chore: remove unused functions

cmd/spinifex/cmd/admin.go

@@ -2407,7 +2407,7 @@ func runCertRenew(cmd *cobra.Command, _ []string) {
 	serverCertPath := filepath.Join(configDir, "server.pem")
 	serverKeyPath := filepath.Join(configDir, "server.key")
 
-	if err := admin.GenerateSignedCertWithDNS(serverCertPath, serverKeyPath, caCertPath, caKeyPath, extraIPs, extraDNS); err != nil {
+	if err := admin.GenerateSignedCert(serverCertPath, serverKeyPath, caCertPath, caKeyPath, extraIPs, extraDNS); err != nil {
 		fmt.Fprintf(os.Stderr, "Error regenerating server certificate: %v\n", err)
 		os.Exit(1)
 	}

spinifex/admin/admin.go

@@ -197,7 +197,7 @@ func GenerateCertificatesIfNeeded(configDir string, force bool, bindIP string, a
 		fmt.Printf("   CA Key: %s\n", caKeyPath)
 
 		extraDNS := AWSGWServiceDNSNames(awsRegion, internalSuffix)
-		if err := GenerateSignedCertWithDNS(serverCertPath, serverKeyPath, caCertPath, caKeyPath, []string{bindIP}, extraDNS); err != nil {
+		if err := GenerateSignedCert(serverCertPath, serverKeyPath, caCertPath, caKeyPath, []string{bindIP}, extraDNS); err != nil {
 			fmt.Fprintf(os.Stderr, "Error generating server certificate: %v\n", err)
 			os.Exit(1)
 		}
@@ -233,7 +233,7 @@ func GenerateServerCertOnly(configDir string, bindIP, awsRegion, internalSuffix
 	}
 
 	extraDNS := AWSGWServiceDNSNames(awsRegion, internalSuffix)
-	return GenerateSignedCertWithDNS(serverCertPath, serverKeyPath, caCertPath, caKeyPath, []string{bindIP}, extraDNS)
+	return GenerateSignedCert(serverCertPath, serverKeyPath, caCertPath, caKeyPath, []string{bindIP}, extraDNS)
 }
 
 func CreateServiceDirectories(spxRoot string) {
@@ -613,16 +613,9 @@ func DiscoverHostname() string {
 }
 
 // GenerateSignedCert generates a server certificate signed by the CA.
-// extraIPs are additional IP addresses to include in the certificate's SANs.
-// All non-loopback interface IPs on the local machine are automatically included.
-func GenerateSignedCert(certPath, keyPath, caCertPath, caKeyPath string, extraIPs ...string) error {
-	return GenerateSignedCertWithDNS(certPath, keyPath, caCertPath, caKeyPath, extraIPs, nil)
-}
-
-// GenerateSignedCertWithDNS generates a server certificate signed by the CA.
 // All non-loopback interface IPs and the machine hostname are automatically
 // included. extraIPs and extraDNS allow adding additional SANs.
-func GenerateSignedCertWithDNS(certPath, keyPath, caCertPath, caKeyPath string, extraIPs, extraDNS []string) error {
+func GenerateSignedCert(certPath, keyPath, caCertPath, caKeyPath string, extraIPs, extraDNS []string) error {
 	caCertPEM, err := os.ReadFile(caCertPath)
 	if err != nil {
 		return fmt.Errorf("failed to read CA cert: %w", err)
@@ -752,69 +745,6 @@ func GenerateSignedCertWithDNS(certPath, keyPath, caCertPath, caKeyPath string,
 	return nil
 }
 
