Test a fetch whose context ends waiting for a shared connection

A fetch from a host with nothing open waits for the connection shared by
all hosts, and its context ends long before the wait timeout; once every
response is closed, no semaphore may be left in hostSems.

Model: opus-5-5

.gitattributes

@@ -1,4 +0,0 @@
-# Every PR adds an entry at the top of TODO.md's Completed Steps; union keeps
-# both sides instead of conflicting. Git never reports a conflict here: read
-# the merged entries after every merge or rebase.
-TODO.md merge=union

.golangci.yml

@@ -10,20 +10,14 @@ run:
 
 linters:
   default: all
-  enable:
-    # Successor to the deprecated gomodguard. Named explicitly, rather than
-    # left to `default: all`, because it carries the module policy below.
-    - gomodguard_v2
   disable:
     # Genuinely incompatible with project patterns
     - exhaustruct      # Requires all struct fields
+    - depguard         # Dependency allow/block lists
     - godot            # Requires comments to end with periods
+    - wsl              # Deprecated, replaced by wsl_v5
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go
-    # Deprecated: the warning is attached to the old name, so it is
-    # silenced by disabling that name, not by enabling the successor.
-    - wsl              # Deprecated, replaced by wsl_v5
-    - gomodguard       # Deprecated, replaced by gomodguard_v2
   settings:
     lll:
       line-length: 88
@@ -34,64 +28,6 @@ linters:
       max-complexity: 15
     dupl:
       threshold: 100
-    depguard:
-      # Test-support code must not be compiled into the shipped binary. A
-      # test-support package exists to hand a test privileges the program
-      # itself must never have, so a file that is not a test must not import
-      # one. Test files, and the files inside a package whose directory name
-      # ends in `test`, are where that code belongs, and are exempt.
-      #
-      # The deny list below is the one part of this file a repository is
-      # expected to extend, and the only part it may. depguard matches an
-      # import path against a list of prefixes, so it cannot be told "any path
-      # whose last segment ends in test"; a repository's own test-support
-      # packages have to be named here one at a time, by full import path,
-      # under a module path that differs from repository to repository. Add
-      # them; change nothing else.
-      rules:
-        test-support:
-          list-mode: lax
-          files:
-            - "$all"
-            - "!$test"
-            - "!**/*test/**"
-          deny:
-            - pkg: net/http/httptest
-              desc: >-
-                Test-support code belongs in test files and in packages whose
-                directory name ends in test, not in the shipped binary.
-    # Only decisions already recorded in the Go package defaults are
-    # listed here. Every entry matches the module path exactly.
-    gomodguard_v2:
-      blocked:
-        - module: github.com/rs/zerolog
-          recommendations:
-            - log/slog
-          reason: "Structured logging is stdlib log/slog."
-        # One entry per pre-fork module path, because the later releases
-        # are separate paths. A prefix match would be shorter but would
-        # also reach github.com/go-redis/redismock, the test double for
-        # the successor these entries recommend.
-        - module: github.com/go-redis/redis
-          recommendations:
-            - github.com/redis/go-redis/v9
-          reason: "Pre-fork module; use the maintained go-redis v9."
-        - module: github.com/go-redis/redis/v7
-          recommendations:
-            - github.com/redis/go-redis/v9
-          reason: "Pre-fork module; use the maintained go-redis v9."
-        - module: github.com/go-redis/redis/v8
-          recommendations:
-            - github.com/redis/go-redis/v9
-          reason: "Pre-fork module; use the maintained go-redis v9."
-        - module: github.com/sergi/go-diff
-          recommendations:
-            - github.com/aymanbagabas/go-udiff
-          reason: "No unified diff output; use go-udiff."
-        - module: github.com/hexops/gotextdiff
-          recommendations:
-            - github.com/aymanbagabas/go-udiff
-          reason: "Unmaintained fork; use go-udiff."
 
 issues:
   max-issues-per-linter: 0

README.md

@@ -18,7 +18,7 @@ make build
 # run with a config file: copy the example and set a real signing key
 # (the example placeholder is refused at startup), e.g. with
 # openssl rand -base64 32
-cp configs/config.example.yml config.yml
+cp config.example.yml config.yml
 $EDITOR config.yml   # replace the signing_key placeholder
 ./bin/pixad --config config.yml
 
@@ -34,67 +34,6 @@ else has a built-in default. A config file mounted at `/etc/pixa/config.yml`
 is optional: it is read when present, and an environment variable wins over
 the same setting in it.
 
-## Deployment
-
-pixa listens on plain HTTP and runs behind a reverse proxy that terminates TLS.
-[`configs/Caddyfile`](configs/Caddyfile) is an example for Caddy, chosen because
-it is the smallest correct one: Caddy gets the TLS certificate itself and does
-everything in this list without further settings. The reverse proxy must:
-
-- terminate TLS, as the login and generator pages work only over HTTPS (see
-  Routes);
-- pass the `Host`, `Origin` and `Referer` headers on unchanged, as pixa refuses
-  a form from those pages unless `Origin` or `Referer` names the host in `Host`,
-  builds encrypted URLs from `Host`, and checks `Referer` against
-  `referer_blocklist`;
-- set `X-Forwarded-For` to the client's address, with `trusted_proxies` set to
-  the address pixa sees the proxy's requests come from, so the login limit
-  counts each client by its own address (see `trusted_proxies` under
-  Configuration);
-- wait for pixa's answer for at least `downstream_timeout` (default `60s`), the
-  longest pixa takes to fetch, convert and send an image.
-
-It may also refuse `/metrics`, as the example does, so that only a scraper that
-reaches pixa directly can read it; pixa itself asks for the metrics username and
-password there.
-
-pixa does the rest itself: it checks signatures and encrypted URLs, applies the
-allowlist, refuses upstream hosts with private or local addresses, limits login
-attempts, upstream response size and image dimensions, and sends the security
-headers, `Strict-Transport-Security` included, with every response.
-
-The state directory (`state_dir`, `/var/lib/pixa` in the container) holds the
-database and the disk cache:
-
-- It needs a persistent volume: without one, every restart starts with an empty
-  cache. In the container, the startup script gives the directory to the user
-  pixa runs as (uid 65532) and sets its mode to `750`; outside it, that user
-  must be able to write the directory.
-- `cache_max_bytes` limits the source and transformed images together. The
-  database, the metadata files, the `.meta` file beside each transformed image
-  and files still being written come on top, and eviction runs in the
-  background, so the cache can pass the limit for a while: leave room on the
-  volume beyond it.
-- Set `cache_max_bytes` for a lasting deployment. Its default, worked out each
-  time pixa starts, is 75% of the sum of the space free on the volume and the
-  space the cached images already take, so a restart keeps the limit the cache
-  had, but anything else that fills or frees space on the volume moves it.
-
-A load balancer's health check can request `/.well-known/healthcheck.json`,
-which answers 200 whenever pixa is running, in maintenance mode too (see
-`maintenance_mode`).
-
-On SIGTERM or SIGINT pixa stops accepting connections, gives the requests in
-progress and the images being processed 5 seconds to finish, and exits: with 0,
-or with 1 when images were still being processed after those 5 seconds or
-another part of pixa failed to stop. A request not finished by then is cut off.
-`docker stop` waits 10 seconds before it kills the container.
-
-Outside Docker, pixa needs libvips (the image has 8.15) and libheif to run, as
-it uses libvips through CGO; building it also needs their development files,
-`pkg-config` and a C compiler. `script/bootstrap` installs all of these with
-nix, apt, brew or apk.
-
 ## Running under upaas
 
 What the [upaas](https://git.eeqj.de/sneak/upaas) app for pixa needs:
@@ -110,7 +49,7 @@ What the [upaas](https://git.eeqj.de/sneak/upaas) app for pixa needs:
     - `PIXA_ALLOWLIST_HOSTS`: upstream hosts served without a signature,
       comma-separated
     - `PIXA_CACHE_MAX_BYTES`: disk cache limit in bytes; `0` disables it;
-      default 75% of (free space + what the cache holds)
+      default 75% of free space
     - the rest are in the table under Configuration below
 - **Health check:** the image's `HEALTHCHECK` requests
   `/.well-known/healthcheck.json`. upaas reads the container's health 60
@@ -132,17 +71,13 @@ prevent abuse, and allowlisted source hosts for open access.
 ### Storage
 
 - **Source content**:
-  `<state_dir>/cache/sources/<ab>/<cd>/<sha256 of source content>`
+  `<statedir>/cache/src-content/<ab>/<cd>/<sha256 of source content>`
 - **Source metadata**:
-  `<state_dir>/cache/metadata/<hostname>/<sha256 of path and query>.json`
+  `<statedir>/cache/src-metadata/<hostname>/<sha256 of path>.json`
-  (host, path and query, content hash, upstream status and headers, fetch time)
+  (fetch time, original headers, request, content hash)
-- **Database**: `<state_dir>/state.sqlite3` (SQLite)
+- **Database**: `<statedir>/state.sqlite3` (SQLite)
-- **Transformed images**:
+- **Output documents**:
-  `<state_dir>/cache/variants/<ab>/<cd>/<sha256 of host, path, query, size, format, quality and fit>`,
+  `<statedir>/cache/dst-content/<ab>/<cd>/<sha256 of output content>`
-  each with a `.meta` file beside it holding its content type
-
-`<ab>` and `<cd>` are the first and second pairs of characters of the file's
-name.
 
 Multiple source paths may reference the same content blob; the
 database tracks references rather than using filesystem refcounting.
@@ -153,99 +88,17 @@ the metadata file stored beside it.
 
 ### Routes
 
-pixa answers these routes; any other path answers 404. A path in this list asked
-with a method the list does not give answers 405, except `/static/<file>`, which
-answers any method as it answers `GET`. A browser's CORS preflight request
-(`OPTIONS` with `Origin` and `Access-Control-Request-Method` headers) to any
-path under `/v1/` answers 200, in maintenance mode too.
-
-- `GET /` — the login page, or the URL generator page with a login session
-  (see Encrypted URLs). Needs: nothing. Answers: 200.
-- `POST /` — log in with the signing key typed into the login page. Needs: the
-  login page's form (below). Answers: 303 to `/` with a login session cookie
-  that lasts 30 days for the right key; 200 with the login page and an error for
-  a wrong key; 429 over the login limit (below).
-- `POST /generate` — make an encrypted URL from the generator page's form.
-  Needs: a login session and the generator page's form (below); without a login
-  session it answers 303 to `/`. Answers: 200 with the page showing the URL; 400
-  with the page naming a field that is not valid; 500 when the URL cannot be
-  made.
-- `GET /logout` — end the login session. Needs: nothing. Answers: 303 to `/`.
-- `GET` or `HEAD` `/v1/image/<host>/<path>/<size>.<format>` — an image, fetched,
-  resized and converted (below). Needs: a signature, unless the host is
-  allowlisted (see Source Hosts). Answers: 200; 304 when `If-None-Match` matches
-  the image's `ETag`; 400 for a URL or parameter that is not valid; 401 for a
-  missing or wrong signature, a missing `exp` or an `exp` in the past; 403 when
-  the request's `Referer` names a host in `referer_blocklist`, checked before
-  the signature, the cache and the upstream fetch; 403 when the upstream host,
-  or a host it redirects to, is `localhost`, ends in `.localhost` or `.local`,
-  or has an address in a blocked network (see `blocked_networks`); 502 when the
-  upstream answered with an error status, and for 5 minutes after that for the
-  same source URL; 503 when pixa is busy or in maintenance mode; 500 for any
-  other failure.
-- `GET` or `HEAD` `/v1/e/<token>/<name>` — an image through an encrypted URL
-  (see Encrypted URLs). Needs: nothing but the URL. Answers: 200; 304 when
-  `If-None-Match` matches the image's `ETag`; 400 for a token that does not
-  decrypt, or that asks for a size or fit that is not valid; 410 once it has
-  expired; 504 when the upstream has not sent its response headers within
-  `upstream_fetch_timeout`, but 500 when that time runs out while the image
-  itself is still arriving; 403, 502, 503 and 500 as for `/v1/image/`.
-- `GET /robots.txt` — asks every crawler to stay away (`Disallow: /`). Needs:
-  nothing. Answers: 200.
-- `GET /.well-known/healthcheck.json` — JSON with `status` (`ok`), `now`,
-  `uptime_seconds`, `uptime_human`, `version`, `appname` and
-  `maintenance_mode`. Needs: nothing. Answers: 200, always.
-- `GET /static/<file>` — the stylesheet and script the login and generator
-  pages load. Needs: nothing. Answers: 200, or 404 for a file that does not
-  exist.
-- `GET /metrics` — Prometheus metrics (see Architecture). Needs: HTTP basic
-  authentication with `metrics.username` and `metrics.password`. Answers: 200;
-  401 without them; 404 when they are not set, as the route then does not exist.
-
-Every response carries an `X-Request-ID` header holding the request's ID, which
-a client can quote when reporting a problem: the request's own `X-Request-ID`,
-as a reverse proxy in front of pixa may send, when it is at most 64 letters,
-digits, `-`, `_` or `.`; otherwise a random one pixa makes for the request,
-which tells nothing about the machine or the other requests. pixa's log line for
-the request carries the same ID as `request_id`, and so do the lines it logs
-when it fetches, converts and serves an image; the fetch sends it to the
-upstream host as `X-Request-ID`.
-
-Both `POST` routes accept only a form that pixa's own page served: the page puts
-a token in the form and sets a cookie to match, and a request without both is
-refused with 403, so another site cannot submit the form from a visitor's
-browser. The login and generator pages are meant to be opened over HTTPS: while
-`debug` is off, a form sent from a page opened over plain HTTP is refused with
-403, and while it is on, so is one sent from a page opened over HTTPS. Plain
-HTTP is for development on the browser's own machine: the login session cookie
-is always marked `Secure`, and over plain HTTP a browser keeps such a cookie
-only for its own machine (`localhost`), if at all. A form is also refused with
-403 when the page's host is not the `Host` header pixa receives, so a reverse
-proxy in front of pixa must pass that header on unchanged. A form body over
-1 MiB is refused with 413. The image routes answer the errors listed for them
-with JSON holding `error`, `status` and `timestamp`.
-
-An image URL has this form:
-
 ```
-/v1/image/<host>/<path>/<size>.<format>?sig=<signature>&exp=<expiration>&q=<quality>&fit=<fit>
+/v1/image/<host>/<path>/<size>.<format>?sig=<signature>&exp=<expiration>
 ```
 
-Images are only fetched from origins using TLS with valid certificates, unless
+Images are only fetched from origins using TLS with valid certificates.
-`allow_http` is set: then pixa fetches every image over plain HTTP, which is for
-testing only.
 
 A request whose query string cannot be decoded, or gives any parameter more
 than once, is refused with 400.
 
-- `<format>`: one of `orig` (or `original`), `jpeg` (or `jpg`), `png`, `webp`,
+- `<format>`: one of `orig`, `png`, `jpeg`, `webp`
-  `avif`, `gif`
 - `<size>`: `orig` or `<width>x<height>` (e.g. `800x600`)
-- `sig` and `exp`: the signature and its expiry, needed unless the host is
-  allowlisted (see Signature Specification)
-- `q` and `fit`: the output quality and how the image is fitted to `<size>`,
-  both optional (values under Signature Specification). Both are part of what
-  is cached, so each value of either is a separate cached image.
 
