Fix data races, nil-record panics, scanner SSRF, log date layout, shutdown timeouts, and enable stricter linters (#54)

High (behavioral bugs):
- service.Geo: add RLock on lookups, handle Reload error, keep old DBs on failure
- models.GeoDB.Reload: open new DBs before closing old ones (no reader gap)
- router: guard nil geo records (404 instead of 500) in geo.go, generic.go, dns.go
- router/port_scanner: reject undetermined client IPs (nil->localhost dial)
- internal/httputils: fix access log date layout (02/Jan/2006, not literal Nov)
- server/quic: log.Printf instead of log.Fatal in request handler

Medium:
- server/*: 10s shutdown timeout; SIGTERM drains servers before closing geo DBs
- httputils: Clone() request headers instead of mutating the live map; strings.Builder
- setting/app: handle all os.Stat errors; fix "truster" typos; use errors.New;
  remove dead Token field
- cmd: errors.Is for sentinel checks; os.Stderr; log.Fatal instead of panic;
  pass http.Handler by value (not pointer-to-interface)
- resolver: validate config at startup (pre-parse RRs, validate IPs); check WriteMsg
  errors; Setup returns error

Low:
- .golangci.yaml: enable errcheck, govet, errorlint; fix all resulting findings
- server/tls: explicit TLSConfig{MinVersion: tls.VersionTLS12}
- router/dns: label-exact vhost suffix check, strip port; template.Must
- models: errors.Join instead of %s on []error
- service/geo_test: race-regression test (concurrent lookups during Reload)
- README: Go >= 1.25; fix latent test bug (store.Add->Set in dns_test.go)

server/dns.go

@@ -42,7 +42,9 @@ func (d *DNS) Start() {
 
 func (d *DNS) Stop() {
 	log.Print("Stopping DNS server...")
-	if err := d.server.Shutdown(); err != nil {
+	ctx, cancel := context.WithTimeout(d.ctx, shutdownTimeout)
+	defer cancel()
+	if err := d.server.ShutdownContext(ctx); err != nil {
 		log.Printf("DNS server forced to shutdown: %s", err)
 	}
 }

server/prometheus.go

@@ -42,7 +42,9 @@ func (p *Prometheus) Start() {
 
 func (p *Prometheus) Stop() {
 	log.Print("Stopping Prometheus server...")
-	if err := p.server.Shutdown(p.ctx); err != nil {
+	ctx, cancel := context.WithTimeout(p.ctx, shutdownTimeout)
+	defer cancel()
+	if err := p.server.Shutdown(ctx); err != nil {
 		log.Printf("Prometheus server forced to shutdown: %s", err)
 	}
 }

server/quic.go

@@ -32,7 +32,7 @@ func (q *Quic) Start() {
 	parentHandler := q.tlsServer.server.Handler
 	q.tlsServer.server.Handler = http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
 		if err := q.server.SetQUICHeaders(rw.Header()); err != nil {
-			log.Fatal(err)
+			log.Printf("Failed to set QUIC headers: %s", err)
 		}
 
 		parentHandler.ServeHTTP(rw, req)
@@ -49,7 +49,9 @@ func (q *Quic) Start() {
 
 func (q *Quic) Stop() {
 	log.Print("Stopping QUIC server...")
-	if err := q.server.Close(); err != nil {
-		log.Print("QUIC server forced to shutdown")
+	ctx, cancel := context.WithTimeout(q.ctx, shutdownTimeout)
+	defer cancel()
+	if err := q.server.Shutdown(ctx); err != nil {
+		log.Printf("QUIC server forced to shutdown: %s", err)
 	}
 }

server/server.go

@@ -5,10 +5,13 @@ import (
 	"os"
 	"os/signal"
 	"syscall"
+	"time"
 
 	"github.com/dcarrillo/whatismyip/service"
 )
 
+const shutdownTimeout = 10 * time.Second
+
 type Server interface {
 	Start()
 	Stop()
@@ -29,11 +32,10 @@ func Setup(servers []Server, geoSvc *service.Geo) *Manager {
 func (m *Manager) Run() {
 	m.start()
 
