From da3634b690eb4917bae03d4cc0b763152fed729d Mon Sep 17 00:00:00 2001
From: Evgenii Orlov <4623930+OrlovEvgeny@users.noreply.github.com>
Date: Mon, 21 Jul 2025 19:30:02 +0200
Subject: [PATCH] E2E tests use repeated strings for test data where constants
 add no value (#97)

---------

Co-authored-by: Pasha Sviderski <me@psviderski.name>
Co-authored-by: Anton Ovchinnikov <anton@tonyo.info>
---
 .github/workflows/lint.yml                  | 10 ++++-----
 .golangci.yaml                              | 16 +++++++++++--
 Makefile                                    | 10 +++++----
 cmd/ucind/cluster/create.go                 |  1 +
 cmd/ucind/cluster/remove.go                 |  1 +
 cmd/ucind/cluster/root.go                   |  2 +-
 cmd/uncloud/machine/rm.go                   |  5 ++---
 cmd/uncloud/machine/token.go                |  1 +
 cmd/uncloud/service/inspect.go              |  1 -
 experiment/broadcaster.go                   |  5 +++--
 experiment/explorer/explorer.go             |  3 ++-
 experiment/logger.go                        |  3 ++-
 experiment/networkdb/main.go                |  3 ++-
 experiment/serf_crdt.go                     | 25 +++++++++++----------
 experiment/talos_discovery.go               |  5 +++--
 internal/cli/config/config.go               |  4 ++--
 internal/corrosion/client.go                |  5 +++--
 internal/corrosion/subscribe.go             |  3 ++-
 internal/daemon/daemon.go                   |  3 ++-
 internal/daemon/token.go                    |  5 +++--
 internal/docker/client.go                   |  5 +++--
 internal/machine/api/proxy/backend.go       |  1 +
 internal/machine/api/proxy/director.go      |  3 ++-
 internal/machine/api/proxy/local.go         |  3 ++-
 internal/machine/api/proxy/remote.go        |  7 +++---
 internal/machine/caddyconfig/controller.go  |  4 ++--
 internal/machine/cluster/cluster.go         |  7 +++---
 internal/machine/cluster/dns.go             |  1 +
 internal/machine/cluster/ipam.go            |  3 ++-
 internal/machine/cluster/machine.go         |  1 +
 internal/machine/corroservice/config.go     | 11 ++++-----
 internal/machine/corroservice/docker.go     |  9 ++++----
 internal/machine/corroservice/subprocess.go |  4 ++--
 internal/machine/db.go                      |  4 ++--
 internal/machine/machine.go                 |  4 ++--
 internal/machine/network/peer.go            |  3 ++-
 internal/machine/network/tunnel/tunnel.go   |  7 +++---
 internal/machine/network/wireguard.go       |  5 +++--
 internal/machine/network/wireguard_linux.go | 13 ++++++-----
 internal/machine/state.go                   |  7 +++---
 internal/machine/store/container.go         |  5 +++--
 internal/machine/store/store.go             |  3 ++-
 internal/machine/token.go                   |  3 ++-
 internal/sshexec/remote.go                  |  3 ++-
 internal/ucind/provision.go                 |  1 +
 pkg/api/port_test.go                        |  5 +++--
 pkg/client/caddy_test.go                    |  3 ++-
 pkg/client/compose/port.go                  |  2 +-
 pkg/client/connector/ssh.go                 |  5 +++--
 pkg/client/connector/tcp.go                 |  3 ++-
 pkg/client/connector/wireguard.go           |  7 +++---
 pkg/client/deploy/container.go              |  8 ++++---
 pkg/client/dns.go                           |  9 ++++----
 pkg/client/user.go                          |  3 ++-
 test/e2e/compose_build_test.go              |  1 -
 test/e2e/service_test.go                    | 12 +++++-----
 56 files changed, 170 insertions(+), 116 deletions(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 22d916c5..fabcf835 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -25,15 +25,15 @@ jobs:
         with:
           go-version: "1.23.2"
 
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
+        with:
+          version: v2.2.2
+
       - name: Format code
         run: |
           make format
           git diff --exit-code ||
             (echo "Code is not formatted. Please run 'make format' and commit the changes." && exit 1)
 
-      - name: golangci-lint
-        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
-        with:
-          version: v2.2.2
-
     timeout-minutes: 10
diff --git a/.golangci.yaml b/.golangci.yaml
index ddc5719f..3953f49d 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -1,4 +1,10 @@
 version: "2"
+
+run:
+  concurrency: 4
+  tests: true
+  timeout: 5m
+
 linters:
   default: none
   enable:
@@ -23,8 +29,14 @@ linters:
     # - unparam
     # - unused
     - whitespace
+  exclusions:
+    rules:
+      - path: ^test/e2e
+        linters:
+          - goconst  # constants here add no value, so we skip goconst only for test/e2e.
 
 formatters:
   enable:
-    - gofmt
-    # - goimports
+    - gofumpt
+    - goimports
+
diff --git a/Makefile b/Makefile
index f12e9788..35469261 100644
--- a/Makefile
+++ b/Makefile
@@ -89,9 +89,9 @@ test-clean:
 vet:
 	go vet ./...
 