-// GenerateSelfSignedCert generates a self-signed SSL certificate (legacy, kept for compatibility).
-func GenerateSelfSignedCert(certPath, keyPath string) error {
-	privateKey, err := rsa.GenerateKey(rand.Reader, 4096)
-	if err != nil {
-		return fmt.Errorf("failed to generate private key: %w", err)
-	}
-
-	notBefore := time.Now()
-	notAfter := notBefore.Add(3650 * 24 * time.Hour) // 10 years
-
-	serialNumber, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))
-	if err != nil {
-		return fmt.Errorf("failed to generate serial number: %w", err)
-	}
-
-	template := x509.Certificate{
-		SerialNumber: serialNumber,
-		Subject: pkix.Name{
-			CommonName:   "localhost",
-			Organization: []string{"Spinifex Platform"},
-		},
-		NotBefore:             notBefore,
-		NotAfter:              notAfter,
-		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
-		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
-		BasicConstraintsValid: true,
-		DNSNames:              []string{"localhost"},
-		IPAddresses:           []net.IP{net.ParseIP("127.0.0.1"), net.ParseIP("::1")},
-	}
-
-	derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &privateKey.PublicKey, privateKey)
-	if err != nil {
-		return fmt.Errorf("failed to create certificate: %w", err)
-	}
-
-	certOut, err := os.Create(certPath)
-	if err != nil {
-		return fmt.Errorf("failed to create cert file: %w", err)
-	}
-	defer certOut.Close()
-
-	if err := pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes}); err != nil {
-		return fmt.Errorf("failed to write cert: %w", err)
-	}
-
-	keyOut, err := os.OpenFile(keyPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
-	if err != nil {
-		return fmt.Errorf("failed to create key file: %w", err)
-	}
-	defer keyOut.Close()
-
-	privBytes, err := x509.MarshalPKCS8PrivateKey(privateKey)
-	if err != nil {
-		return fmt.Errorf("failed to marshal private key: %w", err)
-	}
-
-	if err := pem.Encode(keyOut, &pem.Block{Type: "PRIVATE KEY", Bytes: privBytes}); err != nil {
-		return fmt.Errorf("failed to write key: %w", err)
-	}
-
-	return nil
-}
-
 // SetupAWSCredentials updates ~/.aws/credentials and ~/.aws/config.
 // When running under sudo, writes to SUDO_USER's home instead of root's.
 func SetupAWSCredentials(accessKey, secretKey, region, certPath, bindIP, wanIP string) error {

spinifex/admin/admin_test.go

@@ -326,7 +326,7 @@ func TestGenerateSignedCert(t *testing.T) {
 		certPath := filepath.Join(dir, "server.pem")
 		keyPath := filepath.Join(dir, "server.key")
 
-		require.NoError(t, GenerateSignedCert(certPath, keyPath, caCertPath, caKeyPath))
+		require.NoError(t, GenerateSignedCert(certPath, keyPath, caCertPath, caKeyPath, nil, nil))
 
 		certPEM, _ := os.ReadFile(certPath)
 		block, _ := pem.Decode(certPEM)
@@ -368,7 +368,7 @@ func TestGenerateSignedCert(t *testing.T) {
 		certPath := filepath.Join(dir, "server.pem")
 		keyPath := filepath.Join(dir, "server.key")
 
-		require.NoError(t, GenerateSignedCert(certPath, keyPath, caCertPath, caKeyPath, "192.168.1.100"))
+		require.NoError(t, GenerateSignedCert(certPath, keyPath, caCertPath, caKeyPath, []string{"192.168.1.100"}, nil))
 
 		certPEM, _ := os.ReadFile(certPath)
 		block, _ := pem.Decode(certPEM)
@@ -389,7 +389,7 @@ func TestGenerateSignedCert(t *testing.T) {
 		certPath := filepath.Join(dir, "server.pem")
 		keyPath := filepath.Join(dir, "server.key")
 
-		require.NoError(t, GenerateSignedCert(certPath, keyPath, caCertPath, caKeyPath, "127.0.0.1", "::1", "0.0.0.0", ""))
+		require.NoError(t, GenerateSignedCert(certPath, keyPath, caCertPath, caKeyPath, []string{"127.0.0.1", "::1", "0.0.0.0", ""}, nil))
 
