switched to fully self contained docker

internal/app/download.go

@@ -101,7 +101,7 @@ func (s *Server) exchangeRateLimited(r *http.Request, sourceIP string) (bool, er
 		   FROM audit_events
 		  WHERE event_type = 'code_exchange_failed'
 		    AND source_ip = ?
-		    AND created_at > UTC_TIMESTAMP(6) - INTERVAL 10 MINUTE`,
+		    AND created_at > datetime('now', '-10 minutes')`,
 		sourceIP,
 	).Scan(&attempts)
 	return attempts >= 10, err
@@ -130,8 +130,7 @@ func (s *Server) exchangeDeploymentCode(
 		   FROM authorizations
 		  WHERE code_hash = ?
 		    AND revoked_at IS NULL
-		    AND expires_at > UTC_TIMESTAMP(6)
-		  FOR UPDATE`,
+		    AND expires_at > CURRENT_TIMESTAMP`,
 		codeHash[:],
 	).Scan(&authorizationID, &hostLimit, &expiresAt)
 	if errors.Is(err, sql.ErrNoRows) {
@@ -216,7 +215,7 @@ func (s *Server) exchangeDeploymentCode(
 			r.Context(),
 			`UPDATE authorization_hosts
 			    SET hostname = ?,
-			        last_seen_at = UTC_TIMESTAMP(6)
+			        last_seen_at = CURRENT_TIMESTAMP
 			  WHERE id = ?`,
 			request.Hostname, hostID,
 		)
@@ -342,9 +341,9 @@ func (s *Server) handlePackageDownload(w http.ResponseWriter, r *http.Request) {
 		   JOIN packages p ON p.id = ap.package_id
 		  WHERE ds.token_hash = ?
 		    AND ds.revoked_at IS NULL
-		    AND ds.expires_at > UTC_TIMESTAMP(6)
+		    AND ds.expires_at > CURRENT_TIMESTAMP
 		    AND a.revoked_at IS NULL
-		    AND a.expires_at > UTC_TIMESTAMP(6)
+		    AND a.expires_at > CURRENT_TIMESTAMP
 		    AND p.slug = ?
 		    AND p.enabled = TRUE`,
 		sessionHash[:], slug,