-.PHONY: format
-format:
-	go fmt ./...
+.PHONY: format fmt
+format fmt:
+	GOOS=linux golangci-lint fmt
 
 LINT_TARGETS := lint lint-and-fix
 .PHONY: $(LINT_TARGETS) _lint
@@ -99,7 +99,9 @@ $(LINT_TARGETS): _lint
 lint: ARGS=
 lint-and-fix: ARGS=--fix
 _lint:
-	golangci-lint run $(ARGS)
+	# Explicitly set OS to Linux to not skip *_linux.go files when running on macOS.
+	# Uncloud daemon won't likely support OS other than Linux anytime soon, so for now we can rely on that.
+	GOOS=linux golangci-lint run $(ARGS)
 
 .PHONY: docs-image-push
 docs-image-push:
diff --git a/cmd/ucind/cluster/create.go b/cmd/ucind/cluster/create.go
index 8ead4845..9f60efdb 100644
--- a/cmd/ucind/cluster/create.go
+++ b/cmd/ucind/cluster/create.go
@@ -2,6 +2,7 @@ package cluster
 
 import (
 	"fmt"
+
 	"github.com/psviderski/uncloud/internal/ucind"
 	"github.com/spf13/cobra"
 )
diff --git a/cmd/ucind/cluster/remove.go b/cmd/ucind/cluster/remove.go
index c4d01bca..70ad44e7 100644
--- a/cmd/ucind/cluster/remove.go
+++ b/cmd/ucind/cluster/remove.go
@@ -2,6 +2,7 @@ package cluster
 
 import (
 	"fmt"
+
 	"github.com/psviderski/uncloud/internal/ucind"
 	"github.com/spf13/cobra"
 )
diff --git a/cmd/ucind/cluster/root.go b/cmd/ucind/cluster/root.go
index 34d99cde..68dd208c 100644
--- a/cmd/ucind/cluster/root.go
+++ b/cmd/ucind/cluster/root.go
@@ -13,7 +13,7 @@ func NewRootCommand() *cobra.Command {
 	}
 	cmd.AddCommand(
 		NewCreateCommand(),
-		//NewListCommand(),
+		// NewListCommand(),
 		NewRemoveCommand(),
 	)
 	return cmd
diff --git a/cmd/uncloud/machine/rm.go b/cmd/uncloud/machine/rm.go
index aedec26c..b792e67b 100644
--- a/cmd/uncloud/machine/rm.go
+++ b/cmd/uncloud/machine/rm.go
@@ -101,7 +101,6 @@ func remove(ctx context.Context, uncli *cli.CLI, machineName string, opts remove
 		err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
 			return removeContainers(ctx, client, containers)
 		}, uncli.ProgressOut(), "Removing containers")
-
 		if err != nil {
 			return fmt.Errorf("remove containers: %w", err)
 		}
@@ -112,8 +111,8 @@ func remove(ctx context.Context, uncli *cli.CLI, machineName string, opts remove
 	// TODO: 5. Remove the machine from the cluster store.
 
 	return fmt.Errorf("resetting machine is not fully implemented yet")
-	//fmt.Printf("Machine '%s' removed from the cluster.\n", m.Name)
-	//return nil
+	// fmt.Printf("Machine '%s' removed from the cluster.\n", m.Name)
+	// return nil
 }
 
 // formatContainerTree formats a list of containers grouped by service as a tree structure.
diff --git a/cmd/uncloud/machine/token.go b/cmd/uncloud/machine/token.go
index ccce8831..fed1fb87 100644
--- a/cmd/uncloud/machine/token.go
+++ b/cmd/uncloud/machine/token.go
@@ -2,6 +2,7 @@ package machine
 
 import (
 	"fmt"
+
 	"github.com/psviderski/uncloud/internal/daemon"
 	"github.com/psviderski/uncloud/internal/machine"
 	"github.com/spf13/cobra"
diff --git a/cmd/uncloud/service/inspect.go b/cmd/uncloud/service/inspect.go
index b8910ca3..7d63b89d 100644
--- a/cmd/uncloud/service/inspect.go
+++ b/cmd/uncloud/service/inspect.go
@@ -9,7 +9,6 @@ import (
 
 	"github.com/docker/docker/pkg/stringid"
 	"github.com/docker/go-units"
-
 	"github.com/psviderski/uncloud/internal/cli"
 	"github.com/spf13/cobra"
 )
diff --git a/experiment/broadcaster.go b/experiment/broadcaster.go
index 81acfa90..2b0e15e9 100644
--- a/experiment/broadcaster.go
+++ b/experiment/broadcaster.go
@@ -3,10 +3,11 @@ package main
 import (
 	"context"
 	"fmt"
-	"github.com/hashicorp/serf/serf"
-	crdt "github.com/ipfs/go-ds-crdt"
 	"log/slog"
 	"time"
+
+	"github.com/hashicorp/serf/serf"
+	crdt "github.com/ipfs/go-ds-crdt"
 )
 
 // Implements the Broadcaster interface.
diff --git a/experiment/explorer/explorer.go b/experiment/explorer/explorer.go
index 3b8e85b6..a51cf326 100644
--- a/experiment/explorer/explorer.go
+++ b/experiment/explorer/explorer.go
@@ -2,9 +2,10 @@ package main
 
 import (
 	"fmt"
-	"github.com/dgraph-io/badger/v3"
 	"log"
 	"time"
+
+	"github.com/dgraph-io/badger/v3"
 )
 
 func customTimeEncoder(t time.Time) string {
diff --git a/experiment/logger.go b/experiment/logger.go
index 9a8c6a3c..10dc2aa0 100644
--- a/experiment/logger.go
+++ b/experiment/logger.go
@@ -2,9 +2,10 @@ package main
 
 import (
 	"fmt"
-	"github.com/ipfs/go-log/v2"
 	"log/slog"
 	"os"
+
+	"github.com/ipfs/go-log/v2"
 )
 
