Test a fetch whose context ends waiting for a shared connection

A fetch from a host with nothing open waits for the connection shared by
all hosts, and its context ends long before the wait timeout; once every
response is closed, no semaphore may be left in hostSems.

Model: opus-5-5

README.md

@@ -34,66 +34,6 @@ else has a built-in default. A config file mounted at `/etc/pixa/config.yml`
 is optional: it is read when present, and an environment variable wins over
 the same setting in it.
 
-## Deployment
-
-pixa listens on plain HTTP and runs behind a reverse proxy that terminates TLS.
-[`configs/Caddyfile`](configs/Caddyfile) is an example for Caddy, chosen because
-it is the smallest correct one: Caddy gets the TLS certificate itself and does
-everything in this list without further settings. The reverse proxy must:
-
-- terminate TLS, as the login and generator pages work only over HTTPS (see
-  Routes);
-- pass the `Host`, `Origin` and `Referer` headers on unchanged, as pixa refuses
-  a form from those pages unless `Origin` or `Referer` names the host in `Host`,
-  and builds encrypted URLs from `Host`;
-- set `X-Forwarded-For` to the client's address, with `trusted_proxies` set to
-  the address pixa sees the proxy's requests come from, so the login limit
-  counts each client by its own address (see `trusted_proxies` under
-  Configuration);
-- wait for pixa's answer for at least `downstream_timeout` (default `60s`), the
-  longest pixa takes to fetch, convert and send an image.
-
-It may also refuse `/metrics`, as the example does, so that only a scraper that
-reaches pixa directly can read it; pixa itself asks for the metrics username and
-password there.
-
-pixa does the rest itself: it checks signatures and encrypted URLs, applies the
-allowlist, refuses upstream hosts with private or local addresses, limits login
-attempts, upstream response size and image dimensions, and sends the security
-headers, `Strict-Transport-Security` included, with every response.
-
-The state directory (`state_dir`, `/var/lib/pixa` in the container) holds the
-database and the disk cache:
-
-- It needs a persistent volume: without one, every restart starts with an empty
-  cache. In the container, the startup script gives the directory to the user
-  pixa runs as (uid 65532) and sets its mode to `750`; outside it, that user
-  must be able to write the directory.
-- `cache_max_bytes` limits the source and transformed images together. The
-  database, the metadata files, the `.meta` file beside each transformed image
-  and files still being written come on top, and eviction runs in the
-  background, so the cache can pass the limit for a while: leave room on the
-  volume beyond it.
-- Set `cache_max_bytes` for a lasting deployment. Its default, worked out each
-  time pixa starts, is 75% of the sum of the space free on the volume and the
-  space the cached images already take, so a restart keeps the limit the cache
-  had, but anything else that fills or frees space on the volume moves it.
-
-A load balancer's health check can request `/.well-known/healthcheck.json`,
-which answers 200 whenever pixa is running, in maintenance mode too (see
-`maintenance_mode`).
-
-On SIGTERM or SIGINT pixa stops accepting connections, gives the requests in
-progress and the images being processed 5 seconds to finish, and exits: with 0,
-or with 1 when images were still being processed after those 5 seconds or
-another part of pixa failed to stop. A request not finished by then is cut off.
-`docker stop` waits 10 seconds before it kills the container.
-
-Outside Docker, pixa needs libvips (the image has 8.15) and libheif to run, as
-it uses libvips through CGO; building it also needs their development files,
-`pkg-config` and a C compiler. `script/bootstrap` installs all of these with
-nix, apt, brew or apk.
-
 ## Running under upaas
 
 What the [upaas](https://git.eeqj.de/sneak/upaas) app for pixa needs:
@@ -109,7 +49,7 @@ What the [upaas](https://git.eeqj.de/sneak/upaas) app for pixa needs:
     - `PIXA_ALLOWLIST_HOSTS`: upstream hosts served without a signature,
       comma-separated
     - `PIXA_CACHE_MAX_BYTES`: disk cache limit in bytes; `0` disables it;
-      default 75% of (free space + what the cache holds)
+      default 75% of free space
     - the rest are in the table under Configuration below
 - **Health check:** the image's `HEALTHCHECK` requests
   `/.well-known/healthcheck.json`. upaas reads the container's health 60
@@ -131,17 +71,13 @@ prevent abuse, and allowlisted source hosts for open access.
 ### Storage
 
 - **Source content**:
-  `<state_dir>/cache/sources/<ab>/<cd>/<sha256 of source content>`
+  `<statedir>/cache/src-content/<ab>/<cd>/<sha256 of source content>`
 - **Source metadata**:
-  `<state_dir>/cache/metadata/<hostname>/<sha256 of path and query>.json`
-  (host, path and query, content hash, upstream status and headers, fetch time)
-- **Database**: `<state_dir>/state.sqlite3` (SQLite)
-- **Transformed images**:
-  `<state_dir>/cache/variants/<ab>/<cd>/<sha256 of host, path, query, size, format, quality and fit>`,
-  each with a `.meta` file beside it holding its content type
-
-`<ab>` and `<cd>` are the first and second pairs of characters of the file's
-name.
+  `<statedir>/cache/src-metadata/<hostname>/<sha256 of path>.json`
+  (fetch time, original headers, request, content hash)
+- **Database**: `<statedir>/state.sqlite3` (SQLite)
+- **Output documents**:
+  `<statedir>/cache/dst-content/<ab>/<cd>/<sha256 of output content>`
 
 Multiple source paths may reference the same content blob; the
 database tracks references rather than using filesystem refcounting.
@@ -152,96 +88,17 @@ the metadata file stored beside it.
 
 ### Routes
 
-pixa answers these routes; any other path answers 404. A path in this list asked
-with a method the list does not give answers 405, except `/static/<file>`, which
-answers any method as it answers `GET`. A browser's CORS preflight request
-(`OPTIONS` with `Origin` and `Access-Control-Request-Method` headers) to any
-path under `/v1/` answers 200, in maintenance mode too.
-
-- `GET /` — the login page, or the URL generator page with a login session
-  (see Encrypted URLs). Needs: nothing. Answers: 200.
-- `POST /` — log in with the signing key typed into the login page. Needs: the
-  login page's form (below). Answers: 303 to `/` with a login session cookie
-  that lasts 30 days for the right key; 200 with the login page and an error for
-  a wrong key; 429 over the login limit (below).
-- `POST /generate` — make an encrypted URL from the generator page's form.
-  Needs: a login session and the generator page's form (below); without a login
-  session it answers 303 to `/`. Answers: 200 with the page showing the URL; 400
-  with the page naming a field that is not valid; 500 when the URL cannot be
-  made.
-- `GET /logout` — end the login session. Needs: nothing. Answers: 303 to `/`.
-- `GET` or `HEAD` `/v1/image/<host>/<path>/<size>.<format>` — an image, fetched,
-  resized and converted (below). Needs: a signature, unless the host is
-  allowlisted (see Source Hosts). Answers: 200; 304 when `If-None-Match` matches
-  the image's `ETag`; 400 for a URL or parameter that is not valid; 401 for a
-  missing or wrong signature, a missing `exp` or an `exp` in the past; 403 when
-  the upstream host, or a host it redirects to, is `localhost`, ends in
-  `.localhost` or `.local`, or has an address in a blocked network (see
-  `blocked_networks`); 502 when the upstream answered with an error status, and
-  for 5 minutes after that for the same source URL; 503 when pixa is busy or in
-  maintenance mode; 500 for any other failure.
-- `GET` or `HEAD` `/v1/e/<token>/<name>` — an image through an encrypted URL
-  (see Encrypted URLs). Needs: nothing but the URL. Answers: 200; 304 when
-  `If-None-Match` matches the image's `ETag`; 400 for a token that does not
-  decrypt, or that asks for a size or fit that is not valid; 410 once it has
-  expired; 504 when the upstream has not sent its response headers within
-  `upstream_fetch_timeout`, but 500 when that time runs out while the image
-  itself is still arriving; 403, 502, 503 and 500 as for `/v1/image/`.
-- `GET /robots.txt` — asks every crawler to stay away (`Disallow: /`). Needs:
-  nothing. Answers: 200.
-- `GET /.well-known/healthcheck.json` — JSON with `status` (`ok`), `now`,
-  `uptime_seconds`, `uptime_human`, `version`, `appname` and
-  `maintenance_mode`. Needs: nothing. Answers: 200, always.
-- `GET /static/<file>` — the script the login and generator pages load. Needs:
-  nothing. Answers: 200, or 404 for a file that does not exist.
-- `GET /metrics` — Prometheus metrics (see Architecture). Needs: HTTP basic
-  authentication with `metrics.username` and `metrics.password`. Answers: 200;
-  401 without them; 404 when they are not set, as the route then does not exist.
-
-Every response carries an `X-Request-ID` header holding the request's ID, which
-a client can quote when reporting a problem: the request's own `X-Request-ID`,
-as a reverse proxy in front of pixa may send, when it is at most 64 letters,
-digits, `-`, `_` or `.`; otherwise a random one pixa makes for the request,
-which tells nothing about the machine or the other requests. pixa's log line for
-the request carries the same ID as `request_id`, and so do the lines it logs
-when it fetches, converts and serves an image; the fetch sends it to the
-upstream host as `X-Request-ID`.
-
-Both `POST` routes accept only a form that pixa's own page served: the page puts
-a token in the form and sets a cookie to match, and a request without both is
-refused with 403, so another site cannot submit the form from a visitor's
-browser. The login and generator pages are meant to be opened over HTTPS: while
-`debug` is off, a form sent from a page opened over plain HTTP is refused with
-403, and while it is on, so is one sent from a page opened over HTTPS. Plain
-HTTP is for development on the browser's own machine: the login session cookie
-is always marked `Secure`, and over plain HTTP a browser keeps such a cookie
-only for its own machine (`localhost`), if at all. A form is also refused with
-403 when the page's host is not the `Host` header pixa receives, so a reverse
-proxy in front of pixa must pass that header on unchanged. A form body over
-1 MiB is refused with 413. The image routes answer the errors listed for them
-with JSON holding `error`, `status` and `timestamp`.
-
-An image URL has this form:
-
 ```
-/v1/image/<host>/<path>/<size>.<format>?sig=<signature>&exp=<expiration>&q=<quality>&fit=<fit>
+/v1/image/<host>/<path>/<size>.<format>?sig=<signature>&exp=<expiration>
 ```
 
-Images are only fetched from origins using TLS with valid certificates, unless
-`allow_http` is set: then pixa fetches every image over plain HTTP, which is for
-testing only.
+Images are only fetched from origins using TLS with valid certificates.
 
 A request whose query string cannot be decoded, or gives any parameter more
 than once, is refused with 400.
 
-- `<format>`: one of `orig` (or `original`), `jpeg` (or `jpg`), `png`, `webp`,
-  `avif`, `gif`
+- `<format>`: one of `orig`, `png`, `jpeg`, `webp`
 - `<size>`: `orig` or `<width>x<height>` (e.g. `800x600`)
-- `sig` and `exp`: the signature and its expiry, needed unless the host is
-  allowlisted (see Signature Specification)
-- `q` and `fit`: the output quality and how the image is fitted to `<size>`,
-  both optional (values under Signature Specification). Both are part of what
-  is cached, so each value of either is a separate cached image.
 
 An image is served with `Cache-Control: public, max-age=<seconds>, immutable`.
 When the URL has an expiry (an `exp`, or the TTL of an encrypted URL),
@@ -256,9 +113,7 @@ source) and one transcode: the first request does the work, and the others wait
 for its image or its error, holding no upstream connection or processing slot
 of their own. A waiting request stops waiting when its own client goes away.
 The work goes on for the others even if the first request's client goes away,
-until that request's `downstream_timeout` ends. The shared fetch sends the first
-request's ID upstream, and the lines logged for the fetch and the transcode
-carry that ID.
+until that request's `downstream_timeout` ends.
 
 The login form (`POST /`) is limited to 5 attempts per minute per client
 address, counting an IPv6 client by its /64; an attempt over the limit is
@@ -277,39 +132,6 @@ its own `X-Forwarded-For`, whether it connects directly or through the proxy,
 because its own address is trusted too. Setting `trusted_proxies` to only the
 address pixa sees for requests that come through the proxy closes this.
 
-### Encrypted URLs
-
-An encrypted URL is an image URL made on pixa's own web page by someone who
-knows the signing key. It works for any upstream host, allowlisted or not,
-without a signature, and whoever gets it can neither read the source URL from it
-nor change what it asks for.
-
-1. Open `/` in a browser over HTTPS (or over plain HTTP while `debug` is on, see
-   Routes) and log in with the signing key (`signing_key`). The login session
-   lasts 30 days, or until `/logout`.
-2. On the generator page, give the source image's URL, the width and height, the
-   format, quality and fit, and how long the URL lasts, then submit the form
-   (`POST /generate`). Width and height both empty or `0` keep the original
-   size; if only one of them is empty or `0`, that side is scaled to keep the
-   image's proportions.
-3. The page shows the URL, `https://<host>/v1/e/<token>/img.<format>`, and when
-   it expires. `<host>` is the host the page was opened on, and the URL starts
-   with `http` instead while `debug` is on. The name after the token is ignored
-   and only gives the URL a file extension, `jpg` for `orig`.
-
-The token holds the source's host, path and query and the size, format,
-quality, fit and expiry, encrypted with a key derived from `signing_key`. The
-source URL's scheme is not kept: the image is fetched like any other (see
-Routes), and the blocked networks still apply.
-
-How long the URL lasts is chosen on the page, from 1 minute to 1 year, or
-never. The expiry is fixed in the token when the URL is made and cannot be
-changed or revoked afterwards. Until then the image is served with a `max-age`
-that ends at the expiry (see Routes); after it the URL answers 410
-`URL has expired`. A URL made to last forever stops working only when
-`signing_key` changes: changing it makes every encrypted URL already handed out
-answer 400, and ends every login session.
-
 ### Image Metadata
 
 pixa decodes and re-encodes every image it serves, and removes all metadata from
@@ -351,8 +173,7 @@ Where:
 - `query` — source query string, empty string if none
 - `width` — requested width in pixels, `0` for original
 - `height` — requested height in pixels, `0` for original
-- `format` — output format, one of those listed under Routes, with `original`
-  signed as `orig` and `jpg` as `jpeg`
+- `format` — output format (jpeg, png, webp, avif, gif, orig)
 - `expiration` — the URL's `exp` query parameter, the Unix timestamp when
   the signature expires; a request whose `exp` is not a whole number, an
   empty `exp=` included, is refused with 400
@@ -408,24 +229,13 @@ startup naming it, as an unknown config key does. The one other accepted
 name is `PIXA_CONFIG_PATH`, the config file's path (like `--config`). The
 variables set by the file's `env:` section are checked the same way.
 
-pixa reads at most one config file: the one given with `--config` (or `-c`),
-otherwise the one `PIXA_CONFIG_PATH` names, otherwise the first of these that
-pixa finds: `/etc/pixa/config.yml`, `/etc/pixa/config.yaml`,
-`~/.config/pixa/config.yml`, `~/.config/pixa/config.yaml`, then `config.yml`
-and `config.yaml` in the working directory. A named file that does not exist,
-cannot be read or does not parse aborts startup. Of the files pixa looks for on
-its own, one it finds but cannot read or parse aborts startup; one it cannot
-find, for any reason, is passed over without a message, even when the file is
-there in a directory pixa may not enter. With no file, pixa uses the environment
-and the defaults.
-
 | Variable                             | Config key                      | Meaning                                                                      |
 | ------------------------------------ | ------------------------------- | ---------------------------------------------------------------------------- |
 | `PIXA_SIGNING_KEY`                   | `signing_key`                   | Required: secret for signed and encrypted URLs and login, 32+ characters     |
 | `PORT`                               | `port`                          | Port to listen on; default `8080`                                            |
 | `PIXA_STATE_DIR`                     | `state_dir`                     | Directory for the database and the disk cache; default `/var/lib/pixa`       |
 | `PIXA_DB_URL`                        | `db_url`                        | SQLite database URL; default `state.sqlite3` in the state directory          |
-| `PIXA_CACHE_MAX_BYTES`               | `cache_max_bytes`               | Disk cache limit in bytes; `0` disables it; default 75% of (free + cached)   |
+| `PIXA_CACHE_MAX_BYTES`               | `cache_max_bytes`               | Disk cache limit in bytes; `0` disables it; default 75% of free space        |
 | `PIXA_ALLOWLIST_HOSTS`               | `allowlist_hosts`               | Upstream hosts served without a signature                                    |
 | `PIXA_BLOCKED_NETWORKS`              | `blocked_networks`              | CIDR ranges never fetched from, on top of the built-in ones                  |
 | `PIXA_TRUSTED_PROXIES`               | `trusted_proxies`               | CIDR ranges of proxies whose `X-Forwarded-For` is believed; default RFC 1918 |
@@ -490,10 +300,8 @@ Key settings in more detail:
   each), so keep it longer than `upstream_fetch_timeout` plus 20 seconds
 - `signing_key` — HMAC secret for URL signatures
 - `cache_max_bytes` — disk cache size limit in bytes; `0` disables the
-  disk cache entirely; omitted defaults to 75% of the sum of the free space on
-  the filesystem containing `<state_dir>/cache/` and the bytes of source and
-  transformed images the cache already holds, worked out at startup (minimum
-  500 MiB)
+  disk cache entirely; omitted defaults to 75% of the free space on
+  the filesystem containing `<state_dir>/cache/` (minimum 500 MiB)
 - `upstream_connections` — the most connections to upstream hosts at once, all
   hosts together, on top of `upstream_connections_per_host`; default `64`. A
   fetch holds its connection until its image has been processed. A fetch that
@@ -506,12 +314,12 @@ Key settings in more detail:
   seconds for one to free up; if none does, and `downstream_timeout` has not
   ended first, it is answered 503 the same way
 - `maintenance_mode` — while `true`, the image routes (`/v1/image/` and
-  `/v1/e/`) answer every request for an image with 503, a `Retry-After` header
-  and a JSON error body. The health check (`/.well-known/healthcheck.json`)
-  still answers 200 and reports `"maintenance_mode": true`. It stays 200
-  because the image's Docker `HEALTHCHECK` requests it: a 503 there would make
-  the container unhealthy, and upaas marks a deploy failed when its container
-  is unhealthy. The login and URL generator pages and `/metrics` keep working
+  `/v1/e/`) answer every request with 503, a `Retry-After` header and a JSON
+  error body. The health check (`/.well-known/healthcheck.json`) still answers
+  200 and reports `"maintenance_mode": true`. It stays 200 because the image's
+  Docker `HEALTHCHECK` requests it: a 503 there would make the container
+  unhealthy, and upaas marks a deploy failed when its container is unhealthy.
+  The login and URL generator pages and `/metrics` keep working
 
 See `config.example.yml` for all options with defaults.
 
