.forgejo/workflows/build.yaml

@@ -15,7 +15,7 @@ jobs:
       - name: Check out repository code
         uses: actions/checkout@v4
       - name: Setup Zig
-        uses: https://github.com/mlugg/setup-zig@v2.2.1
+        uses: https://codeberg.org/mlugg/setup-zig@v2.2.1
       - name: Build project
         run: zig build --summary all
       - name: Run tests

src/Config.zig

@@ -71,7 +71,7 @@ pub fn load(allocator: std.mem.Allocator, env: *const std.process.Environ.Map) !
     defer allocator.free(default_cache_dir);
 
     return .{
-        .listen_host = try allocator.dupe(u8, env.get("WTTR_LISTEN_HOST") orelse "0.0.0.0"),
+        .listen_host = env.get("WTTR_LISTEN_HOST") orelse try allocator.dupe(u8, "0.0.0.0"),
         .listen_port = if (env.get("WTTR_LISTEN_PORT")) |p|
             try std.fmt.parseInt(u16, p, 10)
         else
@@ -181,19 +181,3 @@ test "config loads defaults" {
     try std.testing.expectEqual(@as(u16, 8002), cfg.listen_port);
     try std.testing.expectEqual(@as(usize, 10_000), cfg.cache_size);
 }
-
-test "config owns WTTR_LISTEN_HOST independently of the environment map" {
-    const allocator = std.testing.allocator;
-    var env: std.process.Environ.Map = .init(allocator);
-    // Declared first so it runs last, matching `main`: the config is torn down
-    // while the environment map is still alive, then the map frees its values.
-    // A config that borrowed the map's string would free it twice.
-    defer env.deinit();
-    try env.put("WTTR_CACHE_DIR", @import("build_options").cache_dir);
-    try env.put("WTTR_LISTEN_HOST", "127.0.0.1");
-
-    const cfg = try Config.load(allocator, &env);
-    defer cfg.deinit(allocator);
-
-    try std.testing.expectEqualStrings("127.0.0.1", cfg.listen_host);
-}

src/location/Ip2location.zig

@@ -13,6 +13,7 @@ allocator: Allocator,
 /// every method that touches a file or the network.
 io: std.Io,
 api_key: ?[]const u8,
+http_client: std.http.Client,
 cache: *Cache,
 
 pub fn init(allocator: Allocator, io: std.Io, api_key: ?[]const u8, cache_path: []const u8) !Self {
@@ -23,6 +24,7 @@ pub fn init(allocator: Allocator, io: std.Io, api_key: ?[]const u8, cache_path:
         .allocator = allocator,
         .io = io,
         .api_key = if (api_key) |k| try allocator.dupe(u8, k) else null,
+        .http_client = std.http.Client{ .allocator = allocator, .io = io },
         .cache = cache,
     };
 }
@@ -30,6 +32,7 @@ pub fn init(allocator: Allocator, io: std.Io, api_key: ?[]const u8, cache_path:
 pub fn deinit(self: *Self) void {
     self.cache.deinit();
     self.allocator.destroy(self.cache);
+    self.http_client.deinit();
     if (self.api_key) |k|
         self.allocator.free(k);
 }
@@ -103,15 +106,9 @@ fn fetch(self: *Self, ip_str: []const u8) !Location {
     if (self.api_key) |key|
         try w.print("&key={s}", .{key});
 
-    // A fresh client per request, deliberately: a long-lived `std.http.Client`
-    // validates certificates against the time of its first request. See the
-    // matching comment in `IpWhoIs.fetch` for the failure this prevents.
-    var client: std.http.Client = .{ .allocator = self.allocator, .io = self.io };
-    defer client.deinit();
-
     var response_buf: [4096]u8 = undefined;
     var writer = std.Io.Writer.fixed(&response_buf);
-    const result = try client.fetch(.{
+    const result = try self.http_client.fetch(.{
         .location = .{ .url = w.buffered() },
         .method = .GET,
         .response_writer = &writer,

src/location/IpWhoIs.zig

@@ -11,6 +11,7 @@ const log = std.log.scoped(.ipwhois);
 allocator: Allocator,
 /// Zig 0.16 requires an explicit `Io` for filesystem and HTTP work.
 io: std.Io,
+http_client: std.http.Client,
 cache: *Cache,
 
 pub fn init(allocator: Allocator, io: std.Io, cache_path: []const u8) !Self {
@@ -20,6 +21,7 @@ pub fn init(allocator: Allocator, io: std.Io, cache_path: []const u8) !Self {
     return .{
         .allocator = allocator,
         .io = io,
+        .http_client = std.http.Client{ .allocator = allocator, .io = io },
         .cache = cache,
     };
 }
@@ -27,6 +29,7 @@ pub fn init(allocator: Allocator, io: std.Io, cache_path: []const u8) !Self {
 pub fn deinit(self: *Self) void {
     self.cache.deinit();
     self.allocator.destroy(self.cache);
+    self.http_client.deinit();
 }
 
 pub fn lookup(self: *Self, ip_str: []const u8) ?Location {
@@ -66,20 +69,9 @@ fn fetch(self: *Self, ip_str: []const u8) !Location {
     // which cannot be derived from `country` without matching display text.
     try w.writeAll("?fields=city,region,country,country_code,latitude,longitude&output=json");
 
-    // A fresh client per request, deliberately. `std.http.Client` latches the
-    // wall clock into `now` on its first HTTPS request and validates every
-    // later certificate against that frozen time. A client kept for the life of
-    // the server therefore rejects any certificate issued after its first
-    // lookup (`CertificateNotYetValid`, which std reports only as
-    // `TlsInitializationFailed`), so lookups start failing as soon as the
-    // provider rotates its certificate and keep failing until a restart.
-    // Lookups are cached permanently, so the per-request CA bundle scan is rare.
-    var client: std.http.Client = .{ .allocator = self.allocator, .io = self.io };
-    defer client.deinit();
-
     var response_buf: [4096]u8 = undefined;
     var writer = std.Io.Writer.fixed(&response_buf);
-    const result = try client.fetch(.{
+    const result = try self.http_client.fetch(.{
         .location = .{ .url = w.buffered() },
         .method = .GET,
         .response_writer = &writer,