 // ipfsLogger is an slog logger that implements the IPFS go-log StandardLogger interface.
diff --git a/experiment/networkdb/main.go b/experiment/networkdb/main.go
index dd0b919b..a7d2b9d6 100644
--- a/experiment/networkdb/main.go
+++ b/experiment/networkdb/main.go
@@ -2,12 +2,13 @@ package main
 
 import (
 	"fmt"
-	"github.com/docker/docker/libnetwork/networkdb"
 	"log/slog"
 	"os"
 	"os/signal"
 	"syscall"
 	"time"
+
+	"github.com/docker/docker/libnetwork/networkdb"
 )
 
 func main() {
diff --git a/experiment/serf_crdt.go b/experiment/serf_crdt.go
index e549e08a..a68c671e 100644
--- a/experiment/serf_crdt.go
+++ b/experiment/serf_crdt.go
@@ -4,6 +4,13 @@ import (
 	"context"
 	"flag"
 	"fmt"
+	"log/slog"
+	"net"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
 	"github.com/hashicorp/memberlist"
 	"github.com/hashicorp/serf/cmd/serf/command/agent"
 	"github.com/hashicorp/serf/serf"
@@ -11,12 +18,6 @@ import (
 	badger "github.com/ipfs/go-ds-badger3"
 	crdt "github.com/ipfs/go-ds-crdt"
 	"github.com/lmittmann/tint"
-	"log/slog"
-	"net"
-	"os"
-	"os/signal"
-	"syscall"
-	"time"
 )
 
 func createSerfAgentConfig(name, bindAddr, rpcAddr, profile string) *agent.Config {
@@ -49,9 +50,9 @@ func createSerfAgent(config *agent.Config) (*agent.Agent, error) {
 
 	serfConfig.MemberlistConfig.BindAddr = bindIP
 	serfConfig.MemberlistConfig.BindPort = bindPort
-	//serfConfig.MemberlistConfig.AdvertiseAddr = advertiseIP
-	//serfConfig.MemberlistConfig.AdvertisePort = advertisePort
-	//serfConfig.MemberlistConfig.SecretKey = encryptKey
+	// serfConfig.MemberlistConfig.AdvertiseAddr = advertiseIP
+	// serfConfig.MemberlistConfig.AdvertisePort = advertisePort
+	// serfConfig.MemberlistConfig.SecretKey = encryptKey
 	serfConfig.NodeName = config.NodeName
 	serfConfig.Tags = config.Tags
 	serfConfig.SnapshotPath = config.SnapshotPath
@@ -129,7 +130,7 @@ func main() {
 	logger := slog.New(tint.NewHandler(os.Stdout, &tint.Options{
 		AddSource: true,
 		Level:     slog.LevelDebug,
-		//Level:      slog.LevelInfo,
+		// Level:      slog.LevelInfo,
 		TimeFormat: time.RFC3339Nano,
 	}))
 	slog.SetDefault(logger)
@@ -164,7 +165,7 @@ func main() {
 
 	opts := crdt.DefaultOptions()
 	opts.Logger = newIPFSLogger(logger)
-	//opts.MultiHeadProcessing = true
+	// opts.MultiHeadProcessing = true
 	// TODO: debug why the heads count may grow on the receiving side if the event backlog is huge and the processing
 	//  is slow.
 	store, err := crdt.New(localStore, ds.NewKey("/"), syncer, broadcaster, opts)
@@ -172,7 +173,7 @@ func main() {
 		panic(err)
 	}
 
-	//ticker := time.NewTicker(10 * time.Millisecond)
+	// ticker := time.NewTicker(10 * time.Millisecond)
 	ticker := time.NewTicker(3 * time.Second)
 	go func() {
 		for {
diff --git a/experiment/talos_discovery.go b/experiment/talos_discovery.go
index 6dc7dba5..608bff49 100644
--- a/experiment/talos_discovery.go
+++ b/experiment/talos_discovery.go
@@ -6,12 +6,13 @@ import (
 	"crypto/cipher"
 	"encoding/hex"
 	"fmt"
+	"net/netip"
+	"time"
+
 	"github.com/psviderski/uncloud/internal/machine/network"
 	"github.com/siderolabs/discovery-api/api/v1alpha1/client/pb"
 	discovery "github.com/siderolabs/discovery-client/pkg/client"
 	"go.uber.org/zap"
-	"net/netip"
-	"time"
 )
 
 const (
diff --git a/internal/cli/config/config.go b/internal/cli/config/config.go
index b551e9cc..018a8a2b 100644
--- a/internal/cli/config/config.go
+++ b/internal/cli/config/config.go
@@ -53,11 +53,11 @@ func (c *Config) Read() error {
 
 func (c *Config) Save() error {
 	dir, _ := filepath.Split(c.path)
-	if err := os.MkdirAll(dir, 0700); err != nil {
+	if err := os.MkdirAll(dir, 0o700); err != nil {
 		return fmt.Errorf("create config directory '%s': %w", dir, err)
 	}
 