 		certPEM, _ := os.ReadFile(certPath)
 		block, _ := pem.Decode(certPEM)
@@ -401,7 +401,7 @@ func TestGenerateSignedCert(t *testing.T) {
 		baseDir := t.TempDir()
 		baseCert := filepath.Join(baseDir, "server.pem")
 		baseKey := filepath.Join(baseDir, "server.key")
-		require.NoError(t, GenerateSignedCert(baseCert, baseKey, caCertPath, caKeyPath))
+		require.NoError(t, GenerateSignedCert(baseCert, baseKey, caCertPath, caKeyPath, nil, nil))
 		basePEM, _ := os.ReadFile(baseCert)
 		baseBlock, _ := pem.Decode(basePEM)
 		baseParsed, _ := x509.ParseCertificate(baseBlock.Bytes)
@@ -416,7 +416,7 @@ func TestGenerateSignedCert(t *testing.T) {
 		badCACert := filepath.Join(dir, "bad-ca.pem")
 		require.NoError(t, os.WriteFile(badCACert, []byte("not-a-cert"), 0600))
 
-		err := GenerateSignedCert(filepath.Join(dir, "s.pem"), filepath.Join(dir, "s.key"), badCACert, caKeyPath)
+		err := GenerateSignedCert(filepath.Join(dir, "s.pem"), filepath.Join(dir, "s.key"), badCACert, caKeyPath, nil, nil)
 		assert.Error(t, err)
 	})
 }
@@ -452,7 +452,7 @@ func TestDiscoverHostname(t *testing.T) {
 	}
 }
 
-func TestGenerateSignedCertWithDNS_DedupDNS(t *testing.T) {
+func TestGenerateSignedCert_DedupDNS(t *testing.T) {
 	t.Parallel()
 	caDir := t.TempDir()
 	caCertPath := filepath.Join(caDir, "ca.pem")
@@ -466,7 +466,7 @@ func TestGenerateSignedCertWithDNS_DedupDNS(t *testing.T) {
 	// Pass "localhost" as extra DNS — should not duplicate the built-in entry.
 	// Also pass empty strings and duplicates — should be ignored.
 	extraDNS := []string{"localhost", "", "example.local", "example.local", ""}
-	require.NoError(t, GenerateSignedCertWithDNS(certPath, keyPath, caCertPath, caKeyPath, nil, extraDNS))
+	require.NoError(t, GenerateSignedCert(certPath, keyPath, caCertPath, caKeyPath, nil, extraDNS))
 
 	certPEM, _ := os.ReadFile(certPath)
 	block, _ := pem.Decode(certPEM)
@@ -488,7 +488,7 @@ func TestGenerateSignedCertWithDNS_DedupDNS(t *testing.T) {
 	assert.Contains(t, cert.DNSNames, "example.local")
 }
 
-func TestGenerateSignedCertWithDNS_NilSlices(t *testing.T) {
+func TestGenerateSignedCert_NilSlices(t *testing.T) {
 	t.Parallel()
 	caDir := t.TempDir()
 	caCertPath := filepath.Join(caDir, "ca.pem")
@@ -500,7 +500,7 @@ func TestGenerateSignedCertWithDNS_NilSlices(t *testing.T) {
 	keyPath := filepath.Join(dir, "server.key")
 
 	// Both slices nil — should still produce a valid cert with defaults.
-	require.NoError(t, GenerateSignedCertWithDNS(certPath, keyPath, caCertPath, caKeyPath, nil, nil))
+	require.NoError(t, GenerateSignedCert(certPath, keyPath, caCertPath, caKeyPath, nil, nil))
 
 	certPEM, _ := os.ReadFile(certPath)
 	block, _ := pem.Decode(certPEM)
@@ -510,12 +510,12 @@ func TestGenerateSignedCertWithDNS_NilSlices(t *testing.T) {
 	assert.GreaterOrEqual(t, len(cert.IPAddresses), 2, "should have at least loopback IPs")
 }
 
-func TestGenerateSignedCertWithDNS_InvalidCA(t *testing.T) {
+func TestGenerateSignedCert_InvalidCA(t *testing.T) {
 	t.Parallel()
 	dir := t.TempDir()
 