 An image is served with `Cache-Control: public, max-age=<seconds>, immutable`.
 When the URL has an expiry (an `exp`, or the TTL of an encrypted URL),
@@ -260,9 +113,7 @@ source) and one transcode: the first request does the work, and the others wait
 for its image or its error, holding no upstream connection or processing slot
 of their own. A waiting request stops waiting when its own client goes away.
 The work goes on for the others even if the first request's client goes away,
-until that request's `downstream_timeout` ends. The shared fetch sends the first
+until that request's `downstream_timeout` ends.
-request's ID upstream, and the lines logged for the fetch and the transcode
-carry that ID.
 
 The login form (`POST /`) is limited to 5 attempts per minute per client
 address, counting an IPv6 client by its /64; an attempt over the limit is
@@ -281,39 +132,6 @@ its own `X-Forwarded-For`, whether it connects directly or through the proxy,
 because its own address is trusted too. Setting `trusted_proxies` to only the
 address pixa sees for requests that come through the proxy closes this.
 
-### Encrypted URLs
-
-An encrypted URL is an image URL made on pixa's own web page by someone who
-knows the signing key. It works for any upstream host, allowlisted or not,
-without a signature, and whoever gets it can neither read the source URL from it
-nor change what it asks for.
-
-1. Open `/` in a browser over HTTPS (or over plain HTTP while `debug` is on, see
-   Routes) and log in with the signing key (`signing_key`). The login session
-   lasts 30 days, or until `/logout`.
-2. On the generator page, give the source image's URL, the width and height, the
-   format, quality and fit, and how long the URL lasts, then submit the form
-   (`POST /generate`). Width and height both empty or `0` keep the original
-   size; if only one of them is empty or `0`, that side is scaled to keep the
-   image's proportions.
-3. The page shows the URL, `https://<host>/v1/e/<token>/img.<format>`, and when
-   it expires. `<host>` is the host the page was opened on, and the URL starts
-   with `http` instead while `debug` is on. The name after the token is ignored
-   and only gives the URL a file extension, `jpg` for `orig`.
-
-The token holds the source's host, path and query and the size, format,
-quality, fit and expiry, encrypted with a key derived from `signing_key`. The
-source URL's scheme is not kept: the image is fetched like any other (see
-Routes), and the blocked networks still apply.
-
-How long the URL lasts is chosen on the page, from 1 minute to 1 year, or
-never. The expiry is fixed in the token when the URL is made and cannot be
-changed or revoked afterwards. Until then the image is served with a `max-age`
-that ends at the expiry (see Routes); after it the URL answers 410
-`URL has expired`. A URL made to last forever stops working only when
-`signing_key` changes: changing it makes every encrypted URL already handed out
-answer 400, and ends every login session.
-
 ### Image Metadata
 
 pixa decodes and re-encodes every image it serves, and removes all metadata from
@@ -355,8 +173,7 @@ Where:
 - `query` — source query string, empty string if none
 - `width` — requested width in pixels, `0` for original
 - `height` — requested height in pixels, `0` for original
-- `format` — output format, one of those listed under Routes, with `original`
+- `format` — output format (jpeg, png, webp, avif, gif, orig)
-  signed as `orig` and `jpg` as `jpeg`
 - `expiration` — the URL's `exp` query parameter, the Unix timestamp when
   the signature expires; a request whose `exp` is not a whole number, an
   empty `exp=` included, is refused with 400
@@ -395,11 +212,6 @@ and the URL is
 - **Suffix match**: `.example.com` — matches `cdn.example.com`,
   `images.example.com`, and `example.com`
 
-An IP address is matched exactly; write an IPv6 address without brackets. An
-entry that is neither a host name (letters, digits, hyphens, underscores and
-dots, with at most one leading dot) nor an IP address, such as one with a port
-or a `*.` wildcard, aborts startup.
-
 ### Configuration
 
 Every setting can be given as an environment variable, in a YAML config
@@ -417,26 +229,14 @@ startup naming it, as an unknown config key does. The one other accepted
 name is `PIXA_CONFIG_PATH`, the config file's path (like `--config`). The
 variables set by the file's `env:` section are checked the same way.
 
-pixa reads at most one config file: the one given with `--config` (or `-c`),
-otherwise the one `PIXA_CONFIG_PATH` names, otherwise the first of these that
-pixa finds: `/etc/pixa/config.yml`, `/etc/pixa/config.yaml`,
-`~/.config/pixa/config.yml`, `~/.config/pixa/config.yaml`, then `config.yml`
-and `config.yaml` in the working directory. A named file that does not exist,
-cannot be read or does not parse aborts startup. Of the files pixa looks for on
-its own, only one that does not exist is passed over, without a message. One
-that pixa cannot read or parse aborts startup, naming the file. So does one in a
-directory pixa may not enter, whether or not it is there, since pixa cannot
-tell. With no file, pixa uses the environment and the defaults.
-
 | Variable                             | Config key                      | Meaning                                                                      |
 | ------------------------------------ | ------------------------------- | ---------------------------------------------------------------------------- |
 | `PIXA_SIGNING_KEY`                   | `signing_key`                   | Required: secret for signed and encrypted URLs and login, 32+ characters     |
 | `PORT`                               | `port`                          | Port to listen on; default `8080`                                            |
 | `PIXA_STATE_DIR`                     | `state_dir`                     | Directory for the database and the disk cache; default `/var/lib/pixa`       |
 | `PIXA_DB_URL`                        | `db_url`                        | SQLite database URL; default `state.sqlite3` in the state directory          |
-| `PIXA_CACHE_MAX_BYTES`               | `cache_max_bytes`               | Disk cache limit in bytes; `0` disables it; default 75% of (free + cached)   |
+| `PIXA_CACHE_MAX_BYTES`               | `cache_max_bytes`               | Disk cache limit in bytes; `0` disables it; default 75% of free space        |
 | `PIXA_ALLOWLIST_HOSTS`               | `allowlist_hosts`               | Upstream hosts served without a signature                                    |
-| `PIXA_REFERER_BLOCKLIST`             | `referer_blocklist`             | Hosts whose pages the image routes refuse with 403, by `Referer`             |
 | `PIXA_BLOCKED_NETWORKS`              | `blocked_networks`              | CIDR ranges never fetched from, on top of the built-in ones                  |
 | `PIXA_TRUSTED_PROXIES`               | `trusted_proxies`               | CIDR ranges of proxies whose `X-Forwarded-For` is believed; default RFC 1918 |
 | `PIXA_ALLOW_HTTP`                    | `allow_http`                    | Allow plain-HTTP upstreams, for testing only; default `false`                |
@@ -465,18 +265,6 @@ Key settings in more detail:
   that has no leading zero and is not the scheme's default. Any other value,
   including another scheme such as a browser extension's, aborts startup
 - `allowlist_hosts` — list of allowed upstream hosts
-- `referer_blocklist` — list of hosts whose pages may not show pixa's images, to
-  stop other sites hotlinking them. Entries are written and matched as for
-  `allowlist_hosts` (see Allowlist patterns), and an entry that is neither a
-  host name nor an IP address aborts startup. A request to `/v1/image/` or
-  `/v1/e/` whose `Referer` header names a listed host is refused with 403 before
-  its signature or token is checked and before the cache or the upstream host is
-  used, so it fetches nothing, and it is refused even when the image is cached.
-  A request with no `Referer`, or one that does not parse as a URL
-  with a host, is served, as many clients send none. So this is easily got
-  around: a site whose pages send no `Referer` (for example with
-  `Referrer-Policy: no-referrer`) is not stopped. It does not apply to the login
-  and generator pages. Default: empty
 - `blocked_networks` — list of CIDR ranges to refuse for SSRF protection,
   added to the always-enforced built-in ranges (loopback, private,
   link-local, CGNAT, benchmark, NAT64, and the like); an invalid CIDR
@@ -511,17 +299,9 @@ Key settings in more detail:
   waits for an upstream connection and for a processing slot (up to 10 seconds
   each), so keep it longer than `upstream_fetch_timeout` plus 20 seconds
 - `signing_key` — HMAC secret for URL signatures
-- `db_url` — the SQLite database to open; omitted, it is
-  `file:<state_dir>/state.sqlite3?_pragma=journal_mode(WAL)`, which keeps the
-  database in WAL mode. pixa adds `_pragma=busy_timeout(5000)` to any `db_url`,
-  so a write that finds another in progress waits up to five seconds for it
-  instead of failing. WAL mode comes only from the URL: keep
-  `_pragma=journal_mode(WAL)` in one you set
 - `cache_max_bytes` — disk cache size limit in bytes; `0` disables the
-  disk cache entirely; omitted defaults to 75% of the sum of the free space on
+  disk cache entirely; omitted defaults to 75% of the free space on
-  the filesystem containing `<state_dir>/cache/` and the bytes of source and
+  the filesystem containing `<state_dir>/cache/` (minimum 500 MiB)
-  transformed images the cache already holds, worked out at startup (minimum
-  500 MiB)
 - `upstream_connections` — the most connections to upstream hosts at once, all
   hosts together, on top of `upstream_connections_per_host`; default `64`. A
   fetch holds its connection until its image has been processed. A fetch that
@@ -534,14 +314,14 @@ Key settings in more detail:
   seconds for one to free up; if none does, and `downstream_timeout` has not
   ended first, it is answered 503 the same way
 - `maintenance_mode` — while `true`, the image routes (`/v1/image/` and
-  `/v1/e/`) answer every request for an image with 503, a `Retry-After` header
+  `/v1/e/`) answer every request with 503, a `Retry-After` header and a JSON
-  and a JSON error body. The health check (`/.well-known/healthcheck.json`)
+  error body. The health check (`/.well-known/healthcheck.json`) still answers
-  still answers 200 and reports `"maintenance_mode": true`. It stays 200
+  200 and reports `"maintenance_mode": true`. It stays 200 because the image's
-  because the image's Docker `HEALTHCHECK` requests it: a 503 there would make
+  Docker `HEALTHCHECK` requests it: a 503 there would make the container
-  the container unhealthy, and upaas marks a deploy failed when its container
+  unhealthy, and upaas marks a deploy failed when its container is unhealthy.
-  is unhealthy. The login and URL generator pages and `/metrics` keep working
+  The login and URL generator pages and `/metrics` keep working
 
-See `configs/config.example.yml` for all options with defaults.
+See `config.example.yml` for all options with defaults.
 
 ### Architecture
 
@@ -550,10 +330,7 @@ See `configs/config.example.yml` for all options with defaults.
 - **Image processing**: govips (CGO wrapper for libvips)
 - **Database**: SQLite via modernc.org/sqlite
 - **Static assets**: embedded via `//go:embed`
-- **Metrics**: Prometheus, at `/metrics`: generic HTTP request metrics
+- **Metrics**: Prometheus
-  (duration, response size, requests in flight) and the Go runtime and process
-  metrics; requests are measured and `/metrics` is served only when
-  `metrics.username` and `metrics.password` are set
 - **Logging**: stdlib slog
 
 ## Entrypoints

REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-09-08
+last_modified: 2026-07-06
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -60,28 +60,17 @@ style conventions are in separate documents:
   prerequisite since nvm requires bash. yarn is then pinned via
   `corepack prepare yarn@<version> --activate`. Never install "latest" or "lts";
   always exact versions. `script/cibuild` runs the CI build: it changes to the
-  repo root, runs `script/bootstrap`, runs `script/check`, and builds the image
+  repo root and runs `docker build .`; the Gitea workflow calls it. Four further
-  with the version; the Gitea workflow calls it. **`script/cibuild` runs
+  scripts are our own extensions to the standard: `script/check` runs
-  `script/bootstrap` first**, because the workflow checks out the repo and runs
+  `script/test`, `script/lint`, and `script/fmt-check`; `script/precommit` is
-  nothing else, while `script/fmt-check` runs the formatter on the host: on a
+  what the git pre-commit hook runs, and it calls `script/check`;
-  pristine checkout with nothing installed the run dies there, after the
+  `script/install-precommit` installs the git pre-commit hook (the `make hooks`
-  containerised gates have passed. **The bootstrap alone is not enough**:
+  target shims to it); and `script/projectname` (literally that filename) simply
-  `script/bootstrap` installs node and yarn under nvm and leaves neither on the
+  outputs the project's name. Scripts that need the name call
-  `PATH` of the shell that called it, so a bare `yarn` still exits 127. The host
+  `script/projectname` — e.g. `script/docker` assembles its image tag from it —
-  entrypoints that need yarn — `script/fmt` and `script/fmt-check` — therefore
+  so those scripts stay byte-identical across all repos. Repo-type-specific
-  source nvm for the pinned node version before invoking it, exactly as
+  pre-commit extras (e.g. `go mod tidy` verification in Go repos) belong in
-  `script/bootstrap`'s own install step does. A runner carrying nothing but
+  `script/precommit`, not in the hook itself. Model scripts are at
-  docker and git then gets through `script/check`. Four further scripts are our
-  own extensions to the standard: `script/check` runs `script/test`,
-  `script/lint` and `script/fmt-check`; `script/precommit` is what the git
-  pre-commit hook runs, and it calls `script/check`; `script/install-precommit`
-  installs the git pre-commit hook (the `make hooks` target shims to it); and
-  `script/projectname` (literally that filename) simply outputs the project's
-  name. Scripts that need the name call `script/projectname` — e.g.
-  `script/docker` assembles its image tag from it — so those scripts stay
-  byte-identical across all repos. Repo-type-specific pre-commit extras (e.g.
-  `go mod tidy` verification in Go repos) belong in `script/precommit`, not in
-  the hook itself. Model scripts are at
   `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`. The README
   must document the provided scripts in an **Entrypoints** section (see the
   README requirements below).
@@ -100,140 +89,87 @@ style conventions are in separate documents:
   contributor should be able to understand the entire development workflow by
   reading the Makefile.
 
-- Every repo should have a `Dockerfile`, and it carries the repo's gates: a
+- Every repo should have a `Dockerfile`. All Dockerfiles must run `make check`
-  `lint` phase and a `test` phase, with the final stage depending on both so the
+  as a build step so the build fails if the branch is not green. For non-server
-  image cannot be built unless they pass. For non-server repos the final stage
+  repos, the Dockerfile should bring up a development environment and run
-  brings up a development environment; for server repos it is the runtime image.
+  `make check`. For server repos, `make check` should run as an early build
-  Dockerfiles install development prerequisites by running `script/bootstrap`
+  stage before the final image is assembled. Dockerfiles install development
-  rather than duplicating installs inline; COPY `script/` and the dependency
+  prerequisites by running `script/bootstrap` rather than duplicating installs
-  manifests (`package.json` + `yarn.lock`, `go.mod` + `go.sum`, etc.) before
+  inline; COPY `script/` and the dependency manifests (`package.json` +
-  running it.
+  `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it so the bootstrap
+  layer stays cached until dependencies change.
 