-	signalChan := make(chan os.Signal, len(m.servers))
+	signalChan := make(chan os.Signal, 1)
 	signal.Notify(signalChan, syscall.SIGHUP, syscall.SIGINT, syscall.SIGTERM)
-	var s os.Signal
 	for {
-		s = <-signalChan
+		s := <-signalChan
 
 		if s == syscall.SIGHUP {
 			m.stop()
@@ -43,10 +45,10 @@ func (m *Manager) Run() {
 			m.start()
 		} else {
 			log.Print("Shutting down...")
+			m.stop()
 			if m.geoSvc != nil {
 				m.geoSvc.Shutdown()
 			}
-			m.stop()
 			break
 		}
 	}

server/tcp.go

@@ -11,11 +11,11 @@ import (
 
 type TCP struct {
 	server  *http.Server
-	handler *http.Handler
+	handler http.Handler
 	ctx     context.Context
 }
 
-func NewTCPServer(ctx context.Context, handler *http.Handler) *TCP {
+func NewTCPServer(ctx context.Context, handler http.Handler) *TCP {
 	return &TCP{
 		handler: handler,
 		ctx:     ctx,
@@ -25,7 +25,7 @@ func NewTCPServer(ctx context.Context, handler *http.Handler) *TCP {
 func (t *TCP) Start() {
 	t.server = &http.Server{
 		Addr:         setting.App.BindAddress,
-		Handler:      *t.handler,
+		Handler:      t.handler,
 		ReadTimeout:  setting.App.Server.ReadTimeout,
 		WriteTimeout: setting.App.Server.WriteTimeout,
 	}
@@ -40,7 +40,9 @@ func (t *TCP) Start() {
 
 func (t *TCP) Stop() {
 	log.Print("Stopping TCP server...")
-	if err := t.server.Shutdown(t.ctx); err != nil {
+	ctx, cancel := context.WithTimeout(t.ctx, shutdownTimeout)
+	defer cancel()
+	if err := t.server.Shutdown(ctx); err != nil {
 		log.Printf("TCP server forced to shutdown: %s", err)
 	}
 }

server/tls.go

@@ -2,6 +2,7 @@ package server
 
 import (
 	"context"
+	"crypto/tls"
 	"errors"
 	"log"
 	"net/http"
@@ -11,11 +12,11 @@ import (
 
 type TLS struct {
 	server  *http.Server
-	handler *http.Handler
+	handler http.Handler
 	ctx     context.Context
 }
 
-func NewTLSServer(ctx context.Context, handler *http.Handler) *TLS {
+func NewTLSServer(ctx context.Context, handler http.Handler) *TLS {
 	return &TLS{
 		handler: handler,
 		ctx:     ctx,
@@ -25,9 +26,12 @@ func NewTLSServer(ctx context.Context, handler *http.Handler) *TLS {
 func (t *TLS) Start() {
 	t.server = &http.Server{
 		Addr:         setting.App.TLSAddress,
-		Handler:      *t.handler,
+		Handler:      t.handler,
 		ReadTimeout:  setting.App.Server.ReadTimeout,
 		WriteTimeout: setting.App.Server.WriteTimeout,
+		TLSConfig: &tls.Config{
+			MinVersion: tls.VersionTLS12,
+		},
 	}
 
 	log.Printf("Starting TLS server listening on %s", setting.App.TLSAddress)
@@ -41,7 +45,9 @@ func (t *TLS) Start() {
 
 func (t *TLS) Stop() {
 	log.Print("Stopping TLS server...")
-	if err := t.server.Shutdown(t.ctx); err != nil {
+	ctx, cancel := context.WithTimeout(t.ctx, shutdownTimeout)
+	defer cancel()
+	if err := t.server.Shutdown(ctx); err != nil {
 		log.Printf("TLS server forced to shutdown: %s", err)
 	}
 }