Move the load-test origin's logic into internal/loadtestorigin

REPO_POLICIES.md requires cmd/ to be thin: one main.go whose body is a single call into internal/ or pkg/. The image, the handler, the server and their test move unchanged into internal/loadtestorigin, whose Run does what main did; cmd/loadtest-origin/main.go only calls it. Model: opus-5-5
Add script/loadtest to measure throughput, latency and memory (closes #81 )
2026-10-04 22:22:57 +00:00 · 2026-10-04 22:22:57 +00:00 · 2026-10-04 22:22:38 +00:00 · 2026-10-05 00:07:37 +02:00
2 changed files with 71 additions and 9 deletions
@@ -1,12 +1,68 @@
-# .git is sent without its config. Without a VERSION build argument the
-# stage that compiles runs `git describe --tags --always` on .git, which
-# does not need .git/config; that file can hold a credential, such as a
+# .dockerignore does NOT use .gitignore semantics. Docker matches with
+# moby/patternmatcher: filepath.Match plus `**`, so `*` does not cross
+# `/` and an unprefixed pattern is anchored at the context root. Every
+# depth-independent pattern therefore needs `**/`, or `config/.env` and
+# `certs/server.key` still ship while this file reads as solved. Only
+# genuinely root-anchored entries go unprefixed. Never transplant these
+# into .gitignore, where `**/` is wrong.
+#
+# Matching is case-sensitive, so secrets use character ranges rather
+# than an ALL-CAPS twin, which would still miss `Server.Key`.
+#
+# Extend with this repo's own host-built artifacts, written anchored:
+# `/myapp`, never `**/myapp`, which also matches `cmd/myapp/` and
+# deletes the package directory from the context.
+
+# Unlike the standard file, which leaves out all of .git, pixa sends
+# .git without its config. Without a VERSION build argument the stage
+# that compiles runs `git describe --tags --always` on .git, which does
+# not need .git/config; that file can hold a credential, such as a
 # password in a remote URL or the token the CI checkout step stores there.
 .git/config
-.gitignore
-.DS_Store
-.env*
+
+# Agent scratch: one full checkout of the repo per in-flight agent.
+# Anchored because it occurs once where agents run at the repo root.
+# KNOWN GAP: a repo running agents in subdirectories still ships
+# `services/api/.claude/` and must add its own anchored entry.
 .claude
-node_modules
-bin/
-data/
+
+# Environment files. `*.env` covers bare `.env` and the `prod.env`
+# convention. Re-include a committed template with a negation if the
+# build needs one: `!docs/example.env`.
+**/*.[eE][nN][vV]
+**/.[eE][nN][vV].*
+**/.[eE][nN][vV][rR][cC]
+
+# Private keys and the bundles carrying them. Public certificates
+# (*.crt, *.cer) are deliberately absent: they are legitimate inputs.
+**/*.[pP][eE][mM]
+**/*.[kK][eE][yY]
+**/*.[pP]12
+**/*.[pP][fF][xX]
+**/[iI][dD]_[rR][sS][aA]
+**/[iI][dD]_[dD][sS][aA]
+**/[iI][dD]_[eE][cC][dD][sS][aA]
+**/[iI][dD]_[eE][dD]25519
+
+# Dependencies: restored inside the image, never copied in.
+**/node_modules
+
+# OS metadata.
+**/.DS_Store
+**/Thumbs.db
+
+# Editor state: never a build input, and it churns COPY.
+**/*.swp
+**/*.swo
+**/*~
+**/*.bak
+**/.idea
+**/.vscode
+**/*.sublime-*
+
+# pixa's own entries. Nothing in the build reads .gitignore. On the
+# host, `make build` writes bin/pixad, and the example config keeps its
+# state directory in data/.
+.gitignore
+/bin
+/data
@@ -46,6 +46,12 @@ P2: security: per-IP rate limiting on the image routes
  not pixad's limit); `miss` 70 r/s, p50 52 ms, p95 91 ms, p99 122 ms, peak 100
  MiB, one fetch per request; `herd` 74 r/s, p50 52 ms, p95 69 ms, p99 111 ms,
  peak 60 MiB, 188 fetches for 749 requests.
+- 2026-10-04 `.dockerignore` keeps secrets out at every depth (closes #205): the
+  file is now the standard one from `sneak/prompts`, whose patterns match in
+  every directory and, for environment files and private keys, in any letter
+  case, so a nested `.env` or `server.key` no longer reaches the build context.
+  pixa still sends `.git` without `.git/config` in place of the standard file's
+  `.git` line, and still leaves out `.gitignore`, `/bin` and `/data`.
 - 2026-10-04 `REPO_POLICIES.md` matches the canonical copy again (closes #196):
  it is replaced, unchanged, by `prompts/REPO_POLICIES.md` from `sneak/prompts`
  `main`. The rules it adds that pixa's tree breaks are filed:
Author	SHA1	Message	Date
clawbot	e6ac8c1ef5	Move the load-test origin's logic into internal/loadtestorigin check / check (push) Failing after 1s Details REPO_POLICIES.md requires cmd/ to be thin: one main.go whose body is a single call into internal/ or pkg/. The image, the handler, the server and their test move unchanged into internal/loadtestorigin, whose Run does what main did; cmd/loadtest-origin/main.go only calls it. Model: opus-5-5	2026-10-04 22:22:57 +00:00
clawbot	3969146a7f	Add script/loadtest to measure throughput, latency and memory (closes #81 ) script/loadtest [duration [clients]], or make loadtest, is a benchmark that script/check does not run. It builds the image and vegeta from a pinned commit, then for each scenario starts a new pixad container and a new cmd/loadtest-origin container, an upstream host that answers every path with one generated JPEG: a cached image (hit), a new source image per request (miss), and each new source image asked for by all clients at once (herd). It prints vegeta's report, pixad's peak resident memory and the requests the origin got. The containers share a network in 203.0.113.0/24, as pixad refuses private and local upstream addresses. README.md says how to run and read it; TODO.md records a small baseline. Model: opus-5-5	2026-10-04 22:22:57 +00:00
clawbot	0a78165b67	Test that the load-test origin serves one JPEG at every path script/loadtest, added in the next commit, needs an upstream host that answers any path with the same image, so each new path is a new source image for pixad to fetch. This test checks that the origin's handler answers several paths with 200, Content-Type image/jpeg and the same bytes, and that the image decodes as a JPEG of the expected size. It does not build until the origin exists. Model: opus-5-5	2026-10-04 22:22:38 +00:00
clawbot	ef828f71a5	Keep secrets out of the Docker build context at every depth (closes #205 ) check / check (push) Failing after 2s Details .dockerignore patterns without a leading / match only at the root of the build context, so a nested .env or private key still reached it and, through COPY . ., a build-stage layer. The file is now the standard one from sneak/prompts: every pattern that should match anywhere has /, and private keys and environment files are matched in any letter case. pixa keeps its own differences: .git is still sent without .git/config in place of the standard .git line, which the version stamp needs, and .gitignore, /bin and /data stay out. Model: opus-5-5	2026-10-05 00:07:37 +02:00