Update TODO.md

.dockerignore

@@ -6,4 +6,3 @@
 node_modules
 bin/
 data/
-deploy/

Dockerfile

@@ -1,29 +1,7 @@
-# Lint stage
-# golangci/golangci-lint:v2.10.1-alpine, 2026-02-17
-FROM golangci/golangci-lint:v2.10.1-alpine@sha256:33bc6b6156d4c7da87175f187090019769903d04dd408833b83083ed214b0ddf AS lint
-
-RUN apk add --no-cache make build-base vips-dev libheif-dev pkgconfig
-
-WORKDIR /src
-
-# Copy go mod files first for better layer caching
-COPY go.mod go.sum ./
-RUN go mod download
-
-# Copy source code
-COPY . .
-
-# Run formatting check and linter
-RUN make fmt-check
-RUN make lint
-
 # Build stage
 # golang:1.25.4-alpine, 2026-02-25
 FROM golang:1.25.4-alpine@sha256:d3f0cf7723f3429e3f9ed846243970b20a2de7bae6a5b66fc5914e228d831bbb AS builder
 
-# Depend on lint stage passing
-COPY --from=lint /src/go.sum /dev/null
-
 ARG VERSION=dev
 
 # Install build dependencies for CGO image libraries
@@ -31,7 +9,25 @@ RUN apk add --no-cache \
     build-base \
     vips-dev \
     libheif-dev \
-    pkgconfig
+    pkgconfig \
+    curl
+
+# golangci-lint v2.10.1, 2026-02-25
+# SHA-256 checksums per architecture (amd64 / arm64)
+RUN set -e; \
+    ARCH="$(uname -m)"; \
+    if [ "$ARCH" = "aarch64" ] || [ "$ARCH" = "arm64" ]; then \
+      GOARCH="arm64"; \
+      HASH="6652b42ae02915eb2f9cb2a2e0cac99514c8eded8388d88ae3e06e1a52c00de8"; \
+    else \
+      GOARCH="amd64"; \
+      HASH="dfa775874cf0561b404a02a8f4481fc69b28091da95aa697259820d429b09c99"; \
+    fi; \
+    curl -sSfL "https://github.com/golangci/golangci-lint/releases/download/v2.10.1/golangci-lint-2.10.1-linux-${GOARCH}.tar.gz" -o /tmp/golangci-lint.tar.gz && \
+    echo "${HASH}  /tmp/golangci-lint.tar.gz" | sha256sum -c - && \
+    tar -xzf /tmp/golangci-lint.tar.gz -C /tmp && \
+    mv "/tmp/golangci-lint-2.10.1-linux-${GOARCH}/golangci-lint" /usr/local/bin/ && \
+    rm -rf /tmp/golangci-lint*
 
 WORKDIR /src
 
@@ -42,8 +38,8 @@ RUN GOTOOLCHAIN=auto go mod download
 # Copy source code
 COPY . .
 
-# Run tests
+# Run all checks (fmt-check, lint, test)
-RUN make test
+RUN make check
 
 # Build with CGO enabled
 RUN CGO_ENABLED=1 GOTOOLCHAIN=auto go build -ldflags "-X main.Version=${VERSION}" -o /pixad ./cmd/pixad
@@ -75,7 +71,4 @@ WORKDIR /var/lib/pixa
 
 EXPOSE 8080
 
-HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
-    CMD wget -q --spider http://localhost:8080/.well-known/healthcheck.json
-
 ENTRYPOINT ["/usr/local/bin/pixad", "--config", "/etc/pixa/config.yml"]

README.md

@@ -125,17 +125,6 @@ See `config.example.yml` for all options with defaults.
 - **Metrics**: Prometheus
 - **Logging**: stdlib slog
 
-## Deployment
-
-Pixa is deployed via
-[µPaaS](https://git.eeqj.de/sneak/upaas) on `fsn1app1`
-(paas.datavi.be). Pushes to `main` trigger automatic builds and
-deployments. The Dockerfile includes a `HEALTHCHECK` that probes
-`/.well-known/healthcheck.json`.
-
-See [deploy/README.md](deploy/README.md) for the full µPaaS app
-configuration, volume mounts, and production setup instructions.
-
 ## TODO
 
 See [TODO.md](TODO.md) for the full prioritized task list.

TODO.md

@@ -1,65 +1,64 @@
-# Pixa 1.0 TODO
+# Status
 
-Remaining tasks sorted by priority for a working 1.0 release.
+pre-1.0. No git tags. Full policy file set is present, but make check
+fails on main with 10 gosec lint findings, so main is not green.
 
-## P0: Critical for 1.0
+# Next Step
 
-### Image Processing
+Fix the 10 gosec findings so make check passes on main. Fix each issue
-- [x] Add WebP encoding support (currently returns error)
+properly (no blanket nolint suppressions) and confirm lint, tests, and
-- [x] Add AVIF encoding support (implemented via govips)
+CI are green. This restores the main-always-green policy.
 
-### Manual Testing (verify auth/encrypted URLs work)
+# Completed Steps
-- [ ] Manual test: visit `/`, see login form
-- [ ] Manual test: enter wrong key, see error
-- [ ] Manual test: enter correct signing key, see generator form
-- [ ] Manual test: generate encrypted URL, verify it works
-- [ ] Manual test: wait for expiration or use short TTL, verify expired URL returns 410
-- [ ] Manual test: logout, verify redirected to login
 
-### Cache Management
+- 2026-02-25: Docker arm64 build fixed via architecture detection for
-- [ ] Implement cache size management/eviction (prevent disk from filling up)
+  golangci-lint download (#16)
+- 2026-02-25: full repo policy compliance pass (#14): LICENSE,
+  REPO_POLICIES.md, .editorconfig, Gitea Actions CI workflow, Docker
+  images pinned by hash, README restructured to policy sections, hooks
+  Makefile target, golangci-lint errors resolved
+- 2026-02-20: stale local dev config files removed (#12)
+- 2026-02-09: correctness fixes: negative cache checked in Service.Get()
+  before upstream fetch (#8); Stats() column scanning and HitRate
+  computation corrected (#9)
+- 2026-02-08: AllowHTTP propagated to SourceURL() scheme selection (#6)
+- WebP encoding support added (P0 item, checked off in TODO)
+- 2026-01-08: initial implementation with Makefile and TODO checklist
 
-### Configuration
+# Future Steps
-- [ ] Validate configuration on startup (fail fast on bad config)
 
-## P1: Important for Production
+Compliance:
 
-### Security
+- After the gosec fix lands, verify CI runs make check green on main
-- [ ] Implement blocked networks configuration (extend SSRF protection)
-- [ ] Add rate limiting global concurrent fetches (prevent resource exhaustion)
 
-### Image Processing
+P0, critical for 1.0 (from existing TODO.md):
-- [ ] Implement EXIF/metadata stripping (privacy)
 
-## P2: Nice to Have
+- Add AVIF encoding support (currently returns error)
+- Manual test pass for auth and encrypted URLs:
+    - visit /, see login form
+    - wrong key shows error; correct signing key shows generator form
+    - generated encrypted URL works
+    - expired URL (short TTL) returns 410
+    - logout redirects to login
+- Implement cache size management and eviction (prevent disk fill)
+- Validate configuration on startup (fail fast on bad config)
 
-### Security
+P1, important for production:
-- [ ] Implement referer blacklist
-- [ ] Add rate limiting per-IP
-- [ ] Add rate limiting per-origin
 
-### HTTP Response Handling
+- Blocked networks configuration (extend SSRF protection)
-- [ ] Implement Last-Modified headers
+- Rate limit global concurrent fetches (resource exhaustion)
-- [ ] Implement Vary header for content negotiation
+- EXIF/metadata stripping (privacy)
-- [ ] Implement X-Request-ID propagation
 
-### Additional Endpoints
+P2, nice to have:
-- [ ] Implement auto-format selection (format=auto based on Accept header)
 
-### Configuration
+- Referer blacklist; per-IP and per-origin rate limiting
-- [ ] Add all configuration options from README
+- Last-Modified headers; Vary header; X-Request-ID propagation
-- [ ] Implement environment variable overrides
+- Auto-format selection (format=auto based on Accept header)
-- [ ] Implement YAML config file support
+- All configuration options from README; env var overrides; YAML config
-
+  file support
-### Operational
+- Sentry error reporting (optional); comprehensive request logging;
-- [ ] Implement Sentry error reporting (optional)
+  Prometheus metrics
-- [ ] Add comprehensive request logging
+- Integration tests for the image proxy flow; load tests for the
-- [ ] Add performance metrics (Prometheus)
+  1-5k req/s target
-- [ ] Write integration tests for image proxy flow
+- Docs: configuration options, API endpoints, deployment guide, example
-- [ ] Write load tests to verify 1-5k req/s target
+  nginx/caddy reverse proxy config
-
-### Documentation
-- [ ] Document configuration options
-- [ ] Document API endpoints
-- [ ] Document deployment guide
-- [ ] Add example nginx/caddy reverse proxy config

deploy/README.md

@@ -1,78 +0,0 @@
-# Pixa Deployment via µPaaS
-
-Pixa is deployed on `fsn1app1` via
-[µPaaS](https://git.eeqj.de/sneak/upaas) (paas.datavi.be).
-
-## µPaaS App Configuration
-
-Create the app in the µPaaS web UI with these settings:
-
-| Setting | Value |
-| --- | --- |
-| **App name** | `pixa` |
-| **Repo URL** | `git@git.eeqj.de:sneak/pixa.git` |
-| **Branch** | `main` |
-| **Dockerfile path** | `Dockerfile` |
-
-### Environment Variables
-
-| Variable | Description | Required |
-| --- | --- | --- |
-| `PORT` | HTTP listen port (default: 8080) | No |
-
-Configuration is provided via the config file baked into the Docker
-image at `/etc/pixa/config.yml`. To override it, mount a custom
-config file as a volume (see below).
-
-### Volumes
-
-| Host Path | Container Path | Description |
-| --- | --- | --- |
-| `/srv/pixa/data` | `/var/lib/pixa` | SQLite database and image cache |
-| `/srv/pixa/config.yml` | `/etc/pixa/config.yml` | Production config (signing key, whitelist, etc.) |
-
-### Ports
-
-| Host Port | Container Port | Protocol |
-| --- | --- | --- |
-| (assigned) | 8080 | TCP |
-
-### Docker Network
-
-Attach to the shared reverse-proxy network if using Caddy/Traefik
-for TLS termination.
-
-## Production Configuration
-
-Copy `config.example.yml` from the repo root and customize for
-production:
-
-```yaml
-port: 8080
-debug: false
-maintenance_mode: false
-state_dir: /var/lib/pixa
-signing_key: "<generate with: openssl rand -base64 32>"
-whitelist_hosts:
-    - s3.sneak.cloud
-    - static.sneak.cloud
-    - sneak.berlin
-allow_http: false
-```
-
-**Important:** Generate a unique `signing_key` for production. Never
-use the default placeholder value.
-
-## Health Check
-
-The Dockerfile includes a `HEALTHCHECK` instruction that probes
-`/.well-known/healthcheck.json` every 30 seconds. µPaaS verifies
-container health 60 seconds after deployment.
-
-## Deployment Flow
-
-1. Push to `main` triggers the Gitea webhook
-2. µPaaS clones the repo and runs `docker build .`
-3. The Dockerfile runs `make check` (format, lint, test) during build
-4. On success, µPaaS stops the old container and starts the new one
-5. After 60 seconds, µPaaS checks container health

scripts/manual-test.sh

@@ -48,7 +48,7 @@ fi
 
 # Test 3: Wrong password shows error
 echo "--- Test 3: Login with wrong password ---"
-WRONG_LOGIN=$(curl -sf -X POST "$BASE_URL/" -d "key=wrong-key" -c "$COOKIE_JAR")
+WRONG_LOGIN=$(curl -sf -X POST "$BASE_URL/" -d "password=wrong-key" -c "$COOKIE_JAR")
 if echo "$WRONG_LOGIN" | grep -qi "invalid\|error\|incorrect\|wrong"; then
     pass "Wrong password shows error message"
 else
@@ -57,7 +57,7 @@ fi
 
 # Test 4: Correct password redirects to generator
 echo "--- Test 4: Login with correct signing key ---"
-curl -sf -X POST "$BASE_URL/" -d "key=$SIGNING_KEY" -c "$COOKIE_JAR" -b "$COOKIE_JAR" -L -o /dev/null
+curl -sf -X POST "$BASE_URL/" -d "password=$SIGNING_KEY" -c "$COOKIE_JAR" -b "$COOKIE_JAR" -L -o /dev/null
 GENERATOR_PAGE=$(curl -sf "$BASE_URL/" -b "$COOKIE_JAR")
 if echo "$GENERATOR_PAGE" | grep -qi "generate\|url\|source\|logout"; then
     pass "Correct password shows generator page"
@@ -68,12 +68,12 @@ fi
 # Test 5: Generate encrypted URL
 echo "--- Test 5: Generate encrypted URL ---"
 GEN_RESULT=$(curl -sf -X POST "$BASE_URL/generate" -b "$COOKIE_JAR" \
-    -d "url=$TEST_IMAGE_URL" \
+    -d "source_url=$TEST_IMAGE_URL" \
     -d "width=800" \
     -d "height=600" \
     -d "format=jpeg" \
     -d "quality=85" \
-    -d "fit=cover" \
+    -d "fit_mode=cover" \
     -d "ttl=3600")
 if echo "$GEN_RESULT" | grep -q "/v1/e/"; then
     pass "Encrypted URL generated"
@@ -121,10 +121,10 @@ fi
 # Test 9: Generate short-TTL URL and verify expiration
 echo "--- Test 9: Expired URL returns 410 ---"
 # Login again
-curl -sf -X POST "$BASE_URL/" -d "key=$SIGNING_KEY" -c "$COOKIE_JAR" -b "$COOKIE_JAR" -L -o /dev/null
+curl -sf -X POST "$BASE_URL/" -d "password=$SIGNING_KEY" -c "$COOKIE_JAR" -b "$COOKIE_JAR" -L -o /dev/null
 # Generate URL with 1 second TTL
 GEN_RESULT=$(curl -sf -X POST "$BASE_URL/generate" -b "$COOKIE_JAR" \
-    -d "url=$TEST_IMAGE_URL" \
+    -d "source_url=$TEST_IMAGE_URL" \
     -d "width=100" \
     -d "height=100" \
     -d "format=jpeg" \