-	f, err := os.OpenFile(c.path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
+	f, err := os.OpenFile(c.path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o600)
 	if err != nil {
 		return fmt.Errorf("write config file '%s': %w", c.path, err)
 	}
diff --git a/internal/corrosion/client.go b/internal/corrosion/client.go
index fcbf8b78..4b3522b6 100644
--- a/internal/corrosion/client.go
+++ b/internal/corrosion/client.go
@@ -5,14 +5,15 @@ import (
 	"crypto/tls"
 	"errors"
 	"fmt"
-	"github.com/cenkalti/backoff/v4"
-	"golang.org/x/net/http2"
 	"log/slog"
 	"net"
 	"net/http"
 	"net/netip"
 	"net/url"
 	"time"
+
+	"github.com/cenkalti/backoff/v4"
+	"golang.org/x/net/http2"
 )
 
 const (
diff --git a/internal/corrosion/subscribe.go b/internal/corrosion/subscribe.go
index 4f5cc1c0..93b553a6 100644
--- a/internal/corrosion/subscribe.go
+++ b/internal/corrosion/subscribe.go
@@ -6,11 +6,12 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"github.com/cenkalti/backoff/v4"
 	"io"
 	"log/slog"
 	"net/http"
 	"strconv"
+
+	"github.com/cenkalti/backoff/v4"
 )
 
 type ChangeType string
diff --git a/internal/daemon/daemon.go b/internal/daemon/daemon.go
index ebf83044..9f39cdf9 100644
--- a/internal/daemon/daemon.go
+++ b/internal/daemon/daemon.go
@@ -3,9 +3,10 @@ package daemon
 import (
 	"context"
 	"fmt"
+	"log/slog"
+
 	systemd "github.com/coreos/go-systemd/daemon"
 	"github.com/psviderski/uncloud/internal/machine"
-	"log/slog"
 )
 
 type Daemon struct {
diff --git a/internal/daemon/token.go b/internal/daemon/token.go
index 41299cd9..f4d6b408 100644
--- a/internal/daemon/token.go
+++ b/internal/daemon/token.go
@@ -3,10 +3,11 @@ package daemon
 import (
 	"errors"
 	"fmt"
-	"github.com/psviderski/uncloud/internal/machine"
-	"github.com/psviderski/uncloud/internal/machine/network"
 	"net/netip"
 	"os"
+
+	"github.com/psviderski/uncloud/internal/machine"
+	"github.com/psviderski/uncloud/internal/machine/network"
 )
 
 // MachineToken returns the local machine's token that can be used for adding the machine to a cluster.
diff --git a/internal/docker/client.go b/internal/docker/client.go
index 87d26a20..b37f2962 100644
--- a/internal/docker/client.go
+++ b/internal/docker/client.go
@@ -4,10 +4,11 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"github.com/cenkalti/backoff/v4"
-	"github.com/docker/docker/client"
 	"log/slog"
 	"time"
+
+	"github.com/cenkalti/backoff/v4"
+	"github.com/docker/docker/client"
 )
 
 // WaitDaemonReady waits for the Docker daemon to start and be ready to serve requests.
diff --git a/internal/machine/api/proxy/backend.go b/internal/machine/api/proxy/backend.go
index 3d13e324..abfa139b 100644
--- a/internal/machine/api/proxy/backend.go
+++ b/internal/machine/api/proxy/backend.go
@@ -2,6 +2,7 @@ package proxy
 
 import (
 	"fmt"
+
 	"github.com/psviderski/uncloud/internal/machine/api/pb"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/encoding/protowire"
diff --git a/internal/machine/api/proxy/director.go b/internal/machine/api/proxy/director.go
index b4a52d93..65f27274 100644
--- a/internal/machine/api/proxy/director.go
+++ b/internal/machine/api/proxy/director.go
@@ -2,11 +2,12 @@ package proxy
 
 import (
 	"context"
+	"sync"
+
 	"github.com/siderolabs/grpc-proxy/proxy"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/status"
-	"sync"
 )
 
 // Director manages routing of gRPC requests between local and remote backends.
diff --git a/internal/machine/api/proxy/local.go b/internal/machine/api/proxy/local.go
index dee61744..28745578 100644
--- a/internal/machine/api/proxy/local.go
+++ b/internal/machine/api/proxy/local.go
@@ -2,11 +2,12 @@ package proxy
 
 import (
 	"context"
+	"sync"
+
 	"github.com/siderolabs/grpc-proxy/proxy"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/metadata"
-	"sync"
 )
 
 // LocalBackend is a proxy.One2ManyResponder implementation that proxies to a local gRPC server listening on a Unix socket.
diff --git a/internal/machine/api/proxy/remote.go b/internal/machine/api/proxy/remote.go
index 8db7983f..1eeebd93 100644
--- a/internal/machine/api/proxy/remote.go
+++ b/internal/machine/api/proxy/remote.go
@@ -3,14 +3,15 @@ package proxy
 import (
 	"context"
 	"fmt"
+	"net/netip"
+	"sync"
+	"time"
+
 	"github.com/siderolabs/grpc-proxy/proxy"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/backoff"
 	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/metadata"
-	"net/netip"
-	"sync"
-	"time"
 )
 
 // RemoteBackend is a proxy.One2ManyResponder implementation that proxies to a remote gRPC server, injecting machine metadata
diff --git a/internal/machine/caddyconfig/controller.go b/internal/machine/caddyconfig/controller.go
index 13b70008..d98992e1 100644
--- a/internal/machine/caddyconfig/controller.go
+++ b/internal/machine/caddyconfig/controller.go
@@ -29,7 +29,7 @@ type Controller struct {
 
 func NewController(store *store.Store, path string, verifyResponse string) (*Controller, error) {
 	dir := filepath.Dir(path)
-	if err := os.MkdirAll(dir, 0750); err != nil {
+	if err := os.MkdirAll(dir, 0o750); err != nil {
 		return nil, fmt.Errorf("create parent directory for Caddy configuration '%s': %w", dir, err)
 	}
 	if err := fs.Chown(dir, "", CaddyGroup); err != nil {
@@ -114,7 +114,7 @@ func (c *Controller) generateConfig(containers []api.ServiceContainer) error {
 		return fmt.Errorf("marshal Caddy configuration: %w", err)
 	}
 