-- **Linting and testing run in Docker, as phases of the `Dockerfile`.** There is
+- **Dockerfiles must use a separate lint stage for fail-fast feedback.** Go
-  no separate lint file. `script/lint` and `script/test` each build one phase
+  repos use a multistage build where linting runs in an independent stage based
-  and nothing else:
+  on the `golangci/golangci-lint` image (pinned by hash). This stage runs
+  `make fmt-check` and `make lint` before the full build begins. The build stage
+  then declares an explicit dependency on the lint stage via
+  `COPY --from=lint /src/go.sum /dev/null`, which forces BuildKit to complete
+  linting before proceeding to compilation and tests. This ensures lint failures
+  surface in seconds rather than minutes, without blocking on dependency
+  download or compilation in the build stage.
 
-    ```sh
+    The standard pattern for a Go repo Dockerfile is:
-    docker build --no-cache --target lint -t "$(script/projectname)-lint" .
-    docker build --no-cache --target test -t "$(script/projectname)-test" .
-    ```
-
-    **A stage that is not the last one in the file is built only when the final
-    stage's chain depends on it, or when `--target` names it.** That is why the
-    two gates are always invoked by name here, and why the final stage carries a
-    `COPY --from=` of a harmless file from each of them: without that edge a
-    plain `docker build .` builds the last stage alone and exits 0 having linted
-    and tested nothing.
-
-    **Every `docker build` in `script/` is tagged**, here and in
-    `script/cibuild` and `script/docker`. An untagged build leaves a dangling
-    image behind on every invocation, on every developer host and every CI
-    runner; a tagged one replaces the previous image.
-
-    Inside a phase the tool is invoked directly — `golangci-lint`, `go test`,
-    `eslint`, `prettier` — never through `make lint` or `script/test`, which are
-    themselves a `docker build` and would recurse into a daemon that does not
-    exist in a build step. Formatting is the exception and stays on the host:
-    `script/fmt` writes the working tree, and `script/fmt-check` is its
-    read-only twin.
-
-    **No lint verdict may come from a host invocation of the linter.** On a
-    shared host golangci-lint reads a result cache keyed on file content rather
-    than location, so a second checkout of the same content is served the first
-    one's findings, and a host-global lock in `$TMPDIR` makes concurrent runs
-    exit non-zero with `parallel golangci-lint is running` — a status a caller
-    cannot tell from real findings. Both have produced wrong verdicts in this
-    org, in both directions. A container has its own cache, its own `TMPDIR` and
-    a digest-pinned binary, so neither is reachable.
-
-- **Any build that runs checks is built with `--no-cache`.** Docker invalidates
-  a `COPY` layer only when the copied content changes, so on an unchanged tree
-  the check `RUN` is served from cache, nothing executes, and the build still
-  exits 0. Every `docker build` in `script/` therefore passes `--no-cache`:
-  `script/lint`, `script/test`, `script/cibuild` and `script/docker` are the
-  four, and there is no fifth — `script/check` runs the two gate phases and
-  `script/fmt-check`, and builds no image of its own. A bare `docker build .` is
-  not evidence that anything ran: a sub-second build reporting success is a
-  cache hit, not a result. Never invalidate by pruning — `docker builder prune`
-  and friends destroy a build cache shared with every other build on the host.
-
-- **The gate phases are separate stages, and the build stage depends on both.**
-  The lint phase is based on the `golangci/golangci-lint` image (pinned by
-  hash), so lint failures surface in seconds rather than after a full compile,
-  and the test phase is based on the Go image. The canonical Go repo
-  `Dockerfile`:
 
     ```dockerfile
-    # Lint phase
+    # Lint stage — fast feedback on formatting and lint issues
     # golangci/golangci-lint:v2.x.x, YYYY-MM-DD
     FROM golangci/golangci-lint@sha256:... AS lint
     WORKDIR /src
     COPY go.mod go.sum ./
     RUN go mod download
     COPY . .
-    RUN golangci-lint run --config .golangci.yml ./...
+    RUN make fmt-check
+    RUN make lint
 
-    # Test phase
+    # Build stage
-    # golang:1.x-alpine, YYYY-MM-DD
-    FROM golang@sha256:... AS test
-    WORKDIR /src
-    COPY go.mod go.sum ./
-    RUN go mod download
-    COPY . .
-    RUN go test -timeout 90s -race -cover ./... || \
-        { echo "--- Rerunning with -v for details ---"; \
-          go test -timeout 90s -race -v ./...; exit 1; }
-
-    # Build stage. Nothing is wanted from either phase above; the copies
-    # are what make BuildKit build them first, so this stage cannot run
-    # unless lint and test passed.
     # golang:1.x-alpine, YYYY-MM-DD
     FROM golang@sha256:... AS builder
-    COPY --from=lint /src/go.sum /dev/null
-    COPY --from=test /src/go.sum /dev/null
     WORKDIR /src
+
+    # Force BuildKit to run the lint stage before proceeding
+    COPY --from=lint /src/go.sum /dev/null
+
     COPY go.mod go.sum ./
     RUN go mod download
     COPY . .
+    RUN make test
 
     ARG VERSION=dev
     RUN CGO_ENABLED=0 go build -trimpath \
         -ldflags="-s -w -X main.Version=${VERSION}" \
         -o /app ./cmd/app/
 
-    # Runtime stage, and the last one
+    # Runtime stage
     FROM alpine@sha256:...
     COPY --from=builder /app /usr/local/bin/app
     ENTRYPOINT ["app"]
     ```
 
     Key points:
-    - The lint phase uses the `golangci/golangci-lint` image directly (it has
+    - The lint stage uses the `golangci/golangci-lint` image directly (it
-      both Go and the linter), so nothing needs installing.
+      includes both Go and the linter), so there is no need to install the
-    - `COPY --from=<phase> /src/go.sum /dev/null` is a no-op copy whose only
+      linter separately.
-      purpose is the ordering edge. BuildKit runs stages in parallel by default,
+    - `COPY --from=lint /src/go.sum /dev/null` is a no-op file copy that creates
-      and a stage nothing depends on is not built at all, so without these two
+      a stage dependency. BuildKit runs stages in parallel by default; without
-      lines a red gate would not fail the build.
+      this line, the build stage would not wait for lint to finish and a lint
-    - Keep the runtime stage last, and if you add a stage after it, give it the
+      failure might not fail the overall build.
-      same two copies. A plain `docker build .` builds the last stage's chain
-      and nothing else.
     - If the project uses `//go:embed` directives that reference build artifacts
-      (e.g. a web frontend compiled in a separate stage), the lint phase must
+      (e.g. a web frontend compiled in a separate stage), the lint stage must
       create placeholder files so the embed directives resolve. Example:
       `RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css`.
+      The lint stage should not depend on the actual build output — it exists to
+      fail fast.
     - If the project requires CGO or system libraries for linting (e.g.
-      `vips-dev`), install them in the lint phase with `apk add`.
+      `vips-dev`), install them in the lint stage with `apk add`.
-    - `ARG VERSION=dev` is declared in the stage that compiles and supplied by
+    - The build stage runs `make test` after compilation setup. Tests run in the
-      `script/docker` and `script/cibuild`; no stage may call `git describe`.
+      build stage, not the lint stage, because they may require compiled
+      artifacts or heavier dependencies.
 
 - Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
-  runs `script/cibuild` on push, and checks out the repo as its only other step.
+  runs `script/cibuild` (which runs `docker build .`) on push. Since the
-  That script bootstraps, runs the gate phases, and then builds the image, so a
+  Dockerfile already runs `make check`, a successful build implies all checks
-  successful run means every check passed; a bare `docker build .` does not
+  pass.
-  carry the same guarantee, because its gate phases may come from the cache. The
-  image build is uncached and so runs the gate phases a second time. That is the
-  price of the rule above, and it is worth paying: the image that ships is built
-  from a run of its own gates rather than from a cache entry.
 
 - Use platform-standard formatters: `black` for Python, `prettier` for
   JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with
@@ -253,21 +189,14 @@ style conventions are in separate documents:
   module under test to verify it compiles/parses. There is no excuse for
   `make test` to be a no-op.
 
-- `make test` must complete in under 60 seconds. That is the hard cap, and a
+- `make test` must complete in under 20 seconds. Add a 30-second timeout in the
-  suite that exceeds it fails. Under 20 seconds is the target. A suite between
+  Makefile.
-  20 and 60 seconds is still green, but the overage must be filed as an
-  improvement bug against that repo. Add a 90-second timeout to the test
-  invocation (`go test -timeout 90s`). The backstop deliberately sits above the
-  hard cap so that it catches a genuinely hung test rather than a merely slow
-  one.
 
-- **The test command should use the conditional verbose rerun pattern.** Run
+- **`make test` should use the conditional verbose rerun pattern.** Run tests
-  tests without `-v` (verbose) first. If tests fail, automatically rerun with
+  without `-v` (verbose) first. If tests fail, automatically rerun with `-v` to
-  `-v` to show full output. This keeps CI logs and `docker build` output clean
+  show full output. This keeps CI logs and `docker build` output clean on
-  on success (just package/suite summaries) while providing full diagnostic
+  success (just package/suite summaries) while providing full diagnostic detail
-  detail on failure (every test case, every assertion). The command lives in the
+  on failure (every test case, every assertion). The general shell pattern:
-  `test` phase of the `Dockerfile`, since `script/test` builds that phase; the
-  Makefile form below is the same pattern for any repo-local invocation:
 
     ```makefile
     test:
@@ -280,24 +209,11 @@ style conventions are in separate documents:
 
     ```makefile
     test:
-    	@go test -count=1 -timeout 90s -race -cover ./... || \
+    	@go test -timeout 30s -race -cover ./... || \
     		{ echo "--- Rerunning with -v for details ---"; \
-    		  go test -count=1 -timeout 90s -race -v ./...; exit 1; }
+    		  go test -timeout 30s -race -v ./...; exit 1; }
     ```
 
-    `-count=1` is required on both invocations: it defeats Go's test _result_
-    cache, so the target cannot report a pass it did not earn, and the rerun
-    reproduces a failure instead of replaying it. It leaves the build cache
-    alone, so it costs the runtime of the suite and no recompilation.
-
-    Note that this is a second, independent cache, stacked below the Docker
-    layer cache that [issue #26](https://git.eeqj.de/sneak/prompts/issues/26)
-    addresses. `CHECK_EPOCH` guarantees the `RUN make test` _step_ re-executes;
-    it does not guarantee `go test` inside that step does any work, because the
-    `GOCACHE` baked into earlier image layers survives into the re-executed
-    step. They are two separate defects requiring two separate fixes, and a fix
-    for one must not be recorded as covering the other.
-
     Python example:
 
     ```makefile
@@ -323,83 +239,10 @@ style conventions are in separate documents:
   must be in `.gitignore`. No exceptions.
 
 - `.gitignore` should be comprehensive from the start: OS files (`.DS_Store`),
-  editor files (`.swp`, `*~`), in-repo agent scratch directories (`.claude/`),
+  editor files (`.swp`, `*~`), language build artifacts, and `node_modules/`.
-  language build artifacts, and `node_modules/`. Fetch the standard `.gitignore`
+  Fetch the standard `.gitignore` from
-  from `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up
-  setting up a new repo. These patterns are written to `.gitignore`'s own
+  a new repo.
-  semantics, in which an unanchored pattern already matches at every depth; they
-  are not a `.dockerignore` and must not be transplanted into one unmodified.
-
-- **`.dockerignore` does not use `.gitignore` semantics, and copying patterns
-  across unmodified leaves secrets in the build context.** Docker matches with
-  `moby/patternmatcher`: `filepath.Match` semantics plus a `**` extension, so
-  `*` does not cross `/` and a pattern without a leading `**/` is anchored at
-  the build-context root. A `.dockerignore` listing `.env`, `*.pem` and `*.key`
-  therefore excludes only the copies at the repository root, while `config/.env`
-  and `certs/server.key` still reach the context and can land in an image layer
-  — which is more dangerous than a short file with no secret patterns at all,
-  because it reads as solved and stops anyone looking. Give every
-  depth-independent pattern the `**/` prefix and leave only genuinely
-  root-anchored entries unprefixed: `.git`, and the repo's own host-built
-  binary, written `/myapp` and never `**/myapp`, which would also match
-  `cmd/myapp/` and delete the package directory from the context. Matching is
-  case-sensitive, and an ALL-CAPS twin per pattern still misses `Server.Key`, so
-  secret names use character ranges — `**/*.[kK][eE][yY]`, `**/*.[pP][eE][mM]`,
-  and likewise for `.envrc` and the extensionless SSH keys. Where such a pattern
-  also catches something the build needs, re-include it with a negation
-  (`!docs/example.env`); deleting the pattern reopens the exposure for every
-  other file it covers. Fetch the standard `.dockerignore` from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.dockerignore` and extend
-  it with the repo's own artifacts.
-
-- **In-repo agent scratch belongs in both files, written to each file's own
-  semantics.** `.claude/` holds one worktree per in-flight agent — an entire
-  additional checkout of the repo — so under `COPY . .` the build context
-  inflates by a multiple of the repo and another session's unreviewed work can
-  be copied into an image layer. In `.gitignore` the entry is `.claude/`,
-  unanchored. In `.dockerignore` it is `.claude`, anchored and with **no** `**/`
-  prefix, because the prefixed form would also delete any nested directory of
-  that name from the build. Anchoring carries a known gap that the canonical
-  `.dockerignore` states in its own comment, since consuming repos receive the
-  file and not the tracker: the directory is created in the agent's working
-  directory, so a repo running agents in subdirectories still ships
-  `services/api/.claude/` and must add its own anchored entry there.
-
-- **Excluding `.git` means `git describe` cannot run inside any build stage, and
-  it fails quietly there.** In a build stage there is no repository, so
-  `git describe` writes nothing to stdout, `-X main.Version=` comes out empty,
-  the binary reports no version at all, and the build still exits 0. Compute the
-  version on the host and thread it in as a build arg. `script/docker` and
-  `script/cibuild` do this, byte-identically across repos:
-
-    ```sh
-    # Own line: a failing command substitution inside an argument does not
-    # trip `set -e`, so the inline form degrades to an empty constant.
-    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
-    [ -n "$version" ] || version="unknown"
-    docker build --no-cache \
-        --build-arg VERSION="$version" \
-        -t "$(script/projectname)" .
-    ```
-
-    `--always` makes an untagged repo yield an abbreviated commit hash rather
-    than failing, and the `[ -n "$version" ]` line is the single place the
-    fallback is applied — a live check that fires on a build from an export with
-    no `.git` and on a repository with no commits yet. Do not fold it into the
-    substitution as `|| echo unknown`, which makes the guard unreachable. The
-    Dockerfile's side is `ARG VERSION=dev` in the stage that compiles, declared
-    there because `ARG` is stage-scoped; passing `VERSION` to a repo whose
-    Dockerfile declares no such `ARG` is ignored and costs nothing, which is why
-    the scripts stay byte-identical. One consequence for CI: the standard
-    checkout action clones shallow and fetches no tags, so a repo that embeds a
-    tag-derived version must set `fetch-depth: 0` on its checkout step.
-
-- **Verify `.dockerignore` by enumerating the image, not by reading the
-  patterns.** Plant files at the root _and_ at least two directories deep, build
-  a probe image that does `COPY . .`, and list what actually landed
-  (`docker run --rm --entrypoint find IMAGE /app`). The `transferring context`
-  size is not a substitute: a nested secret is a few bytes, and BuildKit
-  transfers only the delta from the previous build.
 
 - **No build artifacts in version control.** Code-derived data (compiled
   bundles, minified output, generated assets) must never be committed to the
@@ -415,45 +258,9 @@ style conventions are in separate documents:
 - Make all changes on a feature branch. You can do whatever you want on a
   feature branch.
 
-- `.golangci.yml` is standardized. The vendored copy in a consuming repo must
+- `.golangci.yml` is standardized and must _NEVER_ be modified by an agent, only
-  _NEVER_ be modified by an agent: fetch it from
+  manually by the user. Fetch from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml` and keep it
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`.
-  byte-identical, so that no repo can quietly loosen its own linting. Linter
-  configuration changes are made to the canonical copy in the `prompts` repo and
-  reach consuming repos by re-vendoring; an agent may open a PR against
-  canonical, which only the user merges. One list is exempt from byte-identity,
-  because it cannot be written once for every repo: the `deny` list of the
-  `test-support` depguard rule, where a repo names its own test-support packages
-  by full import path. A repo adds entries there and changes nothing else, and a
-  re-vendor carries its entries forward. The canonical golangci-lint version is
-  v2.12.2 (released 2026-05-06), pinned as the digest of the lint phase's base
-  image
-  (`golangci/golangci-lint@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240`,
-  which reports `2.12.2 built with go1.26.2 from c0d3ddc9`). That digest is the
-  only pin, since no repo installs golangci-lint on the host: bumping the
-  version means changing it and nothing else.
-
-- **`script/bootstrap` installs a pinned tool by comparing versions, never by
-  testing presence.** An `if ! command -v <tool>; then install; fi` guard tests
-  `PATH` only, so on an already-provisioned machine the pin is inert and a
-  version bump is a silent no-op — while the Dockerfile, installing into a clean
-  image, gets the pinned version, so a local `make check` and `make docker` can
-  disagree about what the tool even is. The canonical form:
-    - compares the installed version against the pin over the **whole** version
-      token; a parser that stops at the first `-` reports `2.12.2` for a host
-      running `2.12.2-rc1` and skips the install;
-    - treats absent, non-zero, empty or unrecognised `--version` output as a
-      mismatch, so the failure direction is a redundant install and never a
-      skipped one;
-    - after installing, re-resolves the binary the way callers do — `hash -r`,
-      then through `PATH`, not through the directory the installer wrote to —
-      and fails naming the resolved path, since an install that a shadowing
-      binary hides succeeds while changing nothing any caller sees;
-    - is actually called, and prints the version on both success paths: a
-      function defined and never invoked has the same exit status and the same
-      empty output as one that worked.
-
-    Keep it POSIX sh: no arrays, no `[[`, no `grep -P`.
 
 - When pinning images or packages by hash, add a comment above the reference
   with the version and date (YYYY-MM-DD).
@@ -572,9 +379,7 @@ style conventions are in separate documents:
   language-specific config). Everything else goes in a subdirectory. Canonical
   subdirectory names:
     - `bin/` — executable scripts and tools
-    - `cmd/` — Go command entrypoints; thin only: one `main.go` per binary whose
+    - `cmd/` — Go command entrypoints
-      body is a single call into `internal/` or `pkg/`, no project logic in
-      `cmd/`
     - `configs/` — configuration templates and examples
     - `deploy/` — deployment manifests (k8s, compose, terraform)
     - `docs/` — documentation and markdown (README.md stays in root)

TODO.md

@@ -3,8 +3,6 @@
 * branch per issue from `next`
 * do the work in Next Step
 * move Next Step to the top of Completed Steps
-* `TODO.md` merges with git's union merge (`.gitattributes`), which never
-  reports a conflict: read the merged entries after every merge or rebase
 * move the top item of Future Steps into Next Step
 * commit (`TODO.md` changes in the same commit as the work)
 * open a PR based on `next`
@@ -27,207 +25,10 @@ The disk cache is now size-bounded with LRU eviction
 
 # Next Step
 
-P2: security: per-IP rate limiting on the image routes
+P2: security: referer blacklist
 
 # Completed Steps
 
-- 2026-10-04 `REPO_POLICIES.md` matches the canonical copy again (closes #196):
-  it is replaced, unchanged, by `prompts/REPO_POLICIES.md` from `sneak/prompts`
-  `main`. The rules it adds that pixa's tree breaks are filed:
-  https://git.eeqj.de/sneak/pixa/issues/202 (lint and tests as `Dockerfile`
-  phases built with `--no-cache`), https://git.eeqj.de/sneak/pixa/issues/203
-  (the workflow's `script/docker-smoke` step),
-  https://git.eeqj.de/sneak/pixa/issues/204 (`.claude/` in `.gitignore`),
-  https://git.eeqj.de/sneak/pixa/issues/205 (`.dockerignore` patterns at every
-  depth), https://git.eeqj.de/sneak/pixa/issues/206 (a thin
-  `cmd/pixad/main.go`) and https://git.eeqj.de/sneak/pixa/issues/208
-  (`fetch-depth: 0` on the CI checkout, so the build sees the tags). Its rule
-  that no build stage runs `git describe` is not followed: pixa takes the
-  version from the `.git` in the build context, per
-  https://git.eeqj.de/sneak/pixa/issues/166, as the copy on `sneak/prompts`
-  `next` already says.
-- 2026-10-04 an integration test of the image proxy flow (closes #80):
-  `TestImageProxyFlow` in `internal/server` starts the database, handlers and
-  middleware from the constructors `pixad` uses, with a fresh state directory,
-  and replaces only the upstream origin with a local test server. For a resize
-  with a change to JPEG and for `orig`, the first request goes through the
-  router, the real fetcher, libvips, the disk cache and SQLite and answers 200
-  with the right content type and size and `X-Pixa-Cache: MISS`; the second
-  answers `HIT` with the same image and the upstream has had one request; the
-  source and the converted image are then in `cache/sources` and
-  `cache/variants`, with their rows in `source_content`, `source_metadata` and
-  `variant_content`. Two optional fields make this possible, which `pixad` does
-  not set and the config file and environment cannot:
-  `httpfetcher.Config.DialContext` connects in place of the dialer that refuses
-  internal addresses, the URL and redirect checks still running, and
-  `handlers.Params.Fetcher` replaces the fetcher the handlers build.
-- 2026-10-04 a URL made on the generator page with a `ttl` is tested to
-  expire (closes #199): a new test in `internal/handlers` makes a URL on the
-  generator page with a `ttl` of one second, checks that `/v1/e/` serves it at
-  once, waits two seconds and checks that it then answers 410. The test waits
-  for real, as pixa reads the clock directly when it makes and checks a URL; it
-  waits two seconds because the time a URL expires is kept in whole seconds.
-  Test only.
-- 2026-10-04 referer blocklist (closes #90): `referer_blocklist`
-  (`PIXA_REFERER_BLOCKLIST`) lists hosts, written and matched as for
-  `allowlist_hosts` with the same matcher; an entry of either list that is
-  neither a host name (letters, digits, hyphens, underscores and dots, with at
-  most one leading dot) nor an IP address, such as one with a port or a `*.`
-  wildcard, aborts startup naming the setting and the entry. Both image routes
-  refuse a request whose `Referer` names a listed host with 403 and a JSON error
-  before the signature, the cache and the upstream fetch, so it fetches nothing
-  and is refused whether or not the image is cached. A request with no
-  `Referer`, or one that does not parse as a URL with a host, is served, so the
-  list is easily got around; `README.md` and `configs/config.example.yml` say
-  so. It does not apply to the login and generator pages.
-- 2026-10-04 fewer files in the repository root (closes #97):
-  `config.example.yml` moved unchanged to `configs/config.example.yml`, and
-  `README.md`, the comments in `internal/config/config.go` and the startup error
-  for the placeholder signing key name the new path; `scripts/manual-test.sh`
-  and its directory are deleted, as the handler tests in `internal/handlers`
-  cover every check it made except two: fetching a real image from the
-  internet, and a URL made on the generator page with a `ttl` answering 410 once
-  the `ttl` has passed (https://git.eeqj.de/sneak/pixa/issues/199);
-  `CONVENTIONS.md` is deleted, as `REPO_POLICIES.md` links the canonical Go HTTP
-  server conventions.
-- 2026-10-04 SQLite writes no longer fail with "database is locked" (closes
-  #198): pixa adds `_pragma=busy_timeout(5000)` to every `db_url`, so a write
-  that finds another in progress on another connection waits up to five seconds
-  for it, and the default `db_url` turns on WAL mode with
-  `_pragma=journal_mode(WAL)`. The old default's `_journal_mode=WAL` is not a
-  parameter the driver reads, so the database was never in WAL mode.
-- 2026-10-04 `TestPeriodicReconciliationAdoptsFileThatAppearsAfterStartup`
-  only passes through a periodic pass (closes #189): it slept for three
-  eviction intervals before writing its file, and a startup pass still running
-  then could adopt the file itself. It now holds the test database's only
-  connection until the startup pass waits for it after walking the empty
-  variant directory, writes the file and lets the connection go, as
-  `TestEvictionRunsOnPeriodicSchedule` does, so only a periodic reconciliation
-  pass can adopt the file. Test only.
-- 2026-10-04 logging in, logging out, the URL generator and `/v1/e/` have
-  handler tests (closes #77): new tests in `internal/handlers`, with no
-  network, check that `GET /` without a login session shows the login form; a
-  wrong key shows it again with an error and sets no session cookie; the right
-  key answers 303 to `/` with a session cookie marked `Secure`, `HttpOnly` and
-  `SameSite=Strict`, with which `GET /` shows the generator page; `GET /logout`
-  answers 303 to `/` with an empty session cookie sent with `Max-Age=0`;
-  `POST /generate` without a login session answers 303 to `/`; `/v1/e/` serves
-  the image for a valid token, answers 410 for an expired one and 400 for one
-  with a character changed, cut short or made with another signing key; and a
-  URL made on the generator page is served by `/v1/e/`. No code changes.
-- 2026-10-04 `TODO.md` merges with git's union merge (closes #190): a root
-  `.gitattributes`, copied from `sneak/prompts`, marks it `merge=union`, so two
-  branches that each add an entry at the top of Completed Steps merge without a
-  conflict and keep both entries. Git now never reports a conflict in
-  `TODO.md`: a real one keeps both versions of the lines, and two entries that
-  share an identical line can end up one inside the other, which a rebase can
-  do to an entry already on `next`. The Workflow above says to read the merged
-  entries after every merge or rebase.
-- 2026-10-04 the default `cache_max_bytes` no longer shrinks as the cache fills
-  (closes #184): for an omitted key, the cache works out the limit when it
-  opens, after the database is open, as 75% of the sum of the free space on the
-  filesystem containing `<state_dir>/cache/` and what the cache already holds by
-  its own size accounting, at least 500 MiB, so a cache filled to its limit
-  keeps that limit across a restart. The computation and its tests moved from
-  `internal/config` to `internal/imgcache`; the config only records whether the
-  key was set.
-- 2026-10-04 `TestEvictionRunsOnPeriodicSchedule` no longer races the evictor
-  (closes #183): it wrote each variant file and then inserted its accounting row
-  by hand, and a reconciliation pass between the two adopted the file first, so
-  the insert failed. It now writes the files only, while holding the test
-  database's only connection so the evictor's startup pass waits after walking
-  the empty variant directory; a periodic reconciliation pass then adopts the
-  files and the eviction pass after it evicts them. No other test in
-  `internal/imgcache` inserts a row by hand after starting the evictor. Test
-  only.
-- 2026-10-04 a config file pixa cannot read aborts startup (closes #176): of the
-  places pixa looks for its config file on its own, only one where the file does
-  not exist is passed over; any other error, such as a directory on the path
-  that pixa may not enter, aborts startup naming the file, as a file that does
-  not parse already did.
-- 2026-10-04 `.golangci.yml` re-vendored from the canonical copy (closes #57):
-  the deprecated `gomodguard` is switched off, so lint runs print no
-  deprecation warning; its successor `gomodguard_v2` runs with the shared
-  module block list, and `depguard` keeps `net/http/httptest` out of files that
-  are not tests. The tree needed no code changes.
-- 2026-10-04 the Content-Security-Policy allows no inline script or style
-  (closes #125): `script-src` and `style-src` are `'self'` only. The generator
-  page's two inline `onclick` handlers moved into
-  `internal/static/generator.js`, attached with `addEventListener`; the bundled
-  Tailwind script, which built styles in the browser, is replaced by a small
-  hand-written `internal/static/style.css` with only the rules the login and
-  generator pages use, the templates carrying a few plain class names in place
-  of Tailwind's. No build step. The pages keep their layout, not every pixel of
-  it.
-- 2026-10-04 deployment guide and example Caddy config (closes #89):
-  "Deployment" in `README.md` says what the reverse proxy in front of pixa must
-  do (terminate TLS; pass `Host`, `Origin` and `Referer` on unchanged; set
-  `X-Forwarded-For`, with `trusted_proxies` to match; wait at least
-  `downstream_timeout`; optionally refuse `/metrics`) and what pixa does itself,
-  that the state directory needs a persistent volume and what `cache_max_bytes`
-  counts, the health check for a load balancer, what a stop does and its exit
-  codes, and what running outside Docker needs; `configs/Caddyfile` is the
-  example, checked with `caddy validate`.
-- 2026-10-04 the metrics basic auth, CORS preflight, request logging and
-  metrics recording have tests (closes #79): `MetricsAuth` on its own answers
-  401 with a challenge without credentials or with a wrong username or password
-  and lets the configured ones through; a preflight request gets `*` for any
-  origin when `access_control_allow_origin` is `*` and no
-  `Access-Control-Allow-Origin` from another origin than the configured one; a
-  `POST /` carrying the signing key leaves no trace of it in the request log
-  line, and the login handler's own log lines leave out the submitted key; the
-  metrics middleware on its own records a request it served, and the router
-  records nothing while no metrics username is set. Not tested: that the router
-  puts the basic auth in front of `/metrics` and records requests when a
-  metrics username is set. Only one test per package can set up `/metrics`, and
-  in `internal/server` that is `TestMaintenanceModeKeepsOtherRoutes`, which
-  needs the owner's approval to change; #180 holds it. Tests only; the basic
-  auth library already compares the password in constant time.
-- 2026-10-04 the image route's signature check and error answers are tested
-  (closes #76): new tests in `internal/handlers`, with no network, check the
-  status and JSON error body for a missing, wrong, unpadded, upper-case or
-  expired signature on a host not on the allowlist, or a valid one sent for
-  its parent domain, a sibling host, a subdomain or the host with another
-  domain appended (401), an unparseable path (400), `localhost` as the
-  upstream host (403) and an upstream error (502); that an allowlisted host is
-  served without a signature, another host only with a valid one; and the
-  answers of `/robots.txt` and the health check. No code changes.
-- 2026-10-04 request IDs returned and passed on, and `/v1/e/` revalidates
-  (closes #84): pixa's own `RequestID` middleware, in place of chi's, gives each
-  request an ID, its own `X-Request-ID` when that is at most 64 letters, digits,
-  `-`, `_` or `.` and a random one otherwise, stores it where chi's did and
-  sends it back as `X-Request-ID` on every response; the upstream fetch sends
-  that ID, and the "upstream fetched", "image converted" and "image served" log
-  lines carry it as `request_id`, a fetch shared by several requests carrying
-  the first request's; `/v1/e/` sets `ETag`, answers a matching `If-None-Match`
-  with 304 and is routed for `HEAD`, the `ETag` and 304 code being
-  `notModified`, which `/v1/image/` calls too; its token checks moved unchanged
-  into `parseImageEncRequest` to keep `HandleImageEnc` within the line limit; no
-  `Vary` is added, as no response depends on a request header except the image
-  routes' CORS headers, for which `go-chi/cors` already sends `Vary: Origin`;
-  `Vary: Accept` is left to #88.
-- 2026-10-04 routes, encrypted URLs and config file documented (closes #75):
-  "Routes" in `README.md` lists every route with its method, purpose, what it
-  needs and the status codes it answers with, and says `q` and `fit` are part
-  of what is cached; "Encrypted URLs" covers logging in, making one on the
-  generator page, how long it lasts and the 410 once it has expired;
-  "Configuration" gives the order in which pixa looks for its config file;
-  `config.example.yml` lists `db_url` and `env` and gives every key's default;
-  `scripts/manual-test.sh` is left to #97.
-- 2026-10-04 shutdown stops cache eviction in progress (closes #102):
-  `StartEviction` runs the eviction goroutine with its own context, which
-  `StopEviction` cancels, so a pass in progress stops at its next database
-  call, file, row or eviction candidate instead of running to completion, and
-  no pass starts after it, so a stop logs at most one warning;
-  `StopEviction` takes a context and, when that context ends before the
-  goroutine exits, stops waiting and returns its error; the handlers' stop hook
-  passes fx's stop context, so an eviction still running when fx's stop
-  deadline ends fails the stop and makes the exit code 1.
-- 2026-10-04 dead code in `internal/imgcache` is gone (closes #73): `Purge`,
-  which only returned an error and which nothing called, is no longer part of
-  the `ImageCache` interface or `Service`; the `SignatureValidator`,
-  `Allowlist` and `Storage` interfaces, which nothing implemented or used, are
-  deleted. Nothing else changes.
 - 2026-10-04 upstream host semaphores and variant `.meta` files no longer
   outlive their use (closes #87): the fetcher counts the fetches holding or
   waiting for a slot of each upstream host's semaphore and removes the host's
@@ -235,14 +36,6 @@ P2: security: per-IP rate limiting on the image routes
   semaphore each until restart; `VariantStorage.Delete` removes the variant's
   `.meta` file along with it, a missing `.meta` file not being an error, and
   `DeleteWithMeta`, which eviction called for that, is gone.
-- 2026-10-04 `README.md` matches the code (closes #74): "Storage" names the
-  cache directories pixa uses (`cache/sources`, `cache/metadata`,
-  `cache/variants`) and how files are named in each, and the comments in
-  `001_schema.sql` name the same paths; the routes and the signature section
-  list the same output formats, `jpg` and `original` included; the TLS
-  sentence names `allow_http` as its exception; "Metrics" says only generic
-  HTTP and Go runtime metrics exist, measured and served only when the metrics
-  username and password are set.
 - 2026-10-03 shutdown sets the exit code and waits for image processing
   (closes #86): fx alone handles SIGINT and SIGTERM, and the server's own
   signal handler is gone; fx's `Run` in `cmd/pixad` exits with the shutdown's
@@ -610,10 +403,12 @@ P2: security: per-IP rate limiting on the image routes
 # Future Steps
 