@@ -522,10 +330,7 @@ See `config.example.yml` for all options with defaults.
 - **Image processing**: govips (CGO wrapper for libvips)
 - **Database**: SQLite via modernc.org/sqlite
 - **Static assets**: embedded via `//go:embed`
-- **Metrics**: Prometheus, at `/metrics`: generic HTTP request metrics
-  (duration, response size, requests in flight) and the Go runtime and process
-  metrics; requests are measured and `/metrics` is served only when
-  `metrics.username` and `metrics.password` are set
+- **Metrics**: Prometheus
 - **Logging**: stdlib slog
 
 ## Entrypoints

TODO.md

@@ -29,83 +29,6 @@ P2: security: referer blacklist
 
 # Completed Steps
 
-- 2026-10-04 the default `cache_max_bytes` no longer shrinks as the cache fills
-  (closes #184): for an omitted key, the cache works out the limit when it
-  opens, after the database is open, as 75% of the sum of the free space on the
-  filesystem containing `<state_dir>/cache/` and what the cache already holds by
-  its own size accounting, at least 500 MiB, so a cache filled to its limit
-  keeps that limit across a restart. The computation and its tests moved from
-  `internal/config` to `internal/imgcache`; the config only records whether the
-  key was set.
-- 2026-10-04 deployment guide and example Caddy config (closes #89):
-  "Deployment" in `README.md` says what the reverse proxy in front of pixa must
-  do (terminate TLS; pass `Host`, `Origin` and `Referer` on unchanged; set
-  `X-Forwarded-For`, with `trusted_proxies` to match; wait at least
-  `downstream_timeout`; optionally refuse `/metrics`) and what pixa does itself,
-  that the state directory needs a persistent volume and what `cache_max_bytes`
-  counts, the health check for a load balancer, what a stop does and its exit
-  codes, and what running outside Docker needs; `configs/Caddyfile` is the
-  example, checked with `caddy validate`.
-- 2026-10-04 the metrics basic auth, CORS preflight, request logging and
-  metrics recording have tests (closes #79): `MetricsAuth` on its own answers
-  401 with a challenge without credentials or with a wrong username or password
-  and lets the configured ones through; a preflight request gets `*` for any
-  origin when `access_control_allow_origin` is `*` and no
-  `Access-Control-Allow-Origin` from another origin than the configured one; a
-  `POST /` carrying the signing key leaves no trace of it in the request log
-  line, and the login handler's own log lines leave out the submitted key; the
-  metrics middleware on its own records a request it served, and the router
-  records nothing while no metrics username is set. Not tested: that the router
-  puts the basic auth in front of `/metrics` and records requests when a
-  metrics username is set. Only one test per package can set up `/metrics`, and
-  in `internal/server` that is `TestMaintenanceModeKeepsOtherRoutes`, which
-  needs the owner's approval to change; #180 holds it. Tests only; the basic
-  auth library already compares the password in constant time.
-- 2026-10-04 the image route's signature check and error answers are tested
-  (closes #76): new tests in `internal/handlers`, with no network, check the
-  status and JSON error body for a missing, wrong, unpadded, upper-case or
-  expired signature on a host not on the allowlist, or a valid one sent for
-  its parent domain, a sibling host, a subdomain or the host with another
-  domain appended (401), an unparseable path (400), `localhost` as the
-  upstream host (403) and an upstream error (502); that an allowlisted host is
-  served without a signature, another host only with a valid one; and the
-  answers of `/robots.txt` and the health check. No code changes.
-- 2026-10-04 request IDs returned and passed on, and `/v1/e/` revalidates
-  (closes #84): pixa's own `RequestID` middleware, in place of chi's, gives each
-  request an ID, its own `X-Request-ID` when that is at most 64 letters, digits,
-  `-`, `_` or `.` and a random one otherwise, stores it where chi's did and
-  sends it back as `X-Request-ID` on every response; the upstream fetch sends
-  that ID, and the "upstream fetched", "image converted" and "image served" log
-  lines carry it as `request_id`, a fetch shared by several requests carrying
-  the first request's; `/v1/e/` sets `ETag`, answers a matching `If-None-Match`
-  with 304 and is routed for `HEAD`, the `ETag` and 304 code being
-  `notModified`, which `/v1/image/` calls too; its token checks moved unchanged
-  into `parseImageEncRequest` to keep `HandleImageEnc` within the line limit; no
-  `Vary` is added, as no response depends on a request header except the image
-  routes' CORS headers, for which `go-chi/cors` already sends `Vary: Origin`;
-  `Vary: Accept` is left to #88.
-- 2026-10-04 routes, encrypted URLs and config file documented (closes #75):
-  "Routes" in `README.md` lists every route with its method, purpose, what it
-  needs and the status codes it answers with, and says `q` and `fit` are part
-  of what is cached; "Encrypted URLs" covers logging in, making one on the
-  generator page, how long it lasts and the 410 once it has expired;
-  "Configuration" gives the order in which pixa looks for its config file;
-  `config.example.yml` lists `db_url` and `env` and gives every key's default;
-  `scripts/manual-test.sh` is left to #97.
-- 2026-10-04 shutdown stops cache eviction in progress (closes #102):
-  `StartEviction` runs the eviction goroutine with its own context, which
-  `StopEviction` cancels, so a pass in progress stops at its next database
-  call, file, row or eviction candidate instead of running to completion, and
-  no pass starts after it, so a stop logs at most one warning;
-  `StopEviction` takes a context and, when that context ends before the
-  goroutine exits, stops waiting and returns its error; the handlers' stop hook
-  passes fx's stop context, so an eviction still running when fx's stop
-  deadline ends fails the stop and makes the exit code 1.
-- 2026-10-04 dead code in `internal/imgcache` is gone (closes #73): `Purge`,
-  which only returned an error and which nothing called, is no longer part of
-  the `ImageCache` interface or `Service`; the `SignatureValidator`,
-  `Allowlist` and `Storage` interfaces, which nothing implemented or used, are
-  deleted. Nothing else changes.
 - 2026-10-04 upstream host semaphores and variant `.meta` files no longer
   outlive their use (closes #87): the fetcher counts the fetches holding or
   waiting for a slot of each upstream host's semaphore and removes the host's
@@ -113,14 +36,6 @@ P2: security: referer blacklist
   semaphore each until restart; `VariantStorage.Delete` removes the variant's
   `.meta` file along with it, a missing `.meta` file not being an error, and
   `DeleteWithMeta`, which eviction called for that, is gone.
-- 2026-10-04 `README.md` matches the code (closes #74): "Storage" names the
-  cache directories pixa uses (`cache/sources`, `cache/metadata`,
-  `cache/variants`) and how files are named in each, and the comments in
-  `001_schema.sql` name the same paths; the routes and the signature section
-  list the same output formats, `jpg` and `original` included; the TLS
-  sentence names `allow_http` as its exception; "Metrics" says only generic
-  HTTP and Go runtime metrics exist, measured and served only when the metrics
-  username and password are set.
 - 2026-10-03 shutdown sets the exit code and waits for image processing
   (closes #86): fx alone handles SIGINT and SIGTERM, and the server's own
   signal handler is gone; fx's `Run` in `cmd/pixad` exits with the shutdown's
@@ -493,6 +408,7 @@ P2: security: referer blacklist
 - P2: HTTP response handling
     - Last-Modified headers
     - Vary header for content negotiation
+    - X-Request-ID propagation
 - P2: auto format selection (format=auto based on Accept header)
 - P2: configuration
     - YAML config file support
@@ -502,3 +418,8 @@ P2: security: referer blacklist
     - Prometheus performance metrics
     - integration tests for the image proxy flow
     - load tests to verify the 1k to 5k req/s target
+- P2: documentation
+    - configuration options
+    - API endpoints
+    - deployment guide
+    - example nginx or caddy reverse proxy config

config.example.yml

@@ -12,38 +12,27 @@
 # Durations are Go duration strings such as 30s or 2m and must be
 # positive; a bare number has no unit and aborts startup. Sizes are a
 # whole number of bytes.
-#
-# A key left out takes the default its comment gives.
 
-# Port to listen on (default: 8080)
+# Server settings
 port: 8080
-
-# Debug logging and plain-HTTP local development (default: false)
 debug: false
 
 # While true, the image routes (/v1/image/ and /v1/e/) answer every request
-# for an image with 503 and a Retry-After header. The health check keeps
-# answering 200 and reports maintenance_mode as true. It stays 200 because
-# the image's Docker HEALTHCHECK requests it: a 503 there would make the
-# container unhealthy, and upaas marks a deploy failed when its container is
-# unhealthy. (default: false)
+# with 503 and a Retry-After header. The health check keeps answering 200 and
+# reports maintenance_mode as true. It stays 200 because the image's Docker
+# HEALTHCHECK requests it: a 503 there would make the container unhealthy, and
+# upaas marks a deploy failed when its container is unhealthy.
 maintenance_mode: false
 
 # Data directory for SQLite database and cache files
-# (default: /var/lib/pixa)
 state_dir: ./data
 
-# SQLite database URL (default:
-# file:<state_dir>/state.sqlite3?_journal_mode=WAL). An empty value aborts
-# startup; leave the key out to use the default.
-# db_url: "file:./data/state.sqlite3?_journal_mode=WAL"
-
 # Image proxy settings
 # HMAC signing key for URL signatures (required, at least 32 characters)
 # Generate with: openssl rand -base64 32
 signing_key: "CHANGE_ME_generate_with_openssl_rand_base64_32"
 
-# Hosts that don't require signatures (default: none)
+# Hosts that don't require signatures
 # Use "." prefix for wildcard subdomain matching (e.g., ".example.com" matches "cdn.example.com")
 allowlist_hosts:
   - s3.sneak.cloud
@@ -56,7 +45,7 @@ allowlist_hosts:
 # SSRF protection. These are added to the always-enforced built-in ranges
 # (loopback, RFC 1918 private, link-local, CGNAT, benchmark, NAT64, and
 # similar), never replacing them. Each entry must be a valid CIDR in IPv4
-# or IPv6 form; an invalid entry aborts startup. (default: none)
+# or IPv6 form; an invalid entry aborts startup.
 # blocked_networks:
 #   - 100.64.0.0/10
 #   - 2001:db8::/32
@@ -83,7 +72,6 @@ allowlist_hosts:
 #   - 2001:db8::/32
 
 # Allow HTTP upstream (only for testing, always use HTTPS in production)
-# (default: false)
 allow_http: false
 
 # Maximum concurrent connections per upstream host (default: 20)
@@ -128,22 +116,15 @@ access_control_allow_origin: "*"
 
 # Maximum disk cache size in bytes. Explicit values are used exactly as
 # given; 0 disables the disk cache entirely (every request fetches and
-# processes uncached). When omitted, the default is 75% of the sum of
-# the free space on the filesystem containing <state_dir>/cache/ and
-# the bytes of images the cache already holds, worked out at startup,
+# processes uncached). When omitted, the default is 75% of the free
+# space on the filesystem containing <state_dir>/cache/ at startup,
 # with a minimum of 500 MiB.
 # cache_max_bytes: 10737418240
 
-# Sentry DSN for error reporting (default: empty, which turns it off)
+# Sentry error reporting (optional)
 sentry_dsn: ""
 
-# Username and password for /metrics, set together (default: unset). Metrics
-# are measured and /metrics is served only when both are set.
+# Metrics endpoint authentication (optional)
 # metrics:
 #   username: "admin"
 #   password: "secret"
-
-# Environment variables set while this file loads, as described at the top
-# (default: none)
-# env:
-#   PIXA_DEBUG: "true"

configs/Caddyfile

@@ -1,17 +0,0 @@
-# Example Caddy config for running pixa behind Caddy; see "Deployment" in
-# README.md. Replace images.example.com with pixa's public host name, and
-# 127.0.0.1:8080 with the address Caddy reaches pixa on.
-#
-# Caddy gets and renews the TLS certificate for the host name, passes the
-# Host, Origin and Referer headers on unchanged, sets X-Forwarded-For to the
-# client's address, and waits for pixa's answer with no time limit of its
-# own, so pixa's downstream_timeout is what ends a slow request.
-
-images.example.com
-
-# pixa asks for metrics.username and metrics.password on /metrics. This
-# line also keeps it off the public address, for a scraper that reaches
-# pixa directly; remove it to read /metrics through Caddy.
-respond /metrics 404
-
-reverse_proxy 127.0.0.1:8080

internal/config/cache_max_bytes_internal_test.go

@@ -1,10 +1,26 @@
 package config
 
 import (
+	"errors"
+	"log/slog"
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 )
 
+// Static errors returned by the stub free-space probes below.
+var (
+	errTestStatfsFailed     = errors.New("statfs failed")
+	errTestProbeNotExpected = errors.New("probe must not be called")
+)
+
+// discardLogger returns a logger that swallows all output, for tests
+// that exercise code paths which log.
+func discardLogger() *slog.Logger {
+	return slog.New(slog.DiscardHandler)
+}
+
 // TestCacheMaxBytesExplicitValueUsedWithoutFloor verifies that an
 // explicitly configured cache_max_bytes value is used exactly as
 // given: the 500 MiB floor applies only to the computed default, never
@@ -135,30 +151,155 @@ func TestCacheMaxBytesInvalidValuesAbortStartup(t *testing.T) {
 	}
 }
 
-// TestCacheMaxBytesExplicitIsRecorded verifies that an omitted
-// cache_max_bytes is recorded as not explicit, so the cache works out
-// the default when it opens, and that an explicit zero is recorded as
-// explicit, so it disables the disk cache instead.
-func TestCacheMaxBytesExplicitIsRecorded(t *testing.T) {
+// TestComputeDefaultCacheMaxBytesUses75PercentOfFreeSpace verifies the
+// computed default is 75% of the probed free space when that exceeds
+// the floor.
+func TestComputeDefaultCacheMaxBytesUses75PercentOfFreeSpace(t *testing.T) {
 	t.Parallel()
 
-	signingKeyLine := "signing_key: " + validTestSigningKey + "\n"
+	// 4 GiB free -> 3 GiB default.
+	probe := func(string) (uint64, error) { return 4294967296, nil }
 
