wanderer - Moses Yebei

The Problem

Trail data lives scattered across GPS devices, Strava, Komoot, and Hammerhead accounts. wanderer solves that by giving you a self-hosted catalogue where recorded tracks become searchable, shareable entries with metadata, maps, and ActivityPub federation—so your adventure data isn't locked in a proprietary platform.

What This Does

wanderer is a full-stack trail database. The web/ directory holds a SvelteKit frontend with map visualization, search, and trail management. The db/ directory is a Go backend that handles persistence, ActivityPub federation, and third-party integrations.

Key integrations in db/integrations/ sync trails from Strava, Komoot, and Hammerhead. The db/federation/ package implements ActivityPub, letting instances share trails and follow users across servers. The db/ backend also manages a Meilisearch index for fast search, with migrations in db/migrations/ tracking schema changes.

How It Is Wired

Execution starts at main in db/main.go:58, which reaches 41 functions. From there, setupEventHandlers (line 89) wires 35 functions into the event system, and registerRoutes (line 160) sets up the HTTP API. The backend uses a Postgres database (evidenced by the extensive migration history) and Meilisearch for search indexing, initialized via initMeilisearchDocuments (line 359).

The highest-fan-in functions are the federation and notification core: PostActivity (called from 14 places), GetSafeActorContext (11), SafeHTTPClient (9), and SendNotification (7). These sit in db/federation/activity.go and db/util/network.go — change any of them and you break most of the integration and federation paths.

The third-party sync flow runs through syncTrailWithTours, which calls FindTrailByExternalReference, fetchDetailedTour, generateTourGPX, createTrailFromTour, and TryAutoMergeImportedTrail — each called twice from that single function. db/services/trailmerge/service.go owns the merge logic with 51 functions, making it the largest service file. The db/util/network.go file performs cryptographic operations (key generation for ActivityPub) and is imported by 10 other files.

The module graph shows two import cycles: web/src/lib/models/trail.ts, activitypub/actor.ts, and user.ts are mutually reachable. That costs you when refactoring — changing a type in one ripples through the others, and the cycle prevents clean modular extraction.

How To Use It

Setup: Docker Compose is the recommended path, per the README:

wget https://raw.githubusercontent.com/open-wanderer/wanderer/main/docker-compose.yml
docker compose up -d

Configuration: Set ORIGIN to your hostname (defaults to localhost:3000) to avoid CORS errors. Set MEILI_MASTER_KEY in production — the README warns the default is insecure. Both go in your environment or the docker-compose.yml.

Running: After startup (up to 90 seconds), the frontend is at localhost:3000. For bare-metal, the docs at docs/ cover building from source.

Real-World Use

A trail-running club runs wanderer on a VPS. Members link their Strava accounts via the integration in db/integrations/strava/strava.go. When someone uploads a GPX, db/services/trailmerge/service.go deduplicates it against existing trails and offers a merge suggestion. The club's instance federates with another club's server via ActivityPub, so shared trails appear in both catalogs through db/federation/activity.go.

Code Health & Issues

Static analysis found 117 findings: 54 high, 63 medium. The high-severity items are:

High – Import cycles in web/src/lib/models/trail.ts, activitypub/actor.ts, and user.ts — mutually reachable modules make refactoring risky.
High – Oversized files: web/src/lib/util/icon_util.ts (1528 lines), db/services/trailmerge/service.go, web/src/routes/trail/edit/[id]/+page.svelte.
High – Deep nesting (depth 10) in geojson_util.ts, combobox.svelte, editor.svelte.
High – Duplicated code blocks: 737 repeated 6-line blocks across 201 files, concentrated in db/federation/.

SDLC observations: CI uses GitHub Actions, tests exist but cover only 8 of 590 source files (ratio 0.014). The code health audit flags unpinned GitHub Actions tags (@v4, @v8), missing permissions declarations on the workflow token, an unpinned base image in db/Dockerfile, no dependency vulnerability scan, large binaries committed (10.6MB trailer.mp4), and a root user in the Docker image.