-	if err = os.WriteFile(c.path, configBytes, 0640); err != nil {
+	if err = os.WriteFile(c.path, configBytes, 0o640); err != nil {
 		return fmt.Errorf("write Caddy configuration to file '%s': %w", c.path, err)
 	}
 	if err = fs.Chown(c.path, "", CaddyGroup); err != nil {
diff --git a/internal/machine/cluster/cluster.go b/internal/machine/cluster/cluster.go
index 0e293a28..d2e5c1e8 100644
--- a/internal/machine/cluster/cluster.go
+++ b/internal/machine/cluster/cluster.go
@@ -5,6 +5,10 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"log/slog"
+	"net/netip"
+	"time"
+
 	"github.com/psviderski/uncloud/internal/corrosion"
 	"github.com/psviderski/uncloud/internal/machine/api/pb"
 	"github.com/psviderski/uncloud/internal/machine/network"
@@ -13,9 +17,6 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/types/known/emptypb"
-	"log/slog"
-	"net/netip"
-	"time"
 )
 
 type Cluster struct {
diff --git a/internal/machine/cluster/dns.go b/internal/machine/cluster/dns.go
index 0de7e86b..3ba14a1a 100644
--- a/internal/machine/cluster/dns.go
+++ b/internal/machine/cluster/dns.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+
 	"github.com/psviderski/uncloud/internal/dns"
 	"github.com/psviderski/uncloud/internal/machine/api/pb"
 	"github.com/psviderski/uncloud/internal/machine/store"
diff --git a/internal/machine/cluster/ipam.go b/internal/machine/cluster/ipam.go
index 7e1adbf1..fa6b128f 100644
--- a/internal/machine/cluster/ipam.go
+++ b/internal/machine/cluster/ipam.go
@@ -3,8 +3,9 @@ package cluster
 import (
 	"errors"
 	"fmt"
-	"go4.org/netipx"
 	"net/netip"
+
+	"go4.org/netipx"
 )
 
 const DefaultSubnetBits = 24
diff --git a/internal/machine/cluster/machine.go b/internal/machine/cluster/machine.go
index 3ab9ca20..02968d3d 100644
--- a/internal/machine/cluster/machine.go
+++ b/internal/machine/cluster/machine.go
@@ -2,6 +2,7 @@ package cluster
 
 import (
 	"fmt"
+
 	"github.com/psviderski/uncloud/internal/secret"
 )
 
diff --git a/internal/machine/corroservice/config.go b/internal/machine/corroservice/config.go
index d0202ca4..fa6538a7 100644
--- a/internal/machine/corroservice/config.go
+++ b/internal/machine/corroservice/config.go
@@ -3,11 +3,12 @@ package corroservice
 import (
 	"bytes"
 	"fmt"
-	"github.com/BurntSushi/toml"
-	"github.com/psviderski/uncloud/internal/fs"
 	"net/netip"
 	"os"
 	"path/filepath"
+
+	"github.com/BurntSushi/toml"
+	"github.com/psviderski/uncloud/internal/fs"
 )
 
 const (
@@ -50,7 +51,7 @@ func (c *Config) Write(path, owner string) error {
 	if err := encoder.Encode(c); err != nil {
 		return fmt.Errorf("encode config: %w", err)
 	}
-	if err := os.WriteFile(path, data.Bytes(), 0600); err != nil {
+	if err := os.WriteFile(path, data.Bytes(), 0o600); err != nil {
 		return err
 	}
 	if err := fs.Chown(path, owner, owner); err != nil {
@@ -62,10 +63,10 @@ func (c *Config) Write(path, owner string) error {
 func MkDataDir(dir, owner string) error {
 	parent, _ := filepath.Split(dir)
 	// Use 0711 for parent directories to allow `owner` to access its nested data directory.
-	if err := os.MkdirAll(parent, 0711); err != nil {
+	if err := os.MkdirAll(parent, 0o711); err != nil {
 		return fmt.Errorf("create directory %q: %w", parent, err)
 	}
-	if err := os.Mkdir(dir, 0700); err != nil {
+	if err := os.Mkdir(dir, 0o700); err != nil {
 		if !os.IsExist(err) {
 			return fmt.Errorf("create directory %q: %w", dir, err)
 		}
diff --git a/internal/machine/corroservice/docker.go b/internal/machine/corroservice/docker.go
index 2bb92c36..054d38da 100644
--- a/internal/machine/corroservice/docker.go
+++ b/internal/machine/corroservice/docker.go
@@ -3,15 +3,16 @@ package corroservice
 import (
 	"context"
 	"fmt"
+	"io"
+	"log/slog"
+	"path/filepath"
+	"time"
+
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/image"
 	"github.com/docker/docker/api/types/mount"
 	"github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/client"
-	"io"
-	"log/slog"
-	"path/filepath"
-	"time"
 )
 
 const (
diff --git a/internal/machine/corroservice/subprocess.go b/internal/machine/corroservice/subprocess.go
index 01cff492..985fe30e 100644
--- a/internal/machine/corroservice/subprocess.go
+++ b/internal/machine/corroservice/subprocess.go
@@ -111,8 +111,8 @@ func (s *SubprocessService) startProcess(ctx context.Context) error {
 
 	// TODO: figure out the waiting process
 	// Wait for initialization
-	//timer := time.NewTimer(2 * time.Second)
-	//defer timer.Stop()
+	// timer := time.NewTimer(2 * time.Second)
+	// defer timer.Stop()
 