-	omitted, err := configFromYAML(t, signingKeyLine)
+	got, err := ComputeDefaultCacheMaxBytes(t.TempDir(), probe)
+	if err != nil {
+		t.Fatalf("ComputeDefaultCacheMaxBytes returned error: %v", err)
+	}
+
+	if got != 3221225472 {
+		t.Errorf("ComputeDefaultCacheMaxBytes = %d, want 3221225472 (75%% of 4 GiB)",
+			got)
+	}
+}
+
+// TestComputeDefaultCacheMaxBytesAppliesFloorToComputedDefault
+// verifies that when 75% of free space is below 500 MiB, the computed
+// default is floored at DefaultCacheMaxBytesFloor.
+func TestComputeDefaultCacheMaxBytesAppliesFloorToComputedDefault(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name      string
+		freeBytes uint64
+	}{
+		{name: "100 MiB free", freeBytes: 104857600},
+		{name: "zero free", freeBytes: 0},
+		{name: "just below floor threshold", freeBytes: 699050665},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			probe := func(string) (uint64, error) { return tc.freeBytes, nil }
+
+			got, err := ComputeDefaultCacheMaxBytes(t.TempDir(), probe)
+			if err != nil {
+				t.Fatalf("ComputeDefaultCacheMaxBytes returned error: %v", err)
+			}
+
+			if got != DefaultCacheMaxBytesFloor {
+				t.Errorf("ComputeDefaultCacheMaxBytes = %d, want floor %d",
+					got, DefaultCacheMaxBytesFloor)
+			}
+		})
+	}
+}
+
+// TestComputeDefaultCacheMaxBytesPropagatesProbeError verifies that a
+// failing free-space probe produces an error naming the config key,
+// instead of a silently wrong default.
+func TestComputeDefaultCacheMaxBytesPropagatesProbeError(t *testing.T) {
+	t.Parallel()
+
+	probe := func(string) (uint64, error) { return 0, errTestStatfsFailed }
+
+	_, err := ComputeDefaultCacheMaxBytes(t.TempDir(), probe)
+	if err == nil {
+		t.Fatal("probe failure must produce an error, got nil")
+	}
+
+	t.Logf("got expected error: %v", err)
+
+	if !strings.Contains(err.Error(), keyCacheMaxBytes) {
+		t.Errorf("error %q does not name the config key cache_max_bytes", err.Error())
+	}
+}
+
+// TestResolveCacheMaxBytesComputesDefaultWhenOmitted verifies that an
+// omitted cache_max_bytes key resolves to the computed default, that
+// the probe is pointed at <state_dir>/cache/ (which must be created
+// first so statfs measures the right filesystem), and that the result
+// lands on the Config.
+func TestResolveCacheMaxBytesComputesDefaultWhenOmitted(t *testing.T) {
+	t.Parallel()
+
+	c, err := configFromYAML(t, "signing_key: "+validTestSigningKey+"\n")
 	if err != nil {
 		t.Fatalf("minimal config should be valid, got error: %v", err)
 	}
 
-	if omitted.CacheMaxBytesExplicit {
-		t.Error("omitted cache_max_bytes recorded as explicit")
+	c.StateDir = t.TempDir()
+	wantCacheDir := filepath.Join(c.StateDir, "cache")
+
+	var probedPath string
+
+	// 4 GiB free -> 3 GiB default.
+	probe := func(path string) (uint64, error) {
+		probedPath = path
+
+		return 4294967296, nil
 	}
 
-	zero, err := configFromYAML(t, signingKeyLine+"cache_max_bytes: 0\n")
+	err = c.resolveCacheMaxBytes(discardLogger(), probe)
 	if err != nil {
-		t.Fatalf("cache_max_bytes: 0 must be accepted, got error: %v", err)
+		t.Fatalf("resolveCacheMaxBytes returned error: %v", err)
 	}
 
-	if !zero.CacheMaxBytesExplicit {
-		t.Error("cache_max_bytes: 0 not recorded as explicit")
+	if c.CacheMaxBytes != 3221225472 {
+		t.Errorf("CacheMaxBytes = %d, want computed default 3221225472",
+			c.CacheMaxBytes)
+	}
+
+	if probedPath != wantCacheDir {
+		t.Errorf("free space probed at %q, want cache directory %q",
+			probedPath, wantCacheDir)
+	}
+
+	info, err := os.Stat(wantCacheDir)
+	if err != nil || !info.IsDir() {
+		t.Errorf("cache directory %q was not created before probing: info=%v err=%v",
+			wantCacheDir, info, err)
+	}
+}
+
+// TestResolveCacheMaxBytesDoesNotOverrideExplicitValue verifies that
+// an explicitly configured value survives resolution untouched and
+// that the free-space probe is never consulted for it.
+func TestResolveCacheMaxBytesDoesNotOverrideExplicitValue(t *testing.T) {
+	t.Parallel()
+
+	yamlContent := "signing_key: " + validTestSigningKey + "\ncache_max_bytes: 1024\n"
+
+	c, err := configFromYAML(t, yamlContent)
+	if err != nil {
+		t.Fatalf("explicit cache_max_bytes must be accepted, got error: %v", err)
+	}
+
+	c.StateDir = t.TempDir()
+
+	probe := func(string) (uint64, error) {
+		t.Error("free-space probe must not be consulted for explicit values")
+
+		return 0, errTestProbeNotExpected
+	}
+
+	err = c.resolveCacheMaxBytes(discardLogger(), probe)
+	if err != nil {
+		t.Fatalf("resolveCacheMaxBytes returned error: %v", err)
+	}
+
+	if c.CacheMaxBytes != 1024 {
+		t.Errorf("CacheMaxBytes = %d, want explicit 1024 (no floor, no recompute)",
+			c.CacheMaxBytes)
 	}
 }

internal/config/cachesize.go

@@ -0,0 +1,116 @@
+package config
+
+import (
+	"fmt"
+	"log/slog"
+	"math"
+	"os"
+	"path/filepath"
+	"syscall"
+)
+
+// DefaultCacheMaxBytesFloor is the minimum computed default for the
+// cache_max_bytes setting: 500 MiB. The floor applies only to the
+// computed default (when the key is omitted from the configuration),
+// never to explicitly configured values.
+const DefaultCacheMaxBytesFloor int64 = 524288000
+
+// cacheDirPerms is the permission mode for the cache directory created
+// before probing free space, matching the state directory permissions.
+const cacheDirPerms = 0o750
+
+// freeSpaceFractionNumerator and freeSpaceFractionDenominator express
+// the 75% share of free space used for the computed default limit as
+// integer arithmetic (dividing before multiplying avoids overflow).
+const (
+	freeSpaceFractionNumerator   uint64 = 3
+	freeSpaceFractionDenominator uint64 = 4
+)
+
+// FreeSpaceProbeFunc reports the number of free bytes available on the
+// filesystem containing path. It is a function type so tests can
+// inject a fake probe instead of depending on the host disk.
+type FreeSpaceProbeFunc func(path string) (uint64, error)
+
+// defaultFreeSpaceProbe reports free filesystem bytes via statfs on
+// the given path, as available to unprivileged processes.
+func defaultFreeSpaceProbe(path string) (uint64, error) {
+	var stat syscall.Statfs_t
+
+	err := syscall.Statfs(path, &stat)
+	if err != nil {
+		return 0, err
+	}
+
+	if stat.Bsize < 0 {
+		return 0, fmt.Errorf("%w %d for %q", errNegativeBlockSize, stat.Bsize, path)
+	}
+
+	blockSize := uint64(stat.Bsize)
+
+	return stat.Bavail * blockSize, nil
+}
+
+// ComputeDefaultCacheMaxBytes returns the default cache size limit for
+// the filesystem containing cacheDir: 75% of the free bytes reported
+// by probe, with a floor of DefaultCacheMaxBytesFloor.
+func ComputeDefaultCacheMaxBytes(
+	cacheDir string, probe FreeSpaceProbeFunc,
+) (int64, error) {
+	freeBytes, err := probe(cacheDir)
+	if err != nil {
+		return 0, fmt.Errorf("config key %q: cannot determine free space for %q: %w",
+			"cache_max_bytes", cacheDir, err)
+	}
+
+	computed := freeBytes / freeSpaceFractionDenominator * freeSpaceFractionNumerator
+	computed = min(computed, math.MaxInt64)
+
+	// gosec cannot see that min() above bounds computed, so it reads
+	// this conversion as potentially overflowing. It cannot: computed is
+	// at most math.MaxInt64 on every path here.
+	//nolint:gosec // G115: clamped to MaxInt64 by min above
+	limit := int64(computed)
+	limit = max(limit, DefaultCacheMaxBytesFloor)
+
+	return limit, nil
+}
+
+// resolveCacheMaxBytes finalizes CacheMaxBytes after state_dir
+// validation: an explicitly configured value is kept as-is (no floor
+// applies), while an omitted key receives the computed default based
+// on free space in <state_dir>/cache/. The cache directory is created
+// first so statfs measures the filesystem that will actually hold the
+// cache. The effective limit is logged either way.
+func (c *Config) resolveCacheMaxBytes(
+	log *slog.Logger, probe FreeSpaceProbeFunc,
+) error {
+	if !c.cacheMaxBytesExplicit {
+		cacheDir := filepath.Join(c.StateDir, "cache")
+
+		err := os.MkdirAll(cacheDir, cacheDirPerms)
+		if err != nil {
+			return fmt.Errorf("config key %q: cannot create cache directory %q: %w",
+				keyCacheMaxBytes, cacheDir, err)
+		}
+
+		limit, err := ComputeDefaultCacheMaxBytes(cacheDir, probe)
+		if err != nil {
+			return err
+		}
+
+		c.CacheMaxBytes = limit
+
+		log.Info("computed default cache size limit from free space",
+			"cache_max_bytes", limit,
+			"cache_dir", cacheDir,
+		)
+	}
+
+	log.Info("effective cache size limit",
+		"cache_max_bytes", c.CacheMaxBytes,
+		"cache_disabled", c.CacheMaxBytes == 0,
+	)
+
+	return nil
+}

internal/config/config.go

@@ -91,7 +91,9 @@ var (
 	errMustBeSetTogether = errors.New("must be set together")
 	errMustNotBeNegative = errors.New("must not be negative")
 	errOverflowsInt64    = errors.New("overflows a 64-bit integer")
-	errValueNull         = errors.New(
+	errNegativeBlockSize = errors.New(
+		"statfs reported negative block size")
+	errValueNull = errors.New(
 		"value is null; omit the key entirely to use the default")
 	errValuesNull = errors.New(
 		"value is null; omit a key entirely to use its default")
@@ -169,16 +171,16 @@ type Config struct {
 
 	// CacheMaxBytes is the disk cache size limit in bytes. Zero
 	// disables the disk cache entirely. When cache_max_bytes is
-	// omitted from the configuration, this is zero and
-	// CacheMaxBytesExplicit is false.
+	// omitted from the configuration, this holds the computed default
+	// (75% of free space on the filesystem containing
+	// <state_dir>/cache/, floored at DefaultCacheMaxBytesFloor).
 	CacheMaxBytes int64
 
-	// CacheMaxBytesExplicit records whether cache_max_bytes was
+	// cacheMaxBytesExplicit records whether cache_max_bytes was
 	// explicitly set, in the environment or the configuration file.
-	// Explicit values are used exactly as given; for an omitted key the
-	// cache works out the default limit when it opens (see
-	// imgcache.CacheConfig.UseDefaultMaxBytes).
-	CacheMaxBytesExplicit bool
+	// Explicit values are used exactly as given; only an omitted key
+	// gets the computed default (and its floor) in resolveCacheMaxBytes.
+	cacheMaxBytesExplicit bool
 }
 
 // New creates a new Config instance from the environment and the
@@ -215,13 +217,9 @@ func New(_ fx.Lifecycle, params Params) (*Config, error) {
 		return nil, err
 	}
 
-	// An omitted cache_max_bytes is worked out and logged when the
-	// cache opens.
-	if c.CacheMaxBytesExplicit {
-		log.Info("effective cache size limit",
-			"cache_max_bytes", c.CacheMaxBytes,
-			"cache_disabled", c.CacheMaxBytes == 0,
-		)
+	err = c.resolveCacheMaxBytes(log, defaultFreeSpaceProbe)
+	if err != nil {
+		return nil, err
 	}
 
 	if c.Debug {
@@ -300,11 +298,11 @@ func newFromSmartConfig(sc *smartconfig.Config) (*Config, error) {
 		TrustedProxies:  trustedProxies,
 	}
 
-	// The default for an omitted cache_max_bytes is worked out when
-	// the cache opens; here we only record whether the operator set
-	// the key explicitly.
+	// The computed default for cache_max_bytes needs a validated
+	// state_dir, so it is resolved later (resolveCacheMaxBytes); here
+	// we only record whether the operator set the key explicitly.
 	if _, present := lookupValue(sc, keyCacheMaxBytes); present {
-		c.CacheMaxBytesExplicit = true
+		c.cacheMaxBytesExplicit = true
 	}
 
 	// Build DBURL from StateDir if not explicitly set. The derived URL

internal/config/env_internal_test.go

@@ -98,7 +98,7 @@ func TestEnvironmentSetsEveryKey(t *testing.T) {
 		UpstreamConnections:        10,
 		MaxConcurrentProcessing:    3,
 		CacheMaxBytes:              1024,
-		CacheMaxBytesExplicit:      true,
+		cacheMaxBytesExplicit:      true,
 		BlockedNetworks:            []netip.Prefix{netip.MustParsePrefix("203.0.113.0/24")},
 		TrustedProxies:             []netip.Prefix{netip.MustParsePrefix("192.0.2.0/24")},
 		AccessControlAllowOrigin:   "https://app.example.com",

internal/db/migrations/001_schema.sql

@@ -2,7 +2,7 @@
 -- Creates all tables for the pixa caching image proxy
 
 -- Source content blobs
--- Files stored at: cache/sources/<ab>/<cd>/<sha256>
+-- Files stored at: cache/src-content/<ab>/<cd>/<sha256>
 -- last_accessed_at is NULL until the first LRU touch; eviction falls
 -- back to fetched_at for rows that have never been touched.
 CREATE TABLE IF NOT EXISTS source_content (
@@ -16,7 +16,7 @@ CREATE INDEX IF NOT EXISTS idx_source_content_last_accessed
     ON source_content(last_accessed_at);
 
 -- Source URL metadata - maps URLs to content hashes
--- JSON stored at: cache/metadata/<hostname>/<path_hash>.json
+-- JSON stored at: cache/src-metadata/<hostname>/<path_hash>.json
 CREATE TABLE IF NOT EXISTS source_metadata (
     id INTEGER PRIMARY KEY AUTOINCREMENT,
     source_host TEXT NOT NULL,
@@ -56,8 +56,7 @@ CREATE INDEX IF NOT EXISTS idx_variant_content_last_accessed
     ON variant_content(last_accessed_at);
 
 -- Output/transformed content blobs
--- Not written: transformed images are stored in cache/variants and
--- tracked in variant_content above.
+-- Files stored at: cache/dst-content/<ab>/<cd>/<sha256>
 CREATE TABLE IF NOT EXISTS output_content (
     content_hash TEXT PRIMARY KEY,
     content_type TEXT NOT NULL,

internal/handlers/auth_login_log_internal_test.go

@@ -1,59 +0,0 @@
-package handlers
-
-import (
-	"bytes"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"strings"
-	"testing"
-
-	"sneak.berlin/go/pixa/internal/config"
-	"sneak.berlin/go/pixa/internal/session"
-)
-
-// TestLoginLogLeavesOutSubmittedKey verifies that the log lines for a
-// failed and for a successful login do not contain the submitted key.
-func TestLoginLogLeavesOutSubmittedKey(t *testing.T) {
-	t.Parallel()
-
-	const wrongKey = "wrong-signing-key-fedcba9876543210"
-
-	var buf bytes.Buffer
-
-	sessMgr, err := session.NewManager(testSigningKey)
-	if err != nil {
-		t.Fatalf("session.NewManager() error = %v", err)
-	}
-
-	h := &Handlers{
-		log:     slog.New(slog.NewJSONHandler(&buf, nil)),
-		config:  &config.Config{SigningKey: testSigningKey},
-		sessMgr: sessMgr,
-	}
-
-	submittedKeys := []string{wrongKey, testSigningKey}
-
-	for _, key := range submittedKeys {
-		form := url.Values{loginKeyField: {key}}
-		req := httptest.NewRequestWithContext(
-			t.Context(), http.MethodPost, "/",
-			strings.NewReader(form.Encode()))
-		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-
-		h.handleLoginPost(httptest.NewRecorder(), req)
-	}
-
-	for _, msg := range []string{"failed login attempt", "successful login"} {
-		if !strings.Contains(buf.String(), msg) {
-			t.Fatalf("log missing %q; got %q", msg, buf.String())
-		}
-	}
-
-	for _, key := range submittedKeys {
-		if strings.Contains(buf.String(), key) {
-			t.Errorf("log contains submitted key %q; got %q", key, buf.String())
-		}
-	}
-}

internal/handlers/handlers.go

@@ -58,16 +58,23 @@ func New(lc fx.Lifecycle, params Params) (*Handlers, error) {
 	}
 
 	lc.Append(fx.Hook{
-		//nolint:contextcheck // the eviction loop outlives OnStart; OnStop cancels it
+		// The eviction goroutine must outlive OnStart, so it cannot
+		// inherit this hook's context. It makes its own instead, which
+		// leaves it uncancellable: an in-flight pass runs to completion
+		// during OnStop regardless of the shutdown deadline. Making the
+		// loop cancellable changes shutdown semantics and is tracked
+		// separately in issue #102, rather than being folded into the
+		// lint-conformance change that surfaced it.
+		//nolint:contextcheck // see issue #102
 		OnStart: func(_ context.Context) error {
 			return s.initImageService()
 		},
-		OnStop: func(ctx context.Context) error {
-			if s.imgCache == nil {
-				return nil
+		OnStop: func(_ context.Context) error {
+			if s.imgCache != nil {
+				s.imgCache.StopEviction()
 			}
 
