Add µPaaS deployment setup for fsn1app1

- Add Docker HEALTHCHECK instruction probing /.well-known/healthcheck.json (30s interval, 5s timeout, 10s start period, 3 retries) for µPaaS container health verification - Create deploy/README.md with full µPaaS app configuration reference (app name, repo URL, branch, env vars, volumes, ports, production config) - Add Deployment section to README.md linking to deploy docs - Add deploy/ to .dockerignore (docs not needed in build context)
2026-03-17 02:17:15 -07:00
41 changed files with 487 additions and 1698 deletions
--- a/.dockerignore
+++ b/.dockerignore
@@ -6,3 +6,4 @@
 node_modules
 bin/
 data/
+deploy/
--- a/.gitea/workflows/check.yml
+++ b/.gitea/workflows/check.yml
@@ -6,4 +6,4 @@ jobs:
        steps:
            # actions/checkout v4.2.2, 2026-02-22
            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-            - run: script/cibuild
+            - run: docker build .
--- a/3
+++ b/3
@@ -75,4 +75,7 @@ WORKDIR /var/lib/pixa

 EXPOSE 8080

+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD wget -q --spider http://localhost:8080/.well-known/healthcheck.json
+
 ENTRYPOINT ["/usr/local/bin/pixad", "--config", "/etc/pixa/config.yml"]
--- a/35
+++ b/35
@@ -1,4 +1,4 @@
-.PHONY: bootstrap setup check lint test fmt fmt-check build clean docker docker-versioned docker-test devserver devserver-stop hooks
+.PHONY: check lint test fmt fmt-check build clean docker docker-test devserver devserver-stop hooks

 VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
 LDFLAGS := -X main.Version=$(VERSION)
@@ -15,30 +15,27 @@ else
 endif

 # Default target: run all checks
-check:
-	@script/check
-
-bootstrap:
-	@script/bootstrap
-
-setup:
-	@script/setup
+check: fmt-check lint test

 # Check formatting without modifying files
 fmt-check:
-	@script/fmt-check
+	@echo "Checking formatting..."
+	@test -z "$$(gofmt -l . | grep -v '^vendor/')" || (echo "Files need formatting:"; gofmt -l . | grep -v '^vendor/'; exit 1)

 # Format code
 fmt:
-	@script/fmt
+	@echo "Formatting code..."
+	gofmt -w $$(find . -name '*.go' -not -path './vendor/*')

 # Run linter
 lint:
-	@script/lint
+	@echo "Running linter..."
+	$(NIX_RUN_PREFIX)golangci-lint run$(NIX_RUN_SUFFIX)

 # Run tests (30-second timeout)
 test:
-	@script/test
+	@echo "Running tests..."
+	$(NIX_RUN_PREFIX)CGO_ENABLED=1 go test -timeout 30s -v ./...$(NIX_RUN_SUFFIX)

 # Build the binary
 build:
@@ -50,12 +47,8 @@ clean:
 	rm -rf bin/
 	rm -rf ./data

-# Build Docker image (tagged via script/projectname)
+# Build Docker image
 docker:
-	@script/docker
-
-# Build Docker image tagged pixad:$(VERSION) and pixad:latest
-docker-versioned:
 	docker build --build-arg VERSION=$(VERSION) -t pixad:$(VERSION) -t pixad:latest .

 # Run tests in Docker (needed for CGO/libvips)
@@ -64,7 +57,7 @@ docker-test:
 	docker run --rm pixad-builder sh -c "CGO_ENABLED=1 GOTOOLCHAIN=auto go test -v ./..."

 # Run local dev server in Docker
-devserver: docker-versioned devserver-stop
+devserver: docker devserver-stop
 	docker run -d --name pixad-dev -p 8080:8080 \
 		-v $(CURDIR)/config.dev.yml:/etc/pixa/config.yml:ro \
 		pixad:latest
@@ -77,4 +70,6 @@ devserver-stop:

 # Install pre-commit hook
 hooks:
-	@script/install-precommit
+	@printf '#!/bin/sh\nset -e\n' > .git/hooks/pre-commit
+	@printf 'make check\n' >> .git/hooks/pre-commit
+	@chmod +x .git/hooks/pre-commit
--- a/README.md
+++ b/README.md
@@ -67,10 +67,7 @@ hosts require an HMAC-SHA256 signature.
 #### Signature Specification

 Signatures use HMAC-SHA256 and include an expiration timestamp to
-prevent replay attacks. Signatures are **exact match only**: every
-component (host, path, query, dimensions, format, expiration) must
-match exactly what was signed. No suffix matching, wildcard matching,
-or partial matching is supported.
+prevent replay attacks.

 **Signed data format** (colon-separated):

@@ -128,30 +125,16 @@ See `config.example.yml` for all options with defaults.
 - **Metrics**: Prometheus
 - **Logging**: stdlib slog

-## Entrypoints
+## Deployment

-This repository adheres to the
-[Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
-standard: normalized scripts in `script/` are the entrypoints for the
-development workflow, and the Makefile targets are thin shims that call
-them. We provide:
+Pixa is deployed via
+[µPaaS](https://git.eeqj.de/sneak/upaas) on `fsn1app1`
+(paas.datavi.be). Pushes to `main` trigger automatic builds and
+deployments. The Dockerfile includes a `HEALTHCHECK` that probes
+`/.well-known/healthcheck.json`.

- `script/bootstrap` — install all dependencies (idempotent)
- `script/setup` — make a fresh clone ready for development
-  (bootstrap, then install-precommit)
- `script/projectname` — output the project name ("pixa")
- `script/test` — run the test suite
- `script/lint` — run golangci-lint
- `script/fmt` — format all code (writes)
- `script/fmt-check` — check formatting (read-only)
- `script/check` — run test, lint, and fmt-check
- `script/docker` — build the Docker image tagged via `script/projectname`
- `script/cibuild` — CI entrypoint: `docker build .` (the Dockerfile
-  runs the checks, so a green build implies a green repo)
- `script/precommit` — pre-commit checks (`go mod tidy` guard, then
-  `script/check`)
- `script/install-precommit` — install the git pre-commit hook that
-  runs `script/precommit`
+See [deploy/README.md](deploy/README.md) for the full µPaaS app
+configuration, volume mounts, and production setup instructions.

 ## TODO

--- a/REPO_POLICIES.md
+++ b/REPO_POLICIES.md
@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-07-06
+last_modified: 2026-02-22
 ---

 This document covers repository structure, tooling, and workflow standards. Code
@@ -34,46 +34,10 @@ style conventions are in separate documents:
  every file before committing. There are zero exceptions to this rule.

 - Every repo with software must have a root `Makefile` with these targets:
-  `make bootstrap`, `make setup`, `make test`, `make lint`, `make fmt` (writes),
-  `make fmt-check` (read-only), `make check` (runs `test`, `lint`, `fmt-check`),
-  `make docker`, and `make hooks` (installs pre-commit hook). A model Makefile
-  is at `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.
-
- Repos follow the
-  [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
-  pattern: the implementation of each Makefile target lives in an executable
-  script in `script/` (`script/bootstrap`, `script/setup`, `script/test`,
-  `script/lint`, `script/fmt`, `script/fmt-check`, `script/check`,
-  `script/docker`), and the Makefile targets are thin shims that call them. The
-  scripts must be POSIX sh (`#!/bin/sh`, `set -eu`, no bashisms) so they run in
-  minimal containers (e.g. alpine images have no bash); locate the repo root
-  with `$(cd "$(dirname "$0")/.." && pwd -P)` and `cd` there before acting. From
-  the standard's canonical set we use `bootstrap`, `setup` (make the repo ready
-  for development after a fresh clone: runs `bootstrap`, then
-  `install-precommit`, plus any repo-specific initialization), `test`, and
-  `cibuild`. `script/bootstrap` installs all dependencies idempotently and
-  assumes nothing is present: base tools come from nix, apt, brew, or apk
-  (detected in that order; apt runs noninteractive). For node it uses the
-  installed node if present; otherwise it installs a PINNED node version via
-  nvm, first installing nvm itself if missing — from a hash-verified GitHub
-  release archive (never `curl | sh`), with bash installed as an explicit
-  prerequisite since nvm requires bash. yarn is then pinned via
-  `corepack prepare yarn@<version> --activate`. Never install "latest" or "lts";
-  always exact versions. `script/cibuild` runs the CI build: it changes to the
-  repo root and runs `docker build .`; the Gitea workflow calls it. Four further
-  scripts are our own extensions to the standard: `script/check` runs
-  `script/test`, `script/lint`, and `script/fmt-check`; `script/precommit` is
-  what the git pre-commit hook runs, and it calls `script/check`;
-  `script/install-precommit` installs the git pre-commit hook (the `make hooks`
-  target shims to it); and `script/projectname` (literally that filename) simply
-  outputs the project's name. Scripts that need the name call
-  `script/projectname` — e.g. `script/docker` assembles its image tag from it —
-  so those scripts stay byte-identical across all repos. Repo-type-specific
-  pre-commit extras (e.g. `go mod tidy` verification in Go repos) belong in
-  `script/precommit`, not in the hook itself. Model scripts are at
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`. The README
-  must document the provided scripts in an **Entrypoints** section (see the
-  README requirements below).
+  `make test`, `make lint`, `make fmt` (writes), `make fmt-check` (read-only),
+  `make check` (prereqs: `test`, `lint`, `fmt-check`), `make docker`, and
+  `make hooks` (installs pre-commit hook). A model Makefile is at
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.

 - Always use Makefile targets (`make fmt`, `make test`, `make lint`, etc.)
  instead of invoking the underlying tools directly. The Makefile is the single
@@ -93,83 +57,11 @@ style conventions are in separate documents:
  as a build step so the build fails if the branch is not green. For non-server
  repos, the Dockerfile should bring up a development environment and run
  `make check`. For server repos, `make check` should run as an early build
-  stage before the final image is assembled. Dockerfiles install development
-  prerequisites by running `script/bootstrap` rather than duplicating installs
-  inline; COPY `script/` and the dependency manifests (`package.json` +
-  `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it so the bootstrap
-  layer stays cached until dependencies change.
-
- **Dockerfiles must use a separate lint stage for fail-fast feedback.** Go
-  repos use a multistage build where linting runs in an independent stage based
-  on the `golangci/golangci-lint` image (pinned by hash). This stage runs
-  `make fmt-check` and `make lint` before the full build begins. The build stage
-  then declares an explicit dependency on the lint stage via
-  `COPY --from=lint /src/go.sum /dev/null`, which forces BuildKit to complete
-  linting before proceeding to compilation and tests. This ensures lint failures
-  surface in seconds rather than minutes, without blocking on dependency
-  download or compilation in the build stage.
-
-    The standard pattern for a Go repo Dockerfile is:
-
-    ```dockerfile
-    # Lint stage — fast feedback on formatting and lint issues
-    # golangci/golangci-lint:v2.x.x, YYYY-MM-DD
-    FROM golangci/golangci-lint@sha256:... AS lint
-    WORKDIR /src
-    COPY go.mod go.sum ./
-    RUN go mod download
-    COPY . .
-    RUN make fmt-check
-    RUN make lint
-
-    # Build stage
-    # golang:1.x-alpine, YYYY-MM-DD
-    FROM golang@sha256:... AS builder
-    WORKDIR /src
-
-    # Force BuildKit to run the lint stage before proceeding
-    COPY --from=lint /src/go.sum /dev/null
-
-    COPY go.mod go.sum ./
-    RUN go mod download
-    COPY . .
-    RUN make test
-
-    ARG VERSION=dev
-    RUN CGO_ENABLED=0 go build -trimpath \
-        -ldflags="-s -w -X main.Version=${VERSION}" \
-        -o /app ./cmd/app/
-
-    # Runtime stage
-    FROM alpine@sha256:...
-    COPY --from=builder /app /usr/local/bin/app
-    ENTRYPOINT ["app"]
-    ```
-
-    Key points:
-    - The lint stage uses the `golangci/golangci-lint` image directly (it
-      includes both Go and the linter), so there is no need to install the
-      linter separately.
-    - `COPY --from=lint /src/go.sum /dev/null` is a no-op file copy that creates
-      a stage dependency. BuildKit runs stages in parallel by default; without
-      this line, the build stage would not wait for lint to finish and a lint
-      failure might not fail the overall build.
-    - If the project uses `//go:embed` directives that reference build artifacts
-      (e.g. a web frontend compiled in a separate stage), the lint stage must
-      create placeholder files so the embed directives resolve. Example:
-      `RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css`.
-      The lint stage should not depend on the actual build output — it exists to
-      fail fast.
-    - If the project requires CGO or system libraries for linting (e.g.
-      `vips-dev`), install them in the lint stage with `apk add`.
-    - The build stage runs `make test` after compilation setup. Tests run in the
-      build stage, not the lint stage, because they may require compiled
-      artifacts or heavier dependencies.
+  stage before the final image is assembled.

 - Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
-  runs `script/cibuild` (which runs `docker build .`) on push. Since the
-  Dockerfile already runs `make check`, a successful build implies all checks
-  pass.
+  runs `docker build .` on push. Since the Dockerfile already runs `make check`,
+  a successful build implies all checks pass.

 - Use platform-standard formatters: `black` for Python, `prettier` for
  JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with
@@ -177,11 +69,9 @@ style conventions are in separate documents:
  Markdown (hard-wrap at 80 columns). Documentation and writing repos (Markdown,
  HTML, CSS) should also have `.prettierrc` and `.prettierignore`.

- Pre-commit hook: runs `script/precommit`, which calls `script/check`. If local
-  testing is not possible in the repo, `script/precommit` may skip `script/test`
-  and run only `script/lint` and `script/fmt-check`. The hook is installed by
-  `script/install-precommit`; the Makefile must provide a `make hooks` target
-  that shims to it.
+- Pre-commit hook: `make check` if local testing is possible, otherwise
+  `make lint && make fmt-check`. The Makefile should provide a `make hooks`
+  target to install the pre-commit hook.

