6 Commits

Include renames

Author	SHA1	Message	Date
clawbot	e1737f497c	Add failing tests for host entries that can never match ... A `*.` entry, an entry with a port and one with two leading dots must abort startup for referer_blocklist, and the first two for allowlist_hosts; IPv4 and IPv6 address entries must still load. Model: opus-5-5	2026-10-04 19:08:30 +00:00
clawbot	625fd42ace	Wait on a busy SQLite database and turn on WAL mode (closes #198) ... Requests and the eviction pass write on separate connections, and with no busy timeout a write that met another one failed at once with "database is locked" and was lost. internal/database now adds _pragma=busy_timeout(5000) to every db_url, the default or one the operator sets, so such a write waits up to five seconds. The default db_url's _journal_mode=WAL is not a parameter the driver reads, so it is now _pragma=journal_mode(WAL). README.md and config.example.yml say what pixa adds to db_url. Model: opus-5-5	2026-10-04 20:58:37 +02:00
clawbot	48f21d4ecf	Abort startup on a config file pixa cannot read (closes #176) ... Of the places pixa looks for its config file on its own, it passed over any place where os.Stat failed, so a file in a directory pixa may not enter was skipped without a word and pixa started on a later file or on the environment and defaults. Now only a path that does not exist, or that runs through a file (such as under a HOME of /dev/null), is passed over; any other error aborts startup naming the file, as a file that does not parse already did. README.md says so where it gives the search order. A config.yml that links to itself tests this as root too. Model: opus-5-5	2026-10-04 18:24:43 +02:00
clawbot	56217cbf4a	Add the four settings the README documented but pixa lacked (closes #61) ... README.md documented access_control_allow_origin, upstream_fetch_timeout, upstream_max_response_size and downstream_timeout, but pixa did not know them, so a config following the README aborted startup. Each is now a setting with its PIXA_ variable, defaulting to the value that was fixed in the code: *, 30s, 50 MiB and 60s. Durations are Go duration strings and must be positive; the size is whole bytes, at most 1 GiB. The origin is * or one http or https origin written exactly as a browser sends it; anything else aborts startup. downstream_timeout sets both the server's write timeout and the per-request timeout. The owner approved the edits to existing tests. Model: opus-5-5	2026-09-29 08:49:18 +02:00
clawbot	1798cba96c	Take the image signing key from PIXA_SIGNING_KEY and refuse the example placeholder (closes #110) ... The Docker image now ships config.docker.yml, which sets only signing_key (read from the PIXA_SIGNING_KEY environment variable), state_dir and port. The placeholder key and the five-host allowlist from config.example.yml are no longer in the image; anything else is configured by mounting a file over /etc/pixa/config.yml. A container started without PIXA_SIGNING_KEY exits naming it. Startup now refuses the exact placeholder signing_key from config.example.yml. It is 45 characters long and used to pass the length check, so a deployment could sign URLs with a key that is public in this repository. README Getting Started is corrected to match. What a reader would trip over: the unset-variable error comes from config interpolation, not from validate(); the signing key checks moved into validateSigningKey to stay under the complexity limit. Disclosure: TODO.md is not updated by this change. Model: opus-4-8 (implementation, review); fable-5-1 (landing message)	2026-09-21 21:59:24 +02:00
clawbot	04b5db6fbf	next -&gt; main (1.0.0 milestone) (#105) ... Accumulating milestone branch. One squashed commit per closed issue; `next` is kept green and mergeable to `main` at any time without notice. Landed so far: - `chore: update golangci-lint to v2.12.2 with canonical config` (#54) — canonical v2-schema `.golangci.yml`, pins bumped in `Dockerfile` and `script/bootstrap`, tree at `0 issues.`. Three behaviour deltas are recorded in that PR's body: `Cache.StoreVariant` takes a context, `MetadataStorage.Store` no longer leaks temp files on failure, and the `signing_key` too-short error text gained a `value too short:` prefix. Sequencing for the milestone is tracked in #103. Reviewed-on: #105 Co-authored-by: clawbot <clawbot@noreply.example.org>	2026-09-21 09:31:54 +02:00