finish wkd store. add hkp key updates.

.gitignore

@@ -14,4 +14,6 @@
 # Dependency directories (remove the comment below to include it)
 # vendor/
 
+sour.is-keyproofs
 .env
+/pub

.vscode/launch.json

@@ -0,0 +1,17 @@
+{
+    // Use IntelliSense to learn about possible attributes.
+    // Hover to view descriptions of existing attributes.
+    // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
+    "version": "0.2.0",
+    "configurations": [
+        {
+            "name": "Launch",
+            "type": "go",
+            "request": "launch",
+            "mode": "auto",
+            "program": "${fileDirname}",
+            "env": {},
+            "args": []
+        }
+    ]
+}

Makefile

@@ -1,7 +1,7 @@
 NAME=sour.is-keyproofs
 BUMP?=current
 DATE:=$(shell date -u +%FT%TZ)
-HASH:=$(shell git rev-pars HEAD 2> /dev/null)
+HASH:=$(shell git rev-parse HEAD 2> /dev/null)
 VERSION:=$(shell BUMP=$(BUMP) ./version.sh)
 
 
@@ -14,6 +14,7 @@ version:
 	@echo $(VERSION)
 tag:
 	git tag -a v$(VERSION) -m "Version: $(VERSION)"
+	git push --follow-tags
 release:
 	@make tag BUMP=patch
 run:

README.md

@@ -1,2 +1,4 @@
 # keyproofs
 OpenPGP notation identity proof web app
+
+see it here: <https://a.sour.is/id/me@sour.is>

example.env

@@ -1,5 +1,7 @@
 # Rename to '.env' or pass required items to environment when running.
 
+# Basic Configuration.
+
 # REDDIT_APIKEY [REQUIRED]
 # REDDIT_SECRET [REQUIRED]
 #   To prevent reddits low ratelimits for non-authenticated requests
@@ -26,6 +28,12 @@ HTTP_LISTEN=
 
 BASE_URL=
 
+# AVATAR_PATH [OPTIONAL]
+#   To set the path for avatar/bg/cover image directories to serve. (default: pub)
+#   Path should allow read/write to application. The folders will be generated automatically.
+
+# Advanced Options. These are used to customize the application in non-standard deployments
+
 # XMPP_URL [OPTIONAL]
 #   To set XMPP http url for VCard verification. (default: BASE_URL)
 
@@ -35,3 +43,20 @@ XMPP_URL=
 #   To set DNS http url for DNS verification. (default: BASE_URL)
 
 XMPP_URL=
+
+# Avatar app
+# DISABLE_AVATAR [OPTIONAL]
+#    Disable the Avatar application. Set to any value other than "false"
+
+# DNS app
+# DISABLE_DNS [OPTIONAL]
+#    Disable the DNS application. Set to any value other than "false"
+
+# Keyproofs app
+# DISABLE_KEYPROOFS [OPTIONAL]
+#    Disable the KeyProofs application. Set to any value other than "false"
+
+# XMPP VCard app
+# DISABLE_VCARD [OPTIONAL]
+#    Disable the VCard application. Set to any value other than "false"
+#    If disabled the username/password are no longer required.

go.mod

@@ -3,19 +3,25 @@ module github.com/sour-is/keyproofs
 go 1.15
 
 require (
+	github.com/disintegration/imaging v1.6.2
+	github.com/fsnotify/fsnotify v1.4.7
 	github.com/go-chi/chi v4.1.2+incompatible
-	github.com/google/go-cmp v0.5.3 // indirect
+	github.com/google/go-cmp v0.5.4 // indirect
 	github.com/hashicorp/golang-lru v0.5.4
 	github.com/joho/godotenv v1.3.0
 	github.com/lucasb-eyer/go-colorful v1.0.3
+	github.com/nullrocks/identicon v0.0.0-20180626043057-7875f45b0022
 	github.com/rs/cors v1.7.0
 	github.com/rs/zerolog v1.20.0
+	github.com/russross/blackfriday v1.5.2
 	github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
 	github.com/sour-is/crypto v0.0.0-20201016232853-f42a24ba5a81
 	github.com/stretchr/testify v1.6.1 // indirect
 	github.com/tv42/zbase32 v0.0.0-20190604154422-aacc64a8f915
+	go.uber.org/multierr v1.6.0
 	go.uber.org/ratelimit v0.1.0
-	golang.org/x/crypto v0.0.0-20201117144127-c1f2f97bffc9
+	golang.org/x/crypto v0.0.0-20201124201722-c8d3bf9c5392
+	golang.org/x/net v0.0.0-20201110031124-69a78807bb2b // indirect
 	golang.org/x/text v0.3.4 // indirect
 	gosrc.io/xmpp v0.5.1
 )

go.sum

@@ -9,6 +9,8 @@ github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/disintegration/imaging v1.6.2 h1:w1LecBlG2Lnp8B3jk5zSuNqd7b4DXhcjwek1ei82L+c=
+github.com/disintegration/imaging v1.6.2/go.mod h1:44/5580QXChDfwIclfc/PCwrr44amcmDAg8hxG0Ewe4=
 github.com/edsrzf/mmap-go v1.0.0/go.mod h1:YO35OhQPt3KJa3ryjFM5Bs14WD66h8eGKpfaBNrHW5M=
 github.com/fatih/color v1.6.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
@@ -28,6 +30,8 @@ github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5a
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.5.3 h1:x95R7cp+rSeeqAMI2knLtQ0DKlaBhv2NrtrOvafPHRo=
 github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.4 h1:L8R9j+yAqZuZjsqh/z+F1NCffTKKLShY6zXTItVIZ8M=
+github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20190908185732-236ed259b199/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/uuid v1.1.1 h1:Gkbcsh/GbpXz7lPftLA3P6TYMwjCLYm83jiFQZF/3gY=
@@ -58,6 +62,8 @@ github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVc
 github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.9/go.mod h1:YNRxwqDuOph6SZLI9vUUz6OYw3QyUt7WiY2yME+cCiQ=
+github.com/nullrocks/identicon v0.0.0-20180626043057-7875f45b0022 h1:Ys0rDzh8s4UMlGaDa1UTA0sfKgvF0hQZzTYX8ktjiDc=
+github.com/nullrocks/identicon v0.0.0-20180626043057-7875f45b0022/go.mod h1:x4NsS+uc7ecH/Cbm9xKQ6XzmJM57rWTkjywjfB2yQ18=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.8.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
@@ -70,6 +76,8 @@ github.com/rs/cors v1.7.0/go.mod h1:gFx+x8UowdsKA9AchylcLynDq+nNFfI8FkUZdN/jGCU=
 github.com/rs/xid v1.2.1/go.mod h1:+uKXf+4Djp6Md1KODXJxgGQPKngRmWyn10oCKFzNHOQ=
 github.com/rs/zerolog v1.20.0 h1:38k9hgtUBdxFwE34yS8rTHmHBa4eN16E4DJlv177LNs=
 github.com/rs/zerolog v1.20.0/go.mod h1:IzD0RJ65iWH0w97OQQebJEvTZYvsCUm9WVLWBQrJRjo=
+github.com/russross/blackfriday v1.5.2 h1:HyvC0ARfnZBqnXwABFeSZHpKvJHJJfPz81GNueLj0oo=
+github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
 github.com/sirupsen/logrus v1.0.5/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
 github.com/sirupsen/logrus v1.4.2 h1:SPIRibHv4MatM3XXNO2BJeFLZwZ2LvZgfQ5+UNI2im4=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
@@ -93,14 +101,23 @@ github.com/twitchyliquid64/golang-asm v0.0.0-20190126203739-365674df15fc/go.mod
 go.coder.com/go-tools v0.0.0-20190317003359-0c6a35b74a16/go.mod h1:iKV5yK9t+J5nG9O3uF6KYdPEz3dyfMyB15MN1rbQ8Qw=
 go.uber.org/atomic v1.4.0 h1:cxzIVoETapQEqDhQu3QfnvXAV4AlzcvUCxkVUFw3+EU=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
+go.uber.org/atomic v1.7.0 h1:ADUqmZGgLDDfbSL9ZmPxKTybcoEYHgpYfELNoN+7hsw=
+go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/multierr v1.1.0 h1:HoEmRHQPVSqub6w2z2d2EOVs2fjyFRGyofhKuyDq0QI=
 go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
+go.uber.org/multierr v1.6.0 h1:y6IPFStTAIT5Ytl7/XYmHvzXQ7S3g/IeZW9hyZ5thw4=
+go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
 go.uber.org/ratelimit v0.1.0 h1:U2AruXqeTb4Eh9sYQSTrMhH8Cb7M0Ian2ibBOnBcnAw=
 go.uber.org/ratelimit v0.1.0/go.mod h1:2X8KaoNd1J0lZV+PxJk/5+DGbO/tpwLR1m++a7FnB/Y=
 golang.org/x/crypto v0.0.0-20180426230345-b49d69b5da94/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201117144127-c1f2f97bffc9 h1:phUcVbl53swtrUN8kQEXFhUxPlIlWyBfKmidCu7P95o=
 golang.org/x/crypto v0.0.0-20201117144127-c1f2f97bffc9/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
+golang.org/x/crypto v0.0.0-20201124201722-c8d3bf9c5392 h1:xYJJ3S178yv++9zXV/hnr29plCAGO9vAFG9dorqaFQc=
+golang.org/x/crypto v0.0.0-20201124201722-c8d3bf9c5392/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
+golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8 h1:hVwzHzIUGRjiF7EcUjqNxk3NCfkPxbDKRdnNE1Rpg0U=
+golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181102091132-c10e9556a7bc/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -108,6 +125,10 @@ golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859 h1:R/3boaszxrf1GEUWTVDzSKVwLmSJpwZ1yqXm8j0v2QI=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200202094626-16171245cfb2 h1:CCH4IOTTfewWjGOlSp+zGcjutRKlBEZQ6wTn8ozI/nI=
+golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20201110031124-69a78807bb2b h1:uwuIcX0g4Yl1NC5XAz37xsr2lTtcqevgzYNVt49waME=
+golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -123,10 +144,11 @@ golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190927073244-c990c680b611/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037 h1:YyJpGZS1sBuBCzLAR1VEpK193GlqGZbnPFnPV/5Rsb4=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f h1:+Nyd8tzPX9R7BWHguqsrbFdRx3WQ/1ib8I44HXV5yTA=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.4 h1:0YWbFKbhXG/wIiuHDSKpS0Iy7FSA+u45VtBMfQcFTTc=
 golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4 h1:SvFZT6jyqRaOeXpc5h/JSfZenJ2O330aBsf7JfSUXmQ=

main.go

@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"net/http"
 	"os"
-	"os/signal"
 	"strings"
 	"time"
 