 - All repos with software must have tests that run via the platform-standard
  test framework (`go test`, `pytest`, `jest`/`vitest`, etc.). If no meaningful
@@ -192,42 +82,6 @@ style conventions are in separate documents:
 - `make test` must complete in under 20 seconds. Add a 30-second timeout in the
  Makefile.

- **`make test` should use the conditional verbose rerun pattern.** Run tests
-  without `-v` (verbose) first. If tests fail, automatically rerun with `-v` to
-  show full output. This keeps CI logs and `docker build` output clean on
-  success (just package/suite summaries) while providing full diagnostic detail
-  on failure (every test case, every assertion). The general shell pattern:
-
-    ```makefile
-    test:
-    	@<test-command> || \
-    		{ echo "--- Rerunning with -v for details ---"; \
-    		  <test-command-with-v>; exit 1; }
-    ```
-
-    Go example:
-
-    ```makefile
-    test:
-    	@go test -timeout 30s -race -cover ./... || \
-    		{ echo "--- Rerunning with -v for details ---"; \
-    		  go test -timeout 30s -race -v ./...; exit 1; }
-    ```
-
-    Python example:
-
-    ```makefile
-    test:
-    	@python -m pytest || \
-    		{ echo "--- Rerunning with -v for details ---"; \
-    		  python -m pytest -v; exit 1; }
-    ```
-
-    The `exit 1` ensures the target always fails after a rerun — the first run
-    already proved the tests are broken, so the build must not pass even if a
-    flaky test happens to succeed on the second attempt. The rerun exists solely
-    for diagnostic output.
-
 - Docker builds must complete in under 5 minutes.

 - `make check` must not modify any files in the repo. Tests may use temporary
@@ -244,13 +98,6 @@ style conventions are in separate documents:
  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up
  a new repo.

- **No build artifacts in version control.** Code-derived data (compiled
-  bundles, minified output, generated assets) must never be committed to the
-  repository if it can be avoided. The build process (e.g. Dockerfile, Makefile)
-  should generate these at build time. Notable exception: Go protobuf generated
-  files (`.pb.go`) ARE committed because repos need to work with `go get`, which
-  downloads code but does not execute code generation.
-
 - Never use `git add -A` or `git add .`. Always stage files explicitly by name.

 - Never force-push to `main`.
@@ -274,76 +121,12 @@ style conventions are in separate documents:
 - Dockerized web services listen on port 8080 by default, overridable with
  `PORT`.

- **HTTP/web services must be hardened for production internet exposure before
-  tagging 1.0.** This means full compliance with security best practices
-  including, without limitation, all of the following:
-    - **Security headers** on every response:
-        - `Strict-Transport-Security` (HSTS) with `max-age` of at least one year
-          and `includeSubDomains`.
-        - `Content-Security-Policy` (CSP) with a restrictive default policy
-          (`default-src 'self'` as a baseline, tightened per-resource as
-          needed). Never use `unsafe-inline` or `unsafe-eval` unless
-          unavoidable, and document the reason.
-        - `X-Frame-Options: DENY` (or `SAMEORIGIN` if framing is required).
-          Prefer the `frame-ancestors` CSP directive as the primary control.
-        - `X-Content-Type-Options: nosniff`.
-        - `Referrer-Policy: strict-origin-when-cross-origin` (or stricter).
-        - `Permissions-Policy` restricting access to browser features the
-          application does not use (camera, microphone, geolocation, etc.).
-    - **Request and response limits:**
-        - Maximum request body size enforced on all endpoints (e.g. Go
-          `http.MaxBytesReader`). Choose a sane default per-route; never accept
-          unbounded input.
-        - Maximum response body size where applicable (e.g. paginated APIs).
-        - `ReadTimeout` and `ReadHeaderTimeout` on the `http.Server` to defend
-          against slowloris attacks.
-        - `WriteTimeout` on the `http.Server`.
-        - `IdleTimeout` on the `http.Server`.
-        - Per-handler execution time limits via `context.WithTimeout` or
-          chi/stdlib `middleware.Timeout`.
-    - **Authentication and session security:**
-        - Rate limiting on password-based authentication endpoints. API keys are
-          high-entropy and not susceptible to brute force, so they are exempt.
-        - CSRF tokens on all state-mutating HTML forms. API endpoints
-          authenticated via `Authorization` header (Bearer token, API key) are
-          exempt because the browser does not attach these automatically.
-        - Passwords stored using bcrypt, scrypt, or argon2 — never plain-text,
-          MD5, or SHA.
-        - Session cookies set with `HttpOnly`, `Secure`, and `SameSite=Lax` (or
-          `Strict`) attributes.
-    - **Reverse proxy awareness:**
-        - True client IP detection when behind a reverse proxy
-          (`X-Forwarded-For`, `X-Real-IP`). The application must accept
-          forwarded headers only from a configured set of trusted proxy
-          addresses — never trust `X-Forwarded-For` unconditionally.
-    - **CORS:**
-        - Authenticated endpoints must restrict `Access-Control-Allow-Origin` to
-          an explicit allowlist of known origins. Wildcard (`*`) is acceptable
-          only for public, unauthenticated read-only APIs.
-    - **Error handling:**
-        - Internal errors must never leak stack traces, SQL queries, file paths,
-          or other implementation details to the client. Return generic error
-          messages in production; detailed errors only when `DEBUG` is enabled.
-    - **TLS:**
-        - Services never terminate TLS directly. They are always deployed behind
-          a TLS-terminating reverse proxy. The service itself listens on plain
-          HTTP. However, HSTS headers and `Secure` cookie flags must still be
-          set by the application so that the browser enforces HTTPS end-to-end.
-
-    This list is non-exhaustive. Apply defense-in-depth: if a standard security
-    hardening measure exists for HTTP services and is not listed here, it is
-    still expected. When in doubt, harden.
-
 - `README.md` is the primary documentation. Required sections:
    - **Description**: First line must include the project name, purpose,
      category (web server, SPA, CLI tool, etc.), license, and author. Example:
      "µPaaS is an MIT-licensed Go web application by @sneak that receives
      git-frontend webhooks and deploys applications via Docker in realtime."
    - **Getting Started**: Copy-pasteable install/usage code block.
-    - **Entrypoints**: Opens by stating that the repo adheres to the
-      [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
-      standard (with that link), then documents each provided `script/`
-      entrypoint and its purpose.
    - **Rationale**: Why does this exist?
    - **Design**: How is the program structured?
    - **TODO**: Update meticulously, even between commits. When planning, put
@@ -361,14 +144,8 @@ style conventions are in separate documents:
 - Use SemVer.

 - Database migrations live in `internal/db/migrations/` and must be embedded in
-  the binary.
-    - `000_migration.sql` — contains ONLY the creation of the migrations
-      tracking table itself. Nothing else.
-    - `001_schema.sql` — the full application schema.
-    - **Pre-1.0.0:** never add additional migration files (002, 003, etc.).
-      There is no installed base to migrate. Edit `001_schema.sql` directly.
-    - **Post-1.0.0:** add new numbered migration files for each schema change.
-      Never edit existing migrations after release.
+  the binary. Pre-1.0.0: modify existing migrations (no installed base assumed).
+  Post-1.0.0: add new migration files.

 - All repos should have an `.editorconfig` enforcing the project's indentation
  settings.
@@ -398,9 +175,6 @@ style conventions are in separate documents:
    - `README.md`, `.git`, `.gitignore`, `.editorconfig`
    - `LICENSE`, `REPO_POLICIES.md` (copy from the `prompts` repo)
    - `Makefile`
-    - `script/` entrypoints (`bootstrap`, `setup`, `projectname`, `test`,
-      `lint`, `fmt`, `fmt-check`, `check`, `docker`, `cibuild`, `precommit`,
-      `install-precommit`)
    - `Dockerfile`, `.dockerignore`
    - `.gitea/workflows/check.yml`
    - Go: `go.mod`, `go.sum`, `.golangci.yml`
--- a/TODO.md
+++ b/TODO.md
@@ -1,87 +1,65 @@
-# Workflow
+# Pixa 1.0 TODO

-* branch (from `main`)
-* do the work in Next Step
-* move Next Step to the top of Completed Steps
-* move the top item of Future Steps into Next Step
-* commit (`TODO.md` changes in the same commit as the work)
-* merge to `main` if the branch is not protected, otherwise open a PR
-* push
+Remaining tasks sorted by priority for a working 1.0 release.

-# Status
+## P0: Critical for 1.0

-pre-1.0. No git tags exist. main (6b4a1d7, 2026-04-07) is current with
-origin; recent work extracted the internal/magic and internal/allowlist
-packages. The 10 gosec findings from the 2026-07-06 morning survey are
-NOT fixed on main: the newest gosec/lint fix commits are from
-2026-02-25 (85729d9, ce6db76) and nothing since touches gosec, so those
-findings remain open.
+### Image Processing
+- [x] Add WebP encoding support (currently returns error)
+- [x] Add AVIF encoding support (implemented via govips)

-# Next Step
+### Manual Testing (verify auth/encrypted URLs work)
+- [ ] Manual test: visit `/`, see login form
+- [ ] Manual test: enter wrong key, see error
+- [ ] Manual test: enter correct signing key, see generator form
+- [ ] Manual test: generate encrypted URL, verify it works
+- [ ] Manual test: wait for expiration or use short TTL, verify expired URL returns 410
+- [ ] Manual test: logout, verify redirected to login

-Fix the 10 open gosec lint findings so make check passes on main again
-(main must always be green; no gosec fix commits have landed since
-2026-02-25). No blanket suppressions; fix or justify each finding
-individually.
+### Cache Management
+- [ ] Implement cache size management/eviction (prevent disk from filling up)

-# Completed Steps
+### Configuration
+- [ ] Validate configuration on startup (fail fast on bad config)

- 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
-  Makefile shims, README Entrypoints section
- 2026-04-07 extract magic byte detection into internal/magic (#42)
- 2026-03-25 extract allowlist package from internal/imgcache (#41)
- 2026-03-25 move schema_migrations table creation into 000.sql (#36)
- 2026-03-20 enforce and document exact-match-only signature
-  verification (#40)
- 2026-03-20 bound imageprocessor.Process input read to prevent
-  unbounded memory use (#37); consolidate appname into an
-  internal/globals constant (#34)
- 2026-03-18 parse version prefix from migration filenames (#33)
- 2026-03-15 QA audit fixes for 1.0/MVP readiness (#25)
- 2026-03-02 split Dockerfile with pre-built golangci-lint stage for
-  faster CI (#23)
- 2026-02-25 repo policy compliance: CI workflow, hash-pinned images,
-  golangci-lint and gosec fixes of that date (#14); arm64 Docker build
-  fix (#16)
- 2026-01-08 WebP and AVIF encoding support via govips (both former P0
-  image processing items, now done)
+## P1: Important for Production

-# Future Steps
+### Security
+- [ ] Implement blocked networks configuration (extend SSRF protection)
+- [ ] Add rate limiting global concurrent fetches (prevent resource exhaustion)

- P0: manual test pass of the auth and encrypted URL flows, then
-  commit the checked-off results to TODO.md: visit / and see the login
-  form; wrong key shows an error; correct signing key shows the
-  generator form; a generated encrypted URL serves the image; an
-  expired URL (short TTL) returns 410; logout redirects back to login
- P0: implement cache size management and eviction so the disk cannot
-  fill up
- P0: validate configuration on startup, fail fast on bad config
- P1: implement blocked networks configuration to extend SSRF
-  protection
- P1: rate limit global concurrent upstream fetches to prevent
-  resource exhaustion
- P1: strip EXIF and other metadata from processed images (privacy)
- P2: security
-    - referer blacklist
-    - per-IP rate limiting
-    - per-origin rate limiting
- P2: HTTP response handling
-    - Last-Modified headers
-    - Vary header for content negotiation
-    - X-Request-ID propagation
- P2: auto format selection (format=auto based on Accept header)
- P2: configuration
-    - add all configuration options from README
-    - environment variable overrides
-    - YAML config file support
- P2: operational
-    - optional Sentry error reporting
-    - comprehensive request logging
-    - Prometheus performance metrics
-    - integration tests for the image proxy flow
-    - load tests to verify the 1k to 5k req/s target
- P2: documentation
-    - configuration options
-    - API endpoints
-    - deployment guide
-    - example nginx or caddy reverse proxy config
+### Image Processing
+- [ ] Implement EXIF/metadata stripping (privacy)
+
+## P2: Nice to Have
+
+### Security
+- [ ] Implement referer blacklist
+- [ ] Add rate limiting per-IP
+- [ ] Add rate limiting per-origin
+
+### HTTP Response Handling
+- [ ] Implement Last-Modified headers
+- [ ] Implement Vary header for content negotiation
+- [ ] Implement X-Request-ID propagation
+
+### Additional Endpoints
+- [ ] Implement auto-format selection (format=auto based on Accept header)
+
+### Configuration
+- [ ] Add all configuration options from README
+- [ ] Implement environment variable overrides
+- [ ] Implement YAML config file support
+
+### Operational
+- [ ] Implement Sentry error reporting (optional)
+- [ ] Add comprehensive request logging
+- [ ] Add performance metrics (Prometheus)
+- [ ] Write integration tests for image proxy flow
+- [ ] Write load tests to verify 1-5k req/s target
+
+### Documentation
+- [ ] Document configuration options
+- [ ] Document API endpoints
+- [ ] Document deployment guide
+- [ ] Add example nginx/caddy reverse proxy config
--- a/cmd/pixad/main.go
+++ b/cmd/pixad/main.go
@@ -17,7 +17,10 @@ import (
 	"sneak.berlin/go/pixa/internal/server"
 )