 - P2: security
+    - per-IP rate limiting on the image routes
     - per-origin rate limiting
 - P2: HTTP response handling
     - Last-Modified headers
     - Vary header for content negotiation
+    - X-Request-ID propagation
 - P2: auto format selection (format=auto based on Accept header)
 - P2: configuration
     - YAML config file support
@@ -621,4 +416,10 @@ P2: security: per-IP rate limiting on the image routes
     - optional Sentry error reporting
     - comprehensive request logging
     - Prometheus performance metrics
+    - integration tests for the image proxy flow
     - load tests to verify the 1k to 5k req/s target
+- P2: documentation
+    - configuration options
+    - API endpoints
+    - deployment guide
+    - example nginx or caddy reverse proxy config

config.example.yml

@@ -12,42 +12,28 @@
 # Durations are Go duration strings such as 30s or 2m and must be
 # positive; a bare number has no unit and aborts startup. Sizes are a
 # whole number of bytes.
-#
-# A key left out takes the default its comment gives.
 
-# Port to listen on (default: 8080)
+# Server settings
 port: 8080
-
-# Debug logging and plain-HTTP local development (default: false)
 debug: false
 
 # While true, the image routes (/v1/image/ and /v1/e/) answer every request
-# for an image with 503 and a Retry-After header. The health check keeps
+# with 503 and a Retry-After header. The health check keeps answering 200 and
-# answering 200 and reports maintenance_mode as true. It stays 200 because
+# reports maintenance_mode as true. It stays 200 because the image's Docker
-# the image's Docker HEALTHCHECK requests it: a 503 there would make the
+# HEALTHCHECK requests it: a 503 there would make the container unhealthy, and
-# container unhealthy, and upaas marks a deploy failed when its container is
+# upaas marks a deploy failed when its container is unhealthy.
-# unhealthy. (default: false)
 maintenance_mode: false
 
 # Data directory for SQLite database and cache files
-# (default: /var/lib/pixa)
 state_dir: ./data
 
-# SQLite database URL (default:
-# file:<state_dir>/state.sqlite3?_pragma=journal_mode(WAL)). pixa adds
-# _pragma=busy_timeout(5000) to it. An empty value aborts startup; leave the
-# key out to use the default.
-# db_url: "file:./data/state.sqlite3?_pragma=journal_mode(WAL)"
-
 # Image proxy settings
 # HMAC signing key for URL signatures (required, at least 32 characters)
 # Generate with: openssl rand -base64 32
 signing_key: "CHANGE_ME_generate_with_openssl_rand_base64_32"
 
-# Hosts that don't require signatures (default: none)
+# Hosts that don't require signatures
 # Use "." prefix for wildcard subdomain matching (e.g., ".example.com" matches "cdn.example.com")
-# An entry that is neither a host name nor an IP address (IPv6 without
-# brackets), such as one with a port or a "*." wildcard, aborts startup.
 allowlist_hosts:
   - s3.sneak.cloud
   - static.sneak.cloud
@@ -55,21 +41,11 @@ allowlist_hosts:
   - github.com
   - user-images.githubusercontent.com
 
-# Hosts whose pages may not show pixa's images, written as for
-# allowlist_hosts. A request to /v1/image/ or /v1/e/ whose Referer header
-# names one of them is answered 403 before anything is fetched, even when
-# the image is cached. A request with no Referer, or one that does not
-# parse, is served, so a site whose pages send no Referer is not stopped.
-# The login and generator pages are not covered. (default: none)
-# referer_blocklist:
-#   - leech.example
-#   - .hotlinker.example
-
 # Additional CIDR ranges to refuse when fetching upstream, extending the
 # SSRF protection. These are added to the always-enforced built-in ranges
 # (loopback, RFC 1918 private, link-local, CGNAT, benchmark, NAT64, and
 # similar), never replacing them. Each entry must be a valid CIDR in IPv4
-# or IPv6 form; an invalid entry aborts startup. (default: none)
+# or IPv6 form; an invalid entry aborts startup.
 # blocked_networks:
 #   - 100.64.0.0/10
 #   - 2001:db8::/32
@@ -96,7 +72,6 @@ allowlist_hosts:
 #   - 2001:db8::/32
 
 # Allow HTTP upstream (only for testing, always use HTTPS in production)
-# (default: false)
 allow_http: false
 
 # Maximum concurrent connections per upstream host (default: 20)
@@ -141,22 +116,15 @@ access_control_allow_origin: "*"
 
 # Maximum disk cache size in bytes. Explicit values are used exactly as
 # given; 0 disables the disk cache entirely (every request fetches and
-# processes uncached). When omitted, the default is 75% of the sum of
+# processes uncached). When omitted, the default is 75% of the free
-# the free space on the filesystem containing <state_dir>/cache/ and
+# space on the filesystem containing <state_dir>/cache/ at startup,
-# the bytes of images the cache already holds, worked out at startup,
 # with a minimum of 500 MiB.
 # cache_max_bytes: 10737418240
 
-# Sentry DSN for error reporting (default: empty, which turns it off)
+# Sentry error reporting (optional)
 sentry_dsn: ""
 
-# Username and password for /metrics, set together (default: unset). Metrics
+# Metrics endpoint authentication (optional)
-# are measured and /metrics is served only when both are set.
 # metrics:
 #   username: "admin"
 #   password: "secret"
-
-# Environment variables set while this file loads, as described at the top
-# (default: none)
-# env:
-#   PIXA_DEBUG: "true"

configs/Caddyfile

@@ -1,17 +0,0 @@
-# Example Caddy config for running pixa behind Caddy; see "Deployment" in
-# README.md. Replace images.example.com with pixa's public host name, and
-# 127.0.0.1:8080 with the address Caddy reaches pixa on.
-#
-# Caddy gets and renews the TLS certificate for the host name, passes the
-# Host, Origin and Referer headers on unchanged, sets X-Forwarded-For to the
-# client's address, and waits for pixa's answer with no time limit of its
-# own, so pixa's downstream_timeout is what ends a slow request.
-
-images.example.com
-
-# pixa asks for metrics.username and metrics.password on /metrics. This
-# line also keeps it off the public address, for a scraper that reaches
-# pixa directly; remove it to read /metrics through Caddy.
-respond /metrics 404
-
-reverse_proxy 127.0.0.1:8080

internal/config/cache_max_bytes_internal_test.go

@@ -1,10 +1,26 @@
 package config
 
 import (
+	"errors"
+	"log/slog"
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 )
 
+// Static errors returned by the stub free-space probes below.
+var (
+	errTestStatfsFailed     = errors.New("statfs failed")
+	errTestProbeNotExpected = errors.New("probe must not be called")
+)
+
+// discardLogger returns a logger that swallows all output, for tests
+// that exercise code paths which log.
+func discardLogger() *slog.Logger {
+	return slog.New(slog.DiscardHandler)
+}
+
 // TestCacheMaxBytesExplicitValueUsedWithoutFloor verifies that an
 // explicitly configured cache_max_bytes value is used exactly as
 // given: the 500 MiB floor applies only to the computed default, never
@@ -135,30 +151,155 @@ func TestCacheMaxBytesInvalidValuesAbortStartup(t *testing.T) {
 	}
 }
 
-// TestCacheMaxBytesExplicitIsRecorded verifies that an omitted
+// TestComputeDefaultCacheMaxBytesUses75PercentOfFreeSpace verifies the
-// cache_max_bytes is recorded as not explicit, so the cache works out
+// computed default is 75% of the probed free space when that exceeds
-// the default when it opens, and that an explicit zero is recorded as
+// the floor.
-// explicit, so it disables the disk cache instead.
+func TestComputeDefaultCacheMaxBytesUses75PercentOfFreeSpace(t *testing.T) {
-func TestCacheMaxBytesExplicitIsRecorded(t *testing.T) {
 	t.Parallel()
 
-	signingKeyLine := "signing_key: " + validTestSigningKey + "\n"
+	// 4 GiB free -> 3 GiB default.
+	probe := func(string) (uint64, error) { return 4294967296, nil }
 
-	omitted, err := configFromYAML(t, signingKeyLine)
+	got, err := ComputeDefaultCacheMaxBytes(t.TempDir(), probe)
+	if err != nil {
+		t.Fatalf("ComputeDefaultCacheMaxBytes returned error: %v", err)
+	}
+
+	if got != 3221225472 {
+		t.Errorf("ComputeDefaultCacheMaxBytes = %d, want 3221225472 (75%% of 4 GiB)",
+			got)
+	}
+}
+
+// TestComputeDefaultCacheMaxBytesAppliesFloorToComputedDefault
+// verifies that when 75% of free space is below 500 MiB, the computed
+// default is floored at DefaultCacheMaxBytesFloor.
+func TestComputeDefaultCacheMaxBytesAppliesFloorToComputedDefault(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name      string
+		freeBytes uint64
+	}{
+		{name: "100 MiB free", freeBytes: 104857600},
+		{name: "zero free", freeBytes: 0},
+		{name: "just below floor threshold", freeBytes: 699050665},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			probe := func(string) (uint64, error) { return tc.freeBytes, nil }
+
+			got, err := ComputeDefaultCacheMaxBytes(t.TempDir(), probe)
+			if err != nil {
+				t.Fatalf("ComputeDefaultCacheMaxBytes returned error: %v", err)
+			}
+
+			if got != DefaultCacheMaxBytesFloor {
+				t.Errorf("ComputeDefaultCacheMaxBytes = %d, want floor %d",
+					got, DefaultCacheMaxBytesFloor)
+			}
+		})
+	}
+}
+
+// TestComputeDefaultCacheMaxBytesPropagatesProbeError verifies that a
+// failing free-space probe produces an error naming the config key,
+// instead of a silently wrong default.
+func TestComputeDefaultCacheMaxBytesPropagatesProbeError(t *testing.T) {
+	t.Parallel()
+
+	probe := func(string) (uint64, error) { return 0, errTestStatfsFailed }
+
+	_, err := ComputeDefaultCacheMaxBytes(t.TempDir(), probe)
+	if err == nil {
+		t.Fatal("probe failure must produce an error, got nil")
+	}
+
+	t.Logf("got expected error: %v", err)
+
+	if !strings.Contains(err.Error(), keyCacheMaxBytes) {
+		t.Errorf("error %q does not name the config key cache_max_bytes", err.Error())
+	}
+}
+
+// TestResolveCacheMaxBytesComputesDefaultWhenOmitted verifies that an
+// omitted cache_max_bytes key resolves to the computed default, that
+// the probe is pointed at <state_dir>/cache/ (which must be created
+// first so statfs measures the right filesystem), and that the result
+// lands on the Config.
+func TestResolveCacheMaxBytesComputesDefaultWhenOmitted(t *testing.T) {
+	t.Parallel()
+
+	c, err := configFromYAML(t, "signing_key: "+validTestSigningKey+"\n")
 	if err != nil {
 		t.Fatalf("minimal config should be valid, got error: %v", err)
 	}
 
-	if omitted.CacheMaxBytesExplicit {
+	c.StateDir = t.TempDir()
-		t.Error("omitted cache_max_bytes recorded as explicit")
+	wantCacheDir := filepath.Join(c.StateDir, "cache")
+
+	var probedPath string
+
+	// 4 GiB free -> 3 GiB default.
+	probe := func(path string) (uint64, error) {
+		probedPath = path
+
+		return 4294967296, nil
 	}
 
-	zero, err := configFromYAML(t, signingKeyLine+"cache_max_bytes: 0\n")
+	err = c.resolveCacheMaxBytes(discardLogger(), probe)
 	if err != nil {
-		t.Fatalf("cache_max_bytes: 0 must be accepted, got error: %v", err)
+		t.Fatalf("resolveCacheMaxBytes returned error: %v", err)
 	}
 
