perf: remove nginx rate limiting for internal package proxy

- Removed rate limiting zones (10r/s for API, 5r/s for downloads)
- Internal package proxy doesn't need rate limiting
- During builds, package managers make hundreds of concurrent requests
- Rate limiting was causing unnecessary delays and potential 429 errors

This improves build performance significantly for CI/CD pipelines

Dockerfile.frontend

@@ -35,18 +35,15 @@ EOF
 
 RUN chmod +x /docker-entrypoint.d/40-inject-config.sh
 
-# Create nginx configuration template with backend proxy support
-RUN cat > /etc/nginx/templates/default.conf.template <<'EOF'
+# Create nginx templates directory and configuration template with backend proxy support
+RUN mkdir -p /etc/nginx/templates && \
+    cat > /etc/nginx/templates/default.conf.template <<'EOF'
 # Upstream backend server
 upstream backend {
     server ${BACKEND_HOST}:${BACKEND_PORT};
     keepalive 32;
 }
 
-# Rate limiting zones
-limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
-limit_req_zone $binary_remote_addr zone=download_limit:10m rate=5r/s;
-
 # Cache configuration
 proxy_cache_path /var/cache/nginx/static levels=1:2 keys_zone=static_cache:10m max_size=100m inactive=60m use_temp_path=off;
 
@@ -76,11 +73,8 @@ server {
 
     # API endpoints - proxy to backend
     location /api/ {
-        # Rate limiting
-        limit_req zone=api_limit burst=20 nodelay;
-
         # Proxy settings
-        proxy_pass http://backend/;
+        proxy_pass http://backend;
         proxy_http_version 1.1;
 
         # Headers
@@ -119,10 +113,8 @@ server {
         proxy_set_header Connection "";
     }
 
-    # Package download endpoints with rate limiting
+    # Package download endpoints
     location ~ ^/(npm|pypi|go)/ {
-        limit_req zone=download_limit burst=10 nodelay;
-
         proxy_pass http://backend;
         proxy_http_version 1.1;
         proxy_set_header Host $host;

Dockerfile.migrate

@@ -2,7 +2,9 @@
 # This Dockerfile expects a PRE-BUILT binary from GoReleaser (no compilation)
 # GoReleaser injects the platform-specific binary automatically
 
-FROM alpine:latest
+FROM --platform=$TARGETPLATFORM alpine:latest
+
+ARG TARGETARCH
 
 # Install runtime dependencies (including CGO/SQLite dependencies)
 RUN apk add --no-cache \
@@ -20,7 +22,8 @@ RUN addgroup -g 1000 gohoarder && \
 
 # Copy pre-built binary from GoReleaser
 # GoReleaser will automatically inject the correct binary for the target platform
-COPY migrate /usr/local/bin/migrate
+# In split/merge mode, binaries are in linux/${TARGETARCH}/ subdirectories
+COPY linux/${TARGETARCH}/migrate /usr/local/bin/migrate
 RUN chmod +x /usr/local/bin/migrate
 
 # Copy migration SQL files

Dockerfile.scanner

@@ -2,7 +2,9 @@
 # This Dockerfile expects a PRE-BUILT binary from GoReleaser (no compilation)
 # GoReleaser injects the platform-specific binary automatically
 
-FROM alpine:latest
+FROM --platform=$TARGETPLATFORM alpine:latest
+
+ARG TARGETARCH
 
 # Install scanning tools and runtime dependencies (including CGO/SQLite dependencies)
 RUN apk add --no-cache \
@@ -14,6 +16,10 @@ RUN apk add --no-cache \
     bash \
     sqlite-libs \
     musl \
+    python3 \
+    py3-pip \
+    npm \
+    go \
     && update-ca-certificates
 
 # Install Trivy for container scanning
@@ -22,6 +28,13 @@ RUN curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/
 # Install Grype for vulnerability scanning
 RUN curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
 
+# Install govulncheck for Go vulnerability scanning
+RUN go install golang.org/x/vuln/cmd/govulncheck@latest && \
+    mv /root/go/bin/govulncheck /usr/local/bin/
+
+# Install pip-audit for Python package vulnerability scanning
+RUN pip3 install --no-cache-dir pip-audit --break-system-packages
+
 # Create non-root user
 RUN addgroup -g 1000 scanner && \
     adduser -D -u 1000 -G scanner scanner
@@ -41,7 +54,8 @@ RUN mkdir -p /var/cache/gohoarder \
 