-var Version string //nolint:gochecknoglobals // set by ldflags
+var (
+	Appname = "pixad" //nolint:gochecknoglobals // set by ldflags
+	Version string    //nolint:gochecknoglobals // set by ldflags
+)

 var configPath string //nolint:gochecknoglobals // cobra flag

@@ -37,6 +40,7 @@ func main() {
 }

 func run(_ *cobra.Command, _ []string) {
+	globals.Appname = Appname
 	globals.Version = Version

 	// Set config path in environment if specified via flag
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -0,0 +1,78 @@
+# Pixa Deployment via µPaaS
+
+Pixa is deployed on `fsn1app1` via
+[µPaaS](https://git.eeqj.de/sneak/upaas) (paas.datavi.be).
+
+## µPaaS App Configuration
+
+Create the app in the µPaaS web UI with these settings:
+
+| Setting | Value |
+| --- | --- |
+| **App name** | `pixa` |
+| **Repo URL** | `git@git.eeqj.de:sneak/pixa.git` |
+| **Branch** | `main` |
+| **Dockerfile path** | `Dockerfile` |
+
+### Environment Variables
+
+| Variable | Description | Required |
+| --- | --- | --- |
+| `PORT` | HTTP listen port (default: 8080) | No |
+
+Configuration is provided via the config file baked into the Docker
+image at `/etc/pixa/config.yml`. To override it, mount a custom
+config file as a volume (see below).
+
+### Volumes
+
+| Host Path | Container Path | Description |
+| --- | --- | --- |
+| `/srv/pixa/data` | `/var/lib/pixa` | SQLite database and image cache |
+| `/srv/pixa/config.yml` | `/etc/pixa/config.yml` | Production config (signing key, whitelist, etc.) |
+
+### Ports
+
+| Host Port | Container Port | Protocol |
+| --- | --- | --- |
+| (assigned) | 8080 | TCP |
+
+### Docker Network
+
+Attach to the shared reverse-proxy network if using Caddy/Traefik
+for TLS termination.
+
+## Production Configuration
+
+Copy `config.example.yml` from the repo root and customize for
+production:
+
+```yaml
+port: 8080
+debug: false
+maintenance_mode: false
+state_dir: /var/lib/pixa
+signing_key: "<generate with: openssl rand -base64 32>"
+whitelist_hosts:
+    - s3.sneak.cloud
+    - static.sneak.cloud
+    - sneak.berlin
+allow_http: false
+```
+
+**Important:** Generate a unique `signing_key` for production. Never
+use the default placeholder value.
+
+## Health Check
+
+The Dockerfile includes a `HEALTHCHECK` instruction that probes
+`/.well-known/healthcheck.json` every 30 seconds. µPaaS verifies
+container health 60 seconds after deployment.
+
+## Deployment Flow
+
+1. Push to `main` triggers the Gitea webhook
+2. µPaaS clones the repo and runs `docker build .`
+3. The Dockerfile runs `make check` (format, lint, test) during build
+4. On success, µPaaS stops the old container and starts the new one
+5. After 60 seconds, µPaaS checks container health
--- a/internal/database/database.go
+++ b/internal/database/database.go
@@ -9,7 +9,6 @@ import (
 	"log/slog"
 	"path/filepath"
 	"sort"
-	"strconv"
 	"strings"

 	"go.uber.org/fx"
@@ -22,10 +21,6 @@ import (
 //go:embed schema/*.sql
 var schemaFS embed.FS

-// bootstrapVersion is the migration that creates the schema_migrations
-// table itself. It is applied before the normal migration loop.
-const bootstrapVersion = 0
-
 // Params defines dependencies for Database.
 type Params struct {
 	fx.In
@@ -40,46 +35,6 @@ type Database struct {
 	config *config.Config
 }

-// ParseMigrationVersion extracts the numeric version prefix from a migration
-// filename. Filenames must follow the pattern "<version>.sql" or
-// "<version>_<description>.sql", where version is a zero-padded numeric
-// string (e.g. "001", "002"). Returns the version as an integer and an
-// error if the filename does not match the expected pattern.
-func ParseMigrationVersion(filename string) (int, error) {
-	name := strings.TrimSuffix(filename, filepath.Ext(filename))
-	if name == "" {
-		return 0, fmt.Errorf("invalid migration filename %q: empty name", filename)
-	}
-
-	// Split on underscore to separate version from description.
-	// If there's no underscore, the entire stem is the version.
-	versionStr := name
-	if idx := strings.IndexByte(name, '_'); idx >= 0 {
-		versionStr = name[:idx]
-	}
-
-	if versionStr == "" {
-		return 0, fmt.Errorf("invalid migration filename %q: empty version prefix", filename)
-	}
-
-	// Validate the version is purely numeric.
-	for _, ch := range versionStr {
-		if ch < '0' || ch > '9' {
-			return 0, fmt.Errorf(
-				"invalid migration filename %q: version %q contains non-numeric character %q",
-				filename, versionStr, string(ch),
-			)
-		}
-	}
-
-	version, err := strconv.Atoi(versionStr)
-	if err != nil {
-		return 0, fmt.Errorf("invalid migration filename %q: %w", filename, err)
-	}
-
-	return version, nil
-}
-
 // New creates a new Database instance.
 func New(lc fx.Lifecycle, params Params) (*Database, error) {
 	s := &Database{
@@ -129,87 +84,43 @@ func (s *Database) connect(ctx context.Context) error {
 	s.db = db
 	s.log.Info("database connected")

-	return ApplyMigrations(ctx, s.db, s.log)
+	return s.runMigrations(ctx)
 }

-// collectMigrations reads the embedded schema directory and returns
-// migration filenames sorted lexicographically.
-func collectMigrations() ([]string, error) {
-	entries, err := schemaFS.ReadDir("schema")
+func (s *Database) runMigrations(ctx context.Context) error {
+	// Create migrations tracking table
+	_, err := s.db.ExecContext(ctx, `
+		CREATE TABLE IF NOT EXISTS schema_migrations (
+			version TEXT PRIMARY KEY,
+			applied_at DATETIME DEFAULT CURRENT_TIMESTAMP
+		)
+	`)
 	if err != nil {
-		return nil, fmt.Errorf("failed to read schema directory: %w", err)
+		return fmt.Errorf("failed to create migrations table: %w", err)
 	}

-	var migrations []string
+	// Get list of migration files
+	entries, err := schemaFS.ReadDir("schema")
+	if err != nil {
+		return fmt.Errorf("failed to read schema directory: %w", err)
+	}

+	// Sort migration files by name (001.sql, 002.sql, etc.)
+	var migrations []string
 	for _, entry := range entries {
 		if !entry.IsDir() && strings.HasSuffix(entry.Name(), ".sql") {
 			migrations = append(migrations, entry.Name())
 		}
 	}
-
 	sort.Strings(migrations)

-	return migrations, nil
-}
-
-// bootstrapMigrationsTable ensures the schema_migrations table exists
-// by applying 000.sql if the table is missing.
-func bootstrapMigrationsTable(ctx context.Context, db *sql.DB, log *slog.Logger) error {
-	var tableExists int
-
-	err := db.QueryRowContext(ctx,
-		"SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name='schema_migrations'",
-	).Scan(&tableExists)
-	if err != nil {
-		return fmt.Errorf("failed to check for migrations table: %w", err)
-	}
-
-	if tableExists > 0 {
-		return nil
-	}
-
-	content, err := schemaFS.ReadFile("schema/000.sql")
-	if err != nil {
-		return fmt.Errorf("failed to read bootstrap migration 000.sql: %w", err)
-	}
-
-	if log != nil {
-		log.Info("applying bootstrap migration", "version", bootstrapVersion)
-	}
-
-	_, err = db.ExecContext(ctx, string(content))
-	if err != nil {
-		return fmt.Errorf("failed to apply bootstrap migration: %w", err)
-	}
-
-	return nil
-}
-
-// ApplyMigrations applies all pending migrations to db. An optional logger
-// may be provided for informational output; pass nil for silent operation.
-// This is exported so tests can apply the real schema without the full fx
-// lifecycle.
-func ApplyMigrations(ctx context.Context, db *sql.DB, log *slog.Logger) error {
-	if err := bootstrapMigrationsTable(ctx, db, log); err != nil {
-		return err
-	}
-
-	migrations, err := collectMigrations()
-	if err != nil {
-		return err
-	}
-
+	// Apply each migration that hasn't been applied yet
 	for _, migration := range migrations {
-		version, parseErr := ParseMigrationVersion(migration)
-		if parseErr != nil {
-			return parseErr
-		}
+		version := strings.TrimSuffix(migration, filepath.Ext(migration))

-		// Check if already applied.
+		// Check if already applied
 		var count int
-
-		err := db.QueryRowContext(ctx,
+		err := s.db.QueryRowContext(ctx,
 			"SELECT COUNT(*) FROM schema_migrations WHERE version = ?",
 			version,
 		).Scan(&count)
@@ -218,40 +129,34 @@ func ApplyMigrations(ctx context.Context, db *sql.DB, log *slog.Logger) error {
 		}

 		if count > 0 {
-			if log != nil {
-				log.Debug("migration already applied", "version", version)
-			}
+			s.log.Debug("migration already applied", "version", version)

 			continue
 		}

-		// Read and apply migration.
-		content, readErr := schemaFS.ReadFile(filepath.Join("schema", migration))
-		if readErr != nil {
-			return fmt.Errorf("failed to read migration %s: %w", migration, readErr)
+		// Read and apply migration
+		content, err := schemaFS.ReadFile(filepath.Join("schema", migration))
+		if err != nil {
+			return fmt.Errorf("failed to read migration %s: %w", migration, err)
 		}

-		if log != nil {
-			log.Info("applying migration", "version", version)
+		s.log.Info("applying migration", "version", version)
+
+		_, err = s.db.ExecContext(ctx, string(content))
+		if err != nil {
+			return fmt.Errorf("failed to apply migration %s: %w", migration, err)
 		}

-		_, execErr := db.ExecContext(ctx, string(content))
-		if execErr != nil {
-			return fmt.Errorf("failed to apply migration %s: %w", migration, execErr)
-		}
-
-		// Record migration as applied.
-		_, recErr := db.ExecContext(ctx,
+		// Record migration as applied
+		_, err = s.db.ExecContext(ctx,
 			"INSERT INTO schema_migrations (version) VALUES (?)",
 			version,
 		)
-		if recErr != nil {
-			return fmt.Errorf("failed to record migration %s: %w", migration, recErr)
+		if err != nil {
+			return fmt.Errorf("failed to record migration %s: %w", migration, err)
 		}

-		if log != nil {
-			log.Info("migration applied successfully", "version", version)
-		}
+		s.log.Info("migration applied successfully", "version", version)
 	}