-	if !zero.CacheMaxBytesExplicit {
+	if c.CacheMaxBytes != 3221225472 {
-		t.Error("cache_max_bytes: 0 not recorded as explicit")
+		t.Errorf("CacheMaxBytes = %d, want computed default 3221225472",
+			c.CacheMaxBytes)
+	}
+
+	if probedPath != wantCacheDir {
+		t.Errorf("free space probed at %q, want cache directory %q",
+			probedPath, wantCacheDir)
+	}
+
+	info, err := os.Stat(wantCacheDir)
+	if err != nil || !info.IsDir() {
+		t.Errorf("cache directory %q was not created before probing: info=%v err=%v",
+			wantCacheDir, info, err)
+	}
+}
+
+// TestResolveCacheMaxBytesDoesNotOverrideExplicitValue verifies that
+// an explicitly configured value survives resolution untouched and
+// that the free-space probe is never consulted for it.
+func TestResolveCacheMaxBytesDoesNotOverrideExplicitValue(t *testing.T) {
+	t.Parallel()
+
+	yamlContent := "signing_key: " + validTestSigningKey + "\ncache_max_bytes: 1024\n"
+
+	c, err := configFromYAML(t, yamlContent)
+	if err != nil {
+		t.Fatalf("explicit cache_max_bytes must be accepted, got error: %v", err)
+	}
+
+	c.StateDir = t.TempDir()
+
+	probe := func(string) (uint64, error) {
+		t.Error("free-space probe must not be consulted for explicit values")
+
+		return 0, errTestProbeNotExpected
+	}
+
+	err = c.resolveCacheMaxBytes(discardLogger(), probe)
+	if err != nil {
+		t.Fatalf("resolveCacheMaxBytes returned error: %v", err)
+	}
+
+	if c.CacheMaxBytes != 1024 {
+		t.Errorf("CacheMaxBytes = %d, want explicit 1024 (no floor, no recompute)",
+			c.CacheMaxBytes)
 	}
 }

internal/config/cachesize.go

@@ -0,0 +1,116 @@
+package config
+
+import (
+	"fmt"
+	"log/slog"
+	"math"
+	"os"
+	"path/filepath"
+	"syscall"
+)
+
+// DefaultCacheMaxBytesFloor is the minimum computed default for the
+// cache_max_bytes setting: 500 MiB. The floor applies only to the
+// computed default (when the key is omitted from the configuration),
+// never to explicitly configured values.
+const DefaultCacheMaxBytesFloor int64 = 524288000
+
+// cacheDirPerms is the permission mode for the cache directory created
+// before probing free space, matching the state directory permissions.
+const cacheDirPerms = 0o750
+
+// freeSpaceFractionNumerator and freeSpaceFractionDenominator express
+// the 75% share of free space used for the computed default limit as
+// integer arithmetic (dividing before multiplying avoids overflow).
+const (
+	freeSpaceFractionNumerator   uint64 = 3
+	freeSpaceFractionDenominator uint64 = 4
+)
+
+// FreeSpaceProbeFunc reports the number of free bytes available on the
+// filesystem containing path. It is a function type so tests can
+// inject a fake probe instead of depending on the host disk.
+type FreeSpaceProbeFunc func(path string) (uint64, error)
+
+// defaultFreeSpaceProbe reports free filesystem bytes via statfs on
+// the given path, as available to unprivileged processes.
+func defaultFreeSpaceProbe(path string) (uint64, error) {
+	var stat syscall.Statfs_t
+
+	err := syscall.Statfs(path, &stat)
+	if err != nil {
+		return 0, err
+	}
+
+	if stat.Bsize < 0 {
+		return 0, fmt.Errorf("%w %d for %q", errNegativeBlockSize, stat.Bsize, path)
+	}
+
+	blockSize := uint64(stat.Bsize)
+
+	return stat.Bavail * blockSize, nil
+}
+
+// ComputeDefaultCacheMaxBytes returns the default cache size limit for
+// the filesystem containing cacheDir: 75% of the free bytes reported
+// by probe, with a floor of DefaultCacheMaxBytesFloor.
+func ComputeDefaultCacheMaxBytes(
+	cacheDir string, probe FreeSpaceProbeFunc,
+) (int64, error) {
+	freeBytes, err := probe(cacheDir)
+	if err != nil {
+		return 0, fmt.Errorf("config key %q: cannot determine free space for %q: %w",
+			"cache_max_bytes", cacheDir, err)
+	}
+
+	computed := freeBytes / freeSpaceFractionDenominator * freeSpaceFractionNumerator
+	computed = min(computed, math.MaxInt64)
+
+	// gosec cannot see that min() above bounds computed, so it reads
+	// this conversion as potentially overflowing. It cannot: computed is
+	// at most math.MaxInt64 on every path here.
+	//nolint:gosec // G115: clamped to MaxInt64 by min above
+	limit := int64(computed)
+	limit = max(limit, DefaultCacheMaxBytesFloor)
+
+	return limit, nil
+}
+
+// resolveCacheMaxBytes finalizes CacheMaxBytes after state_dir
+// validation: an explicitly configured value is kept as-is (no floor
+// applies), while an omitted key receives the computed default based
+// on free space in <state_dir>/cache/. The cache directory is created
+// first so statfs measures the filesystem that will actually hold the
+// cache. The effective limit is logged either way.
+func (c *Config) resolveCacheMaxBytes(
+	log *slog.Logger, probe FreeSpaceProbeFunc,
+) error {
+	if !c.cacheMaxBytesExplicit {
+		cacheDir := filepath.Join(c.StateDir, "cache")
+
+		err := os.MkdirAll(cacheDir, cacheDirPerms)
+		if err != nil {
+			return fmt.Errorf("config key %q: cannot create cache directory %q: %w",
+				keyCacheMaxBytes, cacheDir, err)
+		}
+
+		limit, err := ComputeDefaultCacheMaxBytes(cacheDir, probe)
+		if err != nil {
+			return err
+		}
+
+		c.CacheMaxBytes = limit
+
+		log.Info("computed default cache size limit from free space",
+			"cache_max_bytes", limit,
+			"cache_dir", cacheDir,
+		)
+	}
+
+	log.Info("effective cache size limit",
+		"cache_max_bytes", c.CacheMaxBytes,
+		"cache_disabled", c.CacheMaxBytes == 0,
+	)
+
+	return nil
+}

internal/config/config.go

@@ -4,19 +4,16 @@ package config
 import (
 	"errors"
 	"fmt"
-	"io/fs"
 	"log/slog"
 	"math"
 	"net/netip"
 	"net/url"
 	"os"
 	"path/filepath"
-	"regexp"
 	"runtime"
 	"sort"
 	"strconv"
 	"strings"
-	"syscall"
 	"time"
 
 	"git.eeqj.de/sneak/smartconfig"
@@ -49,7 +46,6 @@ const (
 	keyMetricsPassword            = "metrics.password"
 	keySigningKey                 = "signing_key"
 	keyAllowlistHosts             = "allowlist_hosts"
-	keyRefererBlocklist           = "referer_blocklist"
 	keyAllowHTTP                  = "allow_http"
 	keyUpstreamConnectionsPerHost = "upstream_connections_per_host"
 	keyUpstreamConnections        = "upstream_connections"
@@ -64,7 +60,7 @@ const (
 )
 
 // placeholderSigningKey is the dummy signing_key shipped in
-// configs/config.example.yml. It is 45 characters, so it passes the length
+// config.example.yml. It is 45 characters, so it passes the length
 // check, but it is public in this repository and must be rejected at
 // startup so no deployment ever signs URLs with it.
 const placeholderSigningKey = "CHANGE_ME_generate_with_openssl_rand_base64_32"
@@ -90,20 +86,23 @@ var (
 	errMustBeAtLeastOne  = errors.New("must be at least 1")
 	errValueTooShort     = errors.New("value too short")
 	errPlaceholderKey    = errors.New(
-		"is the placeholder from configs/config.example.yml; " +
+		"is the placeholder from config.example.yml; " +
 			"generate a real key with: openssl rand -base64 32")
 	errMustBeSetTogether = errors.New("must be set together")
 	errMustNotBeNegative = errors.New("must not be negative")
 	errOverflowsInt64    = errors.New("overflows a 64-bit integer")
-	errValueNull         = errors.New(
+	errNegativeBlockSize = errors.New(
+		"statfs reported negative block size")
+	errValueNull = errors.New(
 		"value is null; omit the key entirely to use the default")
 	errValuesNull = errors.New(
 		"value is null; omit a key entirely to use its default")
-	errNotAHost = errors.New("must be a host name such as " +
+	errNotBareHostname = errors.New(
-		"cdn.example.com or .example.com, or an IP address")
+		"must be a bare hostname without scheme, path, or whitespace")
-	errNotADuration   = errors.New("not a duration such as 30s or 2m")
+	errNoHostnameLabels = errors.New("contains no hostname labels")
-	errMustBePositive = errors.New("must be positive")
+	errNotADuration     = errors.New("not a duration such as 30s or 2m")
-	errNotAnOrigin    = errors.New(
+	errMustBePositive   = errors.New("must be positive")
+	errNotAnOrigin      = errors.New(
 		`not "*" or an origin such as https://example.com`)
 )
 
@@ -131,10 +130,6 @@ type Config struct {
 	AllowHTTP                  bool     // Allow non-TLS upstream (testing only)
 	UpstreamConnectionsPerHost int      // Max concurrent connections per upstream host
 
-	// RefererBlocklist holds host patterns, matched as AllowlistHosts is: the
-	// image routes refuse a request whose Referer names a matching host.
-	RefererBlocklist []string
-
 	// UpstreamConnections is the most concurrent connections to all
 	// upstream hosts together, on top of the per-host limit.
 	// MaxConcurrentProcessing is the most images processed at once.
@@ -174,19 +169,18 @@ type Config struct {
 	// address, and an explicit list replaces the default.
 	TrustedProxies []netip.Prefix
 
-	// CacheMaxBytes is the disk cache size limit in bytes. Only an
+	// CacheMaxBytes is the disk cache size limit in bytes. Zero
-	// explicit zero (CacheMaxBytesExplicit true) disables the disk
+	// disables the disk cache entirely. When cache_max_bytes is
-	// cache. Zero with CacheMaxBytesExplicit false means
+	// omitted from the configuration, this holds the computed default
-	// cache_max_bytes was omitted, and the cache works out the default
+	// (75% of free space on the filesystem containing
-	// limit when it opens.
+	// <state_dir>/cache/, floored at DefaultCacheMaxBytesFloor).
 	CacheMaxBytes int64
 
-	// CacheMaxBytesExplicit records whether cache_max_bytes was
+	// cacheMaxBytesExplicit records whether cache_max_bytes was
 	// explicitly set, in the environment or the configuration file.
-	// Explicit values are used exactly as given; for an omitted key the
+	// Explicit values are used exactly as given; only an omitted key
-	// cache works out the default limit when it opens (see
+	// gets the computed default (and its floor) in resolveCacheMaxBytes.
-	// imgcache.CacheConfig.UseDefaultMaxBytes).
+	cacheMaxBytesExplicit bool
-	CacheMaxBytesExplicit bool
 }
 
 // New creates a new Config instance from the environment and the
@@ -223,13 +217,9 @@ func New(_ fx.Lifecycle, params Params) (*Config, error) {
 		return nil, err
 	}
 
-	// An omitted cache_max_bytes is worked out and logged when the
+	err = c.resolveCacheMaxBytes(log, defaultFreeSpaceProbe)
-	// cache opens.
+	if err != nil {
-	if c.CacheMaxBytesExplicit {
+		return nil, err
-		log.Info("effective cache size limit",
-			"cache_max_bytes", c.CacheMaxBytes,
-			"cache_disabled", c.CacheMaxBytes == 0,
-		)
 	}
 
 	if c.Debug {
@@ -275,6 +265,7 @@ func newFromSmartConfig(sc *smartconfig.Config) (*Config, error) {
 	}
 
 	loader := &strictLoader{sc: sc}
+
 	c := &Config{
 		Debug:           loader.boolVal(keyDebug, false),
 		MaintenanceMode: loader.boolVal(keyMaintenanceMode, false),
@@ -302,17 +293,16 @@ func newFromSmartConfig(sc *smartconfig.Config) (*Config, error) {
 			keyAccessControlAllowOrigin, DefaultAccessControlAllowOrigin),
 		DownstreamTimeout: loader.durationVal(
 			keyDownstreamTimeout, DefaultDownstreamTimeout),
-		CacheMaxBytes:    loader.int64Val(keyCacheMaxBytes, 0),
+		CacheMaxBytes:   loader.int64Val(keyCacheMaxBytes, 0),
-		BlockedNetworks:  blockedNetworks,
+		BlockedNetworks: blockedNetworks,
-		TrustedProxies:   trustedProxies,
+		TrustedProxies:  trustedProxies,
-		RefererBlocklist: loader.hostListVal(keyRefererBlocklist),
 	}
 
-	// The default for an omitted cache_max_bytes is worked out when
+	// The computed default for cache_max_bytes needs a validated
-	// the cache opens; here we only record whether the operator set
+	// state_dir, so it is resolved later (resolveCacheMaxBytes); here
-	// the key explicitly.
+	// we only record whether the operator set the key explicitly.
 	if _, present := lookupValue(sc, keyCacheMaxBytes); present {
-		c.CacheMaxBytesExplicit = true
+		c.cacheMaxBytesExplicit = true
 	}
 
 	// Build DBURL from StateDir if not explicitly set. The derived URL
@@ -325,8 +315,7 @@ func newFromSmartConfig(sc *smartconfig.Config) (*Config, error) {
 				settingName(keyDBURL), errValueEmpty)
 		}
 
-		// The driver sets the journal mode only through a _pragma parameter.
+		c.DBURL = fmt.Sprintf("file:%s/state.sqlite3?_journal_mode=WAL", c.StateDir)
-		c.DBURL = fmt.Sprintf("file:%s/state.sqlite3?_pragma=journal_mode(WAL)", c.StateDir)
 	}
 
 	if loader.err != nil {
@@ -425,8 +414,7 @@ func isKnownConfigKey(key string) bool {
 		keyUpstreamConnectionsPerHost, keyUpstreamConnections,
 		keyMaxConcurrentProcessing, keyCacheMaxBytes, keyBlockedNetworks,
 		keyTrustedProxies, keyAccessControlAllowOrigin, keyUpstreamFetchTimeout,
-		keyUpstreamMaxResponseSize, keyDownstreamTimeout, keyRefererBlocklist,
+		keyUpstreamMaxResponseSize, keyDownstreamTimeout, "env":
-		"env":
 		return true
 	}
 
@@ -449,7 +437,6 @@ func envVarNames() map[string]string {
 		keyMetricsPassword:            "PIXA_METRICS_PASSWORD",
 		keySigningKey:                 "PIXA_SIGNING_KEY",
 		keyAllowlistHosts:             "PIXA_ALLOWLIST_HOSTS",
-		keyRefererBlocklist:           "PIXA_REFERER_BLOCKLIST",
 		keyAllowHTTP:                  "PIXA_ALLOW_HTTP",
 		keyUpstreamConnectionsPerHost: "PIXA_UPSTREAM_CONNECTIONS_PER_HOST",
 		keyUpstreamConnections:        "PIXA_UPSTREAM_CONNECTIONS",
@@ -561,8 +548,8 @@ func (c *Config) ensureStateDirWritable() error {
 }
 
 // validateSigningKey checks that the signing key is present, long
-// enough, and not the public placeholder from configs/config.example.yml.
+// enough, and not the public placeholder from config.example.yml. The
-// The key value itself is never echoed in error messages.
+// key value itself is never echoed in error messages.
 func (c *Config) validateSigningKey() error {
 	if c.SigningKey == "" {
 		return fmt.Errorf("%s: %w", settingName(keySigningKey), errValueRequired)
@@ -619,7 +606,7 @@ func (c *Config) validate() error {
 	}
 
 	for _, host := range c.AllowlistHosts {
-		err := validateHostPattern(keyAllowlistHosts, host)
+		err := validateAllowlistHost(host)
 		if err != nil {
 			return err
 		}
@@ -742,24 +729,25 @@ func (c *Config) validateConcurrencyLimits() error {
 	return nil
 }
 
-// hostNamePattern matches a host name: letters, digits, hyphens, underscores
+// validateAllowlistHost checks that an allowlist_hosts entry is a bare
-// and dots, optionally after one leading dot.
+// hostname, optionally with a leading dot for suffix matching. URLs,
-var hostNamePattern = regexp.MustCompile(`^\.?[A-Za-z0-9_-][A-Za-z0-9_.-]*$`)
+// paths, and whitespace indicate a misconfigured entry. An entry with
-
+// no hostname labels (such as ".") is rejected: the allowlist matcher
-// validateHostPattern checks that an entry of the named key, allowlist_hosts
+// treats a leading dot as a suffix pattern, so a bare "." would match
-// or referer_blocklist, is an IP address or a host name, the host name
+// any upstream host written in FQDN trailing-dot form and effectively
-// optionally with one leading dot for suffix matching. Anything else, such as
+// disable URL signing.
-// a URL, a port or a "*." wildcard, can never match a host name that resolves,
+func validateAllowlistHost(host string) error {
-// so it is refused.
+	if strings.Contains(host, "://") || strings.ContainsAny(host, "/ \t") {
-// So is "." alone: the allowlist matcher would match it against any host
+		return fmt.Errorf("%s: entry %q %w",
-// written with a trailing dot, which in allowlist_hosts disables URL signing.
+			settingName(keyAllowlistHosts), host, errNotBareHostname)
-func validateHostPattern(key, host string) error {
-	_, err := netip.ParseAddr(host)
-	if err == nil || hostNamePattern.MatchString(host) {
-		return nil
 	}
 