 	//select {
 	////case <-timer.C:
diff --git a/internal/machine/db.go b/internal/machine/db.go
index eac4e8a0..fce1967a 100644
--- a/internal/machine/db.go
+++ b/internal/machine/db.go
@@ -14,13 +14,13 @@ const DBFileName = "machine.db"
 func NewDB(path string) (*sqlx.DB, error) {
 	// Create the database file with 0600 permissions if it doesn't exist, or update permissions if exists.
 	if _, err := os.Stat(path); os.IsNotExist(err) {
-		file, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0600)
+		file, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0o600)
 		if err != nil {
 			return nil, fmt.Errorf("create SQLite database '%s': %w", path, err)
 		}
 		file.Close()
 	} else {
-		if err = os.Chmod(path, 0600); err != nil {
+		if err = os.Chmod(path, 0o600); err != nil {
 			return nil, fmt.Errorf("update SQLite database permissions '%s': %w", path, err)
 		}
 	}
diff --git a/internal/machine/machine.go b/internal/machine/machine.go
index de30fa06..56e4a04c 100644
--- a/internal/machine/machine.go
+++ b/internal/machine/machine.go
@@ -501,7 +501,7 @@ func listenUnixSocket(path string) (net.Listener, error) {
 
 	// Ensure the parent directory exists and has the correct group permissions.
 	parent, _ := filepath.Split(path)
-	if err = os.MkdirAll(parent, 0750); err != nil {
+	if err = os.MkdirAll(parent, 0o750); err != nil {
 		return nil, fmt.Errorf("create directory %q: %w", parent, err)
 	}
 	if err = os.Chown(parent, -1, gid); err != nil {
@@ -555,7 +555,7 @@ func (m *Machine) configureCorrosion() error {
 		return fmt.Errorf("write corrosion config: %w", err)
 	}
 
-	if err := os.WriteFile(schemaPath, []byte(store.Schema), 0644); err != nil {
+	if err := os.WriteFile(schemaPath, []byte(store.Schema), 0o644); err != nil {
 		return fmt.Errorf("write corrosion schema: %w", err)
 	}
 
diff --git a/internal/machine/network/peer.go b/internal/machine/network/peer.go
index 1c7d8c2e..2be2d45b 100644
--- a/internal/machine/network/peer.go
+++ b/internal/machine/network/peer.go
@@ -1,11 +1,12 @@
 package network
 
 import (
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"log/slog"
 	"net/netip"
 	"slices"
 	"time"
+
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )
 
 const (
diff --git a/internal/machine/network/tunnel/tunnel.go b/internal/machine/network/tunnel/tunnel.go
index ebbcba88..cb6fd7ef 100644
--- a/internal/machine/network/tunnel/tunnel.go
+++ b/internal/machine/network/tunnel/tunnel.go
@@ -3,13 +3,14 @@ package tunnel
 import (
 	"context"
 	"fmt"
+	"net"
+	"net/netip"
+	"time"
+
 	"github.com/psviderski/uncloud/internal/secret"
 	"golang.zx2c4.com/wireguard/conn"
 	"golang.zx2c4.com/wireguard/device"
 	"golang.zx2c4.com/wireguard/tun/netstack"
-	"net"
-	"net/netip"
-	"time"
 )
 
 const (
diff --git a/internal/machine/network/wireguard.go b/internal/machine/network/wireguard.go
index 96863dea..b5dfd36f 100644
--- a/internal/machine/network/wireguard.go
+++ b/internal/machine/network/wireguard.go
@@ -2,10 +2,11 @@ package network
 
 import (
 	"fmt"
-	"github.com/psviderski/uncloud/internal/secret"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"net/netip"
 	"time"
+
+	"github.com/psviderski/uncloud/internal/secret"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )
 
 const (
diff --git a/internal/machine/network/wireguard_linux.go b/internal/machine/network/wireguard_linux.go
index 7fab975d..f11857b7 100644
--- a/internal/machine/network/wireguard_linux.go
+++ b/internal/machine/network/wireguard_linux.go
@@ -6,18 +6,19 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"github.com/psviderski/uncloud/internal/secret"
-	"github.com/vishvananda/netlink"
-	"go4.org/netipx"
-	"golang.org/x/sys/unix"
-	"golang.zx2c4.com/wireguard/wgctrl"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"log/slog"
 	"net"
 	"net/netip"
 	"slices"
 	"sync"
 	"time"
+
+	"github.com/psviderski/uncloud/internal/secret"
+	"github.com/vishvananda/netlink"
+	"go4.org/netipx"
+	"golang.org/x/sys/unix"
+	"golang.zx2c4.com/wireguard/wgctrl"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )
 
 type WireGuardNetwork struct {
diff --git a/internal/machine/state.go b/internal/machine/state.go
index 6ddca418..3443e8a2 100644
--- a/internal/machine/state.go
+++ b/internal/machine/state.go
@@ -3,10 +3,11 @@ package machine
 import (
 	"encoding/json"
 	"fmt"
-	"github.com/psviderski/uncloud/internal/machine/network"
 	"os"
 	"path/filepath"
 	"sync"
+
+	"github.com/psviderski/uncloud/internal/machine/network"
 )
 
 const (
@@ -71,7 +72,7 @@ func (c *State) Save() error {
 		return fmt.Errorf("state path not set")
 	}
 	dir, _ := filepath.Split(c.path)
-	if err := os.MkdirAll(dir, 0711); err != nil {
+	if err := os.MkdirAll(dir, 0o711); err != nil {
 		return fmt.Errorf("create state directory %q: %w", dir, err)
 	}
 