 	return nil
@@ -261,3 +166,77 @@ func ApplyMigrations(ctx context.Context, db *sql.DB, log *slog.Logger) error {
 func (s *Database) DB() *sql.DB {
 	return s.db
 }
+
+// ApplyMigrations applies all migrations to the given database.
+// This is useful for testing where you want to use the real schema
+// without the full fx lifecycle.
+func ApplyMigrations(db *sql.DB) error {
+	ctx := context.Background()
+
+	// Create migrations tracking table
+	_, err := db.ExecContext(ctx, `
+		CREATE TABLE IF NOT EXISTS schema_migrations (
+			version TEXT PRIMARY KEY,
+			applied_at DATETIME DEFAULT CURRENT_TIMESTAMP
+		)
+	`)
+	if err != nil {
+		return fmt.Errorf("failed to create migrations table: %w", err)
+	}
+
+	// Get list of migration files
+	entries, err := schemaFS.ReadDir("schema")
+	if err != nil {
+		return fmt.Errorf("failed to read schema directory: %w", err)
+	}
+
+	// Sort migration files by name (001.sql, 002.sql, etc.)
+	var migrations []string
+	for _, entry := range entries {
+		if !entry.IsDir() && strings.HasSuffix(entry.Name(), ".sql") {
+			migrations = append(migrations, entry.Name())
+		}
+	}
+	sort.Strings(migrations)
+
+	// Apply each migration that hasn't been applied yet
+	for _, migration := range migrations {
+		version := strings.TrimSuffix(migration, filepath.Ext(migration))
+
+		// Check if already applied
+		var count int
+		err := db.QueryRowContext(ctx,
+			"SELECT COUNT(*) FROM schema_migrations WHERE version = ?",
+			version,
+		).Scan(&count)
+		if err != nil {
+			return fmt.Errorf("failed to check migration status: %w", err)
+		}
+
+		if count > 0 {
+			continue
+		}
+
+		// Read and apply migration
+		content, err := schemaFS.ReadFile(filepath.Join("schema", migration))
+		if err != nil {
+			return fmt.Errorf("failed to read migration %s: %w", migration, err)
+		}
+
+		_, err = db.ExecContext(ctx, string(content))
+		if err != nil {
+			return fmt.Errorf("failed to apply migration %s: %w", migration, err)
+		}
+
+		// Record migration as applied
+		_, err = db.ExecContext(ctx,
+			"INSERT INTO schema_migrations (version) VALUES (?)",
+			version,
+		)
+		if err != nil {
+			return fmt.Errorf("failed to record migration %s: %w", migration, err)
+		}
+	}
+
+	return nil
+}
--- a/internal/database/database_test.go
+++ b/internal/database/database_test.go
@@ -1,224 +0,0 @@
-package database
-
-import (
-	"context"
-	"database/sql"
-	"testing"
-
-	_ "modernc.org/sqlite" // SQLite driver registration
-)
-
-// openTestDB returns a fresh in-memory SQLite database.
-func openTestDB(t *testing.T) *sql.DB {
-	t.Helper()
-
-	db, err := sql.Open("sqlite", ":memory:")
-	if err != nil {
-		t.Fatalf("failed to open test db: %v", err)
-	}
-
-	t.Cleanup(func() { db.Close() })
-
-	return db
-}
-
-func TestParseMigrationVersion(t *testing.T) {
-	tests := []struct {
-		name     string
-		filename string
-		want     int
-		wantErr  bool
-	}{
-		{
-			name:     "version only",
-			filename: "001.sql",
-			want:     1,
-		},
-		{
-			name:     "version with description",
-			filename: "001_initial_schema.sql",
-			want:     1,
-		},
-		{
-			name:     "multi-digit version",
-			filename: "042_add_indexes.sql",
-			want:     42,
-		},
-		{
-			name:     "long version number",
-			filename: "00001_long_prefix.sql",
-			want:     1,
-		},
-		{
-			name:     "description with multiple underscores",
-			filename: "003_add_user_auth_tables.sql",
-			want:     3,
-		},
-		{
-			name:     "empty filename",
-			filename: ".sql",
-			wantErr:  true,
-		},
-		{
-			name:     "leading underscore",
-			filename: "_description.sql",
-			wantErr:  true,
-		},
-		{
-			name:     "non-numeric version",
-			filename: "abc_migration.sql",
-			wantErr:  true,
-		},
-		{
-			name:     "mixed alphanumeric version",
-			filename: "001a_migration.sql",
-			wantErr:  true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := ParseMigrationVersion(tt.filename)
-			if tt.wantErr {
-				if err == nil {
-					t.Errorf("ParseMigrationVersion(%q) expected error, got %d", tt.filename, got)
-				}
-
-				return
-			}
-
-			if err != nil {
-				t.Errorf("ParseMigrationVersion(%q) unexpected error: %v", tt.filename, err)
-
-				return
-			}
-
-			if got != tt.want {
-				t.Errorf("ParseMigrationVersion(%q) = %d, want %d", tt.filename, got, tt.want)
-			}
-		})
-	}
-}
-
-func TestApplyMigrations_CreatesSchemaAndTables(t *testing.T) {
-	db := openTestDB(t)
-	ctx := context.Background()
-
-	if err := ApplyMigrations(ctx, db, nil); err != nil {
-		t.Fatalf("ApplyMigrations failed: %v", err)
-	}
-
-	// The schema_migrations table must exist and contain at least
-	// version 0 (the bootstrap) and 1 (the initial schema).
-	rows, err := db.Query("SELECT version FROM schema_migrations ORDER BY version")
-	if err != nil {
-		t.Fatalf("failed to query schema_migrations: %v", err)
-	}
-	defer rows.Close()
-
-	var versions []int
-	for rows.Next() {
-		var v int
-		if err := rows.Scan(&v); err != nil {
-			t.Fatalf("failed to scan version: %v", err)
-		}
-
-		versions = append(versions, v)
-	}
-
-	if err := rows.Err(); err != nil {
-		t.Fatalf("row iteration error: %v", err)
-	}
-
-	if len(versions) < 2 {
-		t.Fatalf("expected at least 2 migrations recorded, got %d: %v", len(versions), versions)
-	}
-
-	if versions[0] != 0 {
-		t.Errorf("first recorded migration = %d, want %d", versions[0], 0)
-	}
-
-	if versions[1] != 1 {
-		t.Errorf("second recorded migration = %d, want %d", versions[1], 1)
-	}
-
-	// Verify that the application tables created by 001.sql exist.
-	for _, table := range []string{"source_content", "source_metadata", "output_content", "request_cache", "negative_cache", "cache_stats"} {
-		var count int
-
-		err := db.QueryRow(
-			"SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name=?",
-			table,
-		).Scan(&count)
-		if err != nil {
-			t.Fatalf("failed to check for table %s: %v", table, err)
-		}
-
-		if count != 1 {
-			t.Errorf("table %s does not exist after migrations", table)
-		}
-	}
-}
-
-func TestApplyMigrations_Idempotent(t *testing.T) {
-	db := openTestDB(t)
-	ctx := context.Background()
-
-	if err := ApplyMigrations(ctx, db, nil); err != nil {
-		t.Fatalf("first ApplyMigrations failed: %v", err)
-	}
-
-	// Running a second time must succeed without errors.
-	if err := ApplyMigrations(ctx, db, nil); err != nil {
-		t.Fatalf("second ApplyMigrations failed: %v", err)
-	}
-
-	// Verify no duplicate rows in schema_migrations.
-	var count int
-
-	err := db.QueryRow("SELECT COUNT(*) FROM schema_migrations WHERE version = 0").Scan(&count)
-	if err != nil {
-		t.Fatalf("failed to count version 0 rows: %v", err)
-	}
-
-	if count != 1 {
-		t.Errorf("expected exactly 1 row for version 0, got %d", count)
-	}
-}
-
-func TestBootstrapMigrationsTable_FreshDatabase(t *testing.T) {
-	db := openTestDB(t)
-	ctx := context.Background()
-
-	if err := bootstrapMigrationsTable(ctx, db, nil); err != nil {
-		t.Fatalf("bootstrapMigrationsTable failed: %v", err)
-	}
-
-	// schema_migrations table must exist.
-	var tableCount int
-
-	err := db.QueryRow(
-		"SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name='schema_migrations'",
-	).Scan(&tableCount)
-	if err != nil {
-		t.Fatalf("failed to check for table: %v", err)
-	}
-
-	if tableCount != 1 {
-		t.Fatalf("schema_migrations table not created")
-	}
-
-	// Version 0 must be recorded.
-	var recorded int
-
-	err = db.QueryRow(
-		"SELECT COUNT(*) FROM schema_migrations WHERE version = 0",
-	).Scan(&recorded)
-	if err != nil {
-		t.Fatalf("failed to check version: %v", err)
-	}
-
-	if recorded != 1 {
-		t.Errorf("expected version 0 to be recorded, got count %d", recorded)
-	}
-}
--- a/internal/database/schema/000.sql
+++ b/internal/database/schema/000.sql
@@ -1,9 +0,0 @@
-- Migration 000: Schema migrations tracking table
-- Applied as a bootstrap step before the normal migration loop.
-
-CREATE TABLE IF NOT EXISTS schema_migrations (
-    version INTEGER PRIMARY KEY,
-    applied_at DATETIME DEFAULT CURRENT_TIMESTAMP
-);
-
-INSERT OR IGNORE INTO schema_migrations (version) VALUES (0);
--- a/internal/database/schema/001_initial_schema.sql
+++ b/internal/database/schema/001_initial_schema.sql
--- a/internal/globals/globals.go
+++ b/internal/globals/globals.go
@@ -5,10 +5,11 @@ import (
 	"go.uber.org/fx"
 )

-const appname = "pixad"
-
-// Version is populated from main() via ldflags.
-var Version string //nolint:gochecknoglobals // set from main
+// Build-time variables populated from main() via ldflags.
+var (
+	Appname string //nolint:gochecknoglobals // set from main
+	Version string //nolint:gochecknoglobals // set from main
+)

 // Globals holds application-wide constants.
 type Globals struct {
@@ -19,7 +20,7 @@ type Globals struct {
 // New creates a new Globals instance from build-time variables.
 func New(_ fx.Lifecycle) (*Globals, error) {
 	return &Globals{
-		Appname: appname,
+		Appname: Appname,
 		Version: Version,
 	}, nil
 }
--- a/internal/handlers/handlers_test.go
+++ b/internal/handlers/handlers_test.go
@@ -82,7 +82,7 @@ func setupTestDB(t *testing.T) *sql.DB {
 		t.Fatalf("failed to open test db: %v", err)
 	}

-	if err := database.ApplyMigrations(context.Background(), db, nil); err != nil {
+	if err := database.ApplyMigrations(db); err != nil {
 		t.Fatalf("failed to apply migrations: %v", err)
 	}

--- a/internal/imageprocessor/testdata/red.avif
+++ b/internal/imageprocessor/testdata/red.avif
--- a/internal/imgcache/imgcache.go
+++ b/internal/imgcache/imgcache.go
@@ -199,6 +199,36 @@ type FetchResult struct {
 	TLSCipherSuite string
 }

+// Processor handles image transformation (resize, format conversion)
+type Processor interface {
+	// Process transforms an image according to the request
+	Process(ctx context.Context, input io.Reader, req *ImageRequest) (*ProcessResult, error)
+	// SupportedInputFormats returns MIME types this processor can read
+	SupportedInputFormats() []string
+	// SupportedOutputFormats returns formats this processor can write
+	SupportedOutputFormats() []ImageFormat
+}
+
+// ProcessResult contains the result of image processing
+type ProcessResult struct {
+	// Content is the processed image data
+	Content io.ReadCloser
+	// ContentLength is the size in bytes
+	ContentLength int64
+	// ContentType is the MIME type of the output
+	ContentType string
+	// Width is the output image width
+	Width int
+	// Height is the output image height
+	Height int
+	// InputWidth is the original image width before processing
+	InputWidth int
+	// InputHeight is the original image height before processing
+	InputHeight int
+	// InputFormat is the detected input format (e.g., "jpeg", "png")
+	InputFormat string
+}
+
 // Storage handles persistent storage of cached content
 type Storage interface {
 	// Store saves content and returns its hash
--- a/internal/imgcache/magic.go
+++ b/internal/imgcache/magic.go
@@ -1,6 +1,4 @@
-// Package magic detects image formats from magic bytes and validates
-// content against declared MIME types.
-package magic
+package imgcache

 import (
 	"bytes"
@@ -29,20 +27,6 @@ const (
 	MIMETypeSVG  = MIMEType("image/svg+xml")
 )

-// ImageFormat represents supported output image formats.
-// This mirrors the type in imgcache to avoid circular imports.
-type ImageFormat string
-
-// Supported image output formats.
-const (
-	FormatOriginal ImageFormat = "orig"
-	FormatJPEG     ImageFormat = "jpeg"
-	FormatPNG      ImageFormat = "png"
-	FormatWebP     ImageFormat = "webp"
-	FormatAVIF     ImageFormat = "avif"
-	FormatGIF      ImageFormat = "gif"
-)
-
 // MinMagicBytes is the minimum number of bytes needed to detect format.
 const MinMagicBytes = 12

@@ -205,7 +189,7 @@ func PeekAndValidate(r io.Reader, declaredType string) (io.Reader, error) {
 	return io.MultiReader(bytes.NewReader(buf), r), nil
 }

-// MIMEToImageFormat converts a MIME type to an ImageFormat.
+// MIMEToImageFormat converts a MIME type to our ImageFormat type.
 func MIMEToImageFormat(mimeType string) (ImageFormat, bool) {
 	normalized := normalizeMIMEType(mimeType)
 	switch MIMEType(normalized) {
@@ -224,7 +208,7 @@ func MIMEToImageFormat(mimeType string) (ImageFormat, bool) {
 	}
 }

-// ImageFormatToMIME converts an ImageFormat to a MIME type string.
+// ImageFormatToMIME converts our ImageFormat to a MIME type string.
 func ImageFormatToMIME(format ImageFormat) string {
 	switch format {
 	case FormatJPEG:
--- a/internal/imgcache/magic_test.go
+++ b/internal/imgcache/magic_test.go
@@ -1,4 +1,4 @@
-package magic
+package imgcache

 import (
 	"bytes"
--- a/internal/imageprocessor/imageprocessor.go
+++ b/internal/imageprocessor/imageprocessor.go
@@ -1,5 +1,4 @@
-// Package imageprocessor provides image format conversion and resizing using libvips.
-package imageprocessor
+package imgcache

 import (
 	"bytes"
@@ -23,133 +22,38 @@ func initVips() {
 	})
 }

-// Format represents supported output image formats.
-type Format string
-
-// Supported image output formats.
-const (
-	FormatOriginal Format = "orig"
-	FormatJPEG     Format = "jpeg"
-	FormatPNG      Format = "png"
-	FormatWebP     Format = "webp"
-	FormatAVIF     Format = "avif"
-	FormatGIF      Format = "gif"
-)
-
-// FitMode represents how to fit an image into requested dimensions.
-type FitMode string
-
-// Supported image fit modes.
-const (
-	FitCover   FitMode = "cover"
-	FitContain FitMode = "contain"
-	FitFill    FitMode = "fill"
-	FitInside  FitMode = "inside"
-	FitOutside FitMode = "outside"
-)
-
-// ErrInvalidFitMode is returned when an invalid fit mode is provided.
-var ErrInvalidFitMode = errors.New("invalid fit mode")
-
-// Size represents requested image dimensions.
-type Size struct {
-	Width  int
-	Height int
-}
-
-// Request holds the parameters for image processing.
-type Request struct {
-	Size    Size
-	Format  Format
-	Quality int
-	FitMode FitMode
-}
-
-// Result contains the output of image processing.
-type Result struct {
-	// Content is the processed image data.
-	Content io.ReadCloser
-	// ContentLength is the size in bytes.
-	ContentLength int64
-	// ContentType is the MIME type of the output.
-	ContentType string
-	// Width is the output image width.
-	Width int
-	// Height is the output image height.
-	Height int
-	// InputWidth is the original image width before processing.
-	InputWidth int
-	// InputHeight is the original image height before processing.
-	InputHeight int
-	// InputFormat is the detected input format (e.g., "jpeg", "png").
-	InputFormat string
-}
-
 // MaxInputDimension is the maximum allowed width or height for input images.
 // Images larger than this are rejected to prevent DoS via decompression bombs.
 const MaxInputDimension = 8192

-// DefaultMaxInputBytes is the default maximum input size in bytes (50 MiB).
-// This matches the default upstream fetcher limit.
-const DefaultMaxInputBytes = 50 << 20
-
 // ErrInputTooLarge is returned when input image dimensions exceed MaxInputDimension.
 var ErrInputTooLarge = errors.New("input image dimensions exceed maximum")

