5 Commits

Include renames

Author	SHA1	Message	Date
clawbot	52db3cf0c5	Test a config file that links to itself and a HOME that is a file ... The test for a directory pixa may not enter is skipped as root, where the gate runs the tests. A config.yml in the working directory that is a symbolic link to itself fails os.Stat as root too, and must abort startup. A config path that runs through a file, such as one under a HOME of /dev/null, cannot hold a file and must be passed over like one that does not exist; today it aborts startup. Model: opus-5-5	2026-10-04 15:59:19 +00:00
clawbot	9cddc4447e	Test that a config file pixa may not read aborts startup ... Of the places pixa looks for its config file on its own, a file in a directory pixa may not enter is passed over today and pixa starts without it. This test puts the config file in such a directory and expects startup to abort with an error naming the file. It is skipped when run as root, which may enter any directory. Model: opus-5-5	2026-10-04 15:59:19 +00:00
clawbot	56217cbf4a	Add the four settings the README documented but pixa lacked (closes #61) ... README.md documented access_control_allow_origin, upstream_fetch_timeout, upstream_max_response_size and downstream_timeout, but pixa did not know them, so a config following the README aborted startup. Each is now a setting with its PIXA_ variable, defaulting to the value that was fixed in the code: *, 30s, 50 MiB and 60s. Durations are Go duration strings and must be positive; the size is whole bytes, at most 1 GiB. The origin is * or one http or https origin written exactly as a browser sends it; anything else aborts startup. downstream_timeout sets both the server's write timeout and the per-request timeout. The owner approved the edits to existing tests. Model: opus-5-5	2026-09-29 08:49:18 +02:00
clawbot	1798cba96c	Take the image signing key from PIXA_SIGNING_KEY and refuse the example placeholder (closes #110) ... The Docker image now ships config.docker.yml, which sets only signing_key (read from the PIXA_SIGNING_KEY environment variable), state_dir and port. The placeholder key and the five-host allowlist from config.example.yml are no longer in the image; anything else is configured by mounting a file over /etc/pixa/config.yml. A container started without PIXA_SIGNING_KEY exits naming it. Startup now refuses the exact placeholder signing_key from config.example.yml. It is 45 characters long and used to pass the length check, so a deployment could sign URLs with a key that is public in this repository. README Getting Started is corrected to match. What a reader would trip over: the unset-variable error comes from config interpolation, not from validate(); the signing key checks moved into validateSigningKey to stay under the complexity limit. Disclosure: TODO.md is not updated by this change. Model: opus-4-8 (implementation, review); fable-5-1 (landing message)	2026-09-21 21:59:24 +02:00
clawbot	04b5db6fbf	next -&gt; main (1.0.0 milestone) (#105) ... Accumulating milestone branch. One squashed commit per closed issue; `next` is kept green and mergeable to `main` at any time without notice. Landed so far: - `chore: update golangci-lint to v2.12.2 with canonical config` (#54) — canonical v2-schema `.golangci.yml`, pins bumped in `Dockerfile` and `script/bootstrap`, tree at `0 issues.`. Three behaviour deltas are recorded in that PR's body: `Cache.StoreVariant` takes a context, `MetadataStorage.Store` no longer leaks temp files on failure, and the `signing_key` too-short error text gained a `value too short:` prefix. Sequencing for the milestone is tracked in #103. Reviewed-on: #105 Co-authored-by: clawbot <clawbot@noreply.example.org>	2026-09-21 09:31:54 +02:00