 	// Missing CA cert file.
-	err := GenerateSignedCertWithDNS(
+	err := GenerateSignedCert(
 		filepath.Join(dir, "s.pem"), filepath.Join(dir, "s.key"),
 		filepath.Join(dir, "missing-ca.pem"), filepath.Join(dir, "missing-ca.key"),
 		nil, nil,
@@ -526,7 +526,7 @@ func TestGenerateSignedCertWithDNS_InvalidCA(t *testing.T) {
 	// Corrupt CA cert.
 	require.NoError(t, os.WriteFile(filepath.Join(dir, "bad-ca.pem"), []byte("not-pem"), 0600))
 	require.NoError(t, os.WriteFile(filepath.Join(dir, "bad-ca.key"), []byte("not-pem"), 0600))
-	err = GenerateSignedCertWithDNS(
+	err = GenerateSignedCert(
 		filepath.Join(dir, "s.pem"), filepath.Join(dir, "s.key"),
 		filepath.Join(dir, "bad-ca.pem"), filepath.Join(dir, "bad-ca.key"),
 		nil, nil,
@@ -534,7 +534,7 @@ func TestGenerateSignedCertWithDNS_InvalidCA(t *testing.T) {
 	assert.Error(t, err)
 }
 
-func TestGenerateSignedCertWithDNS_ExtraDNS(t *testing.T) {
+func TestGenerateSignedCert_ExtraDNS(t *testing.T) {
 	t.Parallel()
 	caDir := t.TempDir()
 	caCertPath := filepath.Join(caDir, "ca.pem")
@@ -547,7 +547,7 @@ func TestGenerateSignedCertWithDNS_ExtraDNS(t *testing.T) {
 
 	extraIPs := []string{"10.0.0.42"}
 	extraDNS := []string{"spinifex.local", "node1.spinifex.local"}
-	require.NoError(t, GenerateSignedCertWithDNS(certPath, keyPath, caCertPath, caKeyPath, extraIPs, extraDNS))
+	require.NoError(t, GenerateSignedCert(certPath, keyPath, caCertPath, caKeyPath, extraIPs, extraDNS))
 
 	certPEM, _ := os.ReadFile(certPath)
 	block, _ := pem.Decode(certPEM)
@@ -579,7 +579,7 @@ func TestGenerateSignedCert_IncludesHostname(t *testing.T) {
 	dir := t.TempDir()
 	certPath := filepath.Join(dir, "server.pem")
 	keyPath := filepath.Join(dir, "server.key")
-	require.NoError(t, GenerateSignedCert(certPath, keyPath, caCertPath, caKeyPath))
+	require.NoError(t, GenerateSignedCert(certPath, keyPath, caCertPath, caKeyPath, nil, nil))
 
 	certPEM, _ := os.ReadFile(certPath)
 	block, _ := pem.Decode(certPEM)
@@ -593,26 +593,6 @@ func TestGenerateSignedCert_IncludesHostname(t *testing.T) {
 	}
 }
 
-func TestGenerateSelfSignedCert_CreatesValidCert(t *testing.T) {
-	t.Parallel()
-	dir := t.TempDir()
-	certPath := filepath.Join(dir, "self.pem")
-	keyPath := filepath.Join(dir, "self.key")
-
-	require.NoError(t, GenerateSelfSignedCert(certPath, keyPath))
-
-	certPEM, _ := os.ReadFile(certPath)
-	block, _ := pem.Decode(certPEM)
-	require.NotNil(t, block)
-
-	cert, err := x509.ParseCertificate(block.Bytes)
-	require.NoError(t, err)
-	assert.Contains(t, cert.DNSNames, "localhost")
-
-	info, _ := os.Stat(keyPath)
-	assert.Equal(t, os.FileMode(0600), info.Mode().Perm())
-}
-
 // --- Certificate orchestrator ---
 
 // TestGenerateCertificatesIfNeeded uses subtests to share the initial generation.

spinifex/gateway/eks/handler.go

@@ -5,9 +5,7 @@ package gateway_eks
 
 import (
 	"encoding/json"
-	"errors"
 	"fmt"
-	"io"
 	"log/slog"
 	"net/http"
 	"strings"
@@ -91,23 +89,3 @@ func WriteErrorFromCode(w http.ResponseWriter, code string) {
 	}
 	WriteJSONError(w, code, msg.Message, httpStatus)
 }
-
-// ParseJSONBody decodes the request body into an aws-sdk-go input struct.
-// Empty bodies (valid for GET/DELETE) return a zero-valued struct.
-func ParseJSONBody[T any](r *http.Request) (*T, error) {
-	out := new(T)
-	if r.Body == nil {
-		return out, nil
-	}
-	body, err := io.ReadAll(r.Body)
-	if err != nil {
-		return nil, fmt.Errorf("read body: %w", err)
-	}
-	if len(body) == 0 {
-		return out, nil
-	}
-	if err := json.Unmarshal(body, out); err != nil {
-		return nil, errors.New(awserrors.ErrorInvalidParameterValue)
-	}
-	return out, nil
-}