@@ -21,6 +20,7 @@ import (
 
 	"github.com/sour-is/keyproofs/pkg/cache"
 	"github.com/sour-is/keyproofs/pkg/config"
+	"github.com/sour-is/keyproofs/pkg/graceful"
 	"github.com/sour-is/keyproofs/pkg/keyproofs"
 )
 
@@ -36,11 +36,16 @@ var (
 )
 
 func main() {
-	log := zerolog.New(zerolog.NewConsoleWriter()).With().Timestamp().Caller().Logger()
+	log := zerolog.New(zerolog.NewConsoleWriter()).
+		With().
+		Timestamp().
+		Caller().
+		Logger()
 
 	ctx := context.Background()
 	ctx = log.WithContext(ctx)
-	ctx = WithInterupt(ctx)
+	ctx = graceful.WithInterupt(ctx)
+	ctx, _ = graceful.WithWaitGroup(ctx)
 
 	cfg := config.New()
 	cfg.Set("app-name", "KeyProofs")
@@ -50,13 +55,14 @@ func main() {
 	ctx = cfg.Apply(ctx)
 
 	if err := run(ctx); err != nil {
-		log.Fatal().Stack().Err(err).Send()
+		log.Error().Stack().Err(err).Msg("Application Failed")
 		os.Exit(1)
 	}
 }
 
 func run(ctx context.Context) error {
 	log := log.Ctx(ctx)
+	wg := graceful.WaitGroup(ctx)
 
 	// derive baseURL from listener options
 	listen := env("HTTP_LISTEN", ":9061")
@@ -66,10 +72,6 @@ func run(ctx context.Context) error {
 	}
 	baseURL := fmt.Sprintf("http://%s", host)
 
-	// Create cache for promise engine
-	arc, _ := lru.NewARC(4096)
-	c := cache.New(arc)
-
 	// Set config values
 	cfg := config.FromContext(ctx)
 	cfg.Set("base-url", env("BASE_URL", baseURL))
@@ -84,29 +86,63 @@ func run(ctx context.Context) error {
 		Credential: xmpp.Password(os.Getenv("XMPP_PASSWORD")),
 	})
 
-	// configure cors middleware
-	corsMiddleware := cors.New(cors.Options{
-		AllowCredentials: true,
-		AllowedMethods:   strings.Fields(env("CORS_METHODS", "GET")),
-		AllowedOrigins:   strings.Fields(env("CORS_ORIGIN", "*")),
-	}).Handler
-
 	mux := chi.NewRouter()
 	mux.Use(
 		cfg.ApplyHTTP,
-		corsMiddleware,
+		func(next http.Handler) http.Handler {
+			return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				r = r.WithContext(log.WithContext(r.Context()))
+				next.ServeHTTP(w, r)
+			})
+		},
+		secHeaders,
+		cors.New(cors.Options{
+			AllowCredentials: true,
+			AllowedMethods:   strings.Fields(env("CORS_METHODS", "GET")),
+			AllowedOrigins:   strings.Fields(env("CORS_ORIGIN", "*")),
+		}).Handler,
 		middleware.RequestID,
 		middleware.RealIP,
 		middleware.RequestLogger(&middleware.DefaultLogFormatter{Logger: accessLog(log.Info)}),
 		middleware.Recoverer,
 	)
 
-	app, err := keyproofs.New(ctx, c)
+	if env("DISABLE_KEYPROOF", "false") == "false" {
-	if err != nil {
+		// Create cache for promise engine
-		return err
+		arc, _ := lru.NewARC(4096)
+		c := cache.New(arc)
+		keyproofs.NewKeyProofApp(ctx, c).Routes(mux)
 	}
 
-	app.Routes(mux)
+	if env("DISABLE_DNS", "false") == "false" {
+		keyproofs.NewDNSApp(ctx).Routes(mux)
+	}
+
+	if env("DISABLE_AVATAR", "false") == "false" {
+		avatarApp, err := keyproofs.NewAvatarApp(ctx, env("AVATAR_PATH", "pub"))
+		if err != nil {
+			return err
+		}
+
+		avatarApp.Routes(mux)
+	}
+
+	if env("DISABLE_WKD", "false") == "false" {
+		avatarApp, err := keyproofs.NewWKDApp(ctx, env("WKD_PATH", "pub"), env("WKD_DOMAIN", "pub"))
+		if err != nil {
+			return err
+		}
+
+		avatarApp.Routes(mux)
+	}
+
+	if env("DISABLE_VCARD", "false") == "false" {
+		vcardApp, err := keyproofs.NewVCardApp(ctx)
+		if err != nil {
+			return err
+		}
+		vcardApp.Routes(mux)
+	}
 
 	log.Info().
 		Str("app", cfg.GetString("app-name")).
@@ -114,21 +150,21 @@ func run(ctx context.Context) error {
 		Str("build-hash", cfg.GetString("build-hash")).
 		Str("build-date", cfg.GetString("build-date")).
 		Str("listen", listen).
+		Int("user", os.Geteuid()).
+		Int("group", os.Getgid()).
 		Msg("startup")
 
-	err = New(&http.Server{
+	err := New(&http.Server{
 		Addr:         listen,
 		WriteTimeout: 15 * time.Second,
 		ReadTimeout:  15 * time.Second,
 		Handler:      mux,
 	}).Run(ctx)
-
 	if err != nil {
 		return err
 	}
 
-	log.Info().Msg("shutdown")
+	return wg.Wait(5 * time.Second)
-	return nil
 }
 
 type Server struct {
@@ -140,23 +176,30 @@ func New(s *http.Server) *Server {
 }
 func (s *Server) Run(ctx context.Context) error {
 	log := log.Ctx(ctx)
+	wg := graceful.WaitGroup(ctx)
 
-	go func() {
+	wg.Go(func() error {
 		<-ctx.Done()
 		log.Info().Msg("Shutdown HTTP")
 
-		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		ctx := context.Background()
+		ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
 		defer cancel()
 		err := s.srv.Shutdown(ctx)
-		if err != nil {
+		if err != nil && err != http.ErrServerClosed {
-			log.Fatal().Err(err)
+			return err
-			return
 		}
 
 		log.Info().Msg("Stopped  HTTP")
-	}()
+		return nil
+	})
 
-	return s.srv.ListenAndServe()
+	err := s.srv.ListenAndServe()
+	if err != nil && err != http.ErrServerClosed {
+		return err
+	}
+
+	return nil
 }
 
 func env(name, defaultValue string) string {
@@ -167,30 +210,16 @@ func env(name, defaultValue string) string {
 	return defaultValue
 }
 
-func WithInterupt(ctx context.Context) context.Context {
+func secHeaders(h http.Handler) http.Handler {
-	log := log.Ctx(ctx)
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-	ctx, cancel := context.WithCancel(ctx)
+		w.Header().Set("X-XSS-Protection", "1; mode=block")
+		w.Header().Set("X-Frame-Options", "DENY")
+		w.Header().Set("X-Content-Type-Options", "nosniff")
+		w.Header().Set("X-Content-Type-Options", "nosniff")
+		w.Header().Set("Content-Security-Policy", "font-src https://pagecdn.io")
 
-	// Listen for Interrupt signals
+		h.ServeHTTP(w, r)
-	c := make(chan os.Signal, 1)
+	})
-	signal.Notify(c, os.Interrupt)
-	defer signal.Stop(c)
-
-	go func() {
-		select {
-		case <-c:
-			cancel()
-			log.Warn().Msg("Shutting down! interrupt received")
-			return
-		case <-ctx.Done():
-			cancel()
-
-			log.Warn().Msg("Shutting down! context cancelled")
-			return
-		}
-	}()
-
-	return ctx
 }
 
 type accessLog func() *zerolog.Event

pkg/graceful/with-interrupt.go

@@ -0,0 +1,127 @@
+package graceful
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"os/signal"
+	"sync"
+	"time"
+
+	"github.com/rs/zerolog/log"
+	"go.uber.org/multierr"
+)
+
+func WithInterupt(ctx context.Context) context.Context {
+	log := log.Ctx(ctx)
+	ctx, cancel := context.WithCancel(ctx)
+
+	// Listen for Interrupt signals
+	c := make(chan os.Signal, 1)
+	signal.Notify(c, os.Interrupt)
+
+	go func() {
+		defer signal.Stop(c)
+
+		for {
+			select {
+			case <-c:
+				cancel()
+				log.Warn().Msg("Shutting down! interrupt received")
+				return
+			case <-ctx.Done():
+				log.Warn().Msg("Shutting down! context cancelled")
+				return
+			}
+		}
+	}()
+
+	return ctx
+}
+
+type contextKey struct{ string }
+
+var wgKey = contextKey{"waitgroup"}
+
+type wgContext struct {
+	wg  sync.WaitGroup
+	err error
+	ctx context.Context
+}
+
+func (wg *wgContext) String() string {
+	return fmt.Sprintf("WaitGroup[%v %v]", wg.err, wg.ctx)
+}
+
+type WG interface {
+	Wait(time.Duration) error
+	Go(func() error)
+}
+
+func WithWaitGroup(ctx context.Context) (context.Context, WG) {
+	if wg := WaitGroup(ctx); wg != nil {
+		return ctx, wg
+	}
+	wg := &wgContext{ctx: ctx}
+	return context.WithValue(ctx, wgKey, wg), wg
+}
+
+func WaitGroup(ctx context.Context) *wgContext {
+	if wg, ok := ctx.Value(wgKey).(*wgContext); ok {
+		return wg
+	}
+	return nil
+}
+
+func (wg *wgContext) Go(fn func() error) {
+	if wg == nil {
+		panic("nil wait group")
+	}
+
+	wg.Add(1)
+	go func() {
+		err := fn()
+		wg.err = multierr.Append(wg.err, err)
+		wg.Done()
+	}()
+}
+
+func (wg *wgContext) Add(n int) {
+	wg.wg.Add(n)
+}
+
+func (wg *wgContext) Done() {
+	wg.wg.Done()
+}
+
+func (wg *wgContext) Wait(gracetime time.Duration) error {
+	if wg == nil {
+		return nil
+	}
+
+	log := log.Ctx(wg.ctx)
+
+	ch := make(chan struct{})
+	go func() {
+		wg.wg.Wait()
+		close(ch)
+	}()
+
+	<-wg.ctx.Done()
+	wg.err = multierr.Append(wg.err, wg.ctx.Err())
+
+	log.Debug().Msg("shutdown begin")
+	timer := time.NewTimer(gracetime)
+
+	select {
+	case <-ch:
+	case <-timer.C:
+		wg.err = multierr.Append(wg.err, ErrExpiredGrace)
+	}
+	log.Debug().Msg("shutdown complete")
+
+	return wg.err
+}
+
+var ErrExpiredGrace = errors.New("grace time expired")