@@ -79,5 +80,5 @@ func (c *State) Save() error {
 	if err != nil {
 		return err
 	}
-	return os.WriteFile(c.path, data, 0600)
+	return os.WriteFile(c.path, data, 0o600)
 }
diff --git a/internal/machine/store/container.go b/internal/machine/store/container.go
index 5b9a9667..1f3a8524 100644
--- a/internal/machine/store/container.go
+++ b/internal/machine/store/container.go
@@ -4,11 +4,12 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	sq "github.com/Masterminds/squirrel"
-	"github.com/psviderski/uncloud/pkg/api"
 	"log/slog"
 	"strings"
 	"time"
+
+	sq "github.com/Masterminds/squirrel"
+	"github.com/psviderski/uncloud/pkg/api"
 )
 
 const (
diff --git a/internal/machine/store/store.go b/internal/machine/store/store.go
index f11e7b99..785eb854 100644
--- a/internal/machine/store/store.go
+++ b/internal/machine/store/store.go
@@ -5,10 +5,11 @@ import (
 	_ "embed"
 	"errors"
 	"fmt"
+	"log/slog"
+
 	"github.com/psviderski/uncloud/internal/corrosion"
 	"github.com/psviderski/uncloud/internal/machine/api/pb"
 	"google.golang.org/protobuf/encoding/protojson"
-	"log/slog"
 )
 
 var (
diff --git a/internal/machine/token.go b/internal/machine/token.go
index 12a554da..2eac8aad 100644
--- a/internal/machine/token.go
+++ b/internal/machine/token.go
@@ -4,9 +4,10 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
-	"github.com/psviderski/uncloud/internal/secret"
 	"net/netip"
 	"strings"
+
+	"github.com/psviderski/uncloud/internal/secret"
 )
 
 const (
diff --git a/internal/sshexec/remote.go b/internal/sshexec/remote.go
index 89134579..f08f3614 100644
--- a/internal/sshexec/remote.go
+++ b/internal/sshexec/remote.go
@@ -3,9 +3,10 @@ package sshexec
 import (
 	"context"
 	"fmt"
-	"golang.org/x/crypto/ssh"
 	"io"
 	"strings"
+
+	"golang.org/x/crypto/ssh"
 )
 
 type Remote struct {
diff --git a/internal/ucind/provision.go b/internal/ucind/provision.go
index dcef530f..a3a20aa6 100644
--- a/internal/ucind/provision.go
+++ b/internal/ucind/provision.go
@@ -2,6 +2,7 @@ package ucind
 
 import (
 	"errors"
+
 	"github.com/docker/docker/client"
 )
 
diff --git a/pkg/api/port_test.go b/pkg/api/port_test.go
index a8e9050f..040f6d52 100644
--- a/pkg/api/port_test.go
+++ b/pkg/api/port_test.go
@@ -1,10 +1,11 @@
 package api
 
 import (
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 	"net/netip"
 	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestPortSpec_Validate(t *testing.T) {
diff --git a/pkg/client/caddy_test.go b/pkg/client/caddy_test.go
index 9cfe4abf..b0789db5 100644
--- a/pkg/client/caddy_test.go
+++ b/pkg/client/caddy_test.go
@@ -1,10 +1,11 @@
 package client
 
 import (
+	"testing"
+
 	"github.com/distribution/reference"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"testing"
 )
 
 func TestLatestCaddyImage(t *testing.T) {
diff --git a/pkg/client/compose/port.go b/pkg/client/compose/port.go
index dc998058..26cb42a9 100644
--- a/pkg/client/compose/port.go
+++ b/pkg/client/compose/port.go
@@ -128,7 +128,7 @@ func convertServicePortConfigToPortSpec(port types.ServicePortConfig) (api.PortS
 
 // convertStandardPortsToPortSpecs converts []types.ServicePortConfig directly to api.PortSpecs.
 func convertStandardPortsToPortSpecs(ports []types.ServicePortConfig) ([]api.PortSpec, error) {
-	var specs = make([]api.PortSpec, 0, len(ports))
+	specs := make([]api.PortSpec, 0, len(ports))
 
 	for _, port := range ports {
 		spec, err := convertServicePortConfigToPortSpec(port)
diff --git a/pkg/client/connector/ssh.go b/pkg/client/connector/ssh.go
index 4ea2accf..742d5399 100644
--- a/pkg/client/connector/ssh.go
+++ b/pkg/client/connector/ssh.go
@@ -3,13 +3,14 @@ package connector
 import (
 	"context"
 	"fmt"
+	"net"
+	"strings"
+
 	"github.com/psviderski/uncloud/internal/machine"
 	"github.com/psviderski/uncloud/internal/sshexec"
 	"golang.org/x/crypto/ssh"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
-	"net"
-	"strings"
 )
 
 type SSHConnectorConfig struct {
diff --git a/pkg/client/connector/tcp.go b/pkg/client/connector/tcp.go
index 711ba560..9072ecab 100644
--- a/pkg/client/connector/tcp.go
+++ b/pkg/client/connector/tcp.go
@@ -3,9 +3,10 @@ package connector
 import (
 	"context"
 	"fmt"
+	"net/netip"
+
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
-	"net/netip"
 )
 
 // TCPConnector establishes a connection to the machine API through a direct TCP connection to an API endpoint.
diff --git a/pkg/client/connector/wireguard.go b/pkg/client/connector/wireguard.go
index 92681e21..a76b3ad4 100644
--- a/pkg/client/connector/wireguard.go
+++ b/pkg/client/connector/wireguard.go
@@ -3,6 +3,10 @@ package connector
 import (
 	"context"
 	"fmt"
+	"net"
+	"net/netip"
+	"strconv"
+
 	"github.com/psviderski/uncloud/internal/cli/config"
 	machine2 "github.com/psviderski/uncloud/internal/machine"
 	"github.com/psviderski/uncloud/internal/machine/network"
@@ -10,9 +14,6 @@ import (
 	"github.com/psviderski/uncloud/pkg/client"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
-	"net"
-	"net/netip"
-	"strconv"
 )
 
