staging

.env.example

@@ -28,4 +28,3 @@ POLAR_WEBHOOK_SECRET=
 POLAR_MODE=
 POLAR_SUCCESS_URL=
 ADMIN_EMAIL=
-ADMIN_PASSWORD_HASH=

.github/workflows/ci.yml

@@ -48,9 +48,21 @@ jobs:
     needs: ci
     if: github.ref == 'refs/heads/staging' && github.event_name == 'push'
     runs-on: ubuntu-latest
+    env:
+      TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
+      TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
+      PROCESS_NAME: Numex API - Staging
     steps:
       - uses: actions/checkout@v4
 
+      - name: Notify staging deploying
+        if: ${{ env.TELEGRAM_BOT_TOKEN != '' && env.TELEGRAM_CHAT_ID != '' }}
+        run: |
+          MESSAGE="${PROCESS_NAME}"$'\n'"Deploying"
+          curl -fsS -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
+            -d "chat_id=${TELEGRAM_CHAT_ID}" \
+            --data-urlencode "text=${MESSAGE}"
+
       - name: Copy source to server
         uses: appleboy/scp-action@v0.1.7
         with:
@@ -68,17 +80,46 @@ jobs:
           username: root
           key: ${{ secrets.DEPLOY_SSH_KEY }}
           script: |
+            set -e
             docker compose -f /opt/numex/deploy/docker-compose.yml build numex-api-staging
             docker compose -f /opt/numex/deploy/docker-compose.yml up -d numex-api-staging
             docker image prune -f
 
+      - name: Notify staging live
+        if: ${{ success() && env.TELEGRAM_BOT_TOKEN != '' && env.TELEGRAM_CHAT_ID != '' }}
+        run: |
+          MESSAGE="${PROCESS_NAME}"$'\n'"Live"
+          curl -fsS -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
+            -d "chat_id=${TELEGRAM_CHAT_ID}" \
+            --data-urlencode "text=${MESSAGE}"
+
+      - name: Notify staging failed
+        if: ${{ failure() && env.TELEGRAM_BOT_TOKEN != '' && env.TELEGRAM_CHAT_ID != '' }}
+        run: |
+          MESSAGE="${PROCESS_NAME}"$'\n'"Failed"
+          curl -fsS -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
+            -d "chat_id=${TELEGRAM_CHAT_ID}" \
+            --data-urlencode "text=${MESSAGE}"
+
   deploy-prod:
     needs: ci
     if: github.ref == 'refs/heads/main' && github.event_name == 'push'
     runs-on: ubuntu-latest
+    env:
+      TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
+      TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
+      PROCESS_NAME: Numex API - Production
     steps:
       - uses: actions/checkout@v4
 
+      - name: Notify prod deploying
+        if: ${{ env.TELEGRAM_BOT_TOKEN != '' && env.TELEGRAM_CHAT_ID != '' }}
+        run: |
+          MESSAGE="${PROCESS_NAME}"$'\n'"Deploying"
+          curl -fsS -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
+            -d "chat_id=${TELEGRAM_CHAT_ID}" \
+            --data-urlencode "text=${MESSAGE}"
+
       - name: Copy source to server
         uses: appleboy/scp-action@v0.1.7
         with:
@@ -96,6 +137,23 @@ jobs:
           username: root
           key: ${{ secrets.DEPLOY_SSH_KEY }}
           script: |
+            set -e
             docker compose -f /opt/numex/deploy/docker-compose.yml build numex-api-prod
             docker compose -f /opt/numex/deploy/docker-compose.yml up -d numex-api-prod
             docker image prune -f
+
+      - name: Notify prod live
+        if: ${{ success() && env.TELEGRAM_BOT_TOKEN != '' && env.TELEGRAM_CHAT_ID != '' }}
+        run: |
+          MESSAGE="${PROCESS_NAME}"$'\n'"Live"
+          curl -fsS -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
+            -d "chat_id=${TELEGRAM_CHAT_ID}" \
+            --data-urlencode "text=${MESSAGE}"
+
+      - name: Notify prod failed
+        if: ${{ failure() && env.TELEGRAM_BOT_TOKEN != '' && env.TELEGRAM_CHAT_ID != '' }}
+        run: |
+          MESSAGE="${PROCESS_NAME}"$'\n'"Failed"
+          curl -fsS -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
+            -d "chat_id=${TELEGRAM_CHAT_ID}" \
+            --data-urlencode "text=${MESSAGE}"

.gitignore

@@ -1,2 +1,5 @@
 .env
+.env.local
 adminpasswd
+.worktrees/
+tmp-api-dev*.log

Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-FROM golang:1.25-alpine AS verify
+FROM golang:1.25.10-alpine AS verify
 WORKDIR /app
 
 COPY go.mod go.sum ./
@@ -9,7 +9,7 @@ RUN go mod download
 COPY . .
 RUN go vet ./... && go build ./cmd/api
 
-FROM golang:1.25-alpine AS builder
+FROM golang:1.25.10-alpine AS builder
 WORKDIR /app
 