pkg/keyproofs/opengpg.go

@@ -13,6 +13,7 @@ import (
 
 	"github.com/rs/zerolog/log"
 	"github.com/sour-is/crypto/openpgp"
+	"github.com/sour-is/crypto/openpgp/packet"
 	"github.com/tv42/zbase32"
 	"golang.org/x/crypto/openpgp/armor"
 )
@@ -22,12 +23,17 @@ func getOpenPGPkey(ctx context.Context, id string) (entity *Entity, err error) {
 		addr := "https://keys.openpgp.org/vks/v1/by-fingerprint/" + strings.ToUpper(id)
 		return getEntityHTTP(ctx, addr, true)
 	} else if email, err := mail.ParseAddress(id); err == nil {
-		addr := getWKDPubKeyAddr(email)
+		addr, advAddr := getWKDPubKeyAddr(email)
 		req, err := getEntityHTTP(ctx, addr, false)
 		if err == nil {
 			return req, err
 		}
 
+		req, err = getEntityHTTP(ctx, advAddr, false)
+		if err == nil {
+			return req, err
+		}
+
 		addr = "https://keys.openpgp.org/vks/v1/by-email/" + url.QueryEscape(id)
 		return getEntityHTTP(ctx, addr, true)
 	} else {
@@ -44,16 +50,15 @@ func getEntityHTTP(ctx context.Context, url string, useArmored bool) (entity *En
 	}
 	cl := http.Client{}
 	resp, err := cl.Do(req)
+	if err != nil {
+		return entity, fmt.Errorf("Requesting key: %w\nRemote URL: %v", err, url)
+	}
 	log.Debug().
 		Bool("useArmored", useArmored).
 		Str("status", resp.Status).
 		Str("url", url).
 		Msg("getEntityHTTP")
 
-	if err != nil {
-		return entity, fmt.Errorf("Requesting key: %w\nRemote URL: %v", err, url)
-	}
-
 	if resp.StatusCode != 200 {
 		return entity, fmt.Errorf("bad response from remote: %s\nRemote URL: %v", resp.Status, url)
 	}
@@ -74,11 +79,17 @@ func (k EntityKey) Key() interface{} {
 }
 
 type Entity struct {
-	Primary     *mail.Address
+	Primary       *mail.Address
-	Emails      []*mail.Address
+	SelfSignature *packet.Signature
-	Fingerprint string
+	Emails        []*mail.Address
-	Proofs      []string
+	Fingerprint   string
-	ArmorText   string
+	Proofs        []string
+	ArmorText     string
+	entity        *openpgp.Entity
+}
+
+func (e *Entity) Serialize(f io.Writer) error {
+	return e.entity.Serialize(f)
 }
 
 func getEntity(lis openpgp.EntityList) (*Entity, error) {
@@ -93,6 +104,7 @@ func getEntity(lis openpgp.EntityList) (*Entity, error) {
 			continue
 		}
 
+		entity.entity = e
 		entity.Fingerprint = fmt.Sprintf("%X", e.PrimaryKey.Fingerprint)
 
 		for name, ident := range e.Identities {
@@ -122,6 +134,7 @@ func getEntity(lis openpgp.EntityList) (*Entity, error) {
 
 			// If identity is self signed read notation data.
 			if ident.SelfSignature != nil && ident.SelfSignature.NotationData != nil {
+				entity.SelfSignature = ident.SelfSignature
 				// Get proofs and append to list.
 				if proofs, ok := ident.SelfSignature.NotationData["proof@metacode.biz"]; ok {
 					entity.Proofs = append(entity.Proofs, proofs...)
@@ -142,9 +155,14 @@ func ReadKey(r io.Reader, useArmored bool) (e *Entity, err error) {
 	var buf bytes.Buffer
 
 	var w io.Writer = &buf
-
 	e = &Entity{}
 
+	defer func() {
+		if e != nil {
+			e.ArmorText = buf.String()
+		}
+	}()
+
 	if !useArmored {
 		var aw io.WriteCloser
 		aw, err = armor.Encode(&buf, "PGP PUBLIC KEY BLOCK", nil)
@@ -155,11 +173,6 @@ func ReadKey(r io.Reader, useArmored bool) (e *Entity, err error) {
 
 		w = aw
 	}
-	defer func() {
-		if e != nil {
-			e.ArmorText = buf.String()
-		}
-	}()
 
 	r = io.TeeReader(r, w)
 
@@ -194,11 +207,11 @@ func isFingerprint(s string) bool {
 	return true
 }
 
-func getWKDPubKeyAddr(email *mail.Address) string {
+func getWKDPubKeyAddr(email *mail.Address) (string, string) {
 	parts := strings.SplitN(email.Address, "@", 2)
-
 	hash := sha1.Sum([]byte(parts[0]))
 	lp := zbase32.EncodeToString(hash[:])
 
-	return fmt.Sprintf("https://%s/.well-known/openpgpkey/hu/%s", parts[1], lp)
+	return fmt.Sprintf("https://%s/.well-known/openpgpkey/hu/%s", parts[1], lp),
+		fmt.Sprintf("https://openpgpkey.%s/.well-known/openpgpkey/hu/%s/%s", parts[1], parts[1], lp)
 }

pkg/keyproofs/proofs.go

@@ -2,6 +2,7 @@ package keyproofs
 
 import (
 	"bufio"
+	"bytes"
 	"context"
 	"encoding/base64"
 	"encoding/json"
@@ -205,6 +206,17 @@ func NewProof(ctx context.Context, uri, fingerprint string) ProofResolver {
 				return &httpResolve{p, url, nil}
 			}
 
+		case strings.Contains(p.URI.Path, "/conv/"), strings.Contains(p.URI.Path, "/twt/"):
+			if sp := strings.SplitN(p.URI.Path, "/", 3); len(sp) == 3 {
+				p.Icon = "fas fa-comment-alt"
+				p.Service = "Twtxt"
+				p.Name = fmt.Sprintf("...@%s", p.URI.Host)
+				p.Link = fmt.Sprintf("https://%s", p.URI.Host)
+
+				url := fmt.Sprintf("https://%s/api/v1/conv", p.URI.Host)
+				return &twtxtResolve{p, url, sp[2], nil}
+			}
+
 		default:
 			if sp := strings.SplitN(p.URI.Path, "/", 3); len(sp) > 1 {
 				p.Icon = "fas fa-project-diagram"
@@ -219,6 +231,7 @@ func NewProof(ctx context.Context, uri, fingerprint string) ProofResolver {
 				return &httpResolve{p, p.Verify, nil}
 			}
 		}
+
 	default:
 		p.Icon = "exclamation-triangle"
 		p.Service = "unknown"
@@ -294,8 +307,8 @@ func (r *gitlabResolve) Resolve(ctx context.Context) error {
 
 	return ErrNoFingerprint
 }
-func (p *gitlabResolve) Proof() *Proof {
+func (r *gitlabResolve) Proof() *Proof {
-	return &p.proof
+	return &r.proof
 }
 
 func (p *Proof) Resolve(ctx context.Context) error {
@@ -305,6 +318,44 @@ func (p *Proof) Proof() *Proof {
 	return p
 }
 
+type twtxtResolve struct {
+	proof   Proof             `json:"-"`
+	url     string            `json:"-"`
+	Hash    string            `json:"hash"`
+	headers map[string]string `json:"-"`
+}
+
+func (t *twtxtResolve) Resolve(ctx context.Context) error {
+	t.proof.Status = ProofInvalid
+
+	twt := struct {
+		Twts []struct {
+			Text  string `json:"text"`
+			Twter struct{ Nick string }
+		} `json:"twts"`
+	}{}
+
+	if err := postJSON(ctx, t.url, nil, t, &twt); err != nil {
+		return err
+	}
+	if len(twt.Twts) > 0 {
+		nick := twt.Twts[0].Twter.Nick
+		t.proof.Name = fmt.Sprintf("%s@%s", nick, t.proof.URI.Host)
+		t.proof.Link += "/user/" + nick
+
+		ck := fmt.Sprintf("[Verifying my OpenPGP key: openpgp4fpr:%s]", t.proof.Fingerprint)
+		if strings.Contains(twt.Twts[0].Text, ck) {
+			t.proof.Status = ProofVerified
+			return nil
+		}
+	}
+
+	return ErrNoFingerprint
+}
+func (t *twtxtResolve) Proof() *Proof {
+	return &t.proof
+}
+
 func checkHTTP(ctx context.Context, uri, fingerprint string, hdr map[string]string) error {
 	log := log.Ctx(ctx)
 