-			return s.imgCache.StopEviction(ctx)
+			return nil
 		},
 	})
 
@@ -83,16 +90,14 @@ func (s *Handlers) WaitForProcessing(ctx context.Context) int {
 // initImageService initializes the image cache and service.
 func (s *Handlers) initImageService() error {
 	// Create the cache. cache_max_bytes: 0 disables the disk cache
-	// entirely; any other value is the eviction limit in bytes; when
-	// it is omitted, the cache works out the default limit itself.
+	// entirely; any other value is the eviction limit in bytes.
 	cache, err := imgcache.NewCache(s.db.DB(), imgcache.CacheConfig{
-		StateDir:           s.config.StateDir,
-		CacheTTL:           imgcache.DefaultCacheTTL,
-		NegativeTTL:        imgcache.DefaultNegativeTTL,
-		MaxBytes:           s.config.CacheMaxBytes,
-		UseDefaultMaxBytes: !s.config.CacheMaxBytesExplicit,
-		DisableDiskCache:   s.config.CacheMaxBytesExplicit && s.config.CacheMaxBytes == 0,
-		Logger:             s.log,
+		StateDir:         s.config.StateDir,
+		CacheTTL:         imgcache.DefaultCacheTTL,
+		NegativeTTL:      imgcache.DefaultNegativeTTL,
+		MaxBytes:         s.config.CacheMaxBytes,
+		DisableDiskCache: s.config.CacheMaxBytes == 0,
+		Logger:           s.log,
 	})
 	if err != nil {
 		return err

internal/handlers/image.go

@@ -10,7 +10,6 @@ import (
 	"time"
 
 	"github.com/go-chi/chi/v5"
-	"github.com/go-chi/chi/v5/middleware"
 	"sneak.berlin/go/pixa/internal/encurl"
 	"sneak.berlin/go/pixa/internal/httpfetcher"
 	"sneak.berlin/go/pixa/internal/imageprocessor"
@@ -248,25 +247,6 @@ func cacheControl(expires time.Time) string {
 	return fmt.Sprintf("public, max-age=%d, immutable", int64(maxAge/time.Second))
 }
 
-// notModified sets the ETag header to etag and, when the request's
-// If-None-Match is that ETag, answers 304 Not Modified. It reports whether it
-// answered. An empty etag sets no header and never answers.
-func notModified(w http.ResponseWriter, r *http.Request, etag string) bool {
-	if etag == "" {
-		return false
-	}
-
-	w.Header().Set("ETag", etag)
-
-	if r.Header.Get("If-None-Match") != etag {
-		return false
-	}
-
-	w.WriteHeader(http.StatusNotModified)
-
-	return true
-}
-
 // writeImageResponse writes headers and streams the image content,
 // handling conditional and HEAD requests.
 func (s *Handlers) writeImageResponse(
@@ -285,8 +265,17 @@ func (s *Handlers) writeImageResponse(
 	w.Header().Set("Cache-Control", cacheControl(req.Expires))
 	w.Header().Set("X-Pixa-Cache", string(resp.CacheStatus))
 
-	if notModified(w, r, resp.ETag) {
-		return
+	if resp.ETag != "" {
+		w.Header().Set("ETag", resp.ETag)
+
+		// Check for conditional request (If-None-Match)
+		if ifNoneMatch := r.Header.Get("If-None-Match"); ifNoneMatch != "" {
+			if ifNoneMatch == resp.ETag {
+				w.WriteHeader(http.StatusNotModified)
+
+				return
+			}
+		}
 	}
 
 	// Handle HEAD request - return headers only
@@ -309,7 +298,6 @@ func (s *Handlers) writeImageResponse(
 	// Log cache status and timing after serving
 	duration := time.Since(startTime)
 	s.log.Info("image served",
-		"request_id", middleware.GetReqID(r.Context()),
 		"cache_key", cacheKey,
 		"cache_status", resp.CacheStatus,
 		"duration_ms", duration.Milliseconds(),

internal/handlers/image_cache_control_internal_test.go

@@ -23,10 +23,8 @@ const photoPath = "/images/photo.jpg"
 // newSignedHostServer returns a router for both image routes, and the Handlers
 // behind it, whose fetcher serves a JPEG at photoPath on signedHost. signedHost
 // is not on the allowlist, so a /v1/image/ URL for it is served only with a
-// valid signature. The handlers and the image service log to log.
-func newSignedHostServer(
-	t *testing.T, log *slog.Logger,
-) (*Handlers, http.Handler) {
+// valid signature.
+func newSignedHostServer(t *testing.T) (*Handlers, http.Handler) {
 	t.Helper()
 
 	cache, err := imgcache.NewCache(setupTestDB(t), imgcache.CacheConfig{
@@ -46,7 +44,6 @@ func newSignedHostServer(
 			signedHost + photoPath: &fstest.MapFile{Data: jpegData},
 		}),
 		SigningKey: testSigningKey,
-		Logger:     log,
 	})
 	if err != nil {
 		t.Fatalf("imgcache.NewService() error = %v", err)
@@ -58,7 +55,7 @@ func newSignedHostServer(
 	}
 
 	h := &Handlers{
-		log:    log,
+		log:    slog.New(slog.DiscardHandler),
 		imgSvc: svc,
 		encGen: encGen,
 	}
@@ -106,7 +103,7 @@ func getMaxAge(t *testing.T, srv http.Handler, target string) int {
 func TestHandleImage_SignedURL_MaxAgeEndsAtExp(t *testing.T) {
 	t.Parallel()
 
-	h, srv := newSignedHostServer(t, slog.New(slog.DiscardHandler))
+	h, srv := newSignedHostServer(t)
 
 	signedURL, err := h.imgSvc.GenerateSignedURL("", &imgcache.ImageRequest{
 		SourceHost: signedHost,
@@ -182,7 +179,7 @@ func TestHandleImageEnc_MaxAge(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
-			h, srv := newSignedHostServer(t, slog.New(slog.DiscardHandler))
+			h, srv := newSignedHostServer(t)
 
 			token, err := h.encGen.Generate(&encurl.Payload{
 				SourceHost: signedHost,

internal/handlers/image_errors_internal_test.go

@@ -1,267 +0,0 @@
-package handlers
-
-import (
-	"encoding/json"
-	"fmt"
-	"image/color"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-	"testing/fstest"
-	"time"
-
-	"github.com/go-chi/chi/v5"
-	"sneak.berlin/go/pixa/internal/httpfetcher"
-	"sneak.berlin/go/pixa/internal/imgcache"
-	"sneak.berlin/go/pixa/internal/signature"
-)
-
-// allowlistedHost is the only host on the allowlist of the image route
-// newImageRoute builds.
-const allowlistedHost = "allowed.example.com"
-
-// newImageRoute returns the image route of a Handlers whose service fetches
-// with fetcher and checks signatures with testSigningKey.
-func newImageRoute(t *testing.T, fetcher httpfetcher.Fetcher) http.Handler {
-	t.Helper()
-
-	cache, err := imgcache.NewCache(setupTestDB(t), imgcache.CacheConfig{
-		StateDir:    t.TempDir(),
-		CacheTTL:    time.Hour,
-		NegativeTTL: 5 * time.Minute,
-	})
-	if err != nil {
-		t.Fatalf("failed to create cache: %v", err)
-	}
-
-	svc, err := imgcache.NewService(&imgcache.ServiceConfig{
-		Cache:      cache,
-		Fetcher:    fetcher,
-		SigningKey: testSigningKey,
-		Allowlist:  []string{allowlistedHost},
-	})
-	if err != nil {
-		t.Fatalf("failed to create service: %v", err)
-	}
-
-	h := &Handlers{imgSvc: svc, log: slog.New(slog.DiscardHandler)}
-
-	r := chi.NewRouter()
-	r.Get("/v1/image/*", h.HandleImage())
-
-	return r
-}
-
-// newPhotoFetcher returns a mock fetcher that serves a JPEG at photoPath on
-// each of hosts, and answers any other URL with an upstream error.
-func newPhotoFetcher(t *testing.T, hosts ...string) *httpfetcher.MockFetcher {
-	t.Helper()
-
-	photo := &fstest.MapFile{
-		Data: generateTestJPEG(t, 100, 100, color.RGBA{255, 0, 0, 255}),
-	}
-
-	files := fstest.MapFS{}
-	for _, host := range hosts {
-		files[host+photoPath] = photo
-	}
-
-	return httpfetcher.NewMock(files)
-}
-
-// photoURL returns the image route URL of photoPath on host, as a 50x50 JPEG.
-func photoURL(host string) string {
-	return "/v1/image/" + host + photoPath + "/50x50.jpeg"
-}
-
-// photoURLWithSig returns photoURL(host) with sig and expires as its sig and
-// exp.
-func photoURLWithSig(host, sig string, expires time.Time) string {
-	return fmt.Sprintf("%s?sig=%s&exp=%d", photoURL(host), sig, expires.Unix())
-}
-
-// photoSignature returns the signature of photoURL(host) at the default
-// quality and fit, made with key and expiring at expires.
-func photoSignature(key, host string, expires time.Time) string {
-	return signature.New(key).Sign(&signature.Request{
-		SourceHost: host,
-		SourcePath: photoPath,
-		Width:      50,
-		Height:     50,
-		Format:     string(imgcache.FormatJPEG),
-		Quality:    85,
-		FitMode:    string(imgcache.FitCover),
-		Expires:    expires,
-	})
-}
-
-// sendGet sends a GET for target to route and returns the response.
-func sendGet(
-	t *testing.T, route http.Handler, target string,
-) *httptest.ResponseRecorder {
-	t.Helper()
-
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, target, nil)
-	rec := httptest.NewRecorder()
-
-	route.ServeHTTP(rec, req)
-	t.Logf("GET %s: %d", target, rec.Code)
-
-	return rec
-}
-
-// checkErrorBody checks that rec has status wantStatus and the JSON error body
-// the image route sends: wantError, wantStatus and the time in RFC 3339.
-func checkErrorBody(
-	t *testing.T, rec *httptest.ResponseRecorder, wantStatus int, wantError string,
-) {
-	t.Helper()
-
-	if rec.Code != wantStatus {
-		t.Errorf("status = %d, want %d", rec.Code, wantStatus)
-	}
-
-	if ct := rec.Header().Get("Content-Type"); ct != "application/json" {
-		t.Errorf("Content-Type = %q, want application/json", ct)
-	}
-
-	var body struct {
-		Error     string `json:"error"`
-		Status    int    `json:"status"`
-		Timestamp string `json:"timestamp"`
-	}
-
-	err := json.NewDecoder(rec.Body).Decode(&body)
-	if err != nil {
-		t.Fatalf("decoding response body: %v", err)
-	}
-
-	if body.Error != wantError || body.Status != wantStatus {
-		t.Errorf("body error and status = %q %d, want %q %d",
-			body.Error, body.Status, wantError, wantStatus)
-	}
-
-	_, err = time.Parse(time.RFC3339, body.Timestamp)
-	if err != nil {
-		t.Errorf("body timestamp: %v", err)
-	}
-}
-
-// TestHandleImage_ErrorAnswers checks the status and the JSON error body the
-// image route answers each request below with. The JPEG at photoPath exists on
-// signedHost and on each host below that differs from it, so a request refused
-// with 401 would otherwise be served.
-func TestHandleImage_ErrorAnswers(t *testing.T) {
-	t.Parallel()
-
-	// A signature for signedHost must not verify for any of these.
-	parentHost := "example.com"
-	siblingHost := "other.example.com"
-	subdomainHost := "img." + signedHost
-	appendedHost := signedHost + ".example.net"
-
-	photos := newPhotoFetcher(t,
-		signedHost, parentHost, siblingHost, subdomainHost, appendedHost)
-	// The real fetcher refuses localhost before any lookup or connection.
-	realFetcher := httpfetcher.New(httpfetcher.DefaultConfig())
-
-	exp := time.Now().Add(time.Hour)
-	expired := time.Now().Add(-time.Hour)
-	sig := photoSignature(testSigningKey, signedHost, exp)
-	otherKeySig := photoSignature("another-signing-key", signedHost, exp)
-	expiredSig := photoSignature(testSigningKey, signedHost, expired)
-	localhostSig := photoSignature(testSigningKey, "localhost", exp)
-
-	// The error every request refused for its signature gets.
-	const unauthorized = "unauthorized"
-
-	tests := []struct {
-		name       string
-		fetcher    httpfetcher.Fetcher
-		target     string
-		wantStatus int
-		wantError  string
-	}{
-		{"no sig or exp", photos, photoURL(signedHost),
-			http.StatusUnauthorized, unauthorized},
-		{"exp but no sig", photos,
-			fmt.Sprintf("%s?exp=%d", photoURL(signedHost), exp.Unix()),
-			http.StatusUnauthorized, unauthorized},
-		{"sig made with another key", photos,
-			photoURLWithSig(signedHost, otherKeySig, exp),
-			http.StatusUnauthorized, unauthorized},
-		{"sig without its = padding", photos,
-			photoURLWithSig(signedHost, strings.TrimRight(sig, "="), exp),
-			http.StatusUnauthorized, unauthorized},
-		{"sig in upper case", photos,
-			photoURLWithSig(signedHost, strings.ToUpper(sig), exp),
-			http.StatusUnauthorized, unauthorized},
-		{"expired sig", photos, photoURLWithSig(signedHost, expiredSig, expired),
-			http.StatusUnauthorized, unauthorized},
-		{"sig sent for the parent domain", photos,
-			photoURLWithSig(parentHost, sig, exp),
-			http.StatusUnauthorized, unauthorized},
-		{"sig sent for a sibling host", photos,
-			photoURLWithSig(siblingHost, sig, exp),
-			http.StatusUnauthorized, unauthorized},
-		{"sig sent for a subdomain", photos,
-			photoURLWithSig(subdomainHost, sig, exp),
-			http.StatusUnauthorized, unauthorized},
-		{"sig sent with another domain appended", photos,
-			photoURLWithSig(appendedHost, sig, exp),
-			http.StatusUnauthorized, unauthorized},
-		{"unparseable path", photos,
-			"/v1/image/" + allowlistedHost + photoPath + "/big.jpeg",
-			http.StatusBadRequest, "invalid image URL: invalid size format"},
-		{"blocked upstream address", realFetcher,
-			photoURLWithSig("localhost", localhostSig, exp),
-			http.StatusForbidden, "forbidden"},
-		{"upstream error", photos,
-			"/v1/image/" + allowlistedHost + "/images/missing.jpg/50x50.jpeg",
-			http.StatusBadGateway, "upstream error"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			rec := sendGet(t, newImageRoute(t, tt.fetcher), tt.target)
-			checkErrorBody(t, rec, tt.wantStatus, tt.wantError)
-		})
-	}
-}
-
-// TestHandleImage_AllowlistOrSignature checks that the image route serves an
-// image without a signature for a host on the allowlist only, and for another
-// host only with a valid signature.
-func TestHandleImage_AllowlistOrSignature(t *testing.T) {
-	t.Parallel()
-
-	photos := newPhotoFetcher(t, allowlistedHost, signedHost)
-	exp := time.Now().Add(time.Hour)
-	sig := photoSignature(testSigningKey, signedHost, exp)
-
-	tests := []struct {
-		name       string
-		target     string
-		wantStatus int
-	}{
-		{"allowlisted host, no sig", photoURL(allowlistedHost), http.StatusOK},
-		{"other host, no sig", photoURL(signedHost), http.StatusUnauthorized},
-		{"other host, valid sig", photoURLWithSig(signedHost, sig, exp),
-			http.StatusOK},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			rec := sendGet(t, newImageRoute(t, photos), tt.target)
-			if rec.Code != tt.wantStatus {
-				t.Errorf("status = %d, want %d", rec.Code, tt.wantStatus)
-			}
-		})
-	}
-}

internal/handlers/imageenc.go

@@ -9,7 +9,6 @@ import (
 	"time"
 
 	"github.com/go-chi/chi/v5"
-	"github.com/go-chi/chi/v5/middleware"
 
 	"sneak.berlin/go/pixa/internal/encurl"
 	"sneak.berlin/go/pixa/internal/httpfetcher"
@@ -25,8 +24,43 @@ func (s *Handlers) HandleImageEnc() http.HandlerFunc {
 		ctx := r.Context()
 		start := time.Now()
 
-		req, ok := s.parseImageEncRequest(w, r)
-		if !ok {
+		// Extract token from URL
+		token := chi.URLParam(r, "token")
+		if token == "" {
+			s.respondError(w, "missing token", http.StatusBadRequest)
+
+			return
+		}
+
+		// Decrypt and validate the payload
+		payload, err := s.encGen.Parse(token)
+		if err != nil {
+			if errors.Is(err, encurl.ErrExpired) {
+				s.log.Debug("encrypted URL expired", "error", err)
+				s.respondError(w, "URL has expired", http.StatusGone)
+
+				return
+			}
+
+			s.log.Debug("failed to decrypt URL", "error", err)
+			s.respondError(w, "invalid encrypted URL", http.StatusBadRequest)
+
+			return
+		}
+
+		// Convert payload to ImageRequest
+		req := payload.ToImageRequest()
+
+		// Apply the same dimension and fit-mode bounds as the plain image
+		// route: a sealed payload is trusted for its origin, not for staying
+		// within limits, so an over-limit size or unknown fit mode is a 400
+		// here rather than an out-of-memory or a 500 from the processor.
+		err = imgcache.ValidateImageRequest(req)
+		if err != nil {
+			s.log.Debug("encrypted URL failed validation", "error", err)
+			s.respondError(w, "invalid encrypted URL: "+err.Error(),
+				http.StatusBadRequest)
+
 			return
 		}
 
@@ -60,17 +94,6 @@ func (s *Handlers) HandleImageEnc() http.HandlerFunc {
 		w.Header().Set("Cache-Control", cacheControl(req.Expires))
 		w.Header().Set("X-Pixa-Cache", string(resp.CacheStatus))
 
-		if notModified(w, r, resp.ETag) {
-			return
-		}
-
-		// A HEAD request gets the headers only
-		if r.Method == http.MethodHead {
-			w.WriteHeader(http.StatusOK)
-
-			return
-		}
-
 		// Stream the response
 		written, err := io.Copy(w, resp.Content)
 		if err != nil {
@@ -82,7 +105,6 @@ func (s *Handlers) HandleImageEnc() http.HandlerFunc {
 		// Log completion
 		duration := time.Since(start)
 		s.log.Info("image served",
-			"request_id", middleware.GetReqID(ctx),
 			"cache_key", imgcache.CacheKey(req),
 			"host", req.SourceHost,
 			"path", req.SourcePath,
@@ -94,56 +116,6 @@ func (s *Handlers) HandleImageEnc() http.HandlerFunc {
 	}
 }
 
-// parseImageEncRequest decrypts the token of an encrypted image URL into an
-// ImageRequest and checks it. On a token that is missing, does not decrypt,
-// has expired or asks for something not valid, it writes an error response
-// and returns false.
-func (s *Handlers) parseImageEncRequest(
-	w http.ResponseWriter, r *http.Request,
-) (*imgcache.ImageRequest, bool) {
-	// Extract token from URL
-	token := chi.URLParam(r, "token")
-	if token == "" {
-		s.respondError(w, "missing token", http.StatusBadRequest)
-
-		return nil, false
-	}
-
-	// Decrypt and validate the payload
-	payload, err := s.encGen.Parse(token)
-	if err != nil {
-		if errors.Is(err, encurl.ErrExpired) {
-			s.log.Debug("encrypted URL expired", "error", err)
-			s.respondError(w, "URL has expired", http.StatusGone)
-
-			return nil, false
-		}
-
-		s.log.Debug("failed to decrypt URL", "error", err)
-		s.respondError(w, "invalid encrypted URL", http.StatusBadRequest)
-
-		return nil, false
-	}
-
-	// Convert payload to ImageRequest
-	req := payload.ToImageRequest()
-
-	// Apply the same dimension and fit-mode bounds as the plain image
-	// route: a sealed payload is trusted for its origin, not for staying
-	// within limits, so an over-limit size or unknown fit mode is a 400
-	// here rather than an out-of-memory or a 500 from the processor.
-	err = imgcache.ValidateImageRequest(req)
-	if err != nil {
-		s.log.Debug("encrypted URL failed validation", "error", err)
-		s.respondError(w, "invalid encrypted URL: "+err.Error(),
-			http.StatusBadRequest)
-
-		return nil, false
-	}
-
-	return req, true
-}
-
 // handleImageError converts image service errors to HTTP responses.
 func (s *Handlers) handleImageError(w http.ResponseWriter, err error) {
 	switch {

internal/handlers/imageenc_internal_test.go

@@ -96,70 +96,3 @@ func TestHandleImageEnc_InvalidFitMode_Returns400(t *testing.T) {
 		t.Fatalf("status = %d, want %d", rec.Code, http.StatusBadRequest)
 	}
 }
-
-// TestHandleImageEnc_IfNoneMatch_Returns304 verifies that an image served
-// through an encrypted URL carries an ETag, and that a request whose
-// If-None-Match is that ETag is answered 304 Not Modified with no body.
-func TestHandleImageEnc_IfNoneMatch_Returns304(t *testing.T) {
-	t.Parallel()
-
-	h, srv := newSignedHostServer(t, slog.New(slog.DiscardHandler))
-	target := encPhotoURL(t, h)
-
-	rec := httptest.NewRecorder()
-	srv.ServeHTTP(rec, httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, target, nil))
-
-	etag := rec.Header().Get("ETag")
-	t.Logf("GET: %d, ETag %q", rec.Code, etag)
-
-	if rec.Code != http.StatusOK || etag == "" {
-		t.Fatalf("GET: status = %d, ETag = %q, want %d and an ETag",
-			rec.Code, etag, http.StatusOK)
-	}
-
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, target, nil)
-	req.Header.Set("If-None-Match", etag)
-
-	rec = httptest.NewRecorder()
-	srv.ServeHTTP(rec, req)
-	t.Logf("GET with If-None-Match: %d, %d body bytes", rec.Code, rec.Body.Len())
-
-	if rec.Code != http.StatusNotModified || rec.Body.Len() != 0 {
-		t.Errorf("status = %d with %d body bytes, want %d with none",
-			rec.Code, rec.Body.Len(), http.StatusNotModified)
-	}
-}
-
-// TestHandleImageEnc_HEAD_ReturnsHeadersOnly verifies that HEAD on an
-// encrypted URL is answered 200 with the headers GET sends and no body.
-func TestHandleImageEnc_HEAD_ReturnsHeadersOnly(t *testing.T) {
-	t.Parallel()
-
-	h, _ := newSignedHostServer(t, slog.New(slog.DiscardHandler))
-
-	r := chi.NewRouter()
-	r.Head("/v1/e/{token}/*", h.HandleImageEnc())
-
-	rec := httptest.NewRecorder()
-	r.ServeHTTP(rec, httptest.NewRequestWithContext(
-		t.Context(), http.MethodHead, encPhotoURL(t, h), nil))
-	t.Logf("HEAD: %d, headers %v, %d body bytes",
-		rec.Code, rec.Header(), rec.Body.Len())
-
-	if rec.Code != http.StatusOK {
-		t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK)
-	}
-
-	for _, name := range []string{
-		"Content-Type", "Content-Length", "Cache-Control", "ETag",
-	} {
-		if rec.Header().Get(name) == "" {
-			t.Errorf("HEAD response has no %s", name)
-		}
-	}
-
-	if rec.Body.Len() != 0 {
-		t.Errorf("HEAD response body has %d bytes, want none", rec.Body.Len())
-	}
-}

internal/handlers/request_id_internal_test.go

@@ -1,131 +0,0 @@
-package handlers
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"io"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-	"time"
-
-	"github.com/go-chi/chi/v5/middleware"
-
-	"sneak.berlin/go/pixa/internal/encurl"
-	"sneak.berlin/go/pixa/internal/imgcache"
-)
-
-// signedPhotoURL returns a signed /v1/image/ URL, valid for a minute, for the
-// JPEG at photoPath on signedHost at 50x50, made with h's image service.
-func signedPhotoURL(t *testing.T, h *Handlers) string {
-	t.Helper()
-
-	signedURL, err := h.imgSvc.GenerateSignedURL("", &imgcache.ImageRequest{
-		SourceHost: signedHost,
-		SourcePath: photoPath,
-		Size:       imgcache.Size{Width: 50, Height: 50},
-		Format:     imgcache.FormatJPEG,
-	}, time.Minute)
-	if err != nil {
-		t.Fatalf("GenerateSignedURL() error = %v", err)
-	}
-
-	return signedURL
-}
-
-// encPhotoURL returns an encrypted /v1/e/ URL, which never expires, for the
-// JPEG at photoPath on signedHost at 50x50, made with h's generator.
-func encPhotoURL(t *testing.T, h *Handlers) string {
-	t.Helper()
-
-	token, err := h.encGen.Generate(&encurl.Payload{
-		SourceHost: signedHost,
-		SourcePath: photoPath,
-		Width:      50,
-		Height:     50,
-		Format:     imgcache.FormatJPEG,
-	})
-	if err != nil {
-		t.Fatalf("Generate() error = %v", err)
-	}
-
-	return "/v1/e/" + token + "/img.jpg"
-}
-
-// requestIDByMessage reads the JSON log lines in logs and returns the
-// request_id of each line, by its message.
-func requestIDByMessage(t *testing.T, logs io.Reader) map[string]string {
-	t.Helper()
-
-	logged := make(map[string]string)
-
-	dec := json.NewDecoder(logs)
-	for dec.More() {
-		var line map[string]any
-
-		err := dec.Decode(&line)
-		if err != nil {
-			t.Fatalf("decoding log line: %v", err)
-		}
-
-		msg, _ := line["msg"].(string)
-		requestID, _ := line["request_id"].(string)
-		logged[msg] = requestID
-	}
-
-	return logged
-}
-
-// TestImageLogLinesCarryRequestID verifies that the lines logged when an image
-// is fetched, converted and served through either image route carry the
-// request's ID as request_id, as the request log line does, so they can be
-// found from it.
-func TestImageLogLinesCarryRequestID(t *testing.T) {
-	t.Parallel()
-
-	const requestID = "test-request-id"
-
-	imageURLs := map[string]func(*testing.T, *Handlers) string{
-		"/v1/image/": signedPhotoURL,
-		"/v1/e/":     encPhotoURL,
-	}
-
-	for route, imageURL := range imageURLs {
-		t.Run(route, func(t *testing.T) {
-			t.Parallel()
-
-			var logs bytes.Buffer
-
-			h, srv := newSignedHostServer(t,
-				slog.New(slog.NewJSONHandler(&logs, nil)))
-
-			ctx := context.WithValue(t.Context(),
-				middleware.RequestIDKey, requestID)
-			rec := httptest.NewRecorder()
-			srv.ServeHTTP(rec, httptest.NewRequestWithContext(
-				ctx, http.MethodGet, imageURL(t, h), nil))
-
-			if rec.Code != http.StatusOK {
-				t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK)
-			}
-
-			t.Logf("logged:\n%s", logs.String())
-
-			logged := requestIDByMessage(t, &logs)
-
-			for _, msg := range []string{
-				"upstream fetched", "image converted", "image served",
-			} {
-				got, ok := logged[msg]
-				if !ok {
-					t.Errorf("no %q line logged", msg)
-				} else if got != requestID {
-					t.Errorf("%q line has request_id %q, want %q",
-						msg, got, requestID)
-				}
-			}
-		})
-	}
-}

internal/handlers/robots_healthcheck_internal_test.go

@@ -1,90 +0,0 @@
-package handlers
-
-import (
-	"encoding/json"
-	"log/slog"
-	"net/http"
-	"testing"
-
-	"go.uber.org/fx/fxtest"
-	"sneak.berlin/go/pixa/internal/config"
-	"sneak.berlin/go/pixa/internal/globals"
-	"sneak.berlin/go/pixa/internal/healthcheck"
-	"sneak.berlin/go/pixa/internal/logger"
-)
-
-// TestHandleRobotsTxt checks that /robots.txt asks every crawler to stay off
-// the whole site.
-func TestHandleRobotsTxt(t *testing.T) {
-	t.Parallel()
-
-	h := &Handlers{log: slog.New(slog.DiscardHandler)}
-	rec := sendGet(t, h.HandleRobotsTxt(), "/robots.txt")
-
-	if rec.Code != http.StatusOK {
-		t.Errorf("status = %d, want %d", rec.Code, http.StatusOK)
-	}
-
-	if ct := rec.Header().Get("Content-Type"); ct != "text/plain" {
-		t.Errorf("Content-Type = %q, want text/plain", ct)
-	}
-
-	want := "User-agent: *\nDisallow: /\n"
-	if rec.Body.String() != want {
-		t.Errorf("body = %q, want %q", rec.Body.String(), want)
-	}
-}
-
-// TestHandleHealthCheck checks that the health check answers 200 with status
-// ok, the app's name and version, now, uptime_seconds, uptime_human and
-// maintenance_mode, which is true here: the health check stays 200 while
-// maintenance mode is on.
-func TestHandleHealthCheck(t *testing.T) {
-	t.Parallel()
-
-	lc := fxtest.NewLifecycle(t)
-
-	log, err := logger.New(lc, logger.Params{Globals: &globals.Globals{}})
-	if err != nil {
-		t.Fatalf("logger.New() error = %v", err)
-	}
-
-	hc, err := healthcheck.New(lc, healthcheck.Params{
-		Globals: &globals.Globals{Appname: "pixad", Version: "v1.2.3"},
-		Config:  &config.Config{MaintenanceMode: true},
-		Logger:  log,
-	})
-	if err != nil {
-		t.Fatalf("healthcheck.New() error = %v", err)
-	}
-
-	h := &Handlers{hc: hc, log: slog.New(slog.DiscardHandler)}
-	rec := sendGet(t, h.HandleHealthCheck(), "/.well-known/healthcheck.json")
-
-	if rec.Code != http.StatusOK {
-		t.Errorf("status = %d, want %d", rec.Code, http.StatusOK)
-	}
-
-	if ct := rec.Header().Get("Content-Type"); ct != "application/json" {
-		t.Errorf("Content-Type = %q, want application/json", ct)
-	}
-
-	var body map[string]any
-
-	err = json.NewDecoder(rec.Body).Decode(&body)
-	if err != nil {
-		t.Fatalf("decoding response body: %v", err)
-	}
-
-	if body["status"] != "ok" || body["appname"] != "pixad" ||
-		body["version"] != "v1.2.3" || body["maintenance_mode"] != true {
-		t.Errorf("body = %v, want status ok, appname pixad, version v1.2.3 "+
-			"and maintenance_mode true", body)
-	}
-
-	for _, key := range []string{"now", "uptime_seconds", "uptime_human"} {
-		if _, ok := body[key]; !ok {
-			t.Errorf("body = %v, has no %s", body, key)
-		}
-	}
-}

internal/httpfetcher/httpfetcher.go

@@ -18,8 +18,6 @@ import (
 	"strings"
 	"sync"
 	"time"
-
-	"github.com/go-chi/chi/v5/middleware"
 )
 
 // Fetcher configuration constants.
@@ -269,13 +267,6 @@ func (f *HTTPFetcher) Fetch(ctx context.Context, url string) (*FetchResult, erro
 	req.Header.Set("User-Agent", f.config.UserAgent)
 	req.Header.Set("Accept", strings.Join(f.config.AllowedContentTypes, ", "))
 
-	// The ID of the request this fetch serves, so the fetch can be found in
-	// the upstream host's logs
-	requestID := middleware.GetReqID(ctx)
-	if requestID != "" {
-		req.Header.Set(middleware.RequestIDHeader, requestID)
-	}
-
 	// Use httptrace to capture connection details
 	var remoteAddr string
 

internal/httpfetcher/request_id_internal_test.go

@@ -1,50 +0,0 @@
-package httpfetcher
-
-import (
-	"context"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/go-chi/chi/v5/middleware"
-)
-
-// TestFetchSendsRequestID verifies that a fetch sends the ID of the request
-// it serves, which the RequestID middleware stores in the request context,
-// to the upstream host as X-Request-Id, so the fetch can be found in that
-// host's logs.
-func TestFetchSendsRequestID(t *testing.T) {
-	t.Parallel()
-
-	const requestID = "test-request-id"
-
-	received := make(chan string, 1)
-
-	srv := httptest.NewServer(http.HandlerFunc(
-		func(w http.ResponseWriter, r *http.Request) {
-			received <- r.Header.Get("X-Request-Id")
-
-			w.Header().Set("Content-Type", contentTypeJPEG)
-			_, _ = io.WriteString(w, imagePayload)
-		}))
-	t.Cleanup(srv.Close)
-
-	f, _ := newServerFetcher(t, srv, nil)
-
-	ctx := context.WithValue(testContext(t), middleware.RequestIDKey, requestID)
-
-	res, err := f.Fetch(ctx, upstreamURL("/image"))
-	if err != nil {
-		t.Fatalf("Fetch() error = %v", err)
-	}
-
-	_ = res.Content.Close()
-
-	got := <-received
-	t.Logf("upstream received X-Request-Id %q", got)
-
-	if got != requestID {
-		t.Errorf("upstream X-Request-Id = %q, want %q", got, requestID)
-	}
-}

internal/imgcache/cache.go

@@ -11,6 +11,7 @@ import (
 	"io"
 	"log/slog"
 	"path/filepath"
+	"sync"
 	"time"
 
 	lru "github.com/hashicorp/golang-lru/v2"
@@ -37,16 +38,11 @@ type CacheConfig struct {
 	NegativeTTL time.Duration
 
 	// MaxBytes is the disk cache size limit in bytes that eviction
-	// enforces. Zero means no limit is enforced (no eviction).
+	// enforces. Zero means no limit is enforced (no eviction). The
+	// config layer supplies the computed default when the operator
+	// omits cache_max_bytes.
 	MaxBytes int64
 
-	// UseDefaultMaxBytes makes NewCache replace MaxBytes with the
-	// default limit: 75% of the sum of the space free on the filesystem
-	// holding the cache and the bytes the cache already holds, at least
-	// DefaultCacheMaxBytesFloor. The config layer sets this when the
-	// operator omits cache_max_bytes.
-	UseDefaultMaxBytes bool
-
 	// DisableDiskCache turns the disk cache off entirely: no cache
 	// directories are created, lookups always miss, stores are
 	// no-ops, and no eviction machinery runs. The config layer sets
@@ -73,11 +69,11 @@ type Cache struct {
 
 	// Eviction machinery. The channels are created in NewCache so
 	// stores can signal write pressure without racing StartEviction.
-	// evictionCancel, set by StartEviction, cancels the eviction
-	// goroutine's context.
 	evictionPressure chan struct{}
+	evictionStop     chan struct{}
 	evictionDone     chan struct{}
-	evictionCancel   context.CancelFunc
+	evictionStarted  bool
+	evictionStopOnce sync.Once
 
 	// metaCache holds the content types of the variants most recently
 	// stored or served, so a hit does not read the variant's .meta file.
@@ -116,6 +112,7 @@ func NewCache(db *sql.DB, config CacheConfig) (*Cache, error) {
 		log:              log,
 		disabled:         config.DisableDiskCache,
 		evictionPressure: make(chan struct{}, 1),
+		evictionStop:     make(chan struct{}),
 		evictionDone:     make(chan struct{}),
 		metaCache:        metaCache,
 		contentLocks:     newContentLock(),
@@ -150,20 +147,6 @@ func NewCache(db *sql.DB, config CacheConfig) (*Cache, error) {
 	c.variants = variants
 	c.srcMetadata = srcMetadata
 
-	if config.UseDefaultMaxBytes {
-		limit, err := c.computeDefaultMaxBytes(context.Background(), defaultFreeSpaceProbe)
-		if err != nil {
-			return nil, err
-		}
-
-		c.config.MaxBytes = limit
-
-		log.Info("computed default cache size limit from free space and cache contents",
-			"cache_max_bytes", limit,
-			"cache_dir", filepath.Join(config.StateDir, "cache"),
-		)
-	}
-
 	return c, nil
 }
 

internal/imgcache/cachesize.go

@@ -1,89 +0,0 @@
-package imgcache
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"math"
-	"path/filepath"
-	"syscall"
-)
-
-// DefaultCacheMaxBytesFloor is the minimum computed default for the
-// cache_max_bytes setting: 500 MiB. The floor applies only to the
-// computed default (when the key is omitted from the configuration),
-// never to explicitly configured values.
-const DefaultCacheMaxBytesFloor int64 = 524288000
-
-// freeSpaceFractionNumerator and freeSpaceFractionDenominator express
-// the 75% share used for the computed default limit as integer
-// arithmetic (dividing before multiplying avoids overflow).
-const (
-	freeSpaceFractionNumerator   uint64 = 3
-	freeSpaceFractionDenominator uint64 = 4
-)
-
-var errNegativeBlockSize = errors.New("statfs reported negative block size")
-
-// FreeSpaceProbeFunc reports the number of free bytes available on the
-// filesystem containing path. It is a function type so tests can
-// inject a fake probe instead of depending on the host disk.
-type FreeSpaceProbeFunc func(path string) (uint64, error)
-
-// defaultFreeSpaceProbe reports free filesystem bytes via statfs on
-// the given path, as available to unprivileged processes.
-func defaultFreeSpaceProbe(path string) (uint64, error) {
-	var stat syscall.Statfs_t
-
-	err := syscall.Statfs(path, &stat)
-	if err != nil {
-		return 0, err
-	}
-
-	if stat.Bsize < 0 {
-		return 0, fmt.Errorf("%w %d for %q", errNegativeBlockSize, stat.Bsize, path)
-	}
-
-	blockSize := uint64(stat.Bsize)
-
-	return stat.Bavail * blockSize, nil
-}
-
-// computeDefaultMaxBytes returns the default cache size limit: 75% of
-// the sum of the free bytes probe reports for <state_dir>/cache/ and
-// the bytes the cache already holds, with a floor of
-// DefaultCacheMaxBytesFloor. Counting what the cache holds keeps the
-// limit from shrinking as the cache fills.
-func (c *Cache) computeDefaultMaxBytes(
-	ctx context.Context, probe FreeSpaceProbeFunc,
-) (int64, error) {
-	cacheDir := filepath.Join(c.config.StateDir, "cache")
-
-	freeBytes, err := probe(cacheDir)
-	if err != nil {
-		return 0, fmt.Errorf(
-			"default cache_max_bytes: cannot determine free space for %q: %w",
-			cacheDir, err)
-	}
-
-	usedBytes, err := c.UsageBytes(ctx)
-	if err != nil {
-		return 0, err
-	}
-
-	// Both terms are at most math.MaxInt64, so the sum cannot overflow.
-	//nolint:gosec // G115: UsageBytes sums file sizes, never negative
-	spaceBytes := min(freeBytes, math.MaxInt64) + uint64(usedBytes)
-
-	computed := spaceBytes / freeSpaceFractionDenominator * freeSpaceFractionNumerator
-	computed = min(computed, math.MaxInt64)
-
-	// gosec cannot see that min() above bounds computed, so it reads
-	// this conversion as potentially overflowing. It cannot: computed is
-	// at most math.MaxInt64 on every path here.
-	//nolint:gosec // G115: clamped to MaxInt64 by min above
-	limit := int64(computed)
-	limit = max(limit, DefaultCacheMaxBytesFloor)
-
-	return limit, nil
-}

internal/imgcache/cachesize_internal_test.go

@@ -1,178 +0,0 @@
-package imgcache
-
-import (
-	"errors"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// errTestStatfsFailed is returned by the failing free-space probe below.
-var errTestStatfsFailed = errors.New("statfs failed")
-
-// TestComputeDefaultMaxBytesCountsWhatTheCacheHolds verifies that the
-// default limit is 75% of the free space plus what the cache already
-// holds, so a cache filled to its limit keeps that limit across a
-// restart instead of shrinking to 75% of the space left free.
-func TestComputeDefaultMaxBytesCountsWhatTheCacheHolds(t *testing.T) {
-	t.Parallel()
-
-	cache, _ := newEvictionTestCache(t, 1<<30)
-
-	// Empty cache, 4 GiB free -> 3 GiB default.
-	got, err := cache.computeDefaultMaxBytes(t.Context(),
-		func(string) (uint64, error) { return 4294967296, nil })
-	if err != nil {
-		t.Fatalf("computeDefaultMaxBytes returned error: %v", err)
-	}
-
-	if got != 3221225472 {
-		t.Errorf("default for an empty cache = %d, want 3221225472 (75%% of 4 GiB)",
-			got)
-	}
-
-	// The cache now holds those 3 GiB, which leaves 1 GiB free.
-	_, err = cache.db.ExecContext(t.Context(),
-		`INSERT INTO variant_content (cache_key, size_bytes, content_type)
-		 VALUES (?, ?, ?)`,
-		string(testVariantKeyOne), 3221225472, testContentTypeWebP,
-	)
-	if err != nil {
-		t.Fatalf("failed to insert variant accounting row: %v", err)
-	}
-
-	got, err = cache.computeDefaultMaxBytes(t.Context(),
-		func(string) (uint64, error) { return 1073741824, nil })
-	if err != nil {
-		t.Fatalf("computeDefaultMaxBytes returned error: %v", err)
-	}
-
-	if got != 3221225472 {
-		t.Errorf("default for a cache holding 3 GiB with 1 GiB free = %d, "+
-			"want 3221225472 (75%% of 1 GiB + 3 GiB)", got)
-	}
-}
-
-// TestComputeDefaultMaxBytesAppliesFloor verifies that when 75% of the
-// free space plus what the cache holds is below 500 MiB, the default
-// is floored at DefaultCacheMaxBytesFloor.
-func TestComputeDefaultMaxBytesAppliesFloor(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		name      string
-		freeBytes uint64
-	}{
-		{name: "100 MiB free", freeBytes: 104857600},
-		{name: "zero free", freeBytes: 0},
-		{name: "just below floor threshold", freeBytes: 699050665},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			cache, _ := newEvictionTestCache(t, 1<<30)
-
-			got, err := cache.computeDefaultMaxBytes(t.Context(),
-				func(string) (uint64, error) { return tc.freeBytes, nil })
-			if err != nil {
-				t.Fatalf("computeDefaultMaxBytes returned error: %v", err)
-			}
-
-			if got != DefaultCacheMaxBytesFloor {
-				t.Errorf("computeDefaultMaxBytes = %d, want floor %d",
-					got, DefaultCacheMaxBytesFloor)
-			}
-		})
-	}
-}
-
-// TestComputeDefaultMaxBytesPropagatesProbeError verifies that a
-// failing free-space probe produces an error naming cache_max_bytes,
-// instead of a silently wrong default.
-func TestComputeDefaultMaxBytesPropagatesProbeError(t *testing.T) {
-	t.Parallel()
-
-	cache, _ := newEvictionTestCache(t, 1<<30)
-
-	_, err := cache.computeDefaultMaxBytes(t.Context(),
-		func(string) (uint64, error) { return 0, errTestStatfsFailed })
-	if err == nil {
-		t.Fatal("probe failure must produce an error, got nil")
-	}
-
-	t.Logf("got expected error: %v", err)
-
-	if !strings.Contains(err.Error(), "cache_max_bytes") {
-		t.Errorf("error %q does not name cache_max_bytes", err.Error())
-	}
-}
-
-// TestComputeDefaultMaxBytesProbesTheCacheDirectory verifies that the
-// probe is pointed at <state_dir>/cache/ and that the directory exists
-// by then, so statfs measures the filesystem that holds the cache.
-func TestComputeDefaultMaxBytesProbesTheCacheDirectory(t *testing.T) {
-	t.Parallel()
-
-	cache, stateDir := newEvictionTestCache(t, 1<<30)
-	wantCacheDir := filepath.Join(stateDir, "cache")
-
-	var probedPath string
-
-	_, err := cache.computeDefaultMaxBytes(t.Context(),
-		func(path string) (uint64, error) {
-			probedPath = path
-
-			info, err := os.Stat(path)
-			if err != nil || !info.IsDir() {
-				t.Errorf("cache directory %q missing when probed: info=%v err=%v",
-					path, info, err)
-			}
-
-			return 4294967296, nil
-		})
-	if err != nil {
-		t.Fatalf("computeDefaultMaxBytes returned error: %v", err)
-	}
-
-	if probedPath != wantCacheDir {
-		t.Errorf("free space probed at %q, want cache directory %q",
-			probedPath, wantCacheDir)
-	}
-}
-
-// TestNewCacheUsesDefaultMaxBytesOnlyWhenAsked verifies that NewCache
-// replaces MaxBytes with the computed default when UseDefaultMaxBytes
-// is set, and keeps MaxBytes as given otherwise.
-func TestNewCacheUsesDefaultMaxBytesOnlyWhenAsked(t *testing.T) {
-	t.Parallel()
-
-	withDefault, err := NewCache(evictionTestDB(t), CacheConfig{
-		StateDir:           t.TempDir(),
-		MaxBytes:           1024,
-		UseDefaultMaxBytes: true,
-	})
-	if err != nil {
-		t.Fatalf("NewCache with UseDefaultMaxBytes failed: %v", err)
-	}
-
-	if withDefault.config.MaxBytes < DefaultCacheMaxBytesFloor {
-		t.Errorf("MaxBytes with UseDefaultMaxBytes = %d, want the default, "+
-			"at least %d", withDefault.config.MaxBytes, DefaultCacheMaxBytesFloor)
-	}
-
-	explicit, err := NewCache(evictionTestDB(t), CacheConfig{
-		StateDir: t.TempDir(),
-		MaxBytes: 1024,
-	})
-	if err != nil {
-		t.Fatalf("NewCache failed: %v", err)
-	}
-
-	if explicit.config.MaxBytes != 1024 {
-		t.Errorf("MaxBytes without UseDefaultMaxBytes = %d, want 1024",
-			explicit.config.MaxBytes)
-	}
-}

internal/imgcache/eviction.go

@@ -117,10 +117,7 @@ func (c *Cache) EvictToLimit(ctx context.Context) error {
 
 // evictBatch fetches one batch of LRU candidates across variants and
 // source blobs and evicts them oldest-first until excessBytes are
-// freed or the batch is exhausted. It returns the bytes freed. A
-// candidate that fails once ctx is cancelled (every one started after
-// that fails at its first database call) ends the batch with ctx's
-// error, without a warning.
+// freed or the batch is exhausted. It returns the bytes freed.
 func (c *Cache) evictBatch(ctx context.Context, excessBytes int64) (int64, error) {
 	candidates, err := c.evictionCandidates(ctx)
 	if err != nil {
@@ -136,10 +133,6 @@ func (c *Cache) evictBatch(ctx context.Context, excessBytes int64) (int64, error
 
 		err := c.evictCandidate(ctx, candidate)
 		if err != nil {
-			if ctx.Err() != nil {
-				return freed, ctx.Err()
-			}
-
 			c.log.Warn("failed to evict cache entry",
 				"cache_key", candidate.cacheKey,
 				"content_hash", candidate.contentHash,
@@ -431,44 +424,37 @@ func (c *Cache) notifyWritePressure() {
 // startup and again on every periodic tick thereafter, and evicts to
 // the configured limit on the given periodic interval and on
 // write-pressure notifications. It is a no-op on a disabled cache or
-// when already started. The goroutine outlives the caller, so it runs
-// with its own context, which StopEviction cancels.
+// when already started.
 func (c *Cache) StartEviction(interval time.Duration) {
-	if c.disabled || c.evictionCancel != nil {
+	if c.disabled || c.evictionStarted {
 		return
 	}
 
-	ctx, cancel := context.WithCancel(context.Background())
-	c.evictionCancel = cancel
+	c.evictionStarted = true
 
-	go c.evictionLoop(ctx, interval)
+	go c.evictionLoop(interval)
 }
 
-// StopEviction cancels the background eviction goroutine, which
-// interrupts a pass in progress, and waits for it to exit or for ctx to
-// end, whichever comes first. In the second case it returns an error
-// wrapping ctx's error. It is safe to call when eviction was never
-// started, and safe to call more than once.
-func (c *Cache) StopEviction(ctx context.Context) error {
-	if c.evictionCancel == nil {
-		return nil
+// StopEviction stops the background eviction goroutine and waits for
+// it to exit. It is safe to call when eviction was never started, and
+// safe to call more than once.
+func (c *Cache) StopEviction() {
+	if !c.evictionStarted {
+		return
 	}
 
-	c.evictionCancel()
-
-	select {
-	case <-c.evictionDone:
-		return nil
-	case <-ctx.Done():
-		return fmt.Errorf("cache eviction still running: %w", ctx.Err())
-	}
+	c.evictionStopOnce.Do(func() {
+		close(c.evictionStop)
+		<-c.evictionDone
+	})
 }
 
-// evictionLoop is the body of the background eviction goroutine. It
-// returns when ctx is cancelled, and starts no pass after that.
-func (c *Cache) evictionLoop(ctx context.Context, interval time.Duration) {
+// evictionLoop is the body of the background eviction goroutine.
+func (c *Cache) evictionLoop(interval time.Duration) {
 	defer close(c.evictionDone)
 
+	ctx := context.Background()
+
 	c.runReconciliationPass(ctx)
 	c.runEvictionPass(ctx)
 
@@ -477,7 +463,7 @@ func (c *Cache) evictionLoop(ctx context.Context, interval time.Duration) {
 
 	for {
 		select {
-		case <-ctx.Done():
+		case <-c.evictionStop:
 			return
 		case <-ticker.C:
 			// Reconciliation walks the cache directories, so it only
@@ -498,13 +484,8 @@ func (c *Cache) evictionLoop(ctx context.Context, interval time.Duration) {
 }
 
 // runEvictionPass runs one eviction pass, logging failures instead of
-// propagating them (the loop must keep running). It does nothing once
-// ctx is cancelled.
+// propagating them (the loop must keep running).
 func (c *Cache) runEvictionPass(ctx context.Context) {
-	if ctx.Err() != nil {
-		return
-	}
-
 	err := c.EvictToLimit(ctx)
 	if err != nil {
 		c.log.Warn("cache eviction pass failed", "error", err)
@@ -512,13 +493,8 @@ func (c *Cache) runEvictionPass(ctx context.Context) {
 }
 
