@@ -3,6 +3,8 @@ # yamllint disable-line rule:line-length
 # yaml-language-server: $schema=https://golangci-lint.run/jsonschema/golangci.jsonschema.json
 version: "2"
 linters:
+  disable:
+    - errcheck
   enable:
     - gocritic
     - godox
@@ -22,3 +24,10 @@ settings:
     staticcheck:
       dot-import-whitelist:
         - "go.alanpearce.eu/gomponents/html"
+  exclusions:
+    generated: strict
+    warn-unused: true
+    presets:
+      - comments
+      - std-error-handling
+      - common-false-positives

@@ -65,7 +65,7 @@ panic("could not stat destination: " + err.Error())
 		}
 		switch {
 		case stat == nil:
-			err := os.MkdirAll(options.Destination, 0o0755)
+			err := os.MkdirAll(options.Destination, 0o750)
 			if err != nil {
 				panic("could not make directory: " + err.Error())
 			}

@@ -93,7 +93,7 @@ }
 
 	for _, tt := range tests {
 		pos, err := b.Seek(tt.offset, tt.whence)
-		if pos != tt.expect || (err != tt.err && !((err == nil) && (tt.err == nil))) {
+		if pos != tt.expect || (err != tt.err && (err != nil || tt.err != nil)) {
 			t.Errorf("Seek(%d, %d): expected %d with error %v, got %d and %v",
 				tt.offset, tt.whence, tt.expect, tt.err, pos, err)
 		}

@@ -171,7 +171,7 @@ if err != nil {
 					return err
 				}
 
-				for _, tag := range post.PostMatter.Taxonomies.Tags {
+				for _, tag := range post.Taxonomies.Tags {
 					cc.Tags.Add(strings.ToLower(tag))
 				}
 				cc.Posts = append(cc.Posts, post)

@@ -100,7 +100,7 @@ go func() {
 		fileEvents := make(map[string]fsnotify.Op)
 		for {
 			select {
-			case baseEvent := <-fw.Watcher.Events:
+			case baseEvent := <-fw.Events:
 				if !fw.ignored(baseEvent.Name) {
 					if baseEvent.Has(fsnotify.Create) || baseEvent.Has(fsnotify.Rename) {
 						f, err := os.Stat(baseEvent.Name)
@@ -140,7 +140,7 @@ }
 						timer.Reset(checkSettleInterval)
 					}
 				}
-			case err := <-fw.Watcher.Errors:
+			case err := <-fw.Errors:
 				fw.log.Warn("error in watcher", "error", err)
 			}
 		}

@@ -50,7 +50,7 @@ func (f *Fetcher) getArtefacts(run uint64) errors.E {
 	runID := strconv.FormatUint(run, 10)
 	f.log.Debug("getting artefacts", "run_id", runID)
 
-	err := os.MkdirAll(filepath.Join(f.options.Root, runID), 0755)
+	err := os.MkdirAll(filepath.Join(f.options.Root, runID), 0o750)
 	if err != nil {
 		return errors.WithMessage(err, "could not create directory")
 	}
@@ -79,7 +79,7 @@ }
 	var badFiles []string
 	for _, f := range contents {
 		name := f.Name()
-		if !(name == "current" || numericFilename.MatchString(name)) {
+		if name != "current" && !numericFilename.MatchString(name) {
 			badFiles = append(badFiles, name)
 		}
 	}
@@ -134,7 +134,7 @@ url := f.options.FetchURL.JoinPath(runID, basename).String()
 
 	f.log.Debug("getting file", "filename", filename, "url", url)
 
-	file, err := os.OpenFile(filename, os.O_CREATE|os.O_WRONLY, 0644)
+	file, err := os.OpenFile(filename, os.O_CREATE|os.O_WRONLY, 0o600)
 	if err != nil {
 		return errors.WithMessage(err, "could not open file")
 	}

@@ -80,7 +80,10 @@ fd, err := f.write(pathname, content)
 	if err != nil {
 		return err
 	}
-	fd.Close()
+
+	if err := fd.Close(); err != nil {
+		return errors.WithStack(err)
+	}
 
 	return nil
 }
@@ -116,7 +119,7 @@ return fd, nil
 }
 
 func openFileWrite(filename string) (*os.File, errors.E) {
-	f, err := os.OpenFile(filename, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0644)
+	f, err := os.OpenFile(filename, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o600)
 	if err != nil {
 		return nil, errors.WithMessage(err, "could not open output file")
 	}
@@ -196,7 +199,7 @@ return openFileWrite(f.join(filename))
 }
 
 func (f *Files) Mkdirp(dir string) errors.E {
-	err := os.MkdirAll(f.join(dir), 0755)
+	err := os.MkdirAll(f.join(dir), 0o750)
 	if err != nil {
 		return errors.WithMessage(err, "could not create directory")
 	}

@@ -192,7 +192,10 @@ }
 
 func etag(content []byte) (string, errors.E) {
 	hash := fnv.New64a()
-	hash.Write(content)
+	_, err := hash.Write(content)
+	if err != nil {
+		return "", errors.WithStack(err)
+	}
 
 	return fmt.Sprintf(`W/"%x"`, hash.Sum(nil)), nil
 }

@@ -45,7 +45,7 @@ func (website *Website) ServeHTTP(w http.ResponseWriter, r *http.Request) *ihttp.Error {
 	urlPath, shouldRedirect := website.reader.CanonicalisePath(r.URL.Path)
 	if shouldRedirect {
 		website.counter.Count(r, "302")
-		http.Redirect(w, r, urlPath, 302)
+		http.Redirect(w, r, urlPath, http.StatusFound)
 
 		return nil
 	}

@@ -182,14 +182,14 @@ mux.HandleFunc("/.well-known/webfinger", website.webfinger)
 	const oidcPath = "/.well-known/openid-configuration"
 	mux.ServeMux.Handle(oidcPath, ihttp.RedirectHandler(cfg.OIDCHost.JoinPath(oidcPath), 302))
 
-	website.App.Handler = mux
+	website.Handler = mux
 
 	return website, nil
 }
 
 func prepareRootDirectory(root string) errors.E {
 	if !file.Exists(root) {
-		err := os.MkdirAll(root, 0755)
+		err := os.MkdirAll(root, 0o750)
 		if err != nil {
 			return errors.WithMessage(err, "could not create root directory")
 		}

@@ -74,7 +74,7 @@ }()
 
 	<-ctx.Done()
 	log.Debug("calling stop")
-	website.App.Shutdown()
+	website.Shutdown()
 	<-sv.Stop()
 	log.Debug("done")
 }