@@ -370,3 +421,36 @@ func httpJSON(ctx context.Context, uri string, hdr map[string]string, dst interf
 
 	return json.NewDecoder(res.Body).Decode(dst)
 }
+
+func postJSON(ctx context.Context, uri string, hdr map[string]string, payload, dst interface{}) error {
+	log := log.Ctx(ctx)
+
+	log.Info().Str("URI", uri).Msg("postJSON")
+
+	body, err := json.Marshal(payload)
+	if err != nil {
+		log.Err(err).Send()
+		return err
+	}
+	buf := bytes.NewBuffer(body)
+
+	req, err := http.NewRequestWithContext(ctx, "POST", uri, buf)
+	if err != nil {
+		log.Err(err).Send()
+		return err
+	}
+
+	req.Header.Set("Accept", "application/json")
+	for k, v := range hdr {
+		req.Header.Set(k, v)
+	}
+
+	res, err := http.DefaultClient.Do(req)
+	if err != nil {
+		log.Err(err)
+		return err
+	}
+	defer res.Body.Close()
+
+	return json.NewDecoder(res.Body).Decode(dst)
+}

pkg/keyproofs/routes-avatar.go

@@ -0,0 +1,344 @@
+package keyproofs
+
+import (
+	"context"
+	"crypto/md5"
+	"crypto/sha256"
+	"encoding/base64"
+	"fmt"
+	"hash"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	"github.com/disintegration/imaging"
+	"github.com/fsnotify/fsnotify"
+	"github.com/go-chi/chi"
+	"github.com/nullrocks/identicon"
+	"github.com/rs/zerolog/log"
+
+	"github.com/sour-is/keyproofs/pkg/graceful"
+)
+
+type avatarApp struct {
+	path string
+}
+
+func NewAvatarApp(ctx context.Context, path string) (*avatarApp, error) {
+	log := log.Ctx(ctx)
+
+	path = filepath.Clean(path)
+	app := &avatarApp{path: path}
+	err := app.CheckFiles(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("check files: %w", err)
+	}
+
+	watch, err := fsnotify.NewWatcher()
+	if err != nil {
+		return nil, err
+	}
+	for _, typ := range []string{"avatar", "bg", "cover"} {
+		err = watch.Add(filepath.Join(path, typ))
+		if err != nil {
+			return nil, fmt.Errorf("adding watch: %w", err)
+		}
+	}
+
+	log.Debug().Msg("startup avatar watcher")
+	wg := graceful.WaitGroup(ctx)
+	wg.Go(func() error {
+		for {
+			select {
+			case <-ctx.Done():
+				log.Debug().Msg("shutdown avatar watcher")
+				return nil
+			case op := <-watch.Events:
+				log.Print(op)
+				switch op.Op {
+				case fsnotify.Create:
+					path = filepath.Dir(op.Name)
+					kind := filepath.Base(path)
+					name := filepath.Base(op.Name)
+					if err := app.createLinks(kind, name); err != nil {
+						log.Err(err).Send()
+					}
+				case fsnotify.Remove, fsnotify.Rename:
+					path = filepath.Dir(op.Name)
+					kind := filepath.Base(path)
+					name := filepath.Base(op.Name)
+					if err := app.removeLinks(kind, name); err != nil {
+						log.Error().Err(err).Send()
+					}
+				default:
+				}
+			case err := <-watch.Errors:
+				log.Err(err).Send()
+			}
+		}
+	})
+
+	return app, nil
+}
+
+func (app *avatarApp) CheckFiles(ctx context.Context) error {
+	log := log.Ctx(ctx)
+
+	for _, name := range []string{".links", "avatar", "bg", "cover"} {
+		log.Debug().Msgf("mkdir: %s", filepath.Join(app.path, name))
+		err := os.MkdirAll(filepath.Join(app.path, name), 0700)
+		if err != nil {
+			return err
+		}
+	}
+
+	return filepath.Walk(app.path, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return fmt.Errorf("walk failed: %w", err)
+		}
+		if info.IsDir() {
+			switch info.Name() {
+			case "avatar", "bg", "cover":
+				return nil
+			default:
+				return filepath.SkipDir
+			}
+		}
+
+		path = filepath.Dir(path)
+		kind := filepath.Base(path)
+		name := info.Name()
+
+		log.Debug().Msgf("link: %s %s %s", app.path, kind, name)
+
+		return app.createLinks(kind, name)
+	})
+}
+
+func (app *avatarApp) get(w http.ResponseWriter, r *http.Request) {
+	log := log.Ctx(r.Context())
+
+	log.Print(r.Host)
+
+	kind := chi.URLParam(r, "kind")
+	hash := chi.URLParam(r, "hash")
+
+	sizeW, sizeH, resize := 0, 0, false
+	if s, err := strconv.Atoi(r.URL.Query().Get("s")); err == nil && s > 0 {
+		sizeW, sizeH, resize = sizeByKind(kind, s)
+	}
+	log.Debug().Int("width", sizeW).Int("height", sizeH).Bool("resize", resize).Str("kind", kind).Msg("Get Image")
+
+	if strings.ContainsRune(hash, '@') {
+		avatarHost, _, err := styleSRV(r.Context(), hash)
+		if err != nil {
+			writeText(w, 500, err.Error())
+			return
+		}
+		hash = hashSHA256(strings.ToLower(hash))
+		http.Redirect(w, r, fmt.Sprintf("https://%s/%s/%s?%s", avatarHost, kind, hash, r.URL.RawQuery), 301)
+		return
+	}
+
+	fname := filepath.Join(app.path, ".links", strings.Join([]string{kind, hash}, "-"))
+	log.Debug().Msgf("path: %s", fname)
+
+	if !fileExists(fname) {
+		switch kind {
+		case "avatar":
+			ig, err := identicon.New("sour.is", 5, 3)
+			if err != nil {
+				writeText(w, 500, err.Error())
+				return
+			}
+
+			ii, err := ig.Draw(hash)
+			if err != nil {
+				writeText(w, 500, err.Error())
+				return
+			}
+
+			w.Header().Set("Content-Type", "image/png")
+			w.WriteHeader(200)
+			err = ii.Png(clamp(128, 512, sizeW), w)
+			log.Error().Err(err).Send()
+
+			return
+		default:
+			sp := strings.SplitN(pixl, ",", 2)
+			b, _ := base64.RawStdEncoding.DecodeString(sp[1])
+			w.Header().Set("Content-Type", "image/png")
+			w.WriteHeader(200)
+			if _, err := w.Write(b); err != nil {
+				log.Error().Err(err).Send()
+			}
+			return
+		}
+	}
+
+	if !resize {
+		f, err := os.Open(fname)
+		if err != nil {
+			writeText(w, 500, err.Error())
+			return
+		}
+
+		w.Header().Set("Content-Type", "image/png")
+		w.WriteHeader(200)
+
+		_, err = io.Copy(w, f)
+		if err != nil {
+			log.Error().Err(err).Send()
+		}
+		return
+	}
+
+	img, err := imaging.Open(fname, imaging.AutoOrientation(true))
+	if err != nil {
+		writeText(w, 500, err.Error())
+		return
+	}
+
+	img = imaging.Fill(img, sizeW, sizeH, imaging.Center, imaging.Lanczos)
+
+	w.Header().Set("Content-Type", "image/png")
+	w.WriteHeader(200)
+	log.Debug().Msg("writing image")
+	err = imaging.Encode(w, img, imaging.PNG)
+	if err != nil {
+		log.Error().Err(err).Send()
+	}
+}
+
+func (app *avatarApp) Routes(r *chi.Mux) {
+	r.MethodFunc("GET", "/{kind:avatar|bg|cover}/{hash}", app.get)
+}
+
+func hashString(value string, h hash.Hash) string {
+	_, _ = h.Write([]byte(value))
+	return fmt.Sprintf("%x", h.Sum(nil))
+}
+func hashMD5(name string) string {
+	return hashString(name, md5.New())
+}
+func hashSHA256(name string) string {
+	return hashString(name, sha256.New())
+}
+
+func (app *avatarApp) createLinks(kind, name string) error {
+	if !strings.ContainsRune(name, '@') {
+		return nil
+	}
+
+	src := filepath.Join("..", kind, name)
+	name = strings.ToLower(name)
+
+	hash := hashMD5(name)
+	link := filepath.Join(app.path, ".links", strings.Join([]string{kind, hash}, "-"))
+	err := app.replaceLink(src, link)
+	if err != nil {
+		return err
+	}
+
+	hash = hashSHA256(name)
+	link = filepath.Join(app.path, ".links", strings.Join([]string{kind, hash}, "-"))
+	err = app.replaceLink(src, link)
+
+	return err
+}
+
+func (app *avatarApp) removeLinks(kind, name string) error {
+	if !strings.ContainsRune(name, '@') {
+		return nil
+	}
+	name = strings.ToLower(name)
+
+	hash := hashMD5(name)
+	link := filepath.Join(app.path, ".links", strings.Join([]string{kind, hash}, "-"))
+	err := os.Remove(link)
+	if err != nil {
+		return err
+	}
+
+	hash = hashSHA256(name)
+	link = filepath.Join(app.path, ".links", strings.Join([]string{kind, hash}, "-"))
+	err = os.Remove(link)
+
+	return err
+}
+
+func (app *avatarApp) replaceLink(src, link string) error {
+	if dst, err := os.Readlink(link); err != nil {
+		if os.IsNotExist(err) {
+			err = os.Symlink(src, link)
+			if err != nil {
+				return err
+			}
+		}
+	} else {
+		if dst != src {
+			err = os.Remove(link)
+			if err != nil {
+				return err
+			}
+			err = os.Symlink(src, link)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+func fileExists(filename string) bool {
+	info, err := os.Stat(filename)
+	if os.IsNotExist(err) {
+		return false
+	}
+	return !info.IsDir()
+}
+
+func sizeByKind(kind string, size int) (sizeW int, sizeH int, resize bool) {
+	switch kind {
+	case "avatar":
+		if size == 0 {
+			size = 128
+		}
+		sizeW = clamp(128, 640, size)
+		sizeH = sizeW
+		resize = true
+
+		return
+	case "cover":
+		if size == 0 {
+			size = 940
+		}
+
+		sizeW = clamp(640, 1300, size)
+		sizeH = ratio(sizeW, 2.7)
+		resize = true
+
+		return
+	default:
+		return 0, 0, false
+	}
+}
+
+func ratio(size int, ratio float64) int {
+	return int(float64(size) / ratio)
+}
+func clamp(min, max, size int) int {
+	if size > max {
+		return max
+	}
+
+	if size < min {
+		return min
+	}
+
+	return size
+}

pkg/keyproofs/routes-dns.go

@@ -0,0 +1,32 @@
+package keyproofs
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"strings"
+
+	"github.com/go-chi/chi"
+)
+
+type dnsApp struct {
+	resolver *net.Resolver
+}
+
+func NewDNSApp(ctx context.Context) *dnsApp {
+	return &dnsApp{resolver: net.DefaultResolver}
+}
+func (app *dnsApp) getDNS(w http.ResponseWriter, r *http.Request) {
+	domain := chi.URLParam(r, "domain")
+
+	res, err := app.resolver.LookupTXT(r.Context(), domain)
+	if err != nil {
+		writeText(w, 400, err.Error())
+		return
+	}
+
+	writeText(w, 200, strings.Join(res, "\n"))
+}
+func (app *dnsApp) Routes(r *chi.Mux) {
+	r.MethodFunc("GET", "/dns/{domain}", app.getDNS)
+}

pkg/keyproofs/routes-keyproofs.go

@@ -4,18 +4,15 @@ import (
 	"context"
 	"encoding/base64"
 	"fmt"
-	"net"
+	"html/template"
 	"net/http"
-	"net/mail"
 	"strconv"
-	"strings"
-	"text/template"
 	"time"
 