 // runReconciliationPass runs one reconciliation pass, logging failures
-// instead of propagating them (the loop must keep running). It does
-// nothing once ctx is cancelled.
+// instead of propagating them (the loop must keep running).
 func (c *Cache) runReconciliationPass(ctx context.Context) {
-	if ctx.Err() != nil {
-		return
-	}
-
 	err := c.reconcileAccounting(ctx)
 	if err != nil {
 		c.log.Warn("cache accounting reconciliation failed", "error", err)
@@ -535,8 +511,7 @@ func (c *Cache) runReconciliationPass(ctx context.Context) {
 // know (and rows whose files are gone), and sweeps stale temp files
 // left behind by crashed writes. Running it periodically, not just
 // once, bounds how long such drift can accumulate unaccounted for on a
-// long-running process to one eviction interval. Once ctx is cancelled,
-// it stops at the next file or row and returns ctx's error.
+// long-running process to one eviction interval.
 func (c *Cache) reconcileAccounting(ctx context.Context) error {
 	if c.disabled {
 		return nil
@@ -571,10 +546,6 @@ func (c *Cache) reconcileVariantFiles(ctx context.Context) error {
 	return filepath.WalkDir(
 		c.variants.baseDir,
 		func(path string, entry fs.DirEntry, err error) error {
-			if ctx.Err() != nil {
-				return ctx.Err()
-			}
-
 			if err != nil || entry.IsDir() {
 				return err
 			}
@@ -663,10 +634,6 @@ func (c *Cache) reconcileVariantRows(ctx context.Context) error {
 	}
 
 	for _, key := range keys {
-		if ctx.Err() != nil {
-			return ctx.Err()
-		}
-
 		if c.variants.Exists(key) {
 			continue
 		}
@@ -732,10 +699,6 @@ func (c *Cache) reconcileSourceFiles(ctx context.Context) error {
 	return filepath.WalkDir(
 		c.srcContent.baseDir,
 		func(path string, entry fs.DirEntry, err error) error {
-			if ctx.Err() != nil {
-				return ctx.Err()
-			}
-
 			if err != nil || entry.IsDir() {
 				return err
 			}
@@ -797,10 +760,6 @@ func (c *Cache) reconcileSourceRows(ctx context.Context) error {
 	}
 
 	for _, hash := range hashes {
-		if ctx.Err() != nil {
-			return ctx.Err()
-		}
-
 		if c.srcContent.Exists(hash) {
 			continue
 		}

internal/imgcache/eviction_internal_test.go

@@ -4,12 +4,9 @@ import (
 	"bytes"
 	"context"
 	"database/sql"
-	"errors"
 	"io/fs"
-	"log/slog"
 	"os"
 	"path/filepath"
-	"strings"
 	"testing"
 	"time"
 
@@ -660,7 +657,7 @@ func TestEvictionRunsUnderWritePressure(t *testing.T) {
 	// An interval far longer than the test ensures only write
 	// pressure can trigger eviction here.
 	cache.StartEviction(time.Hour)
-	defer func() { _ = cache.StopEviction(t.Context()) }()
+	defer cache.StopEviction()
 
 	keys := []VariantKey{
 		testVariantKeyOne, testVariantKeyTwo, testVariantKeyThree,
@@ -693,7 +690,7 @@ func TestEvictionRunsOnPeriodicSchedule(t *testing.T) {
 	// write-pressure notification fires and only the periodic ticker
 	// can trigger eviction.
 	cache.StartEviction(100 * time.Millisecond)
-	defer func() { _ = cache.StopEviction(t.Context()) }()
+	defer cache.StopEviction()
 
 	keys := []VariantKey{
 		testVariantKeyOne, testVariantKeyTwo, testVariantKeyThree,
@@ -754,7 +751,7 @@ func TestStartEvictionReconcilesAccountingWithDisk(t *testing.T) {
 	}
 
 	cache.StartEviction(time.Hour)
-	defer func() { _ = cache.StopEviction(t.Context()) }()
+	defer cache.StopEviction()
 
 	deadline := time.Now().Add(5 * time.Second)
 
@@ -811,7 +808,7 @@ func TestPeriodicReconciliationAdoptsFileThatAppearsAfterStartup(t *testing.T) {
 	const interval = 100 * time.Millisecond
 
 	cache.StartEviction(interval)
-	defer func() { _ = cache.StopEviction(t.Context()) }()
+	defer cache.StopEviction()
 
 	// Let startup reconciliation run and settle on an empty cache
 	// before introducing the untracked file, so the adoption we assert
@@ -865,242 +862,6 @@ func TestPeriodicReconciliationAdoptsFileThatAppearsAfterStartup(t *testing.T) {
 	}
 }
 
-// TestStopEvictionInterruptsPassInProgress holds the test database's
-// only connection, so the startup reconciliation pass waits for it, and
-// checks that StopEviction stops that pass instead of waiting for the
-// connection to come free, and that the stop logs one warning: the
-// interrupted reconciliation's, with no eviction pass started after it.
-func TestStopEvictionInterruptsPassInProgress(t *testing.T) {
-	t.Parallel()
-
-	cache, _ := newEvictionTestCache(t, 1<<30)
-
-	var logBuf bytes.Buffer
-
-	cache.log = slog.New(slog.NewJSONHandler(&logBuf, nil))
-
-	conn, err := cache.db.Conn(t.Context())
-	if err != nil {
-		t.Fatalf("failed to take the database connection: %v", err)
-	}
-
-	defer func() { _ = conn.Close() }()
-
-	cache.StartEviction(time.Hour)
-
-	// The pass is in progress once it waits for the connection.
-	deadline := time.Now().Add(5 * time.Second)
-
-	for cache.db.Stats().WaitCount == 0 {
-		if time.Now().After(deadline) {
-			t.Fatal("the reconciliation pass never waited for the database")
-		}
-
-		time.Sleep(10 * time.Millisecond)
-	}
-
-	ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
-	defer cancel()
-
-	err = cache.StopEviction(ctx)
-	t.Logf("StopEviction() error = %v", err)
-
-	if err != nil {
-		t.Fatalf("StopEviction() error = %v, want nil: the pass waiting for "+
-			"the database did not stop", err)
-	}
-
-	t.Logf("log output: %s", logBuf.String())
-
-	warnings := strings.Count(logBuf.String(), `"level":"WARN"`)
-	if warnings != 1 {
-		t.Errorf("the stop logged %d warnings, want 1", warnings)
-	}
-}
-
-// TestEvictToLimitStopsAtNextCandidateOnceCancelled cancels the context
-// while the oldest of three source blobs is being evicted, and checks that
-// EvictToLimit then returns context.Canceled without evicting the other
-// two or logging a warning for either of them.
-func TestEvictToLimitStopsAtNextCandidateOnceCancelled(t *testing.T) {
-	t.Parallel()
-
-	cache, _ := newEvictionTestCache(t, 1)
-
-	var logBuf bytes.Buffer
-
-	cache.log = slog.New(slog.NewJSONHandler(&logBuf, nil))
-
-	hashes := []ContentHash{
-		storeEvictionTestSource(t, cache, "cancel.example.com", "/a.jpg",
-			bytes.Repeat([]byte{0x61}, 1000)),
-		storeEvictionTestSource(t, cache, "cancel.example.com", "/b.jpg",
-			bytes.Repeat([]byte{0x62}, 1000)),
-		storeEvictionTestSource(t, cache, "cancel.example.com", "/c.jpg",
-			bytes.Repeat([]byte{0x63}, 1000)),
-	}
-
-	base := time.Now().Add(-time.Hour)
-
-	for i, hash := range hashes {
-		setSourceLastAccessed(t, cache, hash, base.Add(time.Duration(i)*time.Minute))
-	}
-
-	ctx, cancel := context.WithCancel(t.Context())
-	defer cancel()
-
-	cache.evictSourceBlobTestHook = func(ContentHash) { cancel() }
-
-	err := cache.EvictToLimit(ctx)
-	t.Logf("EvictToLimit() error = %v", err)
-	t.Logf("log output: %s", logBuf.String())
-
-	if !errors.Is(err, context.Canceled) {
-		t.Errorf("EvictToLimit() error = %v, want context.Canceled", err)
-	}
-
-	if cache.srcContent.Exists(hashes[0]) {
-		t.Errorf("source blob %s, evicted when the context was cancelled, "+
-			"is still on disk", hashes[0])
-	}
-
-	for _, hash := range hashes[1:] {
-		if !cache.srcContent.Exists(hash) {
-			t.Errorf("source blob %s was evicted after the context was cancelled", hash)
-		}
-	}
-
-	if strings.Contains(logBuf.String(), `"level":"WARN"`) {
-		t.Errorf("EvictToLimit logged a warning after the context was cancelled")
-	}
-
-	assertNoDanglingReferences(t, cache)
-}
-
-// TestStopEvictionReturnsWhenItsContextEnds pauses an eviction pass where
-// cancellation cannot reach it, after a source blob's rows are deleted and
-// before its file is removed, and checks that StopEviction returns its
-// context's error when that context ends instead of waiting for the pass.
-// Once the pass goes on, the goroutine exits and no row points at a
-// missing file.
-func TestStopEvictionReturnsWhenItsContextEnds(t *testing.T) {
-	t.Parallel()
-
-	cache, _ := newEvictionTestCache(t, 1)
-
-	paused := make(chan struct{})
-	resume := make(chan struct{})
-
-	cache.evictSourceBlobTestHook = func(ContentHash) {
-		close(paused)
-		<-resume
-	}
-
-	hash := storeEvictionTestSource(t, cache, "stop.example.com", "/a.jpg",
-		bytes.Repeat([]byte{0x61}, 1000))
-
-	cache.StartEviction(time.Hour)
-
-	select {
-	case <-paused:
-	case <-time.After(5 * time.Second):
-		t.Fatal("the eviction pass never reached the source blob")
-	}
-
-	ctx, cancel := context.WithTimeout(t.Context(), 50*time.Millisecond)
-	defer cancel()
-
-	err := cache.StopEviction(ctx)
-	t.Logf("StopEviction() error = %v", err)
-
-	if !errors.Is(err, context.DeadlineExceeded) {
-		t.Errorf("StopEviction() error = %v, want context.DeadlineExceeded", err)
-	}
-
-	close(resume)
-
-	err = cache.StopEviction(t.Context())
-	if err != nil {
-		t.Fatalf("second StopEviction() error = %v, want nil", err)
-	}
-
-	assertNoDanglingReferences(t, cache)
-
-	if cache.srcContent.Exists(hash) {
-		t.Errorf("source blob %s is still on disk after its rows were deleted", hash)
-	}
-}
-
-// TestReconciliationWalksStopOnceCancelled checks that both directory
-// walks of a reconciliation pass return the context's error once it is
-// cancelled, leaving in place a stale temp file they would otherwise
-// remove.
-func TestReconciliationWalksStopOnceCancelled(t *testing.T) {
-	t.Parallel()
-
-	cache, _ := newEvictionTestCache(t, 1<<30)
-
-	ctx, cancel := context.WithCancel(t.Context())
-	cancel()
-
-	staleTime := time.Now().Add(-2 * staleTempFileAge)
-
-	walks := map[string]func(context.Context) error{
-		cache.variants.baseDir:   cache.reconcileVariantFiles,
-		cache.srcContent.baseDir: cache.reconcileSourceFiles,
-	}
-
-	for dir, walk := range walks {
-		tempFile := filepath.Join(dir, tempFilePrefix+"stale")
-
-		err := os.WriteFile(tempFile, []byte("partial"), 0o600)
-		if err != nil {
-			t.Fatalf("failed to write temp file: %v", err)
-		}
-
-		err = os.Chtimes(tempFile, staleTime, staleTime)
-		if err != nil {
-			t.Fatalf("failed to backdate temp file: %v", err)
-		}
-
-		err = walk(ctx)
-		t.Logf("walk of %s: error = %v", dir, err)
-
-		if !errors.Is(err, context.Canceled) {
-			t.Errorf("walk of %s: error = %v, want context.Canceled", dir, err)
-		}
-
-		_, err = os.Stat(tempFile)
-		if err != nil {
-			t.Errorf("walk of %s went on after cancellation: %v", dir, err)
-		}
-	}
-}
-
-// TestReconciliationPassLogsNoWarningOnceCancelled checks that a
-// reconciliation pass run with an already cancelled context logs no
-// warning, so a periodic tick the loop takes after a stop adds no
-// warning to the one from the pass the stop interrupted.
-func TestReconciliationPassLogsNoWarningOnceCancelled(t *testing.T) {
-	t.Parallel()
-
-	cache, _ := newEvictionTestCache(t, 1<<30)
-
-	var logBuf bytes.Buffer
-
-	cache.log = slog.New(slog.NewJSONHandler(&logBuf, nil))
-
-	ctx, cancel := context.WithCancel(t.Context())
-	cancel()
-
-	cache.runReconciliationPass(ctx)
-	t.Logf("log output: %s", logBuf.String())
-
-	if strings.Contains(logBuf.String(), `"level":"WARN"`) {
-		t.Errorf("runReconciliationPass logged a warning with a cancelled context")
-	}
-}
-
 // TestEvictSourceBlobExcludesConcurrentStoreOfIdenticalContent exercises
 // the exact TOCTOU window between evictSourceBlob's row-deletion
 // transaction commit and its content file unlink: a concurrent

internal/imgcache/imgcache.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"errors"
 	"io"
+	"net/url"
 	"time"
 )
 
@@ -153,6 +154,9 @@ type ImageCache interface {
 	// Warm pre-fetches and caches an image without returning it
 	Warm(ctx context.Context, req *ImageRequest) error
 
+	// Purge removes a cached image
+	Purge(ctx context.Context, req *ImageRequest) error
+
 	// Stats returns cache statistics
 	Stats(ctx context.Context) (*CacheStats, error)
 }
@@ -172,3 +176,29 @@ type CacheStats struct {
 	// HitRate is HitCount / (HitCount + MissCount)
 	HitRate float64
 }
+
+// SignatureValidator validates request signatures
+type SignatureValidator interface {
+	// Validate checks if the signature is valid for the request
+	Validate(req *ImageRequest) error
+	// Generate creates a signature for a request
+	Generate(req *ImageRequest) string
+}
+
+// Allowlist checks if a URL is allowlisted (no signature required)
+type Allowlist interface {
+	// IsAllowlisted returns true if the URL doesn't require a signature
+	IsAllowlisted(u *url.URL) bool
+}
+
+// Storage handles persistent storage of cached content
+type Storage interface {
+	// Store saves content and returns its hash
+	Store(ctx context.Context, content io.Reader) (hash string, err error)
+	// Load retrieves content by hash
+	Load(ctx context.Context, hash string) (io.ReadCloser, error)
+	// Delete removes content by hash
+	Delete(ctx context.Context, hash string) error
+	// Exists checks if content exists
+	Exists(ctx context.Context, hash string) (bool, error)
+}

internal/imgcache/service.go

@@ -13,7 +13,6 @@ import (
 
 	"github.com/dustin/go-humanize"
 	"github.com/getsentry/sentry-go"
-	"github.com/go-chi/chi/v5/middleware"
 	"golang.org/x/sync/singleflight"
 	"sneak.berlin/go/pixa/internal/allowlist"
 	"sneak.berlin/go/pixa/internal/httpfetcher"
@@ -57,10 +56,11 @@ type ServiceConfig struct {
 	Logger *slog.Logger
 }
 
-// Static errors for service construction.
+// Static errors for service construction and unimplemented operations.
 var (
-	errCacheRequired      = errors.New("cache is required")
-	errSigningKeyRequired = errors.New("signing key is required")
+	errCacheRequired       = errors.New("cache is required")
+	errSigningKeyRequired  = errors.New("signing key is required")
+	errPurgeNotImplemented = errors.New("purge not implemented")
 )
 
 // NewService creates a new image service.
@@ -189,6 +189,11 @@ func (s *Service) Warm(ctx context.Context, req *ImageRequest) error {
 	return err
 }
 
+// Purge removes a cached image. Purging is not implemented yet.
+func (s *Service) Purge(_ context.Context, _ *ImageRequest) error {
+	return errPurgeNotImplemented
+}
+
 // Stats returns cache statistics.
 func (s *Service) Stats(ctx context.Context) (*CacheStats, error) {
 	return s.cache.Stats(ctx)
@@ -462,7 +467,6 @@ func (s *Service) fetchAndProcess(
 
 	// Log upstream fetch details
 	s.log.Info("upstream fetched",
-		"request_id", middleware.GetReqID(ctx),
 		"host", req.SourceHost,
 		"path", req.SourcePath,
 		"bytes", fetchBytes,
@@ -547,7 +551,6 @@ func (s *Service) processAndStore(
 	}
 
 	s.log.Info("image converted",
-		"request_id", middleware.GetReqID(ctx),
 		"host", req.SourceHost,
 		"path", req.SourcePath,
 		"src_format", processResult.InputFormat,

internal/middleware/middleware.go

@@ -2,12 +2,9 @@
 package middleware
 
 import (
-	"context"
-	"crypto/rand"
 	"log/slog"
 	"net/http"
 	"net/netip"
-	"regexp"
 	"time"
 
 	basicauth "github.com/99designs/basicauth-go"
@@ -118,32 +115,6 @@ func (s *Middleware) RateLimit(
 		})
 }
 