 COPY go.mod go.sum ./

Makefile

@@ -1,9 +1,12 @@
-DB_CONTAINER=numex_db
+ENV_FILE ?= .env.local
+DB_CONTAINER ?= numex_db
+DB_USER ?= numex
+DB_NAME ?= numex
 
 ifeq ($(OS),Windows_NT)
-	WAIT_CMD = @powershell -Command "Start-Sleep 2; while (!(docker exec $(DB_CONTAINER) pg_isready -U numex 2>$$null)) { Start-Sleep 1 }"
+	WAIT_CMD = @powershell -NoProfile -Command 'Start-Sleep 2; do { docker exec $(DB_CONTAINER) pg_isready -U $(DB_USER) -d $(DB_NAME) 2>$$null; if ($$LASTEXITCODE -ne 0) { Start-Sleep 1 } } until ($$LASTEXITCODE -eq 0)'
 else
-	WAIT_CMD = @sleep 2 && until docker exec $(DB_CONTAINER) pg_isready -U numex; do sleep 1; done
+	WAIT_CMD = @sleep 2 && until docker exec $(DB_CONTAINER) pg_isready -U $(DB_USER) -d $(DB_NAME); do sleep 1; done
 endif
 
 ifeq ($(OS),Windows_NT)
@@ -14,17 +17,17 @@ endif
 
 init:
 	@echo Starting containers...
-	docker compose up -d
+	docker compose --env-file $(ENV_FILE) up -d --wait --wait-timeout 60
 	@echo Giving time for PostgreSQL to start...
 	$(WAIT_CMD)
 	@echo Injecting schema...
-	docker exec -i $(DB_CONTAINER) psql -U numex -d numex < internal/db/schema.sql
+	docker exec -i $(DB_CONTAINER) psql -U $(DB_USER) -d $(DB_NAME) < internal/db/schema.sql
 	@echo Seeding data...
-	docker exec -i $(DB_CONTAINER) psql -U numex -d numex < internal/db/data.sql
+	docker exec -i $(DB_CONTAINER) psql -U $(DB_USER) -d $(DB_NAME) < internal/db/data.sql
 	@echo The database was initialized successfully.
 
 down:
-	docker compose down -v
+	docker compose --env-file $(ENV_FILE) down -v
 	@echo Containers and data have been deleted.
 
 run:
@@ -75,7 +78,7 @@ endif
 		psql "$(DATABASE_URL)" -q; \
 	else \
 		{ printf '\\set h %s\n' "$$HASH"; printf "UPDATE app_config SET value = to_json(:'h'::text) WHERE key = 'admin_password_hash';\n"; } | \
-		docker exec -i $(DB_CONTAINER) psql -U numex -d numex -q; \
+		docker exec -i $(DB_CONTAINER) psql -U $(DB_USER) -d $(DB_NAME) -q; \
 	fi && \
 	echo "Admin password updated successfully."
 

cmd/api/server.go

@@ -4,14 +4,17 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"io"
 	"log"
 	"net/http"
+	"os"
 	"os/signal"
 	"strings"
 	"sync"
 	"syscall"
 	"time"
 
+	"numex-api/internal/broadcast"
 	"numex-api/internal/cache"
 	"numex-api/internal/clients"
 	"numex-api/internal/config"
@@ -20,7 +23,6 @@ import (
 	"numex-api/internal/handlers"
 	"numex-api/internal/middlewares"
 	"numex-api/internal/services"
-	"numex-api/internal/workers"
 
 	"github.com/go-playground/validator/v10"
 	"github.com/labstack/echo/v4"
@@ -78,6 +80,10 @@ func run() error {
 	}
 	emailService := clients.NewEmailService(configCache)
 
+	broadcaster := broadcast.NewLogBroadcaster(500)
+	logWriter := io.MultiWriter(os.Stdout, broadcaster)
+	log.SetOutput(logWriter)
+
 	s := handlers.Server{
 		DB:          pool,
 		Queries:     q,
@@ -88,34 +94,24 @@ func run() error {
 		Payme:       paymeClient,
 		Polar:       polarClient,
 		Email:       emailService,
+		Broadcaster: broadcaster,
 	}
 
 	if polarClient != nil && strings.Trim(strings.TrimSpace(configCache.GetString("polar_enabled", "false")), `"`) == "true" {
-		summary, err := handlers.SyncPolarStoreProducts(context.Background(), polarClient, q)
-		if err != nil {
+		if _, err := handlers.SyncPolarStoreProducts(context.Background(), polarClient, q); err != nil {
 			log.Printf("polar store products: startup sync failed: %v", err)
 		} else {
-			log.Printf(
-				"polar store products: startup sync complete created=%d updated=%d deactivated=%d skipped=%d",
-				summary.Created,
-				summary.Updated,
-				summary.Deactivated,
-				summary.Skipped,
-			)
+			log.Printf("polar store products: startup sync completed")
 		}
 	}
 