 	"github.com/go-chi/chi"
 	zlog "github.com/rs/zerolog/log"
+	"github.com/russross/blackfriday"
 	"github.com/skip2/go-qrcode"
-	"gosrc.io/xmpp"
 
 	"github.com/sour-is/keyproofs/pkg/cache"
 	"github.com/sour-is/keyproofs/pkg/config"
@@ -23,32 +20,7 @@ import (
 )
 
 var expireAfter = 20 * time.Minute
-
+var runnerTimeout = 30 * time.Second
-func New(ctx context.Context, c cache.Cacher) (*identity, error) {
-	log := zlog.Ctx(ctx)
-
-	var ok bool
-	var xmppConfig *xmpp.Config
-	if xmppConfig, ok = config.FromContext(ctx).Get("xmpp-config").(*xmpp.Config); !ok {
-		log.Error().Msg("no xmpp-config")
-
-		return nil, fmt.Errorf("no xmpp config")
-	}
-
-	conn, err := NewXMPP(ctx, xmppConfig)
-	if err != nil {
-		return nil, err
-	}
-
-	tasker := promise.NewRunner(ctx, promise.Timeout(30*time.Second), promise.WithCache(c, expireAfter))
-	i := &identity{
-		cache:  c,
-		tasker: tasker,
-		conn:   conn,
-	}
-
-	return i, nil
-}
 
 // 1x1 gif pixel
 var pixl = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkYAAAAAYAAjCB0C8AAAAASUVORK5CYII="
@@ -61,31 +33,34 @@ var defaultStyle = &Style{
 	Palette:    getPalette("#93CCEA"),
 }
 
-type identity struct {
+type keyproofApp struct {
 	cache  cache.Cacher
 	tasker promise.Tasker
-	conn   *connection
 }
 
-func (s *identity) Routes(r *chi.Mux) {
+func NewKeyProofApp(ctx context.Context, c cache.Cacher) *keyproofApp {
-	r.Use(secHeaders)
+	return &keyproofApp{
-	r.MethodFunc("GET", "/id/{id}", s.get)
+		cache: c,
-	r.MethodFunc("GET", "/dns/{domain}", s.getDNS)
+		tasker: promise.NewRunner(
-	r.MethodFunc("GET", "/vcard/{jid}", s.getVCard)
+			ctx,
-	r.MethodFunc("GET", "/qr", s.getQR)
+			promise.Timeout(runnerTimeout),
+			promise.WithCache(c, expireAfter),
+		),
+	}
+}
+func (app *keyproofApp) Routes(r *chi.Mux) {
+	r.MethodFunc("GET", "/", app.getHome)
+	r.MethodFunc("GET", "/id/{id}", app.getProofs)
+	r.MethodFunc("GET", "/qr", app.getQR)
 	r.MethodFunc("GET", "/favicon.ico", func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "image/png")
 		w.WriteHeader(200)
 		_, _ = w.Write(keypng)
 	})
 }
-
+func (app *keyproofApp) getProofs(w http.ResponseWriter, r *http.Request) {
-func fmtKey(key promise.Key) string {
-	return fmt.Sprintf("%T", key.Key())
-}
-
-func (s *identity) get(w http.ResponseWriter, r *http.Request) {
 	log := zlog.Ctx(r.Context())
+	cfg := config.FromContext(r.Context())
 
 	id := chi.URLParam(r, "id")
 	log.Debug().Str("get ", id).Send()
@@ -95,7 +70,7 @@ func (s *identity) get(w http.ResponseWriter, r *http.Request) {
 	defer cancel()
 
 	// Run tasks to resolve entity, style, and proofs.
-	task := s.tasker.Run(EntityKey(id), func(q promise.Q) {
+	task := app.tasker.Run(EntityKey(id), func(q promise.Q) {
 		ctx := q.Context()
 		log := zlog.Ctx(ctx).With().Interface(fmtKey(q), q.Key()).Logger()
 
@@ -127,7 +102,7 @@ func (s *identity) get(w http.ResponseWriter, r *http.Request) {
 			key := q.Key().(StyleKey)
 
 			log.Debug().Msg("start task")
-			style, err := s.getStyle(ctx, string(key))
+			style, err := getStyle(ctx, string(key))
 			if err != nil {
 				q.Reject(err)
 				return
@@ -136,7 +111,6 @@ func (s *identity) get(w http.ResponseWriter, r *http.Request) {
 			log.Debug().Msg("Resolving Style")
 			q.Resolve(style)
 		})
-
 	})
 
 	task.After(func(q promise.ResultQ) {
@@ -172,6 +146,8 @@ func (s *identity) get(w http.ResponseWriter, r *http.Request) {
 	})
 
 	page := page{Style: defaultStyle}
+	page.AppName = fmt.Sprintf("%s v%s", cfg.GetString("app-name"), cfg.GetString("app-version"))
+	page.AppBuild = fmt.Sprintf("%s %s", cfg.GetString("build-date"), cfg.GetString("build-hash"))
 
 	// Wait for either entity to resolve or timeout
 	select {
@@ -186,7 +162,7 @@ func (s *identity) get(w http.ResponseWriter, r *http.Request) {
 
 	case <-ctx.Done():
 		log.Print("Deadline Timeout")
-		if e, ok := s.cache.Get(EntityKey(id)); ok {
+		if e, ok := app.cache.Get(EntityKey(id)); ok {
 			page.Entity = e.Value().(*Entity)
 		}
 	}
@@ -195,7 +171,7 @@ func (s *identity) get(w http.ResponseWriter, r *http.Request) {
 	if page.Entity != nil {
 		var gotStyle, gotProofs bool
 
-		if s, ok := s.cache.Get(StyleKey(page.Entity.Primary.Address)); ok {
+		if s, ok := app.cache.Get(StyleKey(page.Entity.Primary.Address)); ok {
 			page.Style = s.Value().(*Style)
 			gotStyle = true
 		}
@@ -207,7 +183,7 @@ func (s *identity) get(w http.ResponseWriter, r *http.Request) {
 			for i := range page.Entity.Proofs {
 				p := page.Entity.Proofs[i]
 
-				if s, ok := s.cache.Get(ProofKey(p)); ok {
+				if s, ok := app.cache.Get(ProofKey(p)); ok {
 					log.Debug().Str("uri", p).Msg("Proof from cache")
 					proofs[p] = s.Value().(*Proof)
 				} else {
@@ -223,31 +199,62 @@ func (s *identity) get(w http.ResponseWriter, r *http.Request) {
 	}
 
 	// Template and display.
-	t, err := template.New("identity").Parse(pageTPL)
+	var err error
+	t := template.New("page")
+	t, err = t.Parse(pageTPL)
 	if err != nil {
-		WriteText(w, 500, err.Error())
+		writeText(w, 500, err.Error())
 		return
 	}
+
+	t, err = t.Parse(proofTPL)
+	if err != nil {
+		writeText(w, 500, err.Error())
+		return
+	}
+
 	err = t.Execute(w, page)
 	if err != nil {
-		WriteText(w, 500, err.Error())
+		writeText(w, 500, err.Error())
 		return
 	}
 }
+func (app *keyproofApp) getHome(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	cfg := config.FromContext(ctx)
 
-func (s *identity) getDNS(w http.ResponseWriter, r *http.Request) {
+	baseURL := cfg.GetString("base-url")
-	domain := chi.URLParam(r, "domain")
+	if id := r.URL.Query().Get("id"); id != "" {
+		http.Redirect(w, r, fmt.Sprintf("%s/id/%s", baseURL, id), http.StatusFound)
+		return
+	}
 
-	res, err := net.DefaultResolver.LookupTXT(r.Context(), domain)
+	page := page{Style: defaultStyle, IsComplete: true, Markdown: homeMKDN}
+	page.AppName = fmt.Sprintf("%s v%s", cfg.GetString("app-name"), cfg.GetString("app-version"))
+
+	// Template and display.
+	var err error
+	t := template.New("page")
+	t = t.Funcs(template.FuncMap{"markDown": markDowner})
+	t, err = t.Parse(pageTPL)
 	if err != nil {
-		WriteText(w, 400, err.Error())
+		writeText(w, 500, err.Error())
 		return
 	}
 
-	WriteText(w, 200, strings.Join(res, "\n"))
+	t, err = t.Parse(homeTPL)
-}
+	if err != nil {
+		writeText(w, 500, err.Error())
+		return
+	}
 
-func (s *identity) getQR(w http.ResponseWriter, r *http.Request) {
+	err = t.Execute(w, page)
+	if err != nil {
+		writeText(w, 500, err.Error())
+		return
+	}
+}
+func (app *keyproofApp) getQR(w http.ResponseWriter, r *http.Request) {
 	log := zlog.Ctx(r.Context())
 
 	content := r.URL.Query().Get("c")
@@ -277,7 +284,7 @@ func (s *identity) getQR(w http.ResponseWriter, r *http.Request) {
 
 	png, err := qrcode.Encode(content, quality, size)
 	if err != nil {
-		WriteText(w, 400, err.Error())
+		writeText(w, 400, err.Error())
 		return
 	}
 
@@ -287,38 +294,18 @@ func (s *identity) getQR(w http.ResponseWriter, r *http.Request) {
 	_, _ = w.Write(png)
 }
 
