4 Commits

Include renames

Author	SHA1	Message	Date
sneak	11946cb653	Allowlist no host in the example config (closes #249) ... configs/config.example.yml allowlisted github.com and user-images.githubusercontent.com, where anyone can put an image, so a deployment set up as Getting Started says served those images to anyone without a signature. The example now leaves allowlist_hosts out, with one commented entry under example.com. Getting Started and "Running under upaas" in README.md say that every image on an allowlisted host is served without a signature, so an allowlisted host must be one the operator controls. Model: opus-5-5	2026-10-15 02:43:40 +00:00
clawbot	40ad39843b	Limit each client's requests to the image routes (closes #236) ... The new setting image_requests_per_minute (PIXA_IMAGE_REQUESTS_PER_MINUTE), default 600, caps the GET and HEAD requests one client sends to /v1/image/ and /v1/e/ per minute; the next is answered 429 with Retry-After and the image routes' JSON error body. It uses the login limit's RateLimit middleware, so clients are told apart the same way, behind the CORS middleware, so a preflight is not counted. 0 turns it off, as script/loadtest does; a negative or non-integer value stops startup. TestEnvironmentSetsEveryKey gains the new variable, under the standing approval in #64. To stay within the linters' limits, the sentry_dsn check moves unchanged into validateSentryDSN, and the cache_max_bytes explicit flag is set in one line. Model: opus-5-5	2026-10-13 01:36:18 +02:00
clawbot	8314099abd	Refuse image requests whose Referer is on referer_blocklist (closes #90) ... A new setting, referer_blocklist (PIXA_REFERER_BLOCKLIST), lists hosts whose pages may not show pixa's images. Entries are written and matched as allowlist_hosts are, with the same matcher. Both image routes check the Referer before the signature, the cache and the upstream fetch, and answer 403 with the JSON error, so a blocked request costs nothing and is refused whether or not the image is cached. No Referer, or one that does not parse, is served; README.md says this makes the list easy to get around. An entry of either host list that is not a host name (letters, digits, hyphens, underscores, dots, at most one leading dot) or an IP address now aborts startup naming the setting and the entry. Model: opus-5-5	2026-10-04 22:24:50 +02:00
clawbot	8568c17d1b	Move the example config to configs/, delete scripts/ and CONVENTIONS.md (closes #97) ... config.example.yml moves unchanged to configs/config.example.yml, the directory REPO_POLICIES.md names for configuration examples. README.md, the comments in internal/config/config.go and the startup error for the placeholder signing key name the new path. scripts/manual-test.sh and its directory are deleted. The handler tests in internal/handlers cover every check it made except two: fetching a real image from the internet, and a URL made on the generator page with a ttl answering 410 once the ttl has passed (#199). CONVENTIONS.md, a reformatted copy of the Go HTTP server conventions, is deleted, as REPO_POLICIES.md links the canonical document. Model: opus-5-5	2026-10-04 21:07:52 +02:00