 // WireGuardConnector establishes a connection to the cluster API through a WireGuard tunnel
diff --git a/pkg/client/deploy/container.go b/pkg/client/deploy/container.go
index f77795e7..e4bde19b 100644
--- a/pkg/client/deploy/container.go
+++ b/pkg/client/deploy/container.go
@@ -11,9 +11,11 @@ import (
 
 type ContainerSpecStatus string
 
-const ContainerUpToDate ContainerSpecStatus = "up-to-date"
-const ContainerNeedsUpdate ContainerSpecStatus = "needs-update"
-const ContainerNeedsRecreate ContainerSpecStatus = "needs-recreate"
+const (
+	ContainerUpToDate      ContainerSpecStatus = "up-to-date"
+	ContainerNeedsUpdate   ContainerSpecStatus = "needs-update"
+	ContainerNeedsRecreate ContainerSpecStatus = "needs-recreate"
+)
 
 func EvalContainerSpecChange(current api.ServiceSpec, new api.ServiceSpec) ContainerSpecStatus {
 	current = current.SetDefaults()
diff --git a/pkg/client/dns.go b/pkg/client/dns.go
index 95130e18..5f508dad 100644
--- a/pkg/client/dns.go
+++ b/pkg/client/dns.go
@@ -4,6 +4,11 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"io"
+	"net/http"
+	"sync"
+	"time"
+
 	"github.com/cenkalti/backoff/v4"
 	"github.com/docker/compose/v2/pkg/progress"
 	"github.com/psviderski/uncloud/internal/machine/api/pb"
@@ -11,10 +16,6 @@ import (
 	"github.com/psviderski/uncloud/pkg/api"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
-	"io"
-	"net/http"
-	"sync"
-	"time"
 )
 
 // GetDomain returns the cluster domain name or ErrNotFound if it hasn't been reserved yet.
diff --git a/pkg/client/user.go b/pkg/client/user.go
index 96c23b5c..01f8fe38 100644
--- a/pkg/client/user.go
+++ b/pkg/client/user.go
@@ -2,10 +2,11 @@ package client
 
 import (
 	"fmt"
+	"net/netip"
+
 	"github.com/psviderski/uncloud/internal/machine/network"
 	"github.com/psviderski/uncloud/internal/secret"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-	"net/netip"
 )
 
 type User struct {
diff --git a/test/e2e/compose_build_test.go b/test/e2e/compose_build_test.go
index 36006ec5..888590c2 100644
--- a/test/e2e/compose_build_test.go
+++ b/test/e2e/compose_build_test.go
@@ -20,7 +20,6 @@ import (
 	"github.com/psviderski/uncloud/pkg/api"
 	"github.com/psviderski/uncloud/pkg/client/compose"
 	"github.com/stretchr/testify/assert"
-
 	"github.com/stretchr/testify/require"
 )
 
diff --git a/test/e2e/service_test.go b/test/e2e/service_test.go
index 45d3039f..9f8137ee 100644
--- a/test/e2e/service_test.go
+++ b/test/e2e/service_test.go
@@ -259,8 +259,8 @@ func TestDeployment(t *testing.T) {
 		assert.Len(t, machines.ToSlice(), 3, "Expected 1 container on each machine")
 
 		// TODO: update the container spec in-place if only the placement constraint has changed.
-		//containers = serviceContainerIDs(svc)
-		//assert.True(t, initialContainers.IsSubset(containers), "Expected all initial containers to remain")
+		// containers = serviceContainerIDs(svc)
+		// assert.True(t, initialContainers.IsSubset(containers), "Expected all initial containers to remain")
 	})
 
 	t.Run("caddy", func(t *testing.T) {
@@ -334,7 +334,7 @@ func TestDeployment(t *testing.T) {
 		assertServiceMatchesSpec(t, svc, deployment.Spec)
 
 		assert.Equal(t, c.Machines[0].ID, svc.Containers[0].MachineID)
-		//initialContainerID := svc.Containers[0].Container.ID
+		// initialContainerID := svc.Containers[0].Container.ID
 
 		// Deploy to all machines without a placement constraint.
 		deployment, err = cli.NewCaddyDeployment(image, api.Placement{})
@@ -352,8 +352,8 @@ func TestDeployment(t *testing.T) {
 		machines := serviceMachines(svc)
 		assert.Len(t, machines.ToSlice(), 3, "Expected 1 container on each machine")
 		// TODO: update the container spec in-place if only the placement constraint has changed.
-		//containers := serviceContainerIDs(svc)
-		//assert.True(t, containers.Contains(initialContainerID), "Expected initial container to remain")
+		// containers := serviceContainerIDs(svc)
+		// assert.True(t, containers.Contains(initialContainerID), "Expected initial container to remain")
 	})
 
 	t.Run("replicated", func(t *testing.T) {
@@ -587,7 +587,7 @@ func TestDeployment(t *testing.T) {
 		require.Error(t, err, "Deployment should fail when volume doesn't exist")
 		require.Contains(t, err.Error(), "no machines available")
 		// TODO: implement and check for more details about the failed constraints.
-		//require.Contains(t, err.Error(), "volume 'non-existent-volume' not found")
+		// require.Contains(t, err.Error(), "volume 'non-existent-volume' not found")
 	})
 
 	// Tests that when a volume exists on a single machine, all requested replicas will be deployed to that machine,