-	e := setupEcho(ipExtractor)
+	e := setupEcho(ipExtractor, logWriter)
 	handlers.Handlers(e, &s)
 
 	ctx, cancel := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer cancel()
 
 	var wg sync.WaitGroup
-	billingWorker := workers.NewBillingWorker(pool, paymeClient, emailService)
-	billingWorker.Start(ctx, time.Minute, &wg)
-	downgradeCleanupWorker := workers.NewDowngradeCleanupWorker(pool)
-	downgradeCleanupWorker.Start(ctx, time.Minute, &wg)
 	configCache.StartAutoRefresh(ctx, 5*time.Minute, &wg)
 	services.StartRateFetcher(ctx, q, &wg)
 	services.StartIdempotencyCleanup(ctx, q, &wg)
@@ -125,7 +121,7 @@ func run() error {
 	return err
 }
 
-func setupEcho(ipExtractor func(*http.Request) string) *echo.Echo {
+func setupEcho(ipExtractor func(*http.Request) string, logWriter io.Writer) *echo.Echo {
 	e := echo.New()
 	e.HideBanner = true
 
@@ -137,9 +133,16 @@ func setupEcho(ipExtractor func(*http.Request) string) *echo.Echo {
 	e.IPExtractor = ipExtractor
 
 	e.Use(middleware.RequestID())
+	e.Use(middlewares.VerboseBodyLogger(logWriter, config.EnVar.VerboseHTTPBodyLogging, config.EnVar.VerboseHTTPBodyLogLimit))
 	e.Use(middleware.Recover())
-	e.Use(middlewares.Logger())
-	e.Use(middleware.BodyLimit("1M"))
+	e.Use(middlewares.Logger(logWriter))
+	e.Use(middleware.BodyLimitWithConfig(middleware.BodyLimitConfig{
+		// Skip the voice route — it enforces its own 10 MB limit in the handler.
+		Skipper: func(c echo.Context) bool {
+			return c.Request().URL.Path == "/api/transactions/voice"
+		},
+		Limit: "1M",
+	}))
 	e.Use(middleware.RateLimiter(
 		middleware.NewRateLimiterMemoryStoreWithConfig(
 			middleware.RateLimiterMemoryStoreConfig{

compose.yaml

@@ -11,6 +11,12 @@ services:
       - "5432:5432"
     volumes:
       - postgres_data:/var/lib/postgresql
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
   redis:
     image: redis:8.4-alpine
     container_name: numex_redis
@@ -20,6 +26,12 @@ services:
       - "6379:6379"
     volumes:
       - redis_data:/data
+    healthcheck:
+      test: ["CMD-SHELL", "redis-cli -a ${REDIS_PASSWORD} ping | grep PONG"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 5s
 
 volumes:
   postgres_data:

go.mod

@@ -1,6 +1,6 @@
 module numex-api
 
-go 1.25.9
+go 1.25.10
 
 require (
 	github.com/alexedwards/argon2id v1.0.0
@@ -11,11 +11,12 @@ require (
 	github.com/joho/godotenv v1.5.1
 	github.com/kelseyhightower/envconfig v1.4.0
 	github.com/labstack/echo/v4 v4.15.1
+	github.com/minio/minio-go/v7 v7.0.100
 	github.com/polarsource/polar-go v0.12.0
 	github.com/redis/go-redis/v9 v9.18.0
 	github.com/stretchr/testify v1.11.1
 	github.com/svix/svix-webhooks v1.89.0
-	golang.org/x/crypto v0.47.0
+	golang.org/x/crypto v0.51.0
 	golang.org/x/time v0.14.0
 	google.golang.org/api v0.197.0
 	google.golang.org/genai v1.51.0
@@ -29,8 +30,10 @@ require (
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
+	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.12 // indirect
+	github.com/go-ini/ini v1.67.0 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
@@ -43,12 +46,20 @@ require (
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
+	github.com/klauspost/compress v1.18.2 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.11 // indirect
+	github.com/klauspost/crc32 v1.3.0 // indirect
 	github.com/labstack/gommon v0.4.2 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/minio/crc64nvme v1.1.1 // indirect
+	github.com/minio/md5-simd v1.1.2 // indirect
+	github.com/philhofer/fwd v1.2.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/rs/xid v1.6.0 // indirect
 	github.com/spyzhov/ajson v0.8.0 // indirect
+	github.com/tinylib/msgp v1.6.1 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/valyala/fasttemplate v1.2.2 // indirect
 	go.opencensus.io v0.24.0 // indirect
@@ -58,11 +69,12 @@ require (
 	go.opentelemetry.io/otel/metric v1.39.0 // indirect
 	go.opentelemetry.io/otel/trace v1.39.0 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
-	golang.org/x/net v0.49.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/net v0.55.0 // indirect
 	golang.org/x/oauth2 v0.35.0 // indirect
-	golang.org/x/sync v0.19.0 // indirect
-	golang.org/x/sys v0.40.0 // indirect
-	golang.org/x/text v0.33.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/text v0.37.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260203192932-546029d2fa20 // indirect
 	google.golang.org/grpc v1.79.3 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect