feat: blocked_networks config and extended SSRF ranges (closes #67)

Adds the blocked_networks config key: a list of CIDRs, parsed with net/netip, that is added to the built-in list of address ranges the fetcher refuses to contact and can never remove an entry from it. An invalid CIDR aborts startup naming the key and the value.

The built-in list gains CGNAT 100.64.0.0/10, IETF protocol assignments 192.0.0.0/24, benchmark 198.18.0.0/15 and NAT64 64:ff9b::/96. Resolved addresses are unmapped before matching, so IPv4-mapped IPv6 forms are caught too. Enforcement stays in the dial-time re-resolution, which is what closes the DNS rebinding window.

What a reader would trip over: 192.0.0.0/24 is now blocked but TEST-NET-1 (192.0.2.0/24), which the Fetch tests use as a public upstream, is a different range and stays dialable. The package-level dialer enforces the built-in ranges only; operator entries are applied by the fetcher.

Disclosure: one nolint:gochecknoglobals on the immutable built-in prefix list.

Model: opus-4-8 (implementation, review); fable-5-1 (landing message)

Dockerfile

@@ -67,8 +67,9 @@ RUN adduser -D -H -s /sbin/nologin pixad && \
     mkdir -p /var/lib/pixa /etc/pixa && \
     chown pixad:pixad /var/lib/pixa
 
-# Copy default config (edit signing_key before use)
-COPY config.example.yml /etc/pixa/config.yml
+# Copy the image config; signing_key comes from PIXA_SIGNING_KEY.
+# Mount a file over /etc/pixa/config.yml to override anything else.
+COPY config.docker.yml /etc/pixa/config.yml
 
 USER pixad
 WORKDIR /var/lib/pixa

README.md

@@ -15,14 +15,25 @@ git clone https://git.eeqj.de/sneak/pixa.git
 cd pixa
 make build
 
-# run with a config file
-./bin/pixad --config config.example.yml
+# run with a config file: copy the example and set a real signing key
+# (the example placeholder is refused at startup), e.g. with
+# openssl rand -base64 32
+cp config.example.yml config.yml
+$EDITOR config.yml   # replace the signing_key placeholder
+./bin/pixad --config config.yml
 
 # or build and run via Docker
 make docker
-docker run -p 8080:8080 pixad:latest
+docker run -p 8080:8080 -e PIXA_SIGNING_KEY="$(openssl rand -base64 32)" pixa:latest
 ```
 
+A container is configured two ways. The signing key comes from the
+`PIXA_SIGNING_KEY` environment variable, which the baked-in config
+reads; if it is unset the container exits at startup naming the
+variable. Everything else uses built-in defaults, so to change any
+other setting mount your own file over `/etc/pixa/config.yml` (see
+`config.example.yml` for the full set of keys).
+
 ## Rationale
 
 Image-heavy web applications need a fast, caching reverse proxy that

config.docker.yml

@@ -0,0 +1,11 @@
+# Pixa configuration baked into the Docker image.
+#
+# The signing key is read from the PIXA_SIGNING_KEY environment
+# variable; startup aborts naming it when it is unset. Every other key
+# is omitted so its default applies. Operators who need more (an
+# allowlist, metrics, and so on) mount their own file over
+# /etc/pixa/config.yml.
+
+signing_key: "${ENV:PIXA_SIGNING_KEY}"
+state_dir: /var/lib/pixa
+port: 8080

internal/config/config.go

@@ -46,6 +46,12 @@ const (
 	keyBlockedNetworks            = "blocked_networks"
 )
 
+// placeholderSigningKey is the dummy signing_key shipped in
+// config.example.yml. It is 45 characters, so it passes the length
+// check, but it is public in this repository and must be rejected at
+// startup so no deployment ever signs URLs with it.
+const placeholderSigningKey = "CHANGE_ME_generate_with_openssl_rand_base64_32"
+
 // Static validation errors. Each use site attaches the offending key
 // and value by wrapping these with fmt.Errorf and %w.
 var (
@@ -64,6 +70,9 @@ var (
 	errPortOutOfRange    = errors.New("outside the valid port range")
 	errTooFewConnections = errors.New("must be at least 1")
 	errValueTooShort     = errors.New("value too short")
+	errPlaceholderKey    = errors.New(
+		"is the placeholder from config.example.yml; " +
+			"generate a real key with: openssl rand -base64 32")
 	errMustBeSetTogether = errors.New("must be set together")
 	errMustNotBeNegative = errors.New("must not be negative")
 	errOverflowsInt64    = errors.New("overflows a 64-bit integer")
@@ -355,10 +364,10 @@ func (c *Config) ensureStateDirWritable() error {
 	return nil
 }
 
-// validate checks that all required configuration values are set and
-// that every value is within its valid range.
-func (c *Config) validate() error {
-	// The signing key value is never echoed in error messages.
+// validateSigningKey checks that the signing key is present, long
+// enough, and not the public placeholder from config.example.yml. The
+// key value itself is never echoed in error messages.
+func (c *Config) validateSigningKey() error {
 	if c.SigningKey == "" {
 		return fmt.Errorf("config key %q: %w", keySigningKey, errValueRequired)
 	}
@@ -370,6 +379,21 @@ func (c *Config) validate() error {
 			keySigningKey, errValueTooShort, minKeyLength, len(c.SigningKey))
 	}
 
+	if c.SigningKey == placeholderSigningKey {
+		return fmt.Errorf("config key %q: %w", keySigningKey, errPlaceholderKey)
+	}
+
+	return nil
+}
+
+// validate checks that all required configuration values are set and
+// that every value is within its valid range.
+func (c *Config) validate() error {
+	err := c.validateSigningKey()
+	if err != nil {
+		return err
+	}
+
 	const maxPort = 65535
 	if c.Port < 1 || c.Port > maxPort {
 		return fmt.Errorf("config key %q: value %d is %w 1-%d",

internal/config/config_validation_internal_test.go

@@ -303,6 +303,11 @@ func invalidHostAndCredentialCases() []abortCase {
 			yaml:              "signing_key: short\n",
 			wantErrSubstrings: []string{keySigningKey},
 		},
+		{
+			name:              "signing_key is the documented placeholder",
+			yaml:              "signing_key: " + placeholderSigningKey + "\n",
+			wantErrSubstrings: []string{keySigningKey},
+		},
 		{
 			name:              "signing_key missing",
 			yaml:              "port: 8080\n",