merge dev to main

.env.example

@@ -39,3 +39,33 @@ RATELIMIT_EMAIL_PER_HOUR=10
 RATELIMIT_PUSH_PER_HOUR=5
 RATELIMIT_SMS_PER_HOUR=3
 RATELIMIT_INAPP_PER_HOUR=50
+
+# In-app WebSocket
+INAPP_WS_HEARTBEAT_SECONDS=25
+INAPP_WS_BUFFER_SIZE=32
+INAPP_WS_READ_TIMEOUT_SECONDS=60
+
+# WebSocket JWT
+WS_JWT_SECRET=change-me-in-production
+WS_JWT_TTL_SECONDS=60
+
+# Admin API
+ADMIN_TOKEN=change-me-in-production
+
+# DLQ
+DLQ_ENABLED=true
+DLQ_CONSUMER_ENABLED=true
+DLQ_GROUP_ID=notifyhub-dlq-consumer
+
+# Webhooks
+WEBHOOK_ENABLED=true
+WEBHOOK_GROUP_ID=notifyhub-webhook-worker
+WEBHOOK_CONCURRENCY=3
+WEBHOOK_MAX_ATTEMPTS=5
+WEBHOOK_RETRY_BASE_DELAY_MS=1000
+
+# Observability
+OTEL_EXPORTER_OTLP_ENDPOINT=
+OTEL_EXPORTER_OTLP_INSECURE=true
+OTEL_TRACES_SAMPLER_ARG=0.1
+METRICS_PORT=9091

.github/workflows/ci.yml

@@ -0,0 +1,71 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+          cache: true
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v6
+        with:
+          version: latest
+          args: --go=1.24
+
+  test:
+    name: Unit Tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+          cache: true
+
+      - name: Run unit tests
+        run: make test
+
+  test-integration:
+    name: Integration Tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+          cache: true
+
+      - name: Run integration tests
+        run: make test-integration
+
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    needs: [lint, test]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+          cache: true
+
+      - name: Build binaries
+        run: make build

.github/workflows/docker.yml

@@ -0,0 +1,60 @@
+name: Docker
+
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build-push:
+    name: Build & Push (${{ matrix.target }})
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        target: [api, worker]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository_owner }}/notifyhub-${{ matrix.target }}
+          tags: |
+            type=sha,prefix=sha-,format=short
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: deployments/Dockerfile
+          target: ${{ matrix.target }}
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha,scope=${{ matrix.target }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.target }}

.gitignore

@@ -0,0 +1,55 @@
+# Binaries
+bin/
+*.exe
+*.dll
+*.so
+*.dylib
+
+# Test artifacts
+*.test
+*.out
+coverage.html
+coverage.txt
+
+# Build cache
+/tmp/
+
+# Environment files
+.env
+.env.local
+.env.*.local
+*.env
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+*~
+
+# OS
+.DS_Store
+Thumbs.db
+
+# sqlc
+# internal/db/ is generated — keep in source control but ignore any local overrides
+
+# Secrets / keys
+*.pem
+*.key
+*.p12
+*.crt
+
+# Logs
+*.log
+
+# Docker volumes (if mounted locally)
+postgres-data/
+redis-data/
+
+# k6 results
+scripts/loadtest/results/
+
+# md files
+docs/*.md
+docs/adr/