-	return fmt.Errorf("%s: entry %q %w", settingName(key), host, errNotAHost)
+	if strings.Trim(host, ".") == "" {
+		return fmt.Errorf("%s: entry %q %w",
+			settingName(keyAllowlistHosts), host, errNoHostnameLabels)
+	}
+
+	return nil
 }
 
 // loadConfigFile loads configuration from the PIXA_CONFIG_PATH env var
@@ -790,27 +778,19 @@ func loadConfigFile(log *slog.Logger, appName string) (*smartconfig.Config, erro
 	for _, path := range configPaths {
 		cleanPath := filepath.Clean(path)
 
-		// Only a config file that does not exist is skipped, including
-		// one whose path runs through a file, such as under a HOME of
-		// /dev/null. One that cannot be read or does not parse is a
-		// fatal startup error.
 		_, statErr := os.Stat(cleanPath)
-		if errors.Is(statErr, fs.ErrNotExist) || errors.Is(statErr, syscall.ENOTDIR) {
+		if statErr == nil {
-			continue
+			// A config file that exists but does not parse is a fatal
+			// startup error, never something to skip over.
+			sc, err := smartconfig.NewFromConfigPath(path)
+			if err != nil {
+				return nil, fmt.Errorf("failed to parse config file %s: %w", path, err)
+			}
+
+			log.Info("loaded config file", "path", path)
+
+			return sc, nil
 		}
-
-		if statErr != nil {
-			return nil, fmt.Errorf("failed to read config file %s: %w", path, statErr)
-		}
-
-		sc, err := smartconfig.NewFromConfigPath(path)
-		if err != nil {
-			return nil, fmt.Errorf("failed to parse config file %s: %w", path, err)
-		}
-
-		log.Info("loaded config file", "path", path)
-
-		return sc, nil
 	}
 
 	return nil, nil //nolint:nilnil // nil config is valid (use defaults)
@@ -889,19 +869,6 @@ func (l *strictLoader) boolVal(key string, defaultVal bool) bool {
 	return val
 }
 
-func (l *strictLoader) hostListVal(key string) []string {
-	if l.err != nil {
-		return nil
-	}
-
-	val, err := parseHostList(l.sc, key)
-	if err != nil {
-		l.err = err
-	}
-
-	return val
-}
-
 // getString returns the string value for key, or defaultVal if the key
 // is omitted. A present value that is not a string, or is explicitly
 // null, is an error.
@@ -1199,7 +1166,7 @@ func parseCIDRList(sc *smartconfig.Config, key string) ([]netip.Prefix, error) {
 		return nil, errNullConfigValue(key)
 	}
 
-	entries, err := listEntries(raw, key)
+	entries, err := cidrListEntries(raw, key)
 	if err != nil {
 		return nil, err
 	}
@@ -1219,41 +1186,11 @@ func parseCIDRList(sc *smartconfig.Config, key string) ([]netip.Prefix, error) {
 	return prefixes, nil
 }
 
-// parseHostList parses the value of the named config key into host patterns,
+// cidrListEntries extracts the raw entries of the named CIDR-list key as
-// or returns nil if the key is omitted. It accepts a YAML list of strings or a
+// trimmed, non-empty strings, from either a YAML list of strings or a
-// comma-separated string. An explicitly null value, a wrong type, an empty
+// comma-separated string; an empty string is an empty list, as for
-// entry, a non-string entry, or an entry validateHostPattern rejects aborts
+// allowlist_hosts. Any other shape is a configuration error.
-// startup naming the key and the offending value.
+func cidrListEntries(raw any, key string) ([]string, error) {
-func parseHostList(sc *smartconfig.Config, key string) ([]string, error) {
-	raw, ok := lookupValue(sc, key)
-	if !ok {
-		return nil, nil
-	}
-
-	if raw == nil {
-		return nil, errNullConfigValue(key)
-	}
-
-	entries, err := listEntries(raw, key)
-	if err != nil {
-		return nil, err
-	}
-
-	for _, entry := range entries {
-		err := validateHostPattern(key, entry)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	return entries, nil
-}
-
-// listEntries extracts the raw entries of the named list key as trimmed,
-// non-empty strings, from either a YAML list of strings or a comma-separated
-// string; an empty string is an empty list, as for allowlist_hosts. Any other
-// shape is a configuration error.
-func listEntries(raw any, key string) ([]string, error) {
 	switch val := raw.(type) {
 	case []any:
 		entries := make([]string, 0, len(val))

internal/config/config_validation_internal_test.go

@@ -1,18 +1,14 @@
 package config
 
 import (
-	"database/sql"
 	"log/slog"
 	"os"
 	"path/filepath"
-	"slices"
 	"strings"
 	"testing"
 	"time"
 
 	"git.eeqj.de/sneak/smartconfig"
-
-	_ "modernc.org/sqlite" // SQLite driver registration
 )
 
 // validTestSigningKey is a 32-character signing key that satisfies the
@@ -98,43 +94,12 @@ func TestOmittedValuesUseDefaults(t *testing.T) {
 		t.Errorf("AllowlistHosts = %v, want empty", c.AllowlistHosts)
 	}
 
-	wantDBURL := "file:" + DefaultStateDir +
+	wantDBURL := "file:" + DefaultStateDir + "/state.sqlite3?_journal_mode=WAL"
-		"/state.sqlite3?_pragma=journal_mode(WAL)"
 	if c.DBURL != wantDBURL {
 		t.Errorf("DBURL = %q, want derived default %q", c.DBURL, wantDBURL)
 	}
 }
 
-// TestDefaultDBURLOpensTheDatabaseInWALMode opens the db_url derived from
-// state_dir with the SQLite driver pixad uses and checks that the database
-// is in WAL mode: the driver ignores any parameter it does not know.
-func TestDefaultDBURLOpensTheDatabaseInWALMode(t *testing.T) {
-	t.Parallel()
-
-	c, err := configFromYAML(t, signingKeyLine+"state_dir: "+t.TempDir()+"\n")
-	if err != nil {
-		t.Fatalf("config with only state_dir set should be valid, got: %v", err)
-	}
-
-	db, err := sql.Open("sqlite", c.DBURL)
-	if err != nil {
-		t.Fatalf("failed to open %q: %v", c.DBURL, err)
-	}
-
-	t.Cleanup(func() { _ = db.Close() })
-
-	var journalMode string
-
-	err = db.QueryRowContext(t.Context(), "PRAGMA journal_mode").Scan(&journalMode)
-	if err != nil {
-		t.Fatalf("failed to read the journal mode of %q: %v", c.DBURL, err)
-	}
-
-	if journalMode != "wal" {
-		t.Errorf("journal mode of %q = %q, want wal", c.DBURL, journalMode)
-	}
-}
-
 func TestExplicitValidValuesAreUsed(t *testing.T) {
 	t.Parallel()
 
@@ -217,25 +182,6 @@ func TestCommaSeparatedAllowlistStillSupported(t *testing.T) {
 	}
 }
 
-// TestAllowlistHostsAcceptsUnderscore checks that an upstream host name with
-// an underscore, which pixa can fetch from, is accepted as an entry.
-func TestAllowlistHostsAcceptsUnderscore(t *testing.T) {
-	t.Parallel()
-
-	c, err := configFromYAML(t, signingKeyLine+`allowlist_hosts:
-  - my_bucket.example.com
-  - .my_bucket.example.org
-`)
-	if err != nil {
-		t.Fatalf("host names with an underscore should load, got error: %v", err)
-	}
-
-	want := []string{"my_bucket.example.com", ".my_bucket.example.org"}
-	if !slices.Equal(c.AllowlistHosts, want) {
-		t.Errorf("AllowlistHosts = %v, want %v", c.AllowlistHosts, want)
-	}
-}
-
 // runAbortCases asserts that each case's config aborts startup with an
 // error message mentioning every expected substring.
 func runAbortCases(t *testing.T, cases []abortCase) {
@@ -338,20 +284,6 @@ func invalidHostAndCredentialCases() []abortCase {
 				keyAllowlistHosts, "example.com/images",
 			},
 		},
-		{
-			name: "allowlist host with wildcard",
-			yaml: signingKeyLine + "allowlist_hosts:\n  - \"*.example.com\"\n",
-			wantErrSubstrings: []string{
-				keyAllowlistHosts, "*.example.com",
-			},
-		},
-		{
-			name: "allowlist host with port",
-			yaml: signingKeyLine + "allowlist_hosts:\n  - example.com:8443\n",
-			wantErrSubstrings: []string{
-				keyAllowlistHosts, "example.com:8443",
-			},
-		},
 		{
 			name:              "allowlist host with whitespace",
 			yaml:              signingKeyLine + "allowlist_hosts:\n  - \"exa mple.com\"\n",
@@ -632,116 +564,6 @@ func TestMalformedConfigFileAbortsStartup(t *testing.T) {
 	t.Logf("got expected error: %v", err)
 }
 
-// TestConfigFileInDirectoryPixaMayNotEnterAbortsStartup checks that a
-// config file pixa cannot read because it may not enter its directory
-// aborts startup instead of being passed over.
-func TestConfigFileInDirectoryPixaMayNotEnterAbortsStartup(t *testing.T) {
-	if os.Geteuid() == 0 {
-		t.Skip("root may enter any directory")
-	}
-
-	home := t.TempDir()
-	configDir := filepath.Join(home, ".config", "pixa-test-nonexistent-app")
-	configPath := filepath.Join(configDir, "config.yml")
-
-	err := os.MkdirAll(configDir, 0o700)
-	if err != nil {
-		t.Fatalf("failed to create config directory: %v", err)
-	}
-
-	err = os.WriteFile(configPath, []byte(signingKeyLine), 0o600)
-	if err != nil {
-		t.Fatalf("failed to write config: %v", err)
-	}
-
-	err = os.Chmod(configDir, 0)
-	if err != nil {
-		t.Fatalf("failed to remove the config directory's permissions: %v", err)
-	}
-
-	// Give the directory back its permissions so t.TempDir can remove it.
-	t.Cleanup(func() {
-		//nolint:gosec // G302: a directory needs its execute bit to be removed
-		_ = os.Chmod(configDir, 0o700)
-	})
-
-	// The ~/.config candidate is the only one that exists: the appname
-	// rules out /etc, and the working directory is empty.
-	t.Setenv("PIXA_CONFIG_PATH", "")
-	t.Setenv("HOME", home)
-	t.Chdir(t.TempDir())
-
-	log := slog.New(slog.DiscardHandler)
-
-	sc, err := loadConfigFile(log, "pixa-test-nonexistent-app")
-	if err == nil {
-		t.Fatalf("config file pixa cannot read must abort startup, got config: %v",
-			sc)
-	}
-
-	t.Logf("got expected error: %v", err)
-
-	if !strings.Contains(err.Error(), configPath) {
-		t.Errorf("error %q does not name the config file %s", err.Error(), configPath)
-	}
-}
-
-// TestConfigFileLinkingToItselfAbortsStartup checks that a config file
-// pixa cannot read for a reason other than not existing aborts startup,
-// as root too: a symbolic link to itself fails with "too many levels of
-// symbolic links".
-func TestConfigFileLinkingToItselfAbortsStartup(t *testing.T) {
-	workDir := t.TempDir()
-
-	err := os.Symlink("config.yml", filepath.Join(workDir, "config.yml"))
-	if err != nil {
-		t.Fatalf("failed to create symbolic link: %v", err)
-	}
-
-	// Only the working directory's config.yml is there: the appname rules
-	// out /etc, and HOME is empty.
-	t.Setenv("PIXA_CONFIG_PATH", "")
-	t.Setenv("HOME", t.TempDir())
-	t.Chdir(workDir)
-
-	log := slog.New(slog.DiscardHandler)
-
-	sc, err := loadConfigFile(log, "pixa-test-nonexistent-app")
-	if err == nil {
-		t.Fatalf("config file pixa cannot read must abort startup, got config: %v",
-			sc)
-	}
-
-	t.Logf("got expected error: %v", err)
-
-	if !strings.Contains(err.Error(), "config.yml") {
-		t.Errorf("error %q does not name the config file config.yml", err.Error())
-	}
-}
-
-// TestConfigPathThroughFileIsPassedOver checks that a config file path
-// that runs through a file, such as one under a HOME of /dev/null, is
-// passed over like one that does not exist, since no file can be there.
-func TestConfigPathThroughFileIsPassedOver(t *testing.T) {
-	// No config file is there: the appname rules out /etc, HOME is
-	// /dev/null, and the working directory is empty.
-	t.Setenv("PIXA_CONFIG_PATH", "")
-	t.Setenv("HOME", os.DevNull)
-	t.Chdir(t.TempDir())
-
-	log := slog.New(slog.DiscardHandler)
-
-	sc, err := loadConfigFile(log, "pixa-test-nonexistent-app")
-	if err != nil {
-		t.Fatalf("a config path through a file must be passed over, got error: %v",
-			err)
-	}
-
-	if sc != nil {
-		t.Errorf("expected no config file, got config: %v", sc)
-	}
-}
-
 func TestEnsureStateDirCreatesDirectory(t *testing.T) {
 	t.Parallel()
 

internal/config/env_internal_test.go

@@ -65,7 +65,6 @@ func TestEnvironmentSetsEveryKey(t *testing.T) {
 	t.Setenv("PIXA_METRICS_PASSWORD", "metricspass")
 	t.Setenv("PIXA_SIGNING_KEY", validTestSigningKey)
 	t.Setenv("PIXA_ALLOWLIST_HOSTS", "s3.sneak.cloud,.example.com")
-	t.Setenv("PIXA_REFERER_BLOCKLIST", "hotlinker.example,.leech.example")
 	t.Setenv("PIXA_ALLOW_HTTP", "true")
 	t.Setenv("PIXA_UPSTREAM_CONNECTIONS_PER_HOST", "5")
 	t.Setenv("PIXA_UPSTREAM_CONNECTIONS", "10")
@@ -94,13 +93,12 @@ func TestEnvironmentSetsEveryKey(t *testing.T) {
 		MetricsPassword:            "metricspass",
 		SigningKey:                 validTestSigningKey,
 		AllowlistHosts:             []string{testHostS3, ".example.com"},
-		RefererBlocklist:           []string{"hotlinker.example", ".leech.example"},
 		AllowHTTP:                  true,
 		UpstreamConnectionsPerHost: 5,
 		UpstreamConnections:        10,
 		MaxConcurrentProcessing:    3,
 		CacheMaxBytes:              1024,
-		CacheMaxBytesExplicit:      true,
+		cacheMaxBytesExplicit:      true,
 		BlockedNetworks:            []netip.Prefix{netip.MustParsePrefix("203.0.113.0/24")},
 		TrustedProxies:             []netip.Prefix{netip.MustParsePrefix("192.0.2.0/24")},
 		AccessControlAllowOrigin:   "https://app.example.com",