The Bottom Line

wanderer is a functional, feature-rich trail database with real federation and third-party integrations — the architecture is sound and the feature set is impressive. The main risks are maintenance: import cycles, oversized files, and weak test coverage will make changes progressively harder. Use it if you need a self-hosted trail catalogue with federation; budget time for refactoring before deep customization.

What the analyser found

Deployment readiness

6/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

853 files

TypeScript263
Go215
Svelte140
Markdown27
JSON25
JavaScript14

ReactSvelteTailwindDocker

Module dependencies

The 10 most depended-upon modules of 246, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_lib_models_activitypub_actor["actor"] n1_eb_src_lib_stores_user_store["user_store"] n2_web_src_lib_models_trail["trail"] n3_web_src_lib_models_user["user"] n4_web_src_lib_models_gpx_link["link"] n5_eb_src_lib_models_summit_log["summit_log"] n6__src_lib_models_gpx_waypoint["waypoint"] n7__src_lib_models_notification["notification"] n8_b_src_lib_models_trail_share["trail_share"] n9_web_src_lib_models_list["list"] n0_lib_models_activitypub_actor --> n3_web_src_lib_models_user n6__src_lib_models_gpx_waypoint --> n4_web_src_lib_models_gpx_link n9_web_src_lib_models_list --> n2_web_src_lib_models_trail n9_web_src_lib_models_list --> n3_web_src_lib_models_user n9_web_src_lib_models_list --> n0_lib_models_activitypub_actor n7__src_lib_models_notification --> n0_lib_models_activitypub_actor n5_eb_src_lib_models_summit_log --> n0_lib_models_activitypub_actor n5_eb_src_lib_models_summit_log --> n2_web_src_lib_models_trail n2_web_src_lib_models_trail --> n0_lib_models_activitypub_actor n2_web_src_lib_models_trail --> n5_eb_src_lib_models_summit_log n2_web_src_lib_models_trail --> n8_b_src_lib_models_trail_share n8_b_src_lib_models_trail_share --> n0_lib_models_activitypub_actor classDef cyc stroke:#ef4444,stroke-width:2px; class n0_lib_models_activitypub_actor,n2_web_src_lib_models_trail,n3_web_src_lib_models_user,n5_eb_src_lib_models_summit_log,n7__src_lib_models_notification cyc;

Findings

LowSecret-shaped paths present; the code-health audit confirms or clears them db/util/secrets.go

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high1

medium6

low2

Pin third-party GitHub Actions to a commit SHAhigh4 occurrences

.github/workflows

docker/login-action@v4, docker/setup-buildx-action@v4, softprops/action-gh-release@v3, peter-evans/create-pull-request@v8

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Declare least-privilege permissions for GITHUB_TOKENmedium

.github/workflows/go.yml

1 workflow(s) declare no permissions

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Pin the container base image by digestmedium

db/Dockerfile

curlimages/curl:8.18.0

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Move large binaries to Git LFS or out of the repositorymedium3 occurrences

docs/public/trailer.mp4

3 blobs over 5MB: trailer.mp4 10.6MB, wanderer_lists.gif 6.6MB, wanderer_lists_edit.png 6.5MB

One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.

Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.

Add a non-root USER to the imagemedium

db/Dockerfile

CMD or ENTRYPOINT with no USER directive

A process running as root in the container is root against every mounted volume, and it turns any container escape or writable-mount mistake from a contained problem into a host one.

Fix: Create an unprivileged user, chown what it needs, and end the Dockerfile with USER.

Expand the test suite; it cannot cover this codebasemedium8 occurrences

8 test files against 590 source files (ratio 0.014)

A reviewer reads "has tests" and assumes a safety net that covers two files out of eighty-five, which is how untested paths ship behind a green badge.

Fix: Add tests for the highest fan-in modules first.

Set timeout-minutes on the workflow jobslow4 occurrences

.github/workflows/go.yml

4 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.