5 Commits

Include renames

Author	SHA1	Message	Date
clawbot	11d0393704	Test that concurrent SQLite writes succeed and the default db_url uses WAL ... Adds two tests that fail before the fix. One opens the database the way pixad does and makes writes like one request's and the eviction pass's from several goroutines at once; on separate connections with no busy timeout, some fail with "database is locked". The other opens the db_url derived from state_dir and checks the database is in WAL mode, which the current default's _journal_mode=WAL does not do because the driver ignores that parameter. The expected default db_url in TestOmittedValuesUseDefaults changes to the new one. Model: opus-5-5	2026-10-04 18:30:17 +00:00
clawbot	48f21d4ecf	Abort startup on a config file pixa cannot read (closes #176) ... Of the places pixa looks for its config file on its own, it passed over any place where os.Stat failed, so a file in a directory pixa may not enter was skipped without a word and pixa started on a later file or on the environment and defaults. Now only a path that does not exist, or that runs through a file (such as under a HOME of /dev/null), is passed over; any other error aborts startup naming the file, as a file that does not parse already did. README.md says so where it gives the search order. A config.yml that links to itself tests this as root too. Model: opus-5-5	2026-10-04 18:24:43 +02:00
clawbot	56217cbf4a	Add the four settings the README documented but pixa lacked (closes #61) ... README.md documented access_control_allow_origin, upstream_fetch_timeout, upstream_max_response_size and downstream_timeout, but pixa did not know them, so a config following the README aborted startup. Each is now a setting with its PIXA_ variable, defaulting to the value that was fixed in the code: *, 30s, 50 MiB and 60s. Durations are Go duration strings and must be positive; the size is whole bytes, at most 1 GiB. The origin is * or one http or https origin written exactly as a browser sends it; anything else aborts startup. downstream_timeout sets both the server's write timeout and the per-request timeout. The owner approved the edits to existing tests. Model: opus-5-5	2026-09-29 08:49:18 +02:00
clawbot	1798cba96c	Take the image signing key from PIXA_SIGNING_KEY and refuse the example placeholder (closes #110) ... The Docker image now ships config.docker.yml, which sets only signing_key (read from the PIXA_SIGNING_KEY environment variable), state_dir and port. The placeholder key and the five-host allowlist from config.example.yml are no longer in the image; anything else is configured by mounting a file over /etc/pixa/config.yml. A container started without PIXA_SIGNING_KEY exits naming it. Startup now refuses the exact placeholder signing_key from config.example.yml. It is 45 characters long and used to pass the length check, so a deployment could sign URLs with a key that is public in this repository. README Getting Started is corrected to match. What a reader would trip over: the unset-variable error comes from config interpolation, not from validate(); the signing key checks moved into validateSigningKey to stay under the complexity limit. Disclosure: TODO.md is not updated by this change. Model: opus-4-8 (implementation, review); fable-5-1 (landing message)	2026-09-21 21:59:24 +02:00
clawbot	04b5db6fbf	next -&gt; main (1.0.0 milestone) (#105) ... Accumulating milestone branch. One squashed commit per closed issue; `next` is kept green and mergeable to `main` at any time without notice. Landed so far: - `chore: update golangci-lint to v2.12.2 with canonical config` (#54) — canonical v2-schema `.golangci.yml`, pins bumped in `Dockerfile` and `script/bootstrap`, tree at `0 issues.`. Three behaviour deltas are recorded in that PR's body: `Cache.StoreVariant` takes a context, `MetadataStorage.Store` no longer leaks temp files on failure, and the `signing_key` too-short error text gained a `value too short:` prefix. Sequencing for the milestone is tracked in #103. Reviewed-on: #105 Co-authored-by: clawbot <clawbot@noreply.example.org>	2026-09-21 09:31:54 +02:00