internal/config/referer_blocklist_internal_test.go

@@ -1,166 +0,0 @@
-package config
-
-import (
-	"slices"
-	"testing"
-)
-
-// TestRefererBlocklistParsed loads a referer_blocklist with a host and a
-// pattern starting with "." and checks both are kept in order.
-func TestRefererBlocklistParsed(t *testing.T) {
-	t.Parallel()
-
-	c, err := configFromYAML(t, signingKeyLine+`referer_blocklist:
-  - leech.example
-  - .hotlinker.example
-`)
-	if err != nil {
-		t.Fatalf("valid referer_blocklist should load, got error: %v", err)
-	}
-
-	want := []string{"leech.example", ".hotlinker.example"}
-	if !slices.Equal(c.RefererBlocklist, want) {
-		t.Errorf("RefererBlocklist = %v, want %v", c.RefererBlocklist, want)
-	}
-}
-
-// TestRefererBlocklistAcceptsIPAddresses checks that IPv4 and IPv6 addresses,
-// the IPv6 one written without brackets, are accepted as entries.
-func TestRefererBlocklistAcceptsIPAddresses(t *testing.T) {
-	t.Parallel()
-
-	c, err := configFromYAML(t, signingKeyLine+`referer_blocklist:
-  - 192.0.2.7
-  - "2001:db8::7"
-`)
-	if err != nil {
-		t.Fatalf("IP address entries should load, got error: %v", err)
-	}
-
-	want := []string{"192.0.2.7", "2001:db8::7"}
-	if !slices.Equal(c.RefererBlocklist, want) {
-		t.Errorf("RefererBlocklist = %v, want %v", c.RefererBlocklist, want)
-	}
-}
-
-// TestRefererBlocklistAcceptsUnderscore checks that a host name with an
-// underscore, which a page can be served from, is accepted as an entry.
-func TestRefererBlocklistAcceptsUnderscore(t *testing.T) {
-	t.Parallel()
-
-	c, err := configFromYAML(t, signingKeyLine+`referer_blocklist:
-  - my_site.leech.example
-  - .my_site.hotlinker.example
-`)
-	if err != nil {
-		t.Fatalf("host names with an underscore should load, got error: %v", err)
-	}
-
-	want := []string{"my_site.leech.example", ".my_site.hotlinker.example"}
-	if !slices.Equal(c.RefererBlocklist, want) {
-		t.Errorf("RefererBlocklist = %v, want %v", c.RefererBlocklist, want)
-	}
-}
-
-// TestRefererBlocklistOmittedIsEmpty checks that an omitted key blocks no
-// referer.
-func TestRefererBlocklistOmittedIsEmpty(t *testing.T) {
-	t.Parallel()
-
-	c, err := configFromYAML(t, signingKeyLine)
-	if err != nil {
-		t.Fatalf("minimal config should be valid, got error: %v", err)
-	}
-
-	if len(c.RefererBlocklist) != 0 {
-		t.Errorf("RefererBlocklist = %v, want empty", c.RefererBlocklist)
-	}
-}
-
-// TestRefererBlocklistInvalidAbortsStartup checks that an entry that is not a
-// host, or a value that is not a list of them, aborts startup with an error
-// naming the key and the entry.
-func TestRefererBlocklistInvalidAbortsStartup(t *testing.T) {
-	t.Parallel()
-
-	runAbortCases(t, []abortCase{
-		{
-			name: "entry with a scheme",
-			yaml: signingKeyLine + "referer_blocklist:\n  - https://leech.example\n",
-			wantErrSubstrings: []string{
-				keyRefererBlocklist, "https://leech.example",
-			},
-		},
-		{
-			name: "entry with a path",
-			yaml: signingKeyLine + "referer_blocklist:\n  - leech.example/page\n",
-			wantErrSubstrings: []string{
-				keyRefererBlocklist, "leech.example/page",
-			},
-		},
-		{
-			name: "wildcard entry",
-			yaml: signingKeyLine + "referer_blocklist:\n  - \"*.leech.example\"\n",
-			wantErrSubstrings: []string{
-				keyRefererBlocklist, "*.leech.example",
-			},
-		},
-		{
-			name: "entry with a port",
-			yaml: signingKeyLine + "referer_blocklist:\n  - leech.example:8080\n",
-			wantErrSubstrings: []string{
-				keyRefererBlocklist, "leech.example:8080",
-			},
-		},
-		{
-			name: "two leading dots",
-			yaml: signingKeyLine + "referer_blocklist:\n  - ..leech.example\n",
-			wantErrSubstrings: []string{
-				keyRefererBlocklist, "..leech.example",
-			},
-		},
-		{
-			name:              "dot only",
-			yaml:              signingKeyLine + "referer_blocklist:\n  - \".\"\n",
-			wantErrSubstrings: []string{keyRefererBlocklist, `"."`},
-		},
-		{
-			name:              "empty entry",
-			yaml:              signingKeyLine + "referer_blocklist:\n  - \"\"\n",
-			wantErrSubstrings: []string{keyRefererBlocklist},
-		},
-		{
-			name:              "entry not a string",
-			yaml:              signingKeyLine + "referer_blocklist:\n  - 42\n",
-			wantErrSubstrings: []string{keyRefererBlocklist, "42"},
-		},
-		{
-			name:              "null value",
-			yaml:              signingKeyLine + "referer_blocklist:\n",
-			wantErrSubstrings: []string{keyRefererBlocklist, nullValueText},
-		},
-	})
-}
-
-// TestRefererBlocklistFromEnvironment checks that PIXA_REFERER_BLOCKLIST
-// takes comma-separated entries, and that an entry in it that is not a host
-// aborts startup naming the variable and the entry.
-func TestRefererBlocklistFromEnvironment(t *testing.T) {
-	t.Setenv("PIXA_SIGNING_KEY", validTestSigningKey)
-	t.Setenv("PIXA_REFERER_BLOCKLIST", " leech.example , .hotlinker.example ")
-
-	c, err := newFromSmartConfig(nil)
-	if err != nil {
-		t.Fatalf("valid PIXA_REFERER_BLOCKLIST should load, got error: %v", err)
-	}
-
-	want := []string{"leech.example", ".hotlinker.example"}
-	if !slices.Equal(c.RefererBlocklist, want) {
-		t.Errorf("RefererBlocklist = %v, want %v", c.RefererBlocklist, want)
-	}
-
-	t.Setenv("PIXA_REFERER_BLOCKLIST", "leech.example,https://hotlinker.example")
-
-	_, err = newFromSmartConfig(nil)
-	wantStartupError(t, err, "PIXA_REFERER_BLOCKLIST", "https://hotlinker.example")
-}

internal/database/concurrent_writes_internal_test.go

@@ -1,153 +0,0 @@
-package database
-
-import (
-	"context"
-	"database/sql"
-	"fmt"
-	"log/slog"
-	"path/filepath"
-	"sync"
-	"testing"
-
-	"sneak.berlin/go/pixa/internal/config"
-)
-
-// TestConcurrentWritesAllSucceed opens a database the way pixad does and
-// writes to it from several goroutines at once, so the writes run on
-// separate connections, as one request's writes and the background eviction
-// pass do. Every write must succeed, none failing with "database is locked",
-// whether or not db_url already has parameters, and the parameters it has
-// must still apply.
-func TestConcurrentWritesAllSucceed(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name            string
-		query           string
-		wantJournalMode string
-	}{
-		{
-			name:            "db_url without parameters",
-			query:           "",
-			wantJournalMode: "delete",
-		},
-		{
-			name:            "db_url with the WAL parameter",
-			query:           "?_pragma=journal_mode(WAL)",
-			wantJournalMode: "wal",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			dbURL := "file:" + filepath.Join(t.TempDir(), "state.sqlite3") + tt.query
-
-			d := &Database{
-				log:    slog.New(slog.DiscardHandler),
-				config: &config.Config{DBURL: dbURL},
-			}
-
-			err := d.connect(t.Context())
-			if err != nil {
-				t.Fatalf("failed to connect to %q: %v", dbURL, err)
-			}
-
-			t.Cleanup(func() { _ = d.db.Close() })
-
-			writeConcurrently(t, d.db)
-
-			var journalMode string
-
-			err = d.db.QueryRowContext(t.Context(), "PRAGMA journal_mode").
-				Scan(&journalMode)
-			if err != nil {
-				t.Fatalf("failed to read the journal mode: %v", err)
-			}
-
-			if journalMode != tt.wantJournalMode {
-				t.Errorf("journal mode = %q, want %q", journalMode, tt.wantJournalMode)
-			}
-		})
-	}
-}
-
-// writeConcurrently runs writeLikeOneRequest from several goroutines at once
-// and checks that every write was made.
-func writeConcurrently(t *testing.T, db *sql.DB) {
-	t.Helper()
-
-	const (
-		writers       = 4
-		requestsEach  = 20
-		totalRequests = writers * requestsEach
-	)
-
-	ctx := t.Context()
-
-	var wg sync.WaitGroup
-
-	for writer := range writers {
-		wg.Go(func() {
-			for request := range requestsEach {
-				key := fmt.Sprintf("%d-%d", writer, request)
-
-				err := writeLikeOneRequest(ctx, db, key)
-				if err != nil {
-					t.Errorf("writer %d: %v", writer, err)
-
-					return
-				}
-			}
-		})
-	}
-
-	wg.Wait()
-
-	var hits, sources int
-
-	err := db.QueryRowContext(ctx, `
-		SELECT hit_count, (SELECT COUNT(*) FROM source_content)
-		FROM cache_stats WHERE id = 1
-	`).Scan(&hits, &sources)
-	if err != nil {
-		t.Fatalf("failed to count the writes: %v", err)
-	}
-
-	if hits != totalRequests || sources != totalRequests {
-		t.Errorf("hit_count = %d and %d source_content rows, want %d of each",
-			hits, sources, totalRequests)
-	}
-}
-
-// writeLikeOneRequest makes the writes one request and the eviction pass
-// make: it counts a cache hit, stores a source, records a transformed image
-// and deletes that record again.
-func writeLikeOneRequest(ctx context.Context, db *sql.DB, key string) error {
-	_, err := db.ExecContext(ctx,
-		`UPDATE cache_stats SET hit_count = hit_count + 1 WHERE id = 1`)
-	if err != nil {
-		return fmt.Errorf("counting a cache hit: %w", err)
-	}
-
-	_, err = db.ExecContext(ctx, `INSERT INTO source_content
-		(content_hash, content_type, size_bytes) VALUES (?, 'image/png', 1)`, key)
-	if err != nil {
-		return fmt.Errorf("storing a source: %w", err)
-	}
-
-	_, err = db.ExecContext(ctx, `INSERT INTO variant_content
-		(cache_key, size_bytes, content_type) VALUES (?, 1, 'image/png')`, key)
-	if err != nil {
-		return fmt.Errorf("recording a transformed image: %w", err)
-	}
-
-	_, err = db.ExecContext(ctx,
-		`DELETE FROM variant_content WHERE cache_key = ?`, key)
-	if err != nil {
-		return fmt.Errorf("evicting a transformed image: %w", err)
-	}
-
-	return nil
-}

internal/database/database.go

@@ -243,17 +243,7 @@ func (s *Database) DB() *sql.DB {
 }
 
 func (s *Database) connect(ctx context.Context) error {
-	// Requests and the eviction pass write on separate connections. With
+	dbURL := s.config.DBURL
-	// a busy timeout, a write that finds another one in progress waits up
-	// to five seconds for it instead of failing at once with "database is
-	// locked". The driver runs each _pragma parameter on every connection
-	// it opens.
-	separator := "?"
-	if strings.Contains(s.config.DBURL, "?") {
-		separator = "&"
-	}
-
-	dbURL := s.config.DBURL + separator + "_pragma=busy_timeout(5000)"
 
 	s.log.Info("connecting to database", "url", dbURL)
 

internal/db/migrations/001_schema.sql

@@ -2,7 +2,7 @@
 -- Creates all tables for the pixa caching image proxy
 
 -- Source content blobs
--- Files stored at: cache/sources/<ab>/<cd>/<sha256>
+-- Files stored at: cache/src-content/<ab>/<cd>/<sha256>
 -- last_accessed_at is NULL until the first LRU touch; eviction falls
 -- back to fetched_at for rows that have never been touched.
 CREATE TABLE IF NOT EXISTS source_content (
@@ -16,7 +16,7 @@ CREATE INDEX IF NOT EXISTS idx_source_content_last_accessed
     ON source_content(last_accessed_at);
 
 -- Source URL metadata - maps URLs to content hashes
--- JSON stored at: cache/metadata/<hostname>/<path_hash>.json
+-- JSON stored at: cache/src-metadata/<hostname>/<path_hash>.json
 CREATE TABLE IF NOT EXISTS source_metadata (
     id INTEGER PRIMARY KEY AUTOINCREMENT,
     source_host TEXT NOT NULL,
@@ -56,8 +56,7 @@ CREATE INDEX IF NOT EXISTS idx_variant_content_last_accessed
     ON variant_content(last_accessed_at);
 
 -- Output/transformed content blobs
--- Not written: transformed images are stored in cache/variants and
+-- Files stored at: cache/dst-content/<ab>/<cd>/<sha256>
--- tracked in variant_content above.
 CREATE TABLE IF NOT EXISTS output_content (
     content_hash TEXT PRIMARY KEY,
     content_type TEXT NOT NULL,

internal/handlers/auth_login_log_internal_test.go

@@ -1,59 +0,0 @@
-package handlers
-
-import (
-	"bytes"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"strings"
-	"testing"
-
-	"sneak.berlin/go/pixa/internal/config"
-	"sneak.berlin/go/pixa/internal/session"
-)
-
-// TestLoginLogLeavesOutSubmittedKey verifies that the log lines for a
-// failed and for a successful login do not contain the submitted key.
-func TestLoginLogLeavesOutSubmittedKey(t *testing.T) {
-	t.Parallel()
-
-	const wrongKey = "wrong-signing-key-fedcba9876543210"
-
-	var buf bytes.Buffer
-
-	sessMgr, err := session.NewManager(testSigningKey)
-	if err != nil {
-		t.Fatalf("session.NewManager() error = %v", err)
-	}
-
-	h := &Handlers{
-		log:     slog.New(slog.NewJSONHandler(&buf, nil)),
-		config:  &config.Config{SigningKey: testSigningKey},
-		sessMgr: sessMgr,
-	}
-
-	submittedKeys := []string{wrongKey, testSigningKey}
-
-	for _, key := range submittedKeys {
-		form := url.Values{loginKeyField: {key}}
-		req := httptest.NewRequestWithContext(
-			t.Context(), http.MethodPost, "/",
-			strings.NewReader(form.Encode()))
-		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-
-		h.handleLoginPost(httptest.NewRecorder(), req)
-	}
-
-	for _, msg := range []string{"failed login attempt", "successful login"} {
-		if !strings.Contains(buf.String(), msg) {
-			t.Fatalf("log missing %q; got %q", msg, buf.String())
-		}
-	}
-
-	for _, key := range submittedKeys {
-		if strings.Contains(buf.String(), key) {
-			t.Errorf("log contains submitted key %q; got %q", key, buf.String())
-		}
-	}
-}

internal/handlers/auth_session_internal_test.go

@@ -1,292 +0,0 @@
-package handlers
-
-import (
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"regexp"
-	"strings"
-	"testing"
-	"time"
-
-	"sneak.berlin/go/pixa/internal/imgcache"
-	"sneak.berlin/go/pixa/internal/session"
-)
-
-// formatField is the generator form's format field name.
-const formatField = "format"
-
-// Markers telling the login page from the generator page.
-const (
-	loginForm     = `action="/"`
-	loginKeyInput = `name="key"`
-	generatorForm = `action="/generate"`
-)
-
-// generatedURLPattern extracts the path of the URL the generator page shows.
-// The test router runs with debug on, so the URL starts with http, and its
-// host is httptest's default request host.
-var generatedURLPattern = regexp.MustCompile(
-	`value="http://example\.com(/v1/e/[^"]+)"`)
-
-// findSessionCookie returns the session cookie rec sets, or nil if it sets
-// none.
-func findSessionCookie(rec *httptest.ResponseRecorder) *http.Cookie {
-	for _, c := range rec.Result().Cookies() {
-		if c.Name == session.CookieName {
-			return c
-		}
-	}
-
-	return nil
-}
-
-// TestHandleRoot_NoSession_ShowsLoginForm verifies that GET / without a
-// login session shows the login form.
-func TestHandleRoot_NoSession_ShowsLoginForm(t *testing.T) {
-	t