    preview_url text
 );
-ALTER TABLE public.musictrack ADD CONSTRAINT musictrack_pk PRIMARY KEY (id);
+ALTER TABLE arimelody.musictrack ADD CONSTRAINT musictrack_pk PRIMARY KEY (id);

 --
 -- Music release/track pairs
 --
-CREATE TABLE public.musicreleasetrack (
+CREATE TABLE arimelody.musicreleasetrack (
    release character varying(64) NOT NULL,
    track uuid NOT NULL,
    number integer NOT NULL
 );
-ALTER TABLE public.musicreleasetrack ADD CONSTRAINT musicreleasetrack_pk PRIMARY KEY (release, track);
+ALTER TABLE arimelody.musicreleasetrack ADD CONSTRAINT musicreleasetrack_pk PRIMARY KEY (release, track);

 --
 -- Foreign keys
 --
-ALTER TABLE public.musiccredit ADD CONSTRAINT musiccredit_artist_fk FOREIGN KEY (artist) REFERENCES public.artist(id) ON DELETE CASCADE ON UPDATE CASCADE;
-ALTER TABLE public.musiccredit ADD CONSTRAINT musiccredit_release_fk FOREIGN KEY (release) REFERENCES public.musicrelease(id) ON DELETE CASCADE;
-ALTER TABLE public.musiclink ADD CONSTRAINT musiclink_release_fk FOREIGN KEY (release) REFERENCES public.musicrelease(id) ON UPDATE CASCADE ON DELETE CASCADE;
-ALTER TABLE public.musicreleasetrack ADD CONSTRAINT music_pair_trackref_fk FOREIGN KEY (release) REFERENCES public.musicrelease(id) ON DELETE CASCADE;
-ALTER TABLE public.musicreleasetrack ADD CONSTRAINT music_pair_releaseref_fk FOREIGN KEY (track) REFERENCES public.musictrack(id) ON DELETE CASCADE;
+ALTER TABLE arimelody.privilege ADD CONSTRAINT privilege_account_fk FOREIGN KEY (account) REFERENCES account(id) ON DELETE CASCADE;
+ALTER TABLE arimelody.totp ADD CONSTRAINT totp_account_fk FOREIGN KEY (account) REFERENCES account(id) ON DELETE CASCADE;
+
+ALTER TABLE arimelody.musiccredit ADD CONSTRAINT musiccredit_artist_fk FOREIGN KEY (artist) REFERENCES artist(id) ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE arimelody.musiccredit ADD CONSTRAINT musiccredit_release_fk FOREIGN KEY (release) REFERENCES musicrelease(id) ON DELETE CASCADE;
+ALTER TABLE arimelody.musiclink ADD CONSTRAINT musiclink_release_fk FOREIGN KEY (release) REFERENCES musicrelease(id) ON UPDATE CASCADE ON DELETE CASCADE;
+ALTER TABLE arimelody.musicreleasetrack ADD CONSTRAINT music_pair_trackref_fk FOREIGN KEY (release) REFERENCES musicrelease(id) ON DELETE CASCADE;
+ALTER TABLE arimelody.musicreleasetrack ADD CONSTRAINT music_pair_releaseref_fk FOREIGN KEY (track) REFERENCES musictrack(id) ON DELETE CASCADE;
--- a/views/index.html
+++ b/views/index.html
@ -129,12 +129,17 @@
                OpenTerminal
            </a>
        </li>
+        <li>
+            <a href="https://silver.bliss.town/" target="_blank">
+                Silver.js
+            </a>
+        </li>
    </ul>

    <hr>

    <h2 class="typeout">
-        ## cool people
+        ## cool critters
    </h2>

    <div id="web-buttons">
@ -153,8 +158,29 @@
        <a href="https://elke.cafe" target="_blank">
            <img src="/img/buttons/elke.gif" alt="elke web button" width="88" height="31">
        </a>
-        <a href="https://itzzen.net" target="_blank">
-            <img src="/img/buttons/itzzen.png" alt="itzzen web button" width="88" height="31">
+        <a href="https://invoxiplaygames.uk/" target="_blank">
+            <img src="/img/buttons/ipg.png" alt="InvoxiPlayGames web button" width="88" height="31">
+        </a>
+        <a href="https://ioletsgo.gay" target="_blank">
+            <img src="/img/buttons/ioletsgo.gif" alt="ioletsgo web button" width="88" height="31">
+        </a>
+        <a href="https://notnite.com/" target="_blank">
+            <img src="/img/buttons/notnite.png" alt="notnite web button" width="88" height="31">
+        </a>
+        <a href="https://www.da.vidbuchanan.co.uk/" target="_blank">
+            <img src="/img/buttons/retr0id_now.gif" alt="retr0id web button" width="88" height="31">
+        </a>
+        <a href="https://aikoyori.xyz" target="_blank">
+            <img src="/img/buttons/aikoyori.gif" alt="aikoyori web button" width="88" height="31">
+        </a>
+        <a href="https://xenia.blahaj.land/" target="_blank">
+            <img src="/img/buttons/xenia.png" alt="xenia web button" width="88" height="31">
+        </a>
+        <a href="https://stardust.elysium.gay/" target="_blank">
+            <img src="/img/buttons/stardust.png" alt="stardust web button" width="88" height="31">
+        </a>
+        <a href="https://isabelroses.com/" target="_blank">
+            <img src="/img/buttons/isabelroses.gif" alt="isabel roses web button" width="88" height="31">
        </a>

        <hr>