From d833deabf3efa014decc893bf76ab22576f5ede6 Mon Sep 17 00:00:00 2001
From: Xavier Vello <xavier.vello@gmail.com>
Date: Wed, 7 Oct 2026 22:42:15 +0200
Subject: [PATCH] Support notifying an audit-server over unix socket (#266)

The audit-server is able to listen on a unix socket, but the client does not support http on unix socket. It's pretty simple to implement in golang, by overriding the socket dialer in a http client.

We could also depend on https://github.com/peterbourgon/unixtransport for a better-tested implementation, but I don't think it's worth the maintenance cost.

Reviewed-on: https://codeberg.org/git-pages/git-pages/pulls/266
Reviewed-by: Catherine <whitequark@whitequark.org>
---
 src/audit.go | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/src/audit.go b/src/audit.go
index 3a63e7f..737cdc2 100644
--- a/src/audit.go
+++ b/src/audit.go
@@ -5,6 +5,7 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"net"
 	"net/http"
 	"os"
 	"os/exec"
@@ -345,6 +346,20 @@ func notifyAudit(ctx context.Context, id AuditID) {
 		notifyURL := config.Audit.NotifyURL.URL
 		notifyURL.RawQuery = id.String()
 
+		client := http.Client{}
+		if notifyURL.Scheme == "http+unix" {
+			socketPath := fmt.Sprintf("/%s/%s", notifyURL.Host, notifyURL.Path)
+			client.Transport = &http.Transport{
+				DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
+					var dialer net.Dialer
+					return dialer.DialContext(ctx, "unix", socketPath)
+				},
+			}
+			notifyURL.Scheme = "http"
+			notifyURL.Host = "localhost"
+			notifyURL.Path = ""
+		}
+
 		// See also the explanation in `AuditEventProcessor` above.
 		go func() {
 			backoff := exponential.Backoff{
@@ -353,7 +368,7 @@ func notifyAudit(ctx context.Context, id AuditID) {
 				Max:    time.Second * 60,
 			}
 			for {
-				resp, err := http.Get(notifyURL.String())
+				resp, err := client.Get(notifyURL.String())
 				var body []byte
 				if err == nil {
 					body, _ = io.ReadAll(resp.Body)