-// ErrInputDataTooLarge is returned when the raw input data exceeds the configured byte limit.
-var ErrInputDataTooLarge = errors.New("input data exceeds maximum allowed size")
-
 // ErrUnsupportedOutputFormat is returned when the requested output format is not supported.
 var ErrUnsupportedOutputFormat = errors.New("unsupported output format")

-// ImageProcessor implements image transformation using libvips via govips.
-type ImageProcessor struct {
-	maxInputBytes int64
-}
+// ImageProcessor implements the Processor interface using libvips via govips.
+type ImageProcessor struct{}

-// Params holds configuration for creating an ImageProcessor.
-// Zero values use sensible defaults (MaxInputBytes defaults to DefaultMaxInputBytes).
-type Params struct {
-	// MaxInputBytes is the maximum allowed input size in bytes.
-	// If <= 0, DefaultMaxInputBytes is used.
-	MaxInputBytes int64
-}
-
-// New creates a new image processor with the given parameters.
-// A zero-value Params{} uses sensible defaults.
-func New(params Params) *ImageProcessor {
+// NewImageProcessor creates a new image processor.
+func NewImageProcessor() *ImageProcessor {
 	initVips()

-	maxInputBytes := params.MaxInputBytes
-	if maxInputBytes <= 0 {
-		maxInputBytes = DefaultMaxInputBytes
-	}
-
-	return &ImageProcessor{
-		maxInputBytes: maxInputBytes,
-	}
+	return &ImageProcessor{}
 }

 // Process transforms an image according to the request.
 func (p *ImageProcessor) Process(
 	_ context.Context,
 	input io.Reader,
-	req *Request,
-) (*Result, error) {
-	// Read input with a size limit to prevent unbounded memory consumption.
-	// We read at most maxInputBytes+1 so we can detect if the input exceeds
-	// the limit without consuming additional memory.
-	limited := io.LimitReader(input, p.maxInputBytes+1)
-
-	data, err := io.ReadAll(limited)
+	req *ImageRequest,
+) (*ProcessResult, error) {
+	// Read input
+	data, err := io.ReadAll(input)
 	if err != nil {
 		return nil, fmt.Errorf("failed to read input: %w", err)
 	}

-	if int64(len(data)) > p.maxInputBytes {
-		return nil, ErrInputDataTooLarge
-	}
-
 	// Decode image
 	img, err := vips.NewImageFromBuffer(data)
 	if err != nil {
@@ -205,10 +109,10 @@ func (p *ImageProcessor) Process(
 		return nil, fmt.Errorf("failed to encode: %w", err)
 	}

-	return &Result{
+	return &ProcessResult{
 		Content:       io.NopCloser(bytes.NewReader(output)),
 		ContentLength: int64(len(output)),
-		ContentType:   FormatToMIME(outputFormat),
+		ContentType:   ImageFormatToMIME(outputFormat),
 		Width:         img.Width(),
 		Height:        img.Height(),
 		InputWidth:    origWidth,
@@ -220,17 +124,17 @@ func (p *ImageProcessor) Process(
 // SupportedInputFormats returns MIME types this processor can read.
 func (p *ImageProcessor) SupportedInputFormats() []string {
 	return []string{
-		"image/jpeg",
-		"image/png",
-		"image/gif",
-		"image/webp",
-		"image/avif",
+		string(MIMETypeJPEG),
+		string(MIMETypePNG),
+		string(MIMETypeGIF),
+		string(MIMETypeWebP),
+		string(MIMETypeAVIF),
 	}
 }

 // SupportedOutputFormats returns formats this processor can write.
-func (p *ImageProcessor) SupportedOutputFormats() []Format {
-	return []Format{
+func (p *ImageProcessor) SupportedOutputFormats() []ImageFormat {
+	return []ImageFormat{
 		FormatJPEG,
 		FormatPNG,
 		FormatGIF,
@@ -239,24 +143,6 @@ func (p *ImageProcessor) SupportedOutputFormats() []Format {
 	}
 }

-// FormatToMIME converts a Format to its MIME type string.
-func FormatToMIME(format Format) string {
-	switch format {
-	case FormatJPEG:
-		return "image/jpeg"
-	case FormatPNG:
-		return "image/png"
-	case FormatWebP:
-		return "image/webp"
-	case FormatGIF:
-		return "image/gif"
-	case FormatAVIF:
-		return "image/avif"
-	default:
-		return "application/octet-stream"
-	}
-}
-
 // detectFormat returns the format string from a vips image.
 func (p *ImageProcessor) detectFormat(img *vips.ImageRef) string {
 	format := img.Format()
@@ -285,6 +171,7 @@ func (p *ImageProcessor) resize(img *vips.ImageRef, width, height int, fit FitMo

 	case FitContain:
 		// Resize to fit within dimensions, maintaining aspect ratio
+		// Calculate target dimensions maintaining aspect ratio
 		imgW, imgH := img.Width(), img.Height()
 		scaleW := float64(width) / float64(imgW)
 		scaleH := float64(height) / float64(imgH)
@@ -295,7 +182,7 @@ func (p *ImageProcessor) resize(img *vips.ImageRef, width, height int, fit FitMo
 		return img.Thumbnail(newW, newH, vips.InterestingNone)

 	case FitFill:
-		// Resize to exact dimensions (may distort)
+		// Resize to exact dimensions (may distort) - use ThumbnailWithSize with Force
 		return img.ThumbnailWithSize(width, height, vips.InterestingNone, vips.SizeForce)

 	case FitInside:
@@ -331,7 +218,7 @@ func (p *ImageProcessor) resize(img *vips.ImageRef, width, height int, fit FitMo
 const defaultQuality = 85

 // encode encodes an image to the specified format.
-func (p *ImageProcessor) encode(img *vips.ImageRef, format Format, quality int) ([]byte, error) {
+func (p *ImageProcessor) encode(img *vips.ImageRef, format ImageFormat, quality int) ([]byte, error) {
 	if quality <= 0 {
 		quality = defaultQuality
 	}
@@ -379,8 +266,8 @@ func (p *ImageProcessor) encode(img *vips.ImageRef, format Format, quality int)
 	return output, nil
 }

-// formatFromString converts a format string to Format.
-func (p *ImageProcessor) formatFromString(format string) Format {
+// formatFromString converts a format string to ImageFormat.
+func (p *ImageProcessor) formatFromString(format string) ImageFormat {
 	switch format {
 	case "jpeg":
 		return FormatJPEG
--- a/internal/imageprocessor/imageprocessor_test.go
+++ b/internal/imageprocessor/imageprocessor_test.go
@@ -1,4 +1,4 @@
-package imageprocessor
+package imgcache

 import (
 	"bytes"
@@ -70,36 +70,13 @@ func createTestPNG(t *testing.T, width, height int) []byte {
 	return buf.Bytes()
 }

-// detectMIME is a minimal magic-byte detector for test assertions.
-func detectMIME(data []byte) string {
-	if len(data) >= 3 && data[0] == 0xFF && data[1] == 0xD8 && data[2] == 0xFF {
-		return "image/jpeg"
-	}
-	if len(data) >= 8 && string(data[:8]) == "\x89PNG\r\n\x1a\n" {
-		return "image/png"
-	}
-	if len(data) >= 4 && string(data[:4]) == "GIF8" {
-		return "image/gif"
-	}
-	if len(data) >= 12 && string(data[:4]) == "RIFF" && string(data[8:12]) == "WEBP" {
-		return "image/webp"
-	}
-	if len(data) >= 12 && string(data[4:8]) == "ftyp" {
-		brand := string(data[8:12])
-		if brand == "avif" || brand == "avis" {
-			return "image/avif"
-		}
-	}
-	return ""
-}
-
 func TestImageProcessor_ResizeJPEG(t *testing.T) {
-	proc := New(Params{})
+	proc := NewImageProcessor()
 	ctx := context.Background()

 	input := createTestJPEG(t, 800, 600)

-	req := &Request{
+	req := &ImageRequest{
 		Size:    Size{Width: 400, Height: 300},
 		Format:  FormatJPEG,
 		Quality: 85,
@@ -130,19 +107,23 @@ func TestImageProcessor_ResizeJPEG(t *testing.T) {
 		t.Fatalf("failed to read result: %v", err)
 	}

-	mime := detectMIME(data)
-	if mime != "image/jpeg" {
-		t.Errorf("Output format = %v, want image/jpeg", mime)
+	mime, err := DetectFormat(data)
+	if err != nil {
+		t.Fatalf("DetectFormat() error = %v", err)
+	}
+
+	if mime != MIMETypeJPEG {
+		t.Errorf("Output format = %v, want %v", mime, MIMETypeJPEG)
 	}
 }

 func TestImageProcessor_ConvertToPNG(t *testing.T) {
-	proc := New(Params{})
+	proc := NewImageProcessor()
 	ctx := context.Background()

 	input := createTestJPEG(t, 200, 150)

-	req := &Request{
+	req := &ImageRequest{
 		Size:    Size{Width: 200, Height: 150},
 		Format:  FormatPNG,
 		FitMode: FitCover,
@@ -159,19 +140,23 @@ func TestImageProcessor_ConvertToPNG(t *testing.T) {
 		t.Fatalf("failed to read result: %v", err)
 	}

-	mime := detectMIME(data)
-	if mime != "image/png" {
-		t.Errorf("Output format = %v, want image/png", mime)
+	mime, err := DetectFormat(data)
+	if err != nil {
+		t.Fatalf("DetectFormat() error = %v", err)
+	}
+
+	if mime != MIMETypePNG {
+		t.Errorf("Output format = %v, want %v", mime, MIMETypePNG)
 	}
 }

 func TestImageProcessor_OriginalSize(t *testing.T) {
-	proc := New(Params{})
+	proc := NewImageProcessor()
 	ctx := context.Background()

 	input := createTestJPEG(t, 640, 480)

-	req := &Request{
+	req := &ImageRequest{
 		Size:    Size{Width: 0, Height: 0}, // Original size
 		Format:  FormatJPEG,
 		Quality: 85,
@@ -194,14 +179,14 @@ func TestImageProcessor_OriginalSize(t *testing.T) {
 }

 func TestImageProcessor_FitContain(t *testing.T) {
-	proc := New(Params{})
+	proc := NewImageProcessor()
 	ctx := context.Background()

 	// 800x400 image (2:1 aspect) into 400x400 box with contain
 	// Should result in 400x200 (maintaining aspect ratio)
 	input := createTestJPEG(t, 800, 400)

-	req := &Request{
+	req := &ImageRequest{
 		Size:    Size{Width: 400, Height: 400},
 		Format:  FormatJPEG,
 		Quality: 85,
@@ -221,14 +206,14 @@ func TestImageProcessor_FitContain(t *testing.T) {
 }

 func TestImageProcessor_ProportionalScale_WidthOnly(t *testing.T) {
-	proc := New(Params{})
+	proc := NewImageProcessor()
 	ctx := context.Background()

 	// 800x600 image, request width=400 height=0
 	// Should scale proportionally to 400x300
 	input := createTestJPEG(t, 800, 600)

-	req := &Request{
+	req := &ImageRequest{
 		Size:    Size{Width: 400, Height: 0},
 		Format:  FormatJPEG,
 		Quality: 85,
@@ -251,14 +236,14 @@ func TestImageProcessor_ProportionalScale_WidthOnly(t *testing.T) {
 }

 func TestImageProcessor_ProportionalScale_HeightOnly(t *testing.T) {
-	proc := New(Params{})
+	proc := NewImageProcessor()
 	ctx := context.Background()

 	// 800x600 image, request width=0 height=300
 	// Should scale proportionally to 400x300
 	input := createTestJPEG(t, 800, 600)

-	req := &Request{
+	req := &ImageRequest{
 		Size:    Size{Width: 0, Height: 300},
 		Format:  FormatJPEG,
 		Quality: 85,
@@ -281,12 +266,12 @@ func TestImageProcessor_ProportionalScale_HeightOnly(t *testing.T) {
 }

 func TestImageProcessor_ProcessPNG(t *testing.T) {
-	proc := New(Params{})
+	proc := NewImageProcessor()
 	ctx := context.Background()

 	input := createTestPNG(t, 400, 300)

-	req := &Request{
+	req := &ImageRequest{
 		Size:    Size{Width: 200, Height: 150},
 		Format:  FormatPNG,
 		FitMode: FitCover,
@@ -307,8 +292,13 @@ func TestImageProcessor_ProcessPNG(t *testing.T) {
 	}
 }

+func TestImageProcessor_ImplementsInterface(t *testing.T) {
+	// Verify ImageProcessor implements Processor interface
+	var _ Processor = (*ImageProcessor)(nil)
+}
+
 func TestImageProcessor_SupportedFormats(t *testing.T) {
-	proc := New(Params{})
+	proc := NewImageProcessor()

 	inputFormats := proc.SupportedInputFormats()
 	if len(inputFormats) == 0 {
@@ -322,14 +312,14 @@ func TestImageProcessor_SupportedFormats(t *testing.T) {
 }

 func TestImageProcessor_RejectsOversizedInput(t *testing.T) {
-	proc := New(Params{})
+	proc := NewImageProcessor()
 	ctx := context.Background()

 	// Create an image that exceeds MaxInputDimension (e.g., 10000x100)
 	// This should be rejected before processing to prevent DoS
 	input := createTestJPEG(t, 10000, 100)

-	req := &Request{
+	req := &ImageRequest{
 		Size:    Size{Width: 100, Height: 100},
 		Format:  FormatJPEG,
 		Quality: 85,
@@ -347,13 +337,13 @@ func TestImageProcessor_RejectsOversizedInput(t *testing.T) {
 }

 func TestImageProcessor_RejectsOversizedInputHeight(t *testing.T) {
-	proc := New(Params{})
+	proc := NewImageProcessor()
 	ctx := context.Background()