-func (s *identity) getVCard(w http.ResponseWriter, r *http.Request) {
+func markDowner(args ...interface{}) template.HTML {
-	jid := chi.URLParam(r, "jid")
+	s := blackfriday.MarkdownCommon([]byte(fmt.Sprintf("%s", args...)))
-	if _, err := mail.ParseAddress(jid); err != nil {
+	return template.HTML(s)
-		fmt.Fprint(w, err)
-		w.WriteHeader(400)
-	}
-
-	vcard, err := s.conn.GetXMPPVCard(r.Context(), jid)
-	if err != nil {
-		fmt.Fprint(w, err)
-		w.WriteHeader(500)
-	}
-
-	w.Header().Set("Content-Type", "text/xml")
-	w.WriteHeader(200)
-	fmt.Fprint(w, vcard)
-}
-
-func secHeaders(h http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("X-XSS-Protection", "1; mode=block")
-		w.Header().Set("X-Frame-Options", "DENY")
-		w.Header().Set("X-Content-Type-Options", "nosniff")
-		w.Header().Set("X-Content-Type-Options", "nosniff")
-
-		h.ServeHTTP(w, r)
-	})
 }
 
 // WriteText writes plain text
-func WriteText(w http.ResponseWriter, code int, o string) {
+func writeText(w http.ResponseWriter, code int, o string) {
 	w.Header().Set("Content-Type", "text/plain")
 	w.WriteHeader(code)
 	_, _ = w.Write([]byte(o))
 }
+
+func fmtKey(key promise.Key) string {
+	return fmt.Sprintf("%T", key.Key())
+}

pkg/keyproofs/routes-vcard.go

@@ -0,0 +1,56 @@
+package keyproofs
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/mail"
+
+	"github.com/go-chi/chi"
+	zlog "github.com/rs/zerolog/log"
+	"github.com/sour-is/keyproofs/pkg/config"
+	"gosrc.io/xmpp"
+)
+
+type vcardApp struct {
+	conn *connection
+}
+
+func NewVCardApp(ctx context.Context) (*vcardApp, error) {
+	log := zlog.Ctx(ctx)
+
+	var ok bool
+	var xmppConfig *xmpp.Config
+	if xmppConfig, ok = config.FromContext(ctx).Get("xmpp-config").(*xmpp.Config); !ok {
+		log.Error().Msg("no xmpp-config")
+
+		return nil, fmt.Errorf("no xmpp config")
+	}
+
+	conn, err := NewXMPP(ctx, xmppConfig)
+	if err != nil {
+		return nil, err
+	}
+
+	return &vcardApp{conn: conn}, nil
+}
+func (app *vcardApp) Routes(r *chi.Mux) {
+	r.MethodFunc("GET", "/vcard/{jid}", app.getVCard)
+}
+func (app *vcardApp) getVCard(w http.ResponseWriter, r *http.Request) {
+	jid := chi.URLParam(r, "jid")
+	if _, err := mail.ParseAddress(jid); err != nil {
+		fmt.Fprint(w, err)
+		w.WriteHeader(400)
+	}
+
+	vcard, err := app.conn.GetXMPPVCard(r.Context(), jid)
+	if err != nil {
+		fmt.Fprint(w, err)
+		w.WriteHeader(500)
+	}
+
+	w.Header().Set("Content-Type", "text/xml")
+	w.WriteHeader(200)
+	fmt.Fprint(w, vcard)
+}

pkg/keyproofs/routes-wkd.go

@@ -0,0 +1,380 @@
+package keyproofs
+
+import (
+	"context"
+	"crypto/sha1"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/fsnotify/fsnotify"
+	"github.com/go-chi/chi"
+	"github.com/rs/zerolog/log"
+	"github.com/sour-is/crypto/openpgp"
+	"github.com/sour-is/keyproofs/pkg/graceful"
+	"github.com/tv42/zbase32"
+)
+
+type wkdApp struct {
+	path   string
+	domain string
+}
+
+func NewWKDApp(ctx context.Context, path, domain string) (*wkdApp, error) {
+	log := log.Ctx(ctx)
+	log.Debug().Str("domain", domain).Str("path", path).Msg("NewWKDApp")
+
+	path = filepath.Clean(path)
+	app := &wkdApp{path: path, domain: domain}
+	err := app.CheckFiles(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	watch, err := fsnotify.NewWatcher()
+	if err != nil {
+		return nil, err
+	}
+	for _, typ := range []string{"keys"} {
+		err = watch.Add(filepath.Join(path, typ))
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	log.Debug().Msg("startup wkd watcher")
+	wg := graceful.WaitGroup(ctx)
+	wg.Go(func() error {
+		for {
+			select {
+			case <-ctx.Done():
+				log.Debug().Msg("shutdown wkd watcher")
+				return nil
+			case op := <-watch.Events:
+				log.Print(op)
+				switch op.Op {
+				case fsnotify.Create:
+					path = filepath.Dir(op.Name)
+					kind := filepath.Base(path)
+					name := filepath.Base(op.Name)
+					if err := app.createLinks(kind, name); err != nil {
+						log.Err(err).Send()
+					}
+				case fsnotify.Remove, fsnotify.Rename:
+					path = filepath.Dir(op.Name)
+					kind := filepath.Base(path)
+					name := filepath.Base(op.Name)
+					if err := app.removeLinks(kind, name); err != nil {
+						log.Error().Err(err).Send()
+					}
+				default:
+				}
+			case err := <-watch.Errors:
+				log.Err(err).Send()
+			}
+		}
+	})
+
+	return app, nil
+}
+
+func (app *wkdApp) CheckFiles(ctx context.Context) error {
+	log := log.Ctx(ctx)
+
+	for _, name := range []string{".links", "keys"} {
+		log.Debug().Msgf("mkdir: %s", filepath.Join(app.path, name))
+		err := os.MkdirAll(filepath.Join(app.path, name), 0700)
+		if err != nil {
+			return err
+		}
+	}
+
+	return filepath.Walk(app.path, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		log.Debug().Msg(info.Name())
+		if path == app.path {
+			return nil
+		}
+		if info.IsDir() {
+			switch info.Name() {
+			case "keys":
+				return nil
+			}
+			return filepath.SkipDir
+
+		}
+
+		path = filepath.Dir(path)
+		kind := filepath.Base(path)
+		name := info.Name()
+
+		log.Debug().Msgf("link: %s %s %s", app.path, kind, name)
+
+		return app.createLinks(kind, name)
+	})
+}
+
+func (app *wkdApp) getRedirect(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	log := log.Ctx(ctx)
+
+	log.Print(r.Host)
+
+	hash := chi.URLParam(r, "hash")
+
+	if strings.ContainsRune(hash, '@') {
+		hash, domain := hashHuman(hash)
+		log.Debug().Str("hash", hash).Str("domain", domain).Msg("redirect")
+		if host, adv := getWKDDomain(ctx, domain); adv {
+			log.Debug().Str("host", host).Str("domain", domain).Bool("adv", adv).Msg("redirect")
+			http.Redirect(w, r, fmt.Sprintf("https://%s/.well-known/openpgpkey/hu/%s/%s", host, domain, hash), http.StatusTemporaryRedirect)
+		} else {
+			log.Debug().Str("host", host).Str("domain", domain).Bool("adv", adv).Msg("redirect")
+			http.Redirect(w, r, fmt.Sprintf("https://%s/.well-known/openpgpkey/hu/%s", domain, hash), http.StatusTemporaryRedirect)
+		}
+
+		return
+	}
+
+	writeText(w, http.StatusBadRequest, "Bad Request")
+}
+
+func (app *wkdApp) get(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	log := log.Ctx(ctx)
+
+	log.Print(r.Host)
+
+	hash := chi.URLParam(r, "hash")
+	domain := chi.URLParam(r, "domain")
+	if domain == "" {
+		domain = app.domain
+	}
+
+	if strings.ContainsRune(hash, '@') {
+		hash, domain = hashHuman(hash)
+	}
+
+	fname := filepath.Join(app.path, ".links", strings.Join([]string{"keys", domain, hash}, "-"))
+	log.Debug().Msgf("path: %s", fname)
+
+	f, err := os.Open(fname)
+	if err != nil {
+		writeText(w, 500, err.Error())
+		return
+	}
+
+	_, err = io.Copy(w, f)
+	if err != nil {
+		writeText(w, 500, err.Error())
+		return
+	}
+}
+
+func (app *wkdApp) Routes(r *chi.Mux) {
+	r.MethodFunc("GET", "/wkd/{hash}", app.getRedirect)
+	r.MethodFunc("GET", "/key/{hash}", app.get)
+	r.MethodFunc("POST", "/pks/add", app.postKey)
+	r.MethodFunc("GET", "/.well-known/openpgpkey/hu/{hash}", app.get)
+	r.MethodFunc("GET", "/.well-known/openpgpkey/hu/{domain}/{hash}", app.get)
+}
+
+func (app *wkdApp) createLinks(kind, name string) error {
+	if !strings.ContainsRune(name, '@') {
+		return nil
+	}
+
+	src := filepath.Join("..", kind, name)
+	name = strings.ToLower(name)
+
+	hash, domain := hashHuman(name)
+	link := filepath.Join(app.path, ".links", strings.Join([]string{kind, domain, hash}, "-"))
+	err := app.replaceLink(src, link)
+	if err != nil {
+		return err
+	}
+
+	return err
+}
+func hashHuman(name string) (string, string) {
+	name = strings.ToLower(name)
+	parts := strings.SplitN(name, "@", 2)
+	hash := sha1.Sum([]byte(parts[0]))
+	lp := zbase32.EncodeToString(hash[:])
+
+	return lp, parts[1]
+}
+
+func (app *wkdApp) removeLinks(kind, name string) error {
+	if !strings.ContainsRune(name, '@') {
+		return nil
+	}
+	name = strings.ToLower(name)
+
+	hash, domain := hashHuman(name)
+	link := filepath.Join(app.path, ".links", strings.Join([]string{kind, domain, hash}, "-"))
+	err := os.Remove(link)
+	if err != nil {
+		return err
+	}
+
+	return err
+}
+
+func (app *wkdApp) replaceLink(src, link string) error {
+	if dst, err := os.Readlink(link); err != nil {
+		if os.IsNotExist(err) {
+			err = os.Symlink(src, link)
+			if err != nil {
+				return err
+			}
+		}
+	} else {
+		if dst != src {
+			err = os.Remove(link)
+			if err != nil {
+				return err
+			}
+			err = os.Symlink(src, link)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+func getWKDDomain(ctx context.Context, domain string) (string, bool) {
+	cname, err := net.DefaultResolver.LookupCNAME(ctx, "openpgpkey."+domain)
+	if err == nil {
+		return strings.Trim(cname, "."), true
+	}
+	return domain, false
+}
+
+func (app *wkdApp) postKey(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	log := log.Ctx(ctx)
+
+	body, err := ioutil.ReadAll(r.Body)
+	r.Body.Close()
+	if err != nil {
+		log.Err(err).Send()
+		writeText(w, http.StatusBadRequest, "ERR BODY")
+
+		return
+	}
+
+	q, err := url.ParseQuery(string(body))
+	if err != nil {
+		log.Err(err).Send()
+		writeText(w, http.StatusBadRequest, "ERR PARSE")
+
+		return
+	}
+
+	lis, err := openpgp.ReadArmoredKeyRing(strings.NewReader(q.Get("keytext")))
+	if err != nil {
+		log.Err(err).Send()
+		writeText(w, http.StatusBadRequest, "ERR READ KEY")
+
+		return
+	}
+
+	entity, err := getEntity(lis)
+	if err != nil {
+		log.Err(err).Send()
+		writeText(w, http.StatusBadRequest, "ERR ENTITY")
+
+		return
+	}
+
+	fname := filepath.Join(app.path, "keys", entity.Primary.Address)
+
+	f, err := os.Open(fname)
+	if os.IsNotExist(err) {
+		out, err := os.Create(fname)
+		if err != nil {
+			log.Err(err).Send()
+			writeText(w, http.StatusInternalServerError, "ERR CREATE")
+
+			return
+		}
+
+		err = entity.Serialize(out)
+		if err != nil {
+			log.Err(err).Send()
+			writeText(w, http.StatusInternalServerError, "ERR WRITE")
+			return
+		}
+
+		w.Header().Set("X-HKP-Status", "Created key")
+		writeText(w, http.StatusOK, "OK CREATED")
+		return
+	}
+
+	current, err := openpgp.ReadKeyRing(f)
+	if err != nil {
+		log.Err(err).Send()
+		writeText(w, http.StatusInternalServerError, "ERR READ")
+
+		return
+	}
+	f.Close()
+
+	compare, err := getEntity(current)
+	if err != nil {
+		log.Err(err).Send()
+		writeText(w, http.StatusInternalServerError, "ERR PARSE")
+
+		return
+	}
+
+	if entity.Fingerprint != compare.Fingerprint {
+		w.Header().Set("X-HKP-Status", "Mismatch fingerprint")
+		writeText(w, http.StatusBadRequest, "ERR FINGERPRINT")
+		return
+	}
+	if entity.SelfSignature == nil || compare.SelfSignature == nil {
+		w.Header().Set("X-HKP-Status", "Missing signature")
+		writeText(w, http.StatusBadRequest, "ERR SIGNATURE")
+		return
+	}
+
+	log.Debug().Msgf("%v < %v", entity.SelfSignature.CreationTime, compare.SelfSignature.CreationTime)
+
+	if !compare.SelfSignature.CreationTime.Before(entity.SelfSignature.CreationTime) {
+		w.Header().Set("X-HKP-Status", "out of date")
+		writeText(w, http.StatusBadRequest, "ERR OUT OF DATE")
+
+		return
+	}
+
+	out, err := os.Create(fname)
+	if err != nil {
+		log.Err(err).Send()
+		writeText(w, http.StatusInternalServerError, "ERR CREATE")
+
+		return
+	}
+
+	err = entity.Serialize(out)
+	if err != nil {
+		log.Err(err).Send()
+		writeText(w, http.StatusInternalServerError, "ERR WRITE")
+
+		return
+	}
+
+	w.Header().Set("X-HKP-Status", "Updated key")
+	writeText(w, http.StatusOK, "OK UPDATED")
+}