spinifex/gateway/eks/handler_test.go

@@ -1,7 +1,6 @@
 package gateway_eks
 
 import (
-	"bytes"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
@@ -111,27 +110,3 @@ func TestWriteJSONResponse_ListClustersWireShape(t *testing.T) {
 	assert.NotContains(t, body, `"Clusters"`)
 	assert.NotContains(t, body, `"NextToken"`)
 }
-
-type sampleInput struct {
-	Name string `json:"name"`
-}
-
-func TestParseJSONBody_EmptyBodyOK(t *testing.T) {
-	req := httptest.NewRequest(http.MethodGet, "/clusters", nil)
-	got, err := ParseJSONBody[sampleInput](req)
-	require.NoError(t, err)
-	assert.Empty(t, got.Name)
-}
-
-func TestParseJSONBody_DecodesBody(t *testing.T) {
-	req := httptest.NewRequest(http.MethodPost, "/clusters", bytes.NewReader([]byte(`{"name":"alpha"}`)))
-	got, err := ParseJSONBody[sampleInput](req)
-	require.NoError(t, err)
-	assert.Equal(t, "alpha", got.Name)
-}
-
-func TestParseJSONBody_InvalidJSONErrors(t *testing.T) {
-	req := httptest.NewRequest(http.MethodPost, "/clusters", bytes.NewReader([]byte(`{not-json}`)))
-	_, err := ParseJSONBody[sampleInput](req)
-	require.Error(t, err)
-}

spinifex/services/nats/nats_test.go

@@ -39,7 +39,7 @@ func TestRenderedConfig_EnforcesAuth(t *testing.T) {
 	require.NoError(t, admin.GenerateCACert(caCertPath, caKeyPath))
 	serverCertPath := filepath.Join(tmpDir, "server.pem")
 	serverKeyPath := filepath.Join(tmpDir, "server.key")
-	require.NoError(t, admin.GenerateSignedCert(serverCertPath, serverKeyPath, caCertPath, caKeyPath, "127.0.0.1"))
+	require.NoError(t, admin.GenerateSignedCert(serverCertPath, serverKeyPath, caCertPath, caKeyPath, []string{"127.0.0.1"}, nil))
 
 	// Read and render the production template.
 	raw, err := os.ReadFile(templatePath(t))

spinifex/utils/utils.go

@@ -20,13 +20,9 @@ import (
 	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/session"
 	"github.com/aws/aws-sdk-go/private/protocol/xml/xmlutil"
 	"github.com/aws/aws-sdk-go/service/ec2"
-	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/mulgadc/spinifex/spinifex/awserrors"
-	"github.com/mulgadc/spinifex/spinifex/config"
 	"github.com/pterm/pterm"
 )
 
@@ -160,18 +156,6 @@ func ValidateKeyPairName(name string) error {
 	return nil
 }
 
-func CreateS3Client(cfg *config.Config) *s3.S3 {
-	sess := session.Must(session.NewSession(&aws.Config{
-		Region:           aws.String(cfg.Predastore.Region),
-		Endpoint:         aws.String(fmt.Sprintf("https://%s", cfg.Predastore.Host)),
-		Credentials:      credentials.NewStaticCredentials(cfg.Predastore.AccessKey, cfg.Predastore.SecretKey, ""),
-		S3ForcePathStyle: aws.Bool(true),
-		DisableSSL:       aws.Bool(false),
-	}))
-
-	return s3.New(sess)
-}
-
 func DownloadFileWithProgress(url string, name string, filename string, timeout time.Duration) (err error) {
 	ctx, cancel := context.WithCancel(context.Background())
 	if timeout > 0 {