-// requestIDPattern is what a request's own X-Request-Id must look like to be
-// kept as its ID: 1 to 64 letters, digits, '-', '_' or '.'.
-var requestIDPattern = regexp.MustCompile(`^[A-Za-z0-9._-]{1,64}$`)
-
-// RequestID returns a middleware that gives each request an ID and sends it as
-// the X-Request-Id response header, so a client can quote it when reporting a
-// problem. The ID is the request's own X-Request-Id when that matches
-// requestIDPattern, and otherwise a random one, which tells nothing about the
-// machine or the traffic. It is stored in the request context under chi's
-// RequestIDKey, where the logging middleware, the handlers and the upstream
-// fetch read it.
-func (s *Middleware) RequestID() func(http.Handler) http.Handler {
-	return func(next http.Handler) http.Handler {
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			id := r.Header.Get(middleware.RequestIDHeader)
-			if !requestIDPattern.MatchString(id) {
-				id = rand.Text()
-			}
-
-			w.Header().Set(middleware.RequestIDHeader, id)
-			ctx := context.WithValue(r.Context(), middleware.RequestIDKey, id)
-			next.ServeHTTP(w, r.WithContext(ctx))
-		})
-	}
-}
-
 type loggingResponseWriter struct {
 	http.ResponseWriter
 

internal/middleware/middleware_internal_test.go

@@ -1,16 +1,11 @@
 package middleware
 
 import (
-	"bytes"
 	"log/slog"
 	"net/http"
 	"net/http/httptest"
-	"net/url"
-	"strings"
 	"testing"
 
-	"github.com/prometheus/client_golang/prometheus/promhttp"
-
 	"sneak.berlin/go/pixa/internal/config"
 )
 
@@ -61,203 +56,6 @@ func TestCORSAnswersWithConfiguredOrigin(t *testing.T) {
 	}
 }
 
-// TestCORSAnswersPreflightWithConfiguredOrigin checks that the CORS
-// middleware answers a preflight request, which the CORS library handles
-// apart from other requests, the same way: "*" lets any origin read
-// responses and a single origin lets only that origin read them.
-func TestCORSAnswersPreflightWithConfiguredOrigin(t *testing.T) {
-	t.Parallel()
-
-	const appOrigin = "https://app.example.com"
-
-	cases := []struct {
-		configured    string
-		requestOrigin string
-		want          string
-	}{
-		{"*", "https://any.example.com", "*"},
-		{appOrigin, appOrigin, appOrigin},
-		{appOrigin, "https://other.example.com", ""},
-	}
-
-	testHandler := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		w.WriteHeader(http.StatusOK)
-	})
-
-	for _, tc := range cases {
-		mw := &Middleware{
-			log:    slog.Default(),
-			config: &config.Config{AccessControlAllowOrigin: tc.configured},
-		}
-
-		handler := mw.CORS()(testHandler)
-
-		// An OPTIONS request naming the method it asks about is the
-		// preflight a browser sends before some cross-origin requests.
-		req := httptest.NewRequestWithContext(
-			t.Context(), http.MethodOptions, "/v1/image/example.com/a.jpg/1x1.png", nil)
-		req.Header.Set("Origin", tc.requestOrigin)
-		req.Header.Set("Access-Control-Request-Method", http.MethodGet)
-
-		rec := httptest.NewRecorder()
-
-		handler.ServeHTTP(rec, req)
-
-		got := rec.Header().Get("Access-Control-Allow-Origin")
-		if got != tc.want {
-			t.Errorf("configured %q, preflight from %q: "+
-				"Access-Control-Allow-Origin = %q, want %q",
-				tc.configured, tc.requestOrigin, got, tc.want)
-		}
-	}
-}
-
-// TestMetricsAuthRequiresConfiguredCredentials checks that MetricsAuth on
-// its own answers 401 with a challenge to a request without credentials or
-// with a wrong username or password, and lets a request with the configured
-// username and password through. That the router puts it in front of
-// /metrics is not tested.
-func TestMetricsAuthRequiresConfiguredCredentials(t *testing.T) {
-	t.Parallel()
-
-	const (
-		username  = "metricsuser"
-		password  = "metricspass"
-		challenge = `Basic realm="metrics"`
-	)
-
-	// An empty username stands for a request sent without credentials.
-	cases := []struct {
-		name        string
-		username    string
-		password    string
-		wantReached bool
-	}{
-		{"no credentials", "", "", false},
-		{"wrong username", "someone", password, false},
-		{"wrong password", username, "wrongpass", false},
-		{"configured credentials", username, password, true},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			mw := &Middleware{
-				log: slog.Default(),
-				config: &config.Config{
-					MetricsUsername: username,
-					MetricsPassword: password,
-				},
-			}
-
-			reached := false
-			handler := mw.MetricsAuth()(http.HandlerFunc(
-				func(http.ResponseWriter, *http.Request) {
-					reached = true
-				}))
-
-			req := httptest.NewRequestWithContext(
-				t.Context(), http.MethodGet, "/metrics", nil)
-
-			if tc.username != "" {
-				req.SetBasicAuth(tc.username, tc.password)
-			}
-
-			rec := httptest.NewRecorder()
-
-			handler.ServeHTTP(rec, req)
-
-			if reached != tc.wantReached {
-				t.Fatalf("request reached /metrics = %v, want %v",
-					reached, tc.wantReached)
-			}
-
-			if tc.wantReached {
-				return
-			}
-
-			if rec.Code != http.StatusUnauthorized {
-				t.Errorf("status = %d, want %d",
-					rec.Code, http.StatusUnauthorized)
-			}
-
-			if got := rec.Header().Get("WWW-Authenticate"); got != challenge {
-				t.Errorf("WWW-Authenticate = %q, want %q", got, challenge)
-			}
-		})
-	}
-}
-
-// TestMetricsRecordsServedRequest checks that the metrics middleware
-// records a request it served, so /metrics reports it. It is the only test
-// in this package that sets up the metrics middleware, which registers with
-// the process-wide Prometheus registry and can do so only once.
-func TestMetricsRecordsServedRequest(t *testing.T) {
-	t.Parallel()
-
-	// The line /metrics shows once one GET /test has been served.
-	const want = `http_request_duration_seconds_count{` +
-		`code="200",handler="/test",method="GET",service=""} 1`
-
-	mw := &Middleware{log: slog.Default(), config: &config.Config{}}
-
-	handler := mw.Metrics()(http.HandlerFunc(
-		func(w http.ResponseWriter, _ *http.Request) {
-			w.WriteHeader(http.StatusOK)
-		}))
-
-	handler.ServeHTTP(httptest.NewRecorder(), httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, "/test", nil))
-
-	rec := httptest.NewRecorder()
-	promhttp.Handler().ServeHTTP(rec, httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, "/metrics", nil))
-
-	if !strings.Contains(rec.Body.String(), want) {
-		t.Errorf("/metrics does not report the GET /test served; "+
-			"want the line %q in:\n%s", want, rec.Body.String())
-	}
-}
-
-// TestLoggingLeavesOutSubmittedSigningKey checks that a login, a POST /
-// whose form carries the signing key, leaves no trace of the key in the
-// request's log line.
-func TestLoggingLeavesOutSubmittedSigningKey(t *testing.T) {
-	t.Parallel()
-
-	const signingKey = "test-signing-key-0123456789abcdef"
-
-	var buf bytes.Buffer
-
-	mw := newTestMiddleware(t, &buf)
-
-	// The handler reads the key from the form, as the login handler does.
-	handler := mw.Logging()(http.HandlerFunc(
-		func(w http.ResponseWriter, r *http.Request) {
-			if got := r.FormValue("key"); got != signingKey {
-				t.Errorf("key in form = %q, want %q", got, signingKey)
-			}
-
-			w.WriteHeader(http.StatusSeeOther)
-		}))
-
-	form := url.Values{"key": {signingKey}}
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/",
-		strings.NewReader(form.Encode()))
-	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-
-	handler.ServeHTTP(httptest.NewRecorder(), req)
-
-	if !strings.Contains(buf.String(), `"method":"POST"`) {
-		t.Fatalf("no log line for the request; got %q", buf.String())
-	}
-
-	if strings.Contains(buf.String(), signingKey) {
-		t.Errorf("log output contains the signing key; got %q", buf.String())
-	}
-}
-
 func TestSecurityHeaders(t *testing.T) {
 	t.Parallel()
 

internal/middleware/request_id_internal_test.go

@@ -1,118 +0,0 @@
-package middleware
-
-import (
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/go-chi/chi/v5/middleware"
-
-	"sneak.berlin/go/pixa/internal/config"
-)
-
-// sendRequestID sends a request through the RequestID middleware, carrying
-// incoming as its X-Request-Id unless that is empty. It returns the ID the
-// next handler found in the request context, which the upstream fetch sends
-// and the log lines carry, and the X-Request-Id of the response.
-func sendRequestID(t *testing.T, incoming string) (string, string) {
-	t.Helper()
-
-	mw := &Middleware{log: slog.Default(), config: &config.Config{}}
-
-	var inContext string
-
-	handler := mw.RequestID()(http.HandlerFunc(
-		func(_ http.ResponseWriter, r *http.Request) {
-			inContext = middleware.GetReqID(r.Context())
-		}))
-
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
-	if incoming != "" {
-		req.Header.Set("X-Request-Id", incoming)
-	}
-
-	rec := httptest.NewRecorder()
-	handler.ServeHTTP(rec, req)
-
-	return inContext, rec.Header().Get("X-Request-Id")
-}
-
-// TestRequestIDKeepsShortPlainID verifies that a request's own X-Request-Id of
-// at most 64 letters, digits, '-', '_' or '.' is kept as its ID.
-func TestRequestIDKeepsShortPlainID(t *testing.T) {
-	t.Parallel()
-
-	for _, incoming := range []string{
-		"client-request-id",
-		"A1_b2.c3-d4",
-		strings.Repeat("a", 64),
-	} {
-		inContext, inResponse := sendRequestID(t, incoming)
-
-		if inContext != incoming || inResponse != incoming {
-			t.Errorf("incoming %q: context has %q, response %q, want both %q",
-				incoming, inContext, inResponse, incoming)
-		}
-	}
-}
-
-// TestRequestIDReplacesLongOrUnusualID verifies that a request's own
-// X-Request-Id that is over 64 characters or holds anything but letters,
-// digits, '-', '_' or '.' is neither sent back nor sent upstream: the request
-// gets a fresh ID instead.
-func TestRequestIDReplacesLongOrUnusualID(t *testing.T) {
-	t.Parallel()
-
-	for _, incoming := range []string{
-		strings.Repeat("a", 65),
-		strings.Repeat("a", 9000),
-		"has space",
-		"a/b",
-		"a,b",
-		"<script>",
-		"ünicode",
-	} {
-		inContext, inResponse := sendRequestID(t, incoming)
-		t.Logf("incoming %.20q: made up %q", incoming, inResponse)
-
-		if inResponse == "" || inResponse == incoming {
-			t.Errorf("incoming %.20q: response has %q, want a fresh ID",
-				incoming, inResponse)
-		}
-
-		if inContext != inResponse {
-			t.Errorf("incoming %.20q: context has %q, want the response's %q",
-				incoming, inContext, inResponse)
-		}
-	}
-}
-
-// TestRequestIDMadeUpTellsNothing verifies that the ID made up for a request
-// that sent none differs for every request and does not hold the host name.
-func TestRequestIDMadeUpTellsNothing(t *testing.T) {
-	t.Parallel()
-
-	hostname, err := os.Hostname()
-	if err != nil {
-		t.Fatalf("os.Hostname() error = %v", err)
-	}
-
-	firstInContext, first := sendRequestID(t, "")
-	_, second := sendRequestID(t, "")
-	t.Logf("host %q, made up %q and %q", hostname, first, second)
-
-	if first == "" || first == second {
-		t.Errorf("made up %q and %q, want two different IDs", first, second)
-	}
-
-	if firstInContext != first {
-		t.Errorf("context has %q, want the response's %q", firstInContext, first)
-	}
-
-	if strings.Contains(first, hostname) {
-		t.Errorf("made-up ID %q holds the host name %q", first, hostname)
-	}
-}

internal/server/metrics_internal_test.go

@@ -1,32 +0,0 @@
-package server
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	"github.com/prometheus/client_golang/prometheus/promhttp"
-)
-
-// TestNoMetricsRecordedWithoutMetricsUsername checks that with no metrics
-// username set the router records nothing about the requests it serves.
-// /metrics is not served then, so the process-wide Prometheus registry is
-// read directly. TestMaintenanceModeKeepsOtherRoutes records into the same
-// registry, but never a GET /robots.txt.
-func TestNoMetricsRecordedWithoutMetricsUsername(t *testing.T) {
-	t.Parallel()
-
-	s := newTestServer(t)
-	s.ServeHTTP(httptest.NewRecorder(), httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, "/robots.txt", nil))
-
-	rec := httptest.NewRecorder()
-	promhttp.Handler().ServeHTTP(rec, httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, "/metrics", nil))
-
-	if strings.Contains(rec.Body.String(), `handler="/robots.txt"`) {
-		t.Errorf("with no metrics username GET /robots.txt was recorded:\n%s",
-			rec.Body.String())
-	}
-}

internal/server/request_id_internal_test.go

@@ -1,58 +0,0 @@
-package server
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"testing"
-)
-
-// requestIDHeader is the header that carries a request's ID.
-const requestIDHeader = "X-Request-Id"
-
-// TestResponsesCarryRequestID verifies that every response, whatever its route
-// and status, carries the request's ID as X-Request-Id, so a client can quote
-// it when reporting a problem: one pixa made up when the request brought none,
-// and the request's own X-Request-Id when it brought one.
-func TestResponsesCarryRequestID(t *testing.T) {
-	t.Parallel()
-
-	const clientRequestID = "client-request-id"
-
-	s := newTestServer(t)
-
-	paths := []string{
-		"/robots.txt",
-		"/no-such-path",
-		unsignedImagePath,
-		encryptedImagePath,
-	}
-
-	for _, path := range paths {
-		t.Run(path, func(t *testing.T) {
-			t.Parallel()
-
-			rec := httptest.NewRecorder()
-			s.ServeHTTP(rec, httptest.NewRequestWithContext(
-				t.Context(), http.MethodGet, path, nil))
-			t.Logf("status %d, %s %q",
-				rec.Code, requestIDHeader, rec.Header().Get(requestIDHeader))
-
-			if rec.Header().Get(requestIDHeader) == "" {
-				t.Errorf("response has no %s", requestIDHeader)
-			}
-
-			req := httptest.NewRequestWithContext(
-				t.Context(), http.MethodGet, path, nil)
-			req.Header.Set(requestIDHeader, clientRequestID)
-
-			rec = httptest.NewRecorder()
-			s.ServeHTTP(rec, req)
-
-			got := rec.Header().Get(requestIDHeader)
-			if got != clientRequestID {
-				t.Errorf("%s = %q, want the request's own %q",
-					requestIDHeader, got, clientRequestID)
-			}
-		})
-	}
-}

internal/server/routes.go

@@ -28,7 +28,7 @@ func (s *Server) SetupRoutes() {
 	s.router = chi.NewRouter()
 
 	s.router.Use(middleware.Recoverer)
-	s.router.Use(s.mw.RequestID())
+	s.router.Use(middleware.RequestID)
 	s.router.Use(s.mw.ClientIP())
 	s.router.Use(s.mw.SecurityHeaders())
 	s.router.Use(s.mw.Logging())
@@ -97,7 +97,6 @@ func (s *Server) SetupRoutes() {
 			// The trailing filename (e.g., /img.jpg) is ignored but helps
 			// browsers with content type
 			r.Get("/e/{token}/*", s.h.HandleImageEnc())
-			r.Head("/e/{token}/*", s.h.HandleImageEnc())
 		})
 	})
 

internal/server/routes_internal_test.go

@@ -1,27 +0,0 @@
-package server
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"testing"
-)
-
-// TestEncryptedImageRouteAnswersHEAD verifies that HEAD on the encrypted image
-// route reaches its handler, as GET does, instead of being answered 405 Method
-// Not Allowed. The handler refuses a token it cannot decrypt with 400, so that
-// status shows the request got through.
-func TestEncryptedImageRouteAnswersHEAD(t *testing.T) {
-	t.Parallel()
-
-	s := newTestServer(t)
-
-	rec := httptest.NewRecorder()
-	s.ServeHTTP(rec, httptest.NewRequestWithContext(
-		t.Context(), http.MethodHead, encryptedImagePath, nil))
-	t.Logf("status %d", rec.Code)
-
-	if rec.Code != http.StatusBadRequest {
-		t.Errorf("status = %d, want %d from the encrypted image handler",
-			rec.Code, http.StatusBadRequest)
-	}
-}