pkg/keyproofs/style.go

@@ -25,7 +25,7 @@ type Style struct {
 	Palette []string
 }
 
-func (s *identity) getStyle(ctx context.Context, email string) (*Style, error) {
+func getStyle(ctx context.Context, email string) (*Style, error) {
 	log := log.Ctx(ctx)
 
 	avatarHost, styleHost, err := styleSRV(ctx, email)
@@ -37,7 +37,6 @@ func (s *identity) getStyle(ctx context.Context, email string) (*Style, error) {
 	hash := md5.New()
 	email = strings.TrimSpace(strings.ToLower(email))
 	_, _ = hash.Write([]byte(email))
-
 	id := hash.Sum(nil)
 
 	style := &Style{}

pkg/keyproofs/template.go

@@ -1,10 +1,13 @@
 package keyproofs
 
 type page struct {
-	Entity *Entity
+	AppName  string
-	Style  *Style
+	AppBuild string
-	Proofs *Proofs
+	Entity   *Entity
+	Style    *Style
+	Proofs   *Proofs
 
+	Markdown   string
 	HasProofs  bool
 	IsComplete bool
 	Err        error
@@ -14,7 +17,6 @@ var pageTPL = `
 <html>
 <head>
 	{{if not .IsComplete}}<meta http-equiv="refresh" content="1">{{end}}
-	<script src="https://pagecdn.io/lib/font-awesome/5.14.0/js/fontawesome.min.js"                   crossorigin="anonymous" integrity="sha256-dNZKI9qQEpJG03MLdR2Rg9Dva1o+50fN3zmlDP+3I+Y="></script>
 
 	<link href="https://pagecdn.io/lib/bootstrap/4.5.1/css/bootstrap.min.css"       rel="stylesheet" crossorigin="anonymous" integrity="sha256-VoFZSlmyTXsegReQCNmbXrS4hBBUl/cexZvPmPWoJsY=" >
 	<link href="https://pagecdn.io/lib/font-awesome/5.14.0/css/fontawesome.min.css" rel="stylesheet" crossorigin="anonymous" integrity="sha256-7YMlwkILTJEm0TSengNDszUuNSeZu4KTN3z7XrhUQvc=" >
@@ -24,6 +26,10 @@ var pageTPL = `
 
 {{ with .Style }}
 	<style>
+		@font-face { font-family: "Font Awesome 5 Free"; font-weight: 900; src: url(https://pagecdn.io/lib/font-awesome/5.14.0/webfonts/fa-solid-900.woff2); }
+		@font-face { font-family: "Font Awesome 5 Free"; font-weight: 400; src: url(https://pagecdn.io/lib/font-awesome/5.14.0/webfonts/fa-regular-400.woff2); }
+		@font-face { font-family: "Font Awesome 5 Brands"; src: url(https://pagecdn.io/lib/font-awesome/5.14.0/webfonts/fa-brands-400.woff2); }
+
 		{{range $i, $val := .Palette}}.fg-color-{{$i}} { color: {{$val}}; }
 		{{end}}
 
@@ -44,80 +50,129 @@ var pageTPL = `
 		}
 		.shade { background-color: {{index .Palette 3}}80; border-radius: .25rem;}
 		.lead { padding:0; margin:0;  }
+		.scroll { height: 20em; overflow: scroll; }
+
+		@media only screen and (max-width: 991px) {
+			.jumbotron h1 { font-size: 2rem; }
+			.jumbotron .lead { font-size: 1.0rem; }
+		}
 
 		@media only screen and (max-width: 768px) {
-			 .center-xs { text-align: center; width: 100% }
+			.center-xs { text-align: center; width: 100% }
-			 .center-sm { text-align: center; width: 100% }
+			.center-sm { text-align: center; width: 100% }
-			 .center-md { text-align: center; width: 100% }
+			.center-md { text-align: center; width: 100% }
-			 h1, h2, h3, h4, h5, h6, .lead  { font-size: 75% }
+			.jumbotron h1 { font-size: 2rem; }
-			}
+			.jumbotron .lead { font-size: 1.0rem; }
+		}
 
 		 @media only screen and (max-width: 576px) {
 			.center-xs { text-align: center; width: 100% }
 			.center-sm { text-align: center; width: 100% }
 			.center-md { text-align: center; width: 100% }
-			h1, h2, h3, h4, h5, h6, .lead  { font-size: 75% }
+			.jumbotron .lead { font-size: 0.8rem; }
+			body { font-size: 0.8rem; }
 		}
-
-		@media only screen and (max-width: 0) {
-			.center-xs { text-align: center; width: 100% }
-			.center-sm { text-align: center; width: 100% }
-			.center-md { text-align: center; width: 100% }
-			h1, h2, h3, h4, h5, h6, .lead { font-size: 60% }
-		}
-
 	</style>
 {{end}}
 </head>
 
 <body>
 	<div class="container">
-	<div class="card">
+		<div class="card">
-		<div class="jumbotron heading">
+			{{template "content" .}}
-		<div class="container">
-			<div class="row shade">
 
-				{{ with .Err }}
+			<div class="card-footer text-muted text-center">
-					<div class="col-xs center-md">
+				<a href="/" alt="{{.AppBuild}}">{{.AppName}}</a>
-						<i class="fas fa-exclamation-triangle fa-4x fg-color-11"></i>
+				| &copy; 2020 Sour.is
-					</div>
+				| <a href="/id/me@sour.is">About me</a>
-
+				| <a href="https://github.com/sour-is/keyproofs">GitHub</a>
-					<div class="col-md">
+				| Inspired by <a href="https://keyoxide.org/">keyoxide</a>
-						<h1 class="display-8 fg-color-8">Something went wrong...</h1>
-						<pre class="fg-color-11">{{.}}</pre>
-					</div>
-				{{else}}
-					{{ with .Style }}
-						<div class="col-xs center-md">
-							<img src="{{.Avatar}}" class="img-thumbnail" alt="avatar" style="width:88px; height:88px">
-						</div>
-					{{end}}
-
-
-					{{with .Entity}}
-						<div class="col-md center-md">
-							<h1 class="display-8 fg-color-8">{{.Primary.Name}}</h1>
-							<p class="lead fg-color-11"><i class="fas fa-fingerprint"></i> {{.Fingerprint}}</p>
-						</div>
-						<div class="col-xs center-md">
-							<img src="/qr?s=-2&c=OPENPGP4FPR%3A{{.Fingerprint}}" class="img-thumbnail" alt="qrcode" style="width:88px; height:88px">
-						</div>
-					{{else}}
-						<div class="col-md">
-							<h1 class="display-8 fg-color-8">Loading...</h1>
-							<p class="lead fg-color-11">Reading key from remote service.</p>
-						</div>
-					{{end}}
-
-
-				{{end}}
 			</div>
 		</div>
-		</div>
+	</div>
+</body>
+</html>
+`
 
