[GoDeskio]

Summary

Adds a self-hosted GoDesk SMS vertical slice that does not use Firebase or any other Google service.

Architecture choice is Option B, local server mode, documented in docs/godesk-sms-architecture.md.

• Option A (official android-sms-gateway private server) still wakes phones through api.sms-gate.app and FCM, uses MariaDB, and speaks the SMSGate API. It does not meet the no-Firebase rule.
• Option B keeps a Go API, Postgres, and an httpsms-compatible edge. The API calls SMS Gateway for Android in local server mode (HTTP basic auth to the phone, webhooks back). That is the supported mode with no Firebase.

This PR is against main and does not include the Android release-APK work in #1. The existing httpSMS API and Nuxt app stay in the tree for the current Firebase deployment. docker-compose.selfhosted.yml does not start them.

What works

• docker-compose.selfhosted.yml: Traefik publishes only 80 and 443. Postgres 16 and the API have no host ports. Traefik labels route GODESK_HOST.
• .env.example has placeholders only (change-me, godesk.localhost). No private hostnames or secrets.
• Email/password signup and login (bcrypt, HS256 session JWT, x-api-key). Optional OIDC authorization-code + PKCE when OIDC_ISSUER is set (Authentik-compatible).
• Register an SMS Gateway for Android device (E.164, base URL, basic auth). Password is AES-GCM sealed. The API registers sms:received|sent|delivered|failed webhooks on the phone.
• POST /v1/messages/send with from, to, content and x-api-key selects the matching device and POSTs to the phone.
• POST /v1/gateway/events/{token} stores an inbound SMS and fans out a CloudEvents message.phone.received webhook (X-Event-Type, optional Bearer JWT). Duplicate gateway message ids are not delivered twice.
• Multi-device: from selects the phone. Postgres migrations run on startup.
• Small dashboard at / for signup, login, devices, send, and webhooks.
• README quickstart credits httpSMS (AGPL-3.0) and SMS Gateway for Android / server (Apache-2.0). Upstream license notices stay intact.

Test plan

• cd selfhosted && go test ./... (in-memory store, auth, gateway client, URL checks, HTTP vertical slice)
• DATABASE_URL=postgres://godesk:godesk@127.0.0.1:5432/godesk?sslmode=disable go test ./internal/store/pg against local PostgreSQL 16 (migrations, user create)
• docker compose -f docker-compose.selfhosted.yml up — Docker is not available in this environment
• Browser pass of the dashboard — the dashboard is served by the Go process; it was checked by the unit test fetching / and asserting the HTML contains "GoDesk SMS"
• A real phone running SMS Gateway for Android

Secrets and manual steps

1. cp .env.example .env and replace POSTGRES_PASSWORD and JWT_SECRET (at least 32 characters). Optional CREDENTIALS_KEY seals device passwords; otherwise JWT_SECRET is used.
2. Set PUBLIC_URL and GODESK_HOST to the LAN name phones and browsers will use. http://godesk.localhost is only a generic default.
3. The official SMS Gateway app accepts cleartext only for http://127.0.0.1. Other phones need HTTPS. Traefik's 443 listener currently uses Traefik's default certificate. Install a trusted cert on the phone, or bring your own TLS (still remaining work).
4. The API must be able to reach each phone's local server, and each phone must be able to POST to PUBLIC_URL.
5. Optional OIDC: set OIDC_ISSUER, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET, and OIDC_REDIRECT_URL. New OIDC users get a random password, so password login is not available for those accounts.
6. Do not commit .env, keystores, or certificates.

Remaining work

• Port the Nuxt app in web/ off Firebase and onto this login, and retire the small dashboard.
• Wake phones that cannot accept inbound connections, without FCM (device polling or SSE, not the official private-server push relay).
• Finish private-server mode as a first-class deploy (the HTTP client already knows the URL shape).
• httpsms features not in this slice: bulk send, MMS, end-to-end encryption, search, heartbeats, schedules, and the full webhook event set.
• Retry and signing parity for every outbound webhook.
• Store API keys as hashes and show them once.
• Bring your own TLS material for Traefik. Port 443 currently uses Traefik's default certificate.

  

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​jackc/​pgx/​v5@​v5.7.4
	golang/​golang.org/​x/​crypto@​v0.36.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Critical CVE: Memory-safety vulnerability in golang github.com/jackc/pgx/v5. CVE: GHSA-9jj7-4m8r-rfcm Memory-safety vulnerability in github.com/jackc/pgx/v5. (CRITICAL) Affected versions: < 5.9.0 Patched version: 5.9.0 From: selfhosted/go.mod → golang/github.com/jackc/pgx/v5@v5.7.4 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/jackc/pgx/v5@v5.7.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: pgx contains memory-safety vulnerability in golang github.com/jackc/pgx/v5 CVE: GHSA-xgrm-4fwx-7qm8 pgx contains memory-safety vulnerability (CRITICAL) Affected versions: < 5.9.0 Patched version: 5.9.0 From: selfhosted/go.mod → golang/github.com/jackc/pgx/v5@v5.7.4 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/jackc/pgx/v5@v5.7.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: golang golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses CVE: GHSA-vgwf-h737-ff37 golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses (CRITICAL) Affected versions: < 0.52.0 Patched version: 0.52.0 From: selfhosted/go.mod → golang/golang.org/x/crypto@v0.36.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/crypto@v0.36.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: golang golang.org/x/crypto vulnerable to auth bypass via unenforced @Revoked status CVE: GHSA-5cgq-3rg8-m6cv golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status (CRITICAL) Affected versions: < 0.52.0 Patched version: 0.52.0 From: selfhosted/go.mod → golang/golang.org/x/crypto@v0.36.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/crypto@v0.36.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: golang golang.org/x/crypto vulnerable to infinite loop on large channel writes CVE: GHSA-rm3j-f69w-wqmq golang.org/x/crypto vulnerable to infinite loop on large channel writes (CRITICAL) Affected versions: < 0.52.0 Patched version: 0.52.0 From: selfhosted/go.mod → golang/golang.org/x/crypto@v0.36.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/crypto@v0.36.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: golang golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement CVE: GHSA-x527-x647-q7gg golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement (CRITICAL) Affected versions: < 0.52.0 Patched version: 0.52.0 From: selfhosted/go.mod → golang/golang.org/x/crypto@v0.36.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/crypto@v0.36.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: golang golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed CVE: GHSA-89gr-r52h-f8rx golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed (CRITICAL) Affected versions: < 0.52.0 Patched version: 0.52.0 From: selfhosted/go.mod → golang/golang.org/x/crypto@v0.36.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/crypto@v0.36.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: golang golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys CVE: GHSA-f5wc-c3c7-36mc golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys (CRITICAL) Affected versions: < 0.52.0 Patched version: 0.52.0 From: selfhosted/go.mod → golang/golang.org/x/crypto@v0.36.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/crypto@v0.36.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: golang golang.org/x/crypto doesn't enforce invoking key constraints CVE: GHSA-jppx-rxg9-jmrx golang.org/x/crypto doesn't enforce invoking key constraints (CRITICAL) Affected versions: < 0.52.0 Patched version: 0.52.0 From: selfhosted/go.mod → golang/golang.org/x/crypto@v0.36.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/crypto@v0.36.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report