 	// Create an image with oversized height
 	input := createTestJPEG(t, 100, 10000)

-	req := &Request{
+	req := &ImageRequest{
 		Size:    Size{Width: 100, Height: 100},
 		Format:  FormatJPEG,
 		Quality: 85,
@@ -371,13 +361,14 @@ func TestImageProcessor_RejectsOversizedInputHeight(t *testing.T) {
 }

 func TestImageProcessor_AcceptsMaxDimensionInput(t *testing.T) {
-	proc := New(Params{})
+	proc := NewImageProcessor()
 	ctx := context.Background()

 	// Create an image at exactly MaxInputDimension - should be accepted
+	// Using smaller dimensions to keep test fast
 	input := createTestJPEG(t, MaxInputDimension, 100)

-	req := &Request{
+	req := &ImageRequest{
 		Size:    Size{Width: 100, Height: 100},
 		Format:  FormatJPEG,
 		Quality: 85,
@@ -392,12 +383,12 @@ func TestImageProcessor_AcceptsMaxDimensionInput(t *testing.T) {
 }

 func TestImageProcessor_EncodeWebP(t *testing.T) {
-	proc := New(Params{})
+	proc := NewImageProcessor()
 	ctx := context.Background()

 	input := createTestJPEG(t, 200, 150)

-	req := &Request{
+	req := &ImageRequest{
 		Size:    Size{Width: 100, Height: 75},
 		Format:  FormatWebP,
 		Quality: 80,
@@ -416,9 +407,13 @@ func TestImageProcessor_EncodeWebP(t *testing.T) {
 		t.Fatalf("failed to read result: %v", err)
 	}

-	mime := detectMIME(data)
-	if mime != "image/webp" {
-		t.Errorf("Output format = %v, want image/webp", mime)
+	mime, err := DetectFormat(data)
+	if err != nil {
+		t.Fatalf("DetectFormat() error = %v", err)
+	}
+
+	if mime != MIMETypeWebP {
+		t.Errorf("Output format = %v, want %v", mime, MIMETypeWebP)
 	}

 	// Verify dimensions
@@ -431,7 +426,7 @@ func TestImageProcessor_EncodeWebP(t *testing.T) {
 }

 func TestImageProcessor_DecodeAVIF(t *testing.T) {
-	proc := New(Params{})
+	proc := NewImageProcessor()
 	ctx := context.Background()

 	// Load test AVIF file
@@ -441,7 +436,7 @@ func TestImageProcessor_DecodeAVIF(t *testing.T) {
 	}

 	// Request resize and convert to JPEG
-	req := &Request{
+	req := &ImageRequest{
 		Size:    Size{Width: 2, Height: 2},
 		Format:  FormatJPEG,
 		Quality: 85,
@@ -460,84 +455,23 @@ func TestImageProcessor_DecodeAVIF(t *testing.T) {
 		t.Fatalf("failed to read result: %v", err)
 	}

-	mime := detectMIME(data)
-	if mime != "image/jpeg" {
-		t.Errorf("Output format = %v, want image/jpeg", mime)
-	}
-}
-
-func TestImageProcessor_RejectsOversizedInputData(t *testing.T) {
-	// Create a processor with a very small byte limit
-	const limit = 1024
-	proc := New(Params{MaxInputBytes: limit})
-	ctx := context.Background()
-
-	// Create a valid JPEG that exceeds the byte limit
-	input := createTestJPEG(t, 800, 600) // will be well over 1 KiB
-	if int64(len(input)) <= limit {
-		t.Fatalf("test JPEG must exceed %d bytes, got %d", limit, len(input))
-	}
-
-	req := &Request{
-		Size:    Size{Width: 100, Height: 75},
-		Format:  FormatJPEG,
-		Quality: 85,
-		FitMode: FitCover,
-	}
-
-	_, err := proc.Process(ctx, bytes.NewReader(input), req)
-	if err == nil {
-		t.Fatal("Process() should reject input exceeding maxInputBytes")
-	}
-
-	if err != ErrInputDataTooLarge {
-		t.Errorf("Process() error = %v, want ErrInputDataTooLarge", err)
-	}
-}
-
-func TestImageProcessor_AcceptsInputWithinLimit(t *testing.T) {
-	// Create a small image and set limit well above its size
-	input := createTestJPEG(t, 10, 10)
-	limit := int64(len(input)) * 10 // 10× headroom
-
-	proc := New(Params{MaxInputBytes: limit})
-	ctx := context.Background()
-
-	req := &Request{
-		Size:    Size{Width: 10, Height: 10},
-		Format:  FormatJPEG,
-		Quality: 85,
-		FitMode: FitCover,
-	}
-
-	result, err := proc.Process(ctx, bytes.NewReader(input), req)
+	mime, err := DetectFormat(data)
 	if err != nil {
-		t.Fatalf("Process() error = %v, want nil", err)
-	}
-	defer result.Content.Close()
-}
-
-func TestImageProcessor_DefaultMaxInputBytes(t *testing.T) {
-	// Passing 0 should use the default
-	proc := New(Params{})
-	if proc.maxInputBytes != DefaultMaxInputBytes {
-		t.Errorf("maxInputBytes = %d, want %d", proc.maxInputBytes, DefaultMaxInputBytes)
+		t.Fatalf("DetectFormat() error = %v", err)
 	}

-	// Passing negative should also use the default
-	proc = New(Params{MaxInputBytes: -1})
-	if proc.maxInputBytes != DefaultMaxInputBytes {
-		t.Errorf("maxInputBytes = %d, want %d", proc.maxInputBytes, DefaultMaxInputBytes)
+	if mime != MIMETypeJPEG {
+		t.Errorf("Output format = %v, want %v", mime, MIMETypeJPEG)
 	}
 }

 func TestImageProcessor_EncodeAVIF(t *testing.T) {
-	proc := New(Params{})
+	proc := NewImageProcessor()
 	ctx := context.Background()

 	input := createTestJPEG(t, 200, 150)

-	req := &Request{
+	req := &ImageRequest{
 		Size:    Size{Width: 100, Height: 75},
 		Format:  FormatAVIF,
 		Quality: 85,
@@ -556,9 +490,13 @@ func TestImageProcessor_EncodeAVIF(t *testing.T) {
 		t.Fatalf("failed to read result: %v", err)
 	}

-	mime := detectMIME(data)
-	if mime != "image/avif" {
-		t.Errorf("Output format = %v, want image/avif", mime)
+	mime, err := DetectFormat(data)
+	if err != nil {
+		t.Fatalf("DetectFormat() error = %v", err)
+	}
+
+	if mime != MIMETypeAVIF {
+		t.Errorf("Output format = %v, want %v", mime, MIMETypeAVIF)
 	}

 	// Verify dimensions
--- a/internal/imgcache/service.go
+++ b/internal/imgcache/service.go
@@ -11,21 +11,17 @@ import (
 	"time"

 	"github.com/dustin/go-humanize"
-	"sneak.berlin/go/pixa/internal/allowlist"
-	"sneak.berlin/go/pixa/internal/imageprocessor"
-	"sneak.berlin/go/pixa/internal/magic"
 )

 // Service implements the ImageCache interface, orchestrating cache, fetcher, and processor.
 type Service struct {
-	cache           *Cache
-	fetcher         Fetcher
-	processor       *imageprocessor.ImageProcessor
-	signer          *Signer
-	allowlist       *allowlist.HostAllowList
-	log             *slog.Logger
-	allowHTTP       bool
-	maxResponseSize int64
+	cache     *Cache
+	fetcher   Fetcher
+	processor Processor
+	signer    *Signer
+	whitelist *HostWhitelist
+	log       *slog.Logger
+	allowHTTP bool
 }

 // ServiceConfig holds configuration for the image service.
@@ -54,17 +50,15 @@ func NewService(cfg *ServiceConfig) (*Service, error) {
 		return nil, errors.New("signing key is required")
 	}

-	// Resolve fetcher config for defaults
-	fetcherCfg := cfg.FetcherConfig
-	if fetcherCfg == nil {
-		fetcherCfg = DefaultFetcherConfig()
-	}
-
 	// Use custom fetcher if provided, otherwise create HTTP fetcher
 	var fetcher Fetcher
 	if cfg.Fetcher != nil {
 		fetcher = cfg.Fetcher
 	} else {
+		fetcherCfg := cfg.FetcherConfig
+		if fetcherCfg == nil {
+			fetcherCfg = DefaultFetcherConfig()
+		}
 		fetcher = NewHTTPFetcher(fetcherCfg)
 	}

@@ -80,17 +74,14 @@ func NewService(cfg *ServiceConfig) (*Service, error) {
 		allowHTTP = cfg.FetcherConfig.AllowHTTP
 	}

-	maxResponseSize := fetcherCfg.MaxResponseSize
-
 	return &Service{
-		cache:           cfg.Cache,
-		fetcher:         fetcher,
-		processor:       imageprocessor.New(imageprocessor.Params{MaxInputBytes: maxResponseSize}),
-		signer:          signer,
-		allowlist:       allowlist.New(cfg.Whitelist),
-		log:             log,
-		allowHTTP:       allowHTTP,
-		maxResponseSize: maxResponseSize,
+		cache:     cfg.Cache,
+		fetcher:   fetcher,
+		processor: NewImageProcessor(),
+		signer:    signer,
+		whitelist: NewHostWhitelist(cfg.Whitelist),
+		log:       log,
+		allowHTTP: allowHTTP,
 	}, nil
 }

@@ -155,40 +146,6 @@ func (s *Service) Get(ctx context.Context, req *ImageRequest) (*ImageResponse, e
 	return response, nil
 }

-// loadCachedSource attempts to load source content from cache, returning nil
-// if the cached data is unavailable or exceeds maxResponseSize.
-func (s *Service) loadCachedSource(contentHash ContentHash) []byte {
-	reader, err := s.cache.GetSourceContent(contentHash)
-	if err != nil {
-		s.log.Warn("failed to load cached source, fetching", "error", err)
-
-		return nil
-	}
-
-	// Bound the read to maxResponseSize to prevent unbounded memory use
-	// from unexpectedly large cached files.
-	limited := io.LimitReader(reader, s.maxResponseSize+1)
-	data, err := io.ReadAll(limited)
-	_ = reader.Close()
-
-	if err != nil {
-		s.log.Warn("failed to read cached source, fetching", "error", err)
-
-		return nil
-	}
-
-	if int64(len(data)) > s.maxResponseSize {
-		s.log.Warn("cached source exceeds max response size, discarding",
-			"hash", contentHash,
-			"max_bytes", s.maxResponseSize,
-		)
-
-		return nil
-	}
-
-	return data
-}
-
 // processFromSourceOrFetch processes an image, using cached source content if available.
 func (s *Service) processFromSourceOrFetch(
 	ctx context.Context,
@@ -205,8 +162,22 @@ func (s *Service) processFromSourceOrFetch(
 	var fetchBytes int64

 	if contentHash != "" {
+		// We have cached source - load it
 		s.log.Debug("using cached source", "hash", contentHash)
-		sourceData = s.loadCachedSource(contentHash)
+
+		reader, err := s.cache.GetSourceContent(contentHash)
+		if err != nil {
+			s.log.Warn("failed to load cached source, fetching", "error", err)
+			// Fall through to fetch
+		} else {
+			sourceData, err = io.ReadAll(reader)
+			_ = reader.Close()
+
+			if err != nil {
+				s.log.Warn("failed to read cached source, fetching", "error", err)
+				// Fall through to fetch
+			}
+		}
 	}

 	// Fetch from upstream if we don't have source data or it's empty
@@ -278,7 +249,7 @@ func (s *Service) fetchAndProcess(
 	)

 	// Validate magic bytes match content type
-	if err := magic.ValidateMagicBytes(sourceData, fetchResult.ContentType); err != nil {
+	if err := ValidateMagicBytes(sourceData, fetchResult.ContentType); err != nil {
 		return nil, fmt.Errorf("content validation failed: %w", err)
 	}

@@ -303,14 +274,7 @@ func (s *Service) processAndStore(
 	// Process the image
 	processStart := time.Now()

-	processReq := &imageprocessor.Request{
-		Size:    imageprocessor.Size{Width: req.Size.Width, Height: req.Size.Height},
-		Format:  imageprocessor.Format(req.Format),
-		Quality: req.Quality,
-		FitMode: imageprocessor.FitMode(req.FitMode),
-	}
-
-	processResult, err := s.processor.Process(ctx, bytes.NewReader(sourceData), processReq)
+	processResult, err := s.processor.Process(ctx, bytes.NewReader(sourceData), req)
 	if err != nil {
 		return nil, fmt.Errorf("image processing failed: %w", err)
 	}
@@ -383,7 +347,7 @@ func (s *Service) Stats(ctx context.Context) (*CacheStats, error) {

 // ValidateRequest validates the request signature if required.
 func (s *Service) ValidateRequest(req *ImageRequest) error {
-	// Check if host is allowed (no signature required)
+	// Check if host is whitelisted (no signature required)
 	sourceURL := req.SourceURL()

 	parsedURL, err := url.Parse(sourceURL)
@@ -391,11 +355,11 @@ func (s *Service) ValidateRequest(req *ImageRequest) error {
 		return fmt.Errorf("invalid source URL: %w", err)
 	}

-	if s.allowlist.IsAllowed(parsedURL) {
+	if s.whitelist.IsWhitelisted(parsedURL) {
 		return nil
 	}

-	// Signature required for non-allowed hosts
+	// Signature required for non-whitelisted hosts
 	return s.signer.Verify(req)
 }

--- a/internal/imgcache/service_test.go
+++ b/internal/imgcache/service_test.go
@@ -5,8 +5,6 @@ import (
 	"io"
 	"testing"
 	"time"
-
-	"sneak.berlin/go/pixa/internal/magic"
 )

 func TestService_Get_WhitelistedHost(t *testing.T) {
@@ -153,74 +151,6 @@ func TestService_Get_NonWhitelistedHost_InvalidSignature(t *testing.T) {
 	}
 }

-// TestService_ValidateRequest_SignatureExactHostMatch verifies that
-// ValidateRequest enforces exact host matching for signatures. A
-// signature for one host must not verify for a different host, even
-// if they share a domain suffix.
-func TestService_ValidateRequest_SignatureExactHostMatch(t *testing.T) {
-	signingKey := "test-signing-key-must-be-32-chars"
-	svc, _ := SetupTestService(t,
-		WithSigningKey(signingKey),
-		WithNoWhitelist(),
-	)
-
-	signer := NewSigner(signingKey)
-
-	// Sign a request for "cdn.example.com"
-	signedReq := &ImageRequest{
-		SourceHost: "cdn.example.com",
-		SourcePath: "/photos/cat.jpg",
-		Size:       Size{Width: 50, Height: 50},
-		Format:     FormatJPEG,
-		Quality:    85,
-		FitMode:    FitCover,
-		Expires:    time.Now().Add(time.Hour),
-	}
-	signedReq.Signature = signer.Sign(signedReq)
-
-	// The original request should pass validation
-	t.Run("exact host passes", func(t *testing.T) {
-		err := svc.ValidateRequest(signedReq)
-		if err != nil {
-			t.Errorf("ValidateRequest() exact host failed: %v", err)
-		}
-	})
-
-	// Try to reuse the signature with different hosts
-	tests := []struct {
-		name string
-		host string
-	}{
-		{"parent domain", "example.com"},
-		{"sibling subdomain", "images.example.com"},
-		{"deeper subdomain", "a.cdn.example.com"},
-		{"evil suffix domain", "cdn.example.com.evil.com"},
-		{"prefixed host", "evilcdn.example.com"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name+" rejected", func(t *testing.T) {
-			req := &ImageRequest{
-				SourceHost:  tt.host,
-				SourcePath:  signedReq.SourcePath,
-				SourceQuery: signedReq.SourceQuery,
-				Size:        signedReq.Size,
-				Format:      signedReq.Format,
-				Quality:     signedReq.Quality,
-				FitMode:     signedReq.FitMode,
-				Expires:     signedReq.Expires,
-				Signature:   signedReq.Signature,
-			}
-
-			err := svc.ValidateRequest(req)
-			if err == nil {
-				t.Errorf("ValidateRequest() should reject signature for host %q (signed for %q)",
-					tt.host, signedReq.SourceHost)
-			}
-		})
-	}
-}
-
 func TestService_Get_InvalidFile(t *testing.T) {
 	svc, fixtures := SetupTestService(t)
 	ctx := context.Background()
@@ -317,17 +247,17 @@ func TestService_Get_FormatConversion(t *testing.T) {
 				t.Fatalf("failed to read response: %v", err)
 			}

-			detectedMIME, err := magic.DetectFormat(data)
+			detectedMIME, err := DetectFormat(data)
 			if err != nil {
 				t.Fatalf("failed to detect format: %v", err)
 			}

-			expectedFormat, ok := magic.MIMEToImageFormat(tt.wantMIME)
+			expectedFormat, ok := MIMEToImageFormat(tt.wantMIME)
 			if !ok {
 				t.Fatalf("unknown format for MIME type: %s", tt.wantMIME)
 			}

-			detectedFormat, ok := magic.MIMEToImageFormat(string(detectedMIME))
+			detectedFormat, ok := MIMEToImageFormat(string(detectedMIME))
 			if !ok {
 				t.Fatalf("unknown format for detected MIME type: %s", detectedMIME)
 			}
--- a/internal/imgcache/signature.go
+++ b/internal/imgcache/signature.go
@@ -43,11 +43,6 @@ func (s *Signer) Sign(req *ImageRequest) string {
 }

 // Verify checks if the signature on the request is valid and not expired.
-// Signatures are exact-match only: every component of the signed data
-// (host, path, query, dimensions, format, expiration) must match exactly.
-// No suffix matching, wildcard matching, or partial matching is supported.
-// A signature for "cdn.example.com" will NOT verify for "example.com" or
-// "other.cdn.example.com", and vice versa.
 func (s *Signer) Verify(req *ImageRequest) error {
 	// Check expiration first
 	if req.Expires.IsZero() {
@@ -71,8 +66,6 @@ func (s *Signer) Verify(req *ImageRequest) error {

 // buildSignatureData creates the string to be signed.
 // Format: "host:path:query:width:height:format:expiration"
-// All components are used verbatim (exact match). No normalization,
-// suffix matching, or wildcard expansion is performed.
 func (s *Signer) buildSignatureData(req *ImageRequest) string {
 	return fmt.Sprintf("%s:%s:%s:%d:%d:%s:%d",
 		req.SourceHost,
--- a/internal/imgcache/signature_test.go
+++ b/internal/imgcache/signature_test.go
@@ -152,178 +152,6 @@ func TestSigner_Verify(t *testing.T) {
 	}
 }

-// TestSigner_Verify_ExactMatchOnly verifies that signatures enforce exact
-// matching on every URL component. No suffix matching, wildcard matching,
-// or partial matching is supported.
-func TestSigner_Verify_ExactMatchOnly(t *testing.T) {
-	signer := NewSigner("test-secret-key")
-
-	// Base request that we'll sign, then tamper with individual fields.
-	baseReq := func() *ImageRequest {
-		req := &ImageRequest{
-			SourceHost:  "cdn.example.com",
-			SourcePath:  "/photos/cat.jpg",
-			SourceQuery: "token=abc",
-			Size:        Size{Width: 800, Height: 600},
-			Format:      FormatWebP,
-			Expires:     time.Now().Add(1 * time.Hour),
-		}
-		req.Signature = signer.Sign(req)
-
-		return req
-	}
-
-	tests := []struct {
-		name   string
-		tamper func(req *ImageRequest)
-	}{
-		{
-			name: "parent domain does not match subdomain",
-			tamper: func(req *ImageRequest) {
-				// Signed for cdn.example.com, try example.com
-				req.SourceHost = "example.com"
-			},
-		},
-		{
-			name: "subdomain does not match parent domain",
-			tamper: func(req *ImageRequest) {
-				// Signed for cdn.example.com, try images.cdn.example.com
-				req.SourceHost = "images.cdn.example.com"
-			},
-		},
-		{
-			name: "sibling subdomain does not match",
-			tamper: func(req *ImageRequest) {
-				// Signed for cdn.example.com, try images.example.com
-				req.SourceHost = "images.example.com"
-			},
-		},
-		{
-			name: "host with suffix appended does not match",
-			tamper: func(req *ImageRequest) {
-				// Signed for cdn.example.com, try cdn.example.com.evil.com
-				req.SourceHost = "cdn.example.com.evil.com"
-			},
-		},
-		{
-			name: "host with prefix does not match",
-			tamper: func(req *ImageRequest) {
-				// Signed for cdn.example.com, try evilcdn.example.com
-				req.SourceHost = "evilcdn.example.com"
-			},
-		},
-		{
-			name: "different path does not match",
-			tamper: func(req *ImageRequest) {
-				req.SourcePath = "/photos/dog.jpg"
-			},
-		},
-		{
-			name: "path suffix does not match",
-			tamper: func(req *ImageRequest) {
-				req.SourcePath = "/photos/cat.jpg/extra"
-			},
-		},
-		{
-			name: "path prefix does not match",
-			tamper: func(req *ImageRequest) {
-				req.SourcePath = "/other/photos/cat.jpg"
-			},
-		},
-		{
-			name: "different query does not match",
-			tamper: func(req *ImageRequest) {
-				req.SourceQuery = "token=xyz"
-			},
-		},
-		{
-			name: "added query does not match empty query",
-			tamper: func(req *ImageRequest) {
-				req.SourceQuery = "extra=1"
-			},
-		},
-		{
-			name: "removed query does not match",
-			tamper: func(req *ImageRequest) {
-				req.SourceQuery = ""
-			},
-		},
-		{
-			name: "different width does not match",
-			tamper: func(req *ImageRequest) {
-				req.Size.Width = 801
-			},
-		},
-		{
-			name: "different height does not match",
-			tamper: func(req *ImageRequest) {
-				req.Size.Height = 601
-			},
-		},
-		{
-			name: "different format does not match",
-			tamper: func(req *ImageRequest) {
-				req.Format = FormatPNG
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			req := baseReq()
-			tt.tamper(req)
-
-			err := signer.Verify(req)
-			if err != ErrSignatureInvalid {
-				t.Errorf("Verify() = %v, want %v", err, ErrSignatureInvalid)
-			}
-		})
-	}
-
-	// Verify the unmodified base request still passes
-	t.Run("unmodified request passes", func(t *testing.T) {
-		req := baseReq()
-		if err := signer.Verify(req); err != nil {
-			t.Errorf("Verify() unmodified request failed: %v", err)
-		}
-	})
-}
-
-// TestSigner_Sign_ExactHostInData verifies that Sign uses the exact host
-// string in the signature data, producing different signatures for
-// suffix-related hosts.
-func TestSigner_Sign_ExactHostInData(t *testing.T) {
-	signer := NewSigner("test-secret-key")
-
-	hosts := []string{
-		"cdn.example.com",
-		"example.com",
-		"images.example.com",
-		"images.cdn.example.com",
-		"cdn.example.com.evil.com",
-	}
-
-	sigs := make(map[string]string)
-
-	for _, host := range hosts {
-		req := &ImageRequest{
-			SourceHost:  host,
-			SourcePath:  "/photos/cat.jpg",
-			SourceQuery: "",
-			Size:        Size{Width: 800, Height: 600},
-			Format:      FormatWebP,
-			Expires:     time.Unix(1704067200, 0),
-		}
-
-		sig := signer.Sign(req)
-		if existing, ok := sigs[sig]; ok {
-			t.Errorf("hosts %q and %q produced the same signature", existing, host)
-		}
-
-		sigs[sig] = host
-	}
-}
-
 func TestSigner_DifferentKeys(t *testing.T) {
 	signer1 := NewSigner("secret-key-1")
 	signer2 := NewSigner("secret-key-2")
--- a/internal/imgcache/stats_test.go
+++ b/internal/imgcache/stats_test.go
@@ -16,7 +16,7 @@ func setupStatsTestDB(t *testing.T) *sql.DB {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if err := database.ApplyMigrations(context.Background(), db, nil); err != nil {
+	if err := database.ApplyMigrations(db); err != nil {
 		t.Fatal(err)
 	}
 	t.Cleanup(func() { db.Close() })
--- a/internal/imgcache/testutil_test.go
+++ b/internal/imgcache/testutil_test.go
@@ -2,7 +2,6 @@ package imgcache

 import (
 	"bytes"
-	"context"
 	"database/sql"
 	"image"
 	"image/color"
@@ -194,7 +193,7 @@ func setupServiceTestDB(t *testing.T) *sql.DB {
 	}

 	// Use the real production schema via migrations
-	if err := database.ApplyMigrations(context.Background(), db, nil); err != nil {
+	if err := database.ApplyMigrations(db); err != nil {
 		t.Fatalf("failed to apply migrations: %v", err)
 	}

--- a/internal/allowlist/allowlist.go
+++ b/internal/allowlist/allowlist.go
@@ -1,26 +1,25 @@
-// Package allowlist provides host-based URL allow-listing for the image proxy.
-package allowlist
+package imgcache

 import (
 	"net/url"
 	"strings"
 )

-// HostAllowList checks whether source hosts are permitted.
-type HostAllowList struct {
+// HostWhitelist implements the Whitelist interface for checking allowed source hosts.
+type HostWhitelist struct {
 	// exactHosts contains hosts that must match exactly (e.g., "cdn.example.com")
 	exactHosts map[string]struct{}
 	// suffixHosts contains domain suffixes to match (e.g., ".example.com" matches "cdn.example.com")
 	suffixHosts []string
 }

-// New creates a HostAllowList from a list of host patterns.
+// NewHostWhitelist creates a whitelist from a list of host patterns.
 // Patterns starting with "." are treated as suffix matches.
 // Examples:
 //   - "cdn.example.com" - exact match only
 //   - ".example.com" - matches cdn.example.com, images.example.com, etc.
-func New(patterns []string) *HostAllowList {
-	w := &HostAllowList{
+func NewHostWhitelist(patterns []string) *HostWhitelist {
+	w := &HostWhitelist{
 		exactHosts:  make(map[string]struct{}),
 		suffixHosts: make([]string, 0),
 	}
@@ -41,8 +40,8 @@ func New(patterns []string) *HostAllowList {
 	return w
 }

-// IsAllowed checks if a URL's host is in the allow list.
-func (w *HostAllowList) IsAllowed(u *url.URL) bool {
+// IsWhitelisted checks if a URL's host is in the whitelist.
+func (w *HostWhitelist) IsWhitelisted(u *url.URL) bool {
 	if u == nil {
 		return false
 	}
@@ -72,12 +71,12 @@ func (w *HostAllowList) IsAllowed(u *url.URL) bool {
 	return false
 }

-// IsEmpty returns true if the allow list has no entries.
-func (w *HostAllowList) IsEmpty() bool {
+// IsEmpty returns true if the whitelist has no entries.
+func (w *HostWhitelist) IsEmpty() bool {
 	return len(w.exactHosts) == 0 && len(w.suffixHosts) == 0
 }