-		<div class="container">
+var homeTPL = `
+{{define "content"}}
+<div class="jumbotron heading">
+	<div class="container">
+		<div class="row shade">
+			<div class="col-md">
+				<h1 class="display-8 fg-color-8">Key Proofs</h1>
+				<p class="lead fg-color-11">Verify social identitys using OpenPGP</p>
+			</div>
+		</div>
+	</div>
+</div>
+<br/>
+<div class="card">
+	<div class="card-body">
+		<form method="GET" action="/">
+			<div class="input-group mb-3">
+				<input type="text"
+					   name="id"
+					   class="form-control"
+					   placeholder="Email or Fingerprint..."
+					   aria-label="Email or Fingerprint"
+					   aria-describedby="button-addon" />
+				<div class="input-group-append">
+					<button class="btn btn-outline-secondary" type="submit" id="button-addon">GO</button>
+				</div>
+			</div>
+		</form>
+	</div>
+</div>
+<div class="container"> {{.Markdown | markDown}} </div>
+{{end}}
+`
+
+var proofTPL = `
+{{define "content"}}
+<div class="jumbotron heading">
+	<div class="container">
+		<div class="row shade">
+		{{ with .Err }}
+			<div class="col-xs center-md">
+				<i class="fas fa-exclamation-triangle fa-4x fg-color-11"></i>
+			</div>
+
+			<div class="col-md">
+				<h1 class="display-8 fg-color-8">Something went wrong...</h1>
+				<pre class="fg-color-11">{{.}}</pre>
+			</div>
+		{{else}}
+			{{ with .Style }}
+				<div class="col-xs center-md">
+					<img src="{{.Avatar}}" class="img-thumbnail" alt="avatar" style="width:88px; height:88px">
+				</div>
+			{{end}}
+
+			{{with .Entity}}
+				<div class="col-md center-md">
+					<h1 class="display-8 fg-color-8">{{.Primary.Name}}</h1>
+					<p class="lead fg-color-11"><i class="fas fa-fingerprint"></i> {{.Fingerprint}}</p>
+				</div>
+				<div class="col-xs center-md">
+					<img src="/qr?s=-2&c=OPENPGP4FPR%3A{{.Fingerprint}}" class="img-thumbnail" alt="qrcode" style="width:88px; height:88px">
+				</div>
+			{{else}}
+				<div class="col-md">
+					<h1 class="display-8 fg-color-8">Loading...</h1>
+					<p class="lead fg-color-11">Reading key from remote service.</p>
+				</div>
+			{{end}}
+		{{end}}
+		</div>
+	</div>
+</div>
+
+<div class="container">
+	<div class="row">
+		<div class="col-lg-4 col-md-12 col-sm-12 col-xs-12">
 		{{ with .Entity }}
-		 	<div class="card">
+			<div class="card">
 				<div class="card-header">Contact</div>
 				<div class="list-group list-group-flush">
 					{{with .Primary}}<a href="mailto:{{.Address}}" class="list-group-item list-group-item-action"><i class="fas fa-envelope"></i> <b>{{.Name}} &lt;{{.Address}}&gt;</b> <span class="badge badge-secondary">Primary</span></a>{{end}}
@@ -131,37 +186,36 @@ var pageTPL = `
 		{{with .Proofs}}
 			<div class="card">
 				<div class="card-header">Proofs</div>
-				<ul class="list-group list-group-flush">
+					<ul class="list-group list-group-flush">
-					{{range .}}
+						{{range .}}
-					<li class="list-group-item">
+						<li class="list-group-item">
-						<div class="d-flex w-100 justify-content-between">
+							<div>
-						<div>
+								<a title="{{.Link}}" class="font-weight-bold" href="{{.Link}}">
-						<a title="{{.Link}}" class="font-weight-bold" href="{{.Link}}">
+									<i title="{{.Service}}" class="{{.Icon}}"></i>
-							<i title="{{.Service}}" class="{{.Icon}}"></i>
+									{{.Name}}
-							{{.Name}}
+								</a>
-						</a>
 
-						{{if eq .Status 0}}
+								{{if eq .Status 0}}
-							<a class="text-muted" href="{{.Verify}}"> <i class="fas fa-ellipsis-h"> Checking</i></a>
+									<a class="text-muted" href="{{.Verify}}"> <i class="fas fa-ellipsis-h"> Checking</i></a>
-						{{else if eq .Status 1}}
+								{{else if eq .Status 1}}
-							<a class="text-warning" href="{{.Verify}}"> <i class="fas fa-exclamation-triangle"></i> Error</a>
+									<a class="text-warning" href="{{.Verify}}"> <i class="fas fa-exclamation-triangle"></i> Error</a>
-						{{else if eq .Status 2}}
+								{{else if eq .Status 2}}
-							<a class="text-danger" href="{{.Verify}}"> <i class="far fa-times-circle"></i> Invalid</a>
+									<a class="text-danger" href="{{.Verify}}"> <i class="far fa-times-circle"></i> Invalid</a>
-						{{else if eq .Status 3}}
+								{{else if eq .Status 3}}
-							<a class="text-success" href="{{.Verify}}"> <i class="far fa-check-square"></i> Verified</a>
+									<a class="text-success" href="{{.Verify}}"> <i class="far fa-check-square"></i> Verified</a>
+								{{end}}
+							</div>
+							<div>
+							{{if eq .Service "xmpp"}}
+								<br/>
+								<img src="/qr?s=-2&c={{.Link}}" alt="qrcode" style="width:88px; height:88px">
+							{{end}}
+							</div>
+						</li>
 						{{end}}
-						</div>
+					</ul>
-						<div>
+				</div>
-						{{if eq .Service "xmpp"}}
-							<img src="/qr?s=-2&c={{.Link}}" alt="qrcode" style="width:88px; height:88px">
-						{{end}}
-						</div>
-						</div>
-					</li>
-					{{end}}
-				</ul>
 			</div>
-			<br/>
 		{{else}}
 			<div class="card">
 				<div class="card-header">Proofs</div>
@@ -170,13 +224,48 @@ var pageTPL = `
 			<br/>
 		{{end}}
 		{{end}}
-		</div>
+		<div class="col-lg-8 col-md-12 col-sm-12 col-xs-12">
-
+			<div class="card">
-		<div class="card-footer text-muted text-center">
+				<div class="card-header">Public Key</div>
-			&copy; 2020 Sour.is | <a href="/id/me@sour.is">About me</a> | <a href="https://github.com/sour-is/keyproofs">GitHub</a> | Inspired by <a href="https://keyoxide.org/">keyoxide</a>
+				<div class="card-body scroll">
+					<pre><code>{{.Entity.ArmorText}}</code></pre>
+				</div>
+			</div>
 		</div>
 	</div>
-	</div>
+</div>
-</body>
+{{end}}
-</html>
+`
+
+var homeMKDN = `
+## About Keyproofs
+
+KeyProofs is a server side version of Keyoxide. There is no JavaScript executed on this page and resourcesKeys are looked up via [Web key directory](https://datatracker.ietf.org/doc/draft-koch-openpgp-webkey-service/)
+or from <https://keys.openpgp.org/>.
+
+
+### Decentralized online identity proofs
+
+- You decide which accounts are linked together
+- You decide where this data is stored
+- KeyProofs does not store your identity data on its servers
+- KeyProofs merely verifies the identity proofs and displays them
+
+### Empowering the internet citizen
+
+- A verified identity proof proves ownership of an account and builds trust
+- No bad actor can impersonate you as long as your accounts aren't compromised
+- Your online identity data is safe from greedy internet corporations
+
+### User-centric platform
+
+- KeyProofs generates QR codes that integrate with OpenKeychain and Conversations
+- KeyProofs fetches the key wherever the user decides to store it
+- KeyProofs is self-hostable, meaning you could put it on any server you trust
+
+### Secure and privacy-friendly
+
+- KeyProofs doesn't want your personal data, track you or show you ads
+- KeyProofs relies on OpenPGP, a widely used public-key cryptography standard (RFC-4880)
+- Cryptographic operations are performed on server.
 `

pkg/keyproofs/vcard.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 
 	"github.com/rs/zerolog/log"
+	"github.com/sour-is/keyproofs/pkg/graceful"
 	"gosrc.io/xmpp"
 	"gosrc.io/xmpp/stanza"
 )
@@ -40,34 +41,45 @@ func init() {
 }
 
 type connection struct {
-	client *xmpp.Client
+	client xmpp.StreamClient
 }
 
 func NewXMPP(ctx context.Context, config *xmpp.Config) (*connection, error) {
 	log := log.Ctx(ctx)
+	wg := graceful.WaitGroup(ctx)
+
 	router := xmpp.NewRouter()
 	conn := &connection{}
 
-	var err error
+	cl, err := xmpp.NewClient(config, router, func(err error) { log.Error().Err(err).Send() })
-	conn.client, err = xmpp.NewClient(config, router, func(err error) { log.Error().Err(err).Send() })
 	if err != nil {
 		return nil, err
 	}
+	conn.client = cl
+
+	sc := xmpp.NewStreamManager(cl, func(c xmpp.Sender) { log.Info().Msg("XMPP Client connected.") })
+
+	wg.Go(func() error {
+		log.Debug().Msg("starting XMPP")
+		return sc.Run()
+	})
 
 	go func() {
 		<-ctx.Done()
-		err := conn.client.Disconnect()
+		sc.Stop()
-		log.Error().Err(err).Send()
+		log.Info().Msg("XMPP Client shutdown.")
 	}()
 
-	err = conn.client.Connect()
-
 	return conn, err
 }
 
 func (conn *connection) GetXMPPVCard(ctx context.Context, jid string) (vc *VCard, err error) {
 	log := log.Ctx(ctx)
 
+	if err := conn.client.Resume(); err != nil {
+		return nil, err
+	}
+
 	var iq *stanza.IQ
 	iq, err = stanza.NewIQ(stanza.Attrs{To: jid, Type: "get"})
 	if err != nil {

sour.is-keyproofs.service

@@ -1,10 +1,11 @@
 [Unit]
-Description=sour.is paste API
+Description=sour.is KeyProofs API
 After=syslog.target network.target
 
 [Service]
 Type=simple
 User=www-data
+Group=www-data
 WorkingDirectory=/var/www
 ExecStart=/usr/local/bin/sour.is-keyproofs