half broken

Makefile

@@ -107,7 +107,7 @@ fmt-check: ## Fail if anything is unformatted
 	fi
 
 .PHONY: lint
-lint: ## Vet plus a gocyclo-style sanity check on the biggest package
+lint: ## go vet, with the name it has always had
 	$(GO) vet ./...
 	@echo "lint: ok"
 
@@ -118,13 +118,41 @@ web-check: ## Typecheck and build the console
 ## Run
 
 .PHONY: run
-run: go-build ## Run with deploy/config.example.yaml on unprivileged ports
+run: go-build ## Run with deploy/config.example.yaml (binds :53 — rewrite the ports first)
 	$(DIST)/$(BINARY)-noassets -config deploy/config.example.yaml -log-level debug
 
 .PHONY: check-config
 check-config: go-build ## Validate a config file without starting
 	$(DIST)/$(BINARY)-noassets -config $(or $(CONFIG),deploy/config.example.yaml) -check
 
+## End-to-end
+
+.PHONY: smoke
+smoke: build ## Boot the real binary on unprivileged ports; check the API, metrics and the embedded console
+	@set -euo pipefail; \
+	dir=$$(mktemp -d); \
+	pid=""; \
+	trap '[ -n "$$pid" ] && kill "$$pid" 2>/dev/null || true; rm -rf "$$dir"' EXIT; \
+	sed \
+	  -e 's#127.0.0.1:8080#127.0.0.1:18080#' \
+	  -e 's#0.0.0.0:53#127.0.0.1:15353#g' \
+	  -e 's#\[::\]:53#[::1]:15353#g' \
+	  -e 's#trust_loopback: true#trust_loopback: false#' \
+	  deploy/config.example.yaml > "$$dir/config.yaml"; \
+	$(DIST)/$(BINARY) -config "$$dir/config.yaml" -check; \
+	$(DIST)/$(BINARY) -config "$$dir/config.yaml" > "$$dir/log" 2>&1 & \
+	pid=$$!; \
+	for i in $$(seq 1 40); do \
+	  curl -fsS http://127.0.0.1:18080/api/healthz >/dev/null 2>&1 && break; \
+	  sleep 0.5; \
+	done; \
+	echo "==> health";  curl -fsS http://127.0.0.1:18080/api/healthz; echo; \
+	echo "==> console"; curl -fsS http://127.0.0.1:18080/ | grep -qi '<!doctype html' && echo "embedded"; \
+	echo "==> auth"; \
+	  test "$$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:18080/api/whoami)" = 401 && echo "unauthenticated -> 401"; \
+	  curl -fsS -H "X-API-Key: CHANGE-ME-long-random-string" http://127.0.0.1:18080/api/whoami | grep -q '"can_write":true' && echo "authenticated -> can_write"; \
+	echo "==> metrics"; curl -fsS -H "X-API-Key: CHANGE-ME-long-random-string" http://127.0.0.1:18080/api/metrics | grep -c '^fancydns_'
+
 ## Container
 
 .PHONY: image