 # Copy pre-built binary from GoReleaser
 # GoReleaser will automatically inject the correct binary for the target platform
-COPY gohoarder /usr/local/bin/gohoarder
+# In split/merge mode, binaries are in linux/${TARGETARCH}/ subdirectories
+COPY linux/${TARGETARCH}/gohoarder /usr/local/bin/gohoarder
 RUN chmod +x /usr/local/bin/gohoarder
 
 # Copy example config

Dockerfile.server

@@ -2,7 +2,9 @@
 # This Dockerfile expects a PRE-BUILT binary from GoReleaser (no compilation)
 # GoReleaser injects the platform-specific binary automatically
 
-FROM alpine:latest
+FROM --platform=$TARGETPLATFORM alpine:latest
+
+ARG TARGETARCH
 
 # Install runtime dependencies (CGO/SQLite requires these)
 RUN apk add --no-cache \
@@ -28,7 +30,8 @@ RUN mkdir -p /var/cache/gohoarder \
 
 # Copy pre-built binary from GoReleaser
 # GoReleaser will automatically inject the correct binary for the target platform
-COPY gohoarder /usr/local/bin/gohoarder
+# In split/merge mode, binaries are in linux/${TARGETARCH}/ subdirectories
+COPY linux/${TARGETARCH}/gohoarder /usr/local/bin/gohoarder
 RUN chmod +x /usr/local/bin/gohoarder
 
 # Copy example config

helm/gohoarder/templates/configmap.yaml

@@ -93,24 +93,30 @@ data:
         low: {{ .Values.security.blockThresholds.low }}
       scanners:
         trivy:
-          enabled: {{ .Values.security.scanners.trivy.enabled }}
+          # Disabled in server config (no trivy binary), enabled via env var in scanner pod
+          enabled: false
           timeout: {{ .Values.security.scanners.trivy.timeout | quote }}
           cache_db: {{ .Values.security.scanners.trivy.cacheDb | quote }}
         osv:
+          # API-based scanner - works in both server and scanner pods
           enabled: {{ .Values.security.scanners.osv.enabled }}
           api_url: {{ .Values.security.scanners.osv.apiUrl | quote }}
           timeout: {{ .Values.security.scanners.osv.timeout | quote }}
         grype:
-          enabled: {{ .Values.security.scanners.grype.enabled }}
+          # Disabled in server config (no grype binary), enabled via env var in scanner pod
+          enabled: false
           timeout: {{ .Values.security.scanners.grype.timeout | quote }}
         govulncheck:
-          enabled: {{ .Values.security.scanners.govulncheck.enabled }}
+          # Disabled in server config (no go/govulncheck binary), enabled via env var in scanner pod
+          enabled: false
           timeout: {{ .Values.security.scanners.govulncheck.timeout | quote }}
         npm_audit:
-          enabled: {{ .Values.security.scanners.npmAudit.enabled }}
+          # Disabled in server config (no npm binary), enabled via env var in scanner pod
+          enabled: false
           timeout: {{ .Values.security.scanners.npmAudit.timeout | quote }}
         pip_audit:
-          enabled: {{ .Values.security.scanners.pipAudit.enabled }}
+          # Disabled in server config (no pip binary), enabled via env var in scanner pod
+          enabled: false
           timeout: {{ .Values.security.scanners.pipAudit.timeout | quote }}
         ghsa:
           enabled: {{ .Values.security.scanners.ghsa.enabled }}

