Code map

hostingbot/
├── main.go                       # control-plane entry point
├── cmd/worker-agent/             # worker binary
├── internal/
│   ├── api/
│   │   ├── server.go             # routes + Gin engine
│   │   ├── ws.go                 # WSS hub (JWT + raw-key fallback) + Hub.WorkerQuery for admin RPC
│   │   ├── ws_dispatch.go        # inbound envelope router (incl. admin_query_reply)
│   │   ├── worker_jwt.go         # HS256 worker-token signer/verifier
│   │   ├── internal_api.go       # 127.0.0.1 loopback API for wisehosting-admin
│   │   └── traefik.go            # /v1/traefik/config HTTP-provider (10.88.0.1 host gateway)
│   ├── alerts/                   # alert manager + threshold poller
│   ├── config/                   # YAML loader (+ systemd LoadCredential overlay)
│   ├── database/
│   │   ├── secret.go             # HKDF-SHA256 + AES-GCM cipher
│   │   └── migrations/           # versioned SQL applied via golang-migrate
│   │       ├── 0001_init.up.sql
│   │       ├── 0002_domains.up.sql            # custom domains
│   │       ├── 0003_worker_key_hash.up.sql    # api_key → api_key_hash
│   │       ├── 0004_drop_job_retries.up.sql   # remove max_retries/retry_count
│   │       ├── 0005_rename_login_events.up.sql # login_events → audit_events
│   │       ├── 0006_admin_roles.up.sql        # admin_role_grants
│   │       ├── 0007_admin_sessions.up.sql     # superseded — see 0008
│   │       └── 0008_admin_accounts.up.sql     # decoupled admin_accounts + admin_sessions
│   ├── frameworks/               # Dockerfile presets
│   ├── gitproviders/             # GitHub / GitLab / Bitbucket / Codeberg
│   ├── httpx/                    # TLS 1.3 + SSRF-guarded HTTP/webhook clients
│   ├── logbus/                   # in-process log ring buffer
│   ├── models/                   # wire structs (no GORM tags)
│   ├── plans/                    # plan registry
│   ├── scheduler/                # job poll + worker selector (no in-process retries)
│   ├── usage/                    # 5-min usage sample recorder
│   ├── web/
│   │   ├── handler.go            # //go:embed assets — bakes the SPA into the binary
│   │   ├── domains_api.go        # custom-domain CRUD + DNS verification
│   │   ├── spa/                  # React 19 + Vite 8 dashboard source (see Frontend reference)
│   │   └── ...                   # apps, deployments, env, webhooks, sessions, alerts
│   ├── webhooks/                 # outbound dispatcher (HTTPS + Shoutrrr) + TestDeliver
│   ├── worker/                   # worker agent core (JWT refresh, image-ID pinning)
│   └── wsproto/                  # WSS envelope + HMAC
├── docker-compose.yml            # local Postgres
├── scripts/
│   ├── worker-setup.sh           # one-shot worker installer
│   ├── wireguard-setup.sh        # provision the 10.50.0.0/24 mesh
│   └── cosign-setup.sh           # optional per-host image-signing keypair
└── config.yaml.example