4 Commits

Include renames

Author	SHA1	Message	Date
clawbot	ad0714801c	Limit each client's requests to the image routes (closes #236) ... The new setting image_requests_per_minute (PIXA_IMAGE_REQUESTS_PER_MINUTE), default 600, caps the GET and HEAD requests one client sends to /v1/image/ and /v1/e/ per minute; the next is answered 429 with Retry-After. It uses the login limit's RateLimit middleware, so clients are told apart the same way, and sits in the image routes' group behind the CORS middleware, so a preflight is not counted. 0 turns it off; a negative or non-integer value stops startup. TestEnvironmentSetsEveryKey gains the new variable, under the owner's standing approval in #64. To stay within the linters' limits, the sentry_dsn check moves unchanged into validateSentryDSN, and the cache_max_bytes explicit flag is set in one line. Model: opus-5-5	2026-10-12 09:14:44 +00:00
clawbot	8314099abd	Refuse image requests whose Referer is on referer_blocklist (closes #90) ... A new setting, referer_blocklist (PIXA_REFERER_BLOCKLIST), lists hosts whose pages may not show pixa's images. Entries are written and matched as allowlist_hosts are, with the same matcher. Both image routes check the Referer before the signature, the cache and the upstream fetch, and answer 403 with the JSON error, so a blocked request costs nothing and is refused whether or not the image is cached. No Referer, or one that does not parse, is served; README.md says this makes the list easy to get around. An entry of either host list that is not a host name (letters, digits, hyphens, underscores, dots, at most one leading dot) or an IP address now aborts startup naming the setting and the entry. Model: opus-5-5	2026-10-04 22:24:50 +02:00
clawbot	8568c17d1b	Move the example config to configs/, delete scripts/ and CONVENTIONS.md (closes #97) ... config.example.yml moves unchanged to configs/config.example.yml, the directory REPO_POLICIES.md names for configuration examples. README.md, the comments in internal/config/config.go and the startup error for the placeholder signing key name the new path. scripts/manual-test.sh and its directory are deleted. The handler tests in internal/handlers cover every check it made except two: fetching a real image from the internet, and a URL made on the generator page with a ttl answering 410 once the ttl has passed (#199). CONVENTIONS.md, a reformatted copy of the Go HTTP server conventions, is deleted, as REPO_POLICIES.md links the canonical document. Model: opus-5-5	2026-10-04 21:07:52 +02:00
clawbot	be6c715b36	Write the deployment guide and an example Caddy config (closes #89) ... README.md gains a "Deployment" section: what the reverse proxy in front of pixa must do (terminate TLS, pass Host, Origin and Referer on unchanged, set X-Forwarded-For with trusted_proxies to match, wait at least downstream_timeout, optionally refuse /metrics) and what pixa does itself; that the state directory needs a persistent volume, what cache_max_bytes counts and why to set it; the health check for a load balancer; what SIGTERM does and the exit codes; and what running outside Docker needs. configs/Caddyfile is the example, as Caddy needs no settings beyond the host name and pixa's address. Model: opus-5-5	2026-10-04 15:08:03 +02:00