helm/gohoarder/templates/deployment-scanner.yaml

@@ -109,6 +109,17 @@ spec:
         env:
         - name: CONFIG_FILE
           value: /etc/gohoarder/config.yaml
+        # Enable tool-based scanners only in scanner pod (server doesn't have the tools)
+        - name: GOHOARDER_SECURITY_SCANNERS_TRIVY_ENABLED
+          value: "{{ .Values.security.scanners.trivy.enabled }}"
+        - name: GOHOARDER_SECURITY_SCANNERS_GRYPE_ENABLED
+          value: "{{ .Values.security.scanners.grype.enabled }}"
+        - name: GOHOARDER_SECURITY_SCANNERS_GOVULNCHECK_ENABLED
+          value: "{{ .Values.security.scanners.govulncheck.enabled }}"
+        - name: GOHOARDER_SECURITY_SCANNERS_NPM_AUDIT_ENABLED
+          value: "{{ .Values.security.scanners.npmAudit.enabled }}"
+        - name: GOHOARDER_SECURITY_SCANNERS_PIP_AUDIT_ENABLED
+          value: "{{ .Values.security.scanners.pipAudit.enabled }}"
         {{- if and (eq .Values.metadata.backend "postgresql") .Values.metadata.postgresql.existingSecret }}
         - name: POSTGRES_USER
           valueFrom:

pkg/scanner/osv/osv.go

@@ -121,13 +121,17 @@ func (s *Scanner) Scan(ctx context.Context, registry, packageName, version strin
 	// Convert registry to OSV ecosystem
 	ecosystem := s.registryToEcosystem(registry)
 
+	// Clean package name and version for Go modules
+	// Go proxy cache keys include /@v/version.suffix which OSV doesn't understand
+	cleanName, cleanVersion := s.cleanGoModuleName(packageName, version, ecosystem)
+
 	// Build request
 	req := OSVRequest{
 		Package: PackageInfo{
-			Name:      packageName,
+			Name:      cleanName,
 			Ecosystem: ecosystem,
 		},
-		Version: version,
+		Version: cleanVersion,
 	}
 
 	// Marshal request
@@ -199,6 +203,52 @@ func (s *Scanner) registryToEcosystem(registry string) string {
 	}
 }
 
+// cleanGoModuleName cleans Go module cache keys to extract the actual module path and version
+// Go proxy cache keys include /@v/version.suffix patterns that need to be cleaned
+// Examples:
+//   - "gorm.io/driver/sqlite/@v/v1.6.0.zip" -> "gorm.io/driver/sqlite", "v1.6.0"
+//   - "github.com/pkg/errors/@v/v0.9.1.mod" -> "github.com/pkg/errors", "v0.9.1"
+//   - "regular-package" -> "regular-package", "version" (unchanged for non-Go)
+func (s *Scanner) cleanGoModuleName(packageName, version, ecosystem string) (string, string) {
+	// Only clean for Go modules
+	if ecosystem != "Go" {
+		return packageName, version
+	}
+
+	// Check if package name contains /@v/ pattern (Go module proxy format)
+	if strings.Contains(packageName, "/@v/") {
+		// Split on /@v/ to get the module path
+		parts := strings.Split(packageName, "/@v/")
+		if len(parts) == 2 {
+			// parts[0] is the clean module path (e.g., "gorm.io/driver/sqlite")
+			// parts[1] might be "v1.6.0.zip" or "v1.6.0.mod" or "v1.6.0.info"
+			cleanName := parts[0]
+
+			// Extract version from the second part if version wasn't already clean
+			// Remove file suffixes like .zip, .mod, .info
+			versionPart := parts[1]
+			versionPart = strings.TrimSuffix(versionPart, ".zip")
+			versionPart = strings.TrimSuffix(versionPart, ".mod")
+			versionPart = strings.TrimSuffix(versionPart, ".info")
+
+			// Use the extracted version if it looks valid, otherwise use the provided version
+			if versionPart != "" && strings.HasPrefix(versionPart, "v") {
+				return cleanName, versionPart
+			}
+
+			return cleanName, version
+		}
+	}
+
+	// Also clean version of any file suffixes
+	cleanVersion := version
+	cleanVersion = strings.TrimSuffix(cleanVersion, ".zip")
+	cleanVersion = strings.TrimSuffix(cleanVersion, ".mod")
+	cleanVersion = strings.TrimSuffix(cleanVersion, ".info")
+
+	return packageName, cleanVersion
+}
+
 // convertOSVResult converts OSV response to metadata.ScanResult
 func (s *Scanner) convertOSVResult(osvResp *OSVResponse, registry, packageName, version string) *metadata.ScanResult {
 	vulnerabilities := make([]metadata.Vulnerability, 0, len(osvResp.Vulns))