-// Count returns the total number of allow list entries.
-func (w *HostAllowList) Count() int {
+// Count returns the total number of whitelist entries.
+func (w *HostWhitelist) Count() int {
 	return len(w.exactHosts) + len(w.suffixHosts)
 }
--- a/internal/allowlist/allowlist_test.go
+++ b/internal/allowlist/allowlist_test.go
@@ -1,13 +1,11 @@
-package allowlist_test
+package imgcache

 import (
 	"net/url"
 	"testing"
-
-	"sneak.berlin/go/pixa/internal/allowlist"
 )

-func TestHostAllowList_IsAllowed(t *testing.T) {
+func TestHostWhitelist_IsWhitelisted(t *testing.T) {
 	tests := []struct {
 		name     string
 		patterns []string
@@ -69,7 +67,7 @@ func TestHostAllowList_IsAllowed(t *testing.T) {
 			want:     true,
 		},
 		{
-			name:     "empty allow list",
+			name:     "empty whitelist",
 			patterns: []string{},
 			testURL:  "https://cdn.example.com/image.jpg",
 			want:     false,
@@ -96,7 +94,7 @@ func TestHostAllowList_IsAllowed(t *testing.T) {

 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			w := allowlist.New(tt.patterns)
+			w := NewHostWhitelist(tt.patterns)

 			var u *url.URL
 			if tt.testURL != "" {
@@ -107,15 +105,15 @@ func TestHostAllowList_IsAllowed(t *testing.T) {
 				}
 			}

-			got := w.IsAllowed(u)
+			got := w.IsWhitelisted(u)
 			if got != tt.want {
-				t.Errorf("IsAllowed() = %v, want %v", got, tt.want)
+				t.Errorf("IsWhitelisted() = %v, want %v", got, tt.want)
 			}
 		})
 	}
 }

-func TestHostAllowList_IsEmpty(t *testing.T) {
+func TestHostWhitelist_IsEmpty(t *testing.T) {
 	tests := []struct {
 		name     string
 		patterns []string
@@ -145,7 +143,7 @@ func TestHostAllowList_IsEmpty(t *testing.T) {

 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			w := allowlist.New(tt.patterns)
+			w := NewHostWhitelist(tt.patterns)
 			if got := w.IsEmpty(); got != tt.want {
 				t.Errorf("IsEmpty() = %v, want %v", got, tt.want)
 			}
@@ -153,7 +151,7 @@ func TestHostAllowList_IsEmpty(t *testing.T) {
 	}
 }

-func TestHostAllowList_Count(t *testing.T) {
+func TestHostWhitelist_Count(t *testing.T) {
 	tests := []struct {
 		name     string
 		patterns []string
@@ -183,7 +181,7 @@ func TestHostAllowList_Count(t *testing.T) {

 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			w := allowlist.New(tt.patterns)
+			w := NewHostWhitelist(tt.patterns)
 			if got := w.Count(); got != tt.want {
 				t.Errorf("Count() = %v, want %v", got, tt.want)
 			}
--- a/script/bootstrap
+++ b/script/bootstrap
@@ -1,138 +0,0 @@
-#!/bin/sh
-# script/bootstrap: install all dependencies needed to build and develop
-# this repo. Idempotent: every install is guarded by a check so already
-# installed tools are skipped. Base tooling comes from nix, apt, brew,
-# or apk (detected in that order); assumes NOTHING is present (not git,
-# make, or go). golangci-lint is packaged in nix, brew, and apk; on apt
-# it is installed from a hash-verified GitHub release archive (never
-# curl | sh). CGO image libraries (pkg-config, vips, libheif) are
-# installed for the govips bindings.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-# Pinned versions, 2026-07-07. Never "latest"; exact versions only.
-GOLANGCI_LINT_VERSION="2.10.1"
-# sha256 of golangci-lint-2.10.1-linux-<arch>.tar.gz release archives
-GOLANGCI_LINT_SHA256_AMD64="dfa775874cf0561b404a02a8f4481fc69b28091da95aa697259820d429b09c99"
-GOLANGCI_LINT_SHA256_ARM64="6652b42ae02915eb2f9cb2a2e0cac99514c8eded8388d88ae3e06e1a52c00de8"
-
-PKGMGR=""
-SUDO=""
-
-detect_pkgmgr() {
-    [ -n "$PKGMGR" ] && return 0
-    if command -v nix-env >/dev/null 2>&1; then
-        PKGMGR="nix"
-    elif command -v apt-get >/dev/null 2>&1; then
-        PKGMGR="apt"
-    elif command -v brew >/dev/null 2>&1; then
-        PKGMGR="brew"
-    elif command -v apk >/dev/null 2>&1; then
-        PKGMGR="apk"
-    else
-        echo "bootstrap: no supported package manager (nix, apt, brew, apk)" >&2
-        exit 1
-    fi
-    if [ "$PKGMGR" = "apt" ]; then
-        export DEBIAN_FRONTEND=noninteractive
-        if [ "$(id -u)" != "0" ]; then
-            SUDO="sudo"
-        fi
-    fi
-}
-
-# pkg_install <nix-attr> <apt-pkg> <brew-formula> <apk-pkg>
-pkg_install() {
-    detect_pkgmgr
-    case "$PKGMGR" in
-        nix) nix-env -iA "nixpkgs.$1" ;;
-        apt) $SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2" ;;
-        brew) brew install "$3" ;;
-        apk) apk add --no-cache "$4" ;;
-    esac
-}
-
-missing() {
-    ! command -v "$1" >/dev/null 2>&1
-}
-
-# verify_sha256 <file> <expected-hash>
-verify_sha256() {
-    if command -v sha256sum >/dev/null 2>&1; then
-        actual="$(sha256sum "$1" | cut -d' ' -f1)"
-    else
-        actual="$(shasum -a 256 "$1" | cut -d' ' -f1)"
-    fi
-    if [ "$actual" != "$2" ]; then
-        echo "bootstrap: sha256 mismatch for $1" >&2
-        echo "  expected: $2" >&2
-        echo "  actual:   $actual" >&2
-        exit 1
-    fi
-}
-
-# apt has no golangci-lint package: install a pinned release archive
-# from GitHub, verified by hardcoded sha256 (never curl | sh).
-install_golangci_lint_release() {
-    case "$(uname -m)" in
-        x86_64) goarch="amd64"; sha="$GOLANGCI_LINT_SHA256_AMD64" ;;
-        aarch64|arm64) goarch="arm64"; sha="$GOLANGCI_LINT_SHA256_ARM64" ;;
-        *)
-            echo "bootstrap: unsupported architecture $(uname -m)" >&2
-            exit 1
-            ;;
-    esac
-    if missing curl; then pkg_install curl curl curl curl; fi
-    name="golangci-lint-${GOLANGCI_LINT_VERSION}-linux-${goarch}"
-    tmp="$(mktemp -d)"
-    curl -fsSL -o "$tmp/$name.tar.gz" \
-        "https://github.com/golangci/golangci-lint/releases/download/v${GOLANGCI_LINT_VERSION}/${name}.tar.gz"
-    verify_sha256 "$tmp/$name.tar.gz" "$sha"
-    tar -xzf "$tmp/$name.tar.gz" -C "$tmp"
-    $SUDO install -m 0755 "$tmp/$name/golangci-lint" /usr/local/bin/golangci-lint
-    rm -rf "$tmp"
-}
-
-ensure_golangci_lint() {
-    if ! missing golangci-lint; then return 0; fi
-    detect_pkgmgr
-    case "$PKGMGR" in
-        apt) install_golangci_lint_release ;;
-        *) pkg_install golangci-lint golangci-lint golangci-lint golangci-lint ;;
-    esac
-}
-
-# CGO dependencies for govips (image processing)
-ensure_cgo_deps() {
-    if missing pkg-config; then
-        pkg_install pkg-config pkg-config pkg-config pkgconfig
-    fi
-    if ! pkg-config --exists vips; then
-        pkg_install vips libvips-dev vips vips-dev
-    fi
-    if ! pkg-config --exists libheif; then
-        pkg_install libheif libheif-dev libheif libheif-dev
-    fi
-}
-
-main() {
-    cd "$ROOT"
-
-    # Base tooling
-    if missing git; then pkg_install git git git git; fi
-    if missing make; then pkg_install gnumake make make make; fi
-
-    # Go toolchain and linter
-    if missing go; then pkg_install go golang go go; fi
-    ensure_golangci_lint
-
-    # CGO image libraries
-    ensure_cgo_deps
-
-    go mod download
-
-    echo "bootstrap complete"
-}
-
-main "$@"
--- a/script/check
+++ b/script/check
@@ -1,15 +0,0 @@
-#!/bin/sh
-# script/check: run all checks (test, lint, fmt-check). Our own
-# extension to scripts-to-rule-them-all. Must not modify any files.
-# Generic: usually needs no adaptation.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-
-main() {
-    "$SCRIPT_DIR/test"
-    "$SCRIPT_DIR/lint"
-    "$SCRIPT_DIR/fmt-check"
-}
-
-main "$@"
--- a/script/cibuild
+++ b/script/cibuild
@@ -1,15 +0,0 @@
-#!/bin/sh
-# script/cibuild: run the CI build. The Dockerfile runs the checks
-# (make fmt-check, lint, test), so a successful build implies a green
-# repo. Generic: needs no adaptation. The Gitea workflow runs this on
-# push.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    docker build .
-}
-
-main "$@"
--- a/script/docker
+++ b/script/docker
@@ -1,15 +0,0 @@
-#!/bin/sh
-# script/docker: build the Docker image tagged with the project name.
-# Identical in all repos; the tag comes from script/projectname.
-# Generic: needs no adaptation.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    docker build -t "$("$SCRIPT_DIR/projectname")" .
-}
-
-main "$@"
--- a/script/fmt
+++ b/script/fmt
@@ -1,14 +0,0 @@
-#!/bin/sh
-# script/fmt: format all files (writes).
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    echo "Formatting code..."
-    # shellcheck disable=SC2046 # word splitting of file list is wanted
-    gofmt -w $(find . -name '*.go' -not -path './vendor/*')
-}
-
-main "$@"
--- a/script/fmt-check
+++ b/script/fmt-check
@@ -1,18 +0,0 @@
-#!/bin/sh
-# script/fmt-check: check formatting (read-only). Same scope as
-# script/fmt, but fails instead of writing.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    echo "Checking formatting..."
-    if [ -n "$(gofmt -l . | grep -v '^vendor/')" ]; then
-        echo "Files need formatting:"
-        gofmt -l . | grep -v '^vendor/'
-        exit 1
-    fi
-}
-
-main "$@"
--- a/script/install-precommit
+++ b/script/install-precommit
@@ -1,16 +0,0 @@
-#!/bin/sh
-# script/install-precommit: install the git pre-commit hook that runs
-# script/precommit. Our own extension to scripts-to-rule-them-all.
-# Generic: needs no adaptation.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    printf '#!/bin/sh\nset -e\nscript/precommit\n' > .git/hooks/pre-commit
-    chmod +x .git/hooks/pre-commit
-    echo "pre-commit hook installed: runs script/precommit"
-}
-
-main "$@"
--- a/script/lint
+++ b/script/lint
@@ -1,23 +0,0 @@
-#!/bin/sh
-# script/lint: run the linter. CGO dependencies (pkg-config, vips,
-# libheif) come from nix-shell when not already available (e.g. inside
-# a Docker build or an existing nix-shell).
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-run_with_cgo_deps() {
-    if command -v pkg-config >/dev/null 2>&1; then
-        sh -c "$1"
-    else
-        nix-shell -p pkg-config vips libheif golangci-lint git --run "$1"
-    fi
-}
-
-main() {
-    cd "$ROOT"
-    echo "Running linter..."
-    run_with_cgo_deps "golangci-lint run"
-}
-
-main "$@"
--- a/script/precommit
+++ b/script/precommit
@@ -1,21 +0,0 @@
-#!/bin/sh
-# script/precommit: run by the git pre-commit hook; fails the commit if
-# checks fail. Our own extension to scripts-to-rule-them-all. Go repo
-# extras: go mod tidy must not change go.mod/go.sum.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    go mod tidy
-    git diff --exit-code -- go.mod go.sum || {
-        echo "precommit: go mod tidy changed go.mod/go.sum;" \
-            "stage the changes and retry" >&2
-        exit 1
-    }
-    "$SCRIPT_DIR/check"
-}
-
-main "$@"
--- a/script/projectname
+++ b/script/projectname
@@ -1,12 +0,0 @@
-#!/bin/sh
-# script/projectname: output the name of this project. Our own
-# extension to scripts-to-rule-them-all. Other scripts that need the
-# name (e.g. script/docker) call this, so they can stay identical
-# across all repos.
-set -eu
-
-main() {
-    echo "pixa"
-}
-
-main "$@"
--- a/script/setup
+++ b/script/setup
@@ -1,14 +0,0 @@
-#!/bin/sh
-# script/setup: set up the repo for development after a fresh clone:
-# installs dependencies (script/bootstrap) and the git pre-commit hook.
-# Add any repo-specific initialization (db init, .env template) here.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-
-main() {
-    "$SCRIPT_DIR/bootstrap"
-    "$SCRIPT_DIR/install-precommit"
-}
-
-main "$@"
--- a/script/test
+++ b/script/test
@@ -1,23 +0,0 @@
-#!/bin/sh
-# script/test: run the test suite. CGO dependencies (pkg-config, vips,
-# libheif) come from nix-shell when not already available (e.g. inside
-# a Docker build or an existing nix-shell).
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-run_with_cgo_deps() {
-    if command -v pkg-config >/dev/null 2>&1; then
-        sh -c "$1"
-    else
-        nix-shell -p pkg-config vips libheif golangci-lint git --run "$1"
-    fi
-}
-
-main() {
-    cd "$ROOT"
-    echo "Running tests..."
-    run_with_cgo_deps "CGO_ENABLED=1 go test -timeout 30s -v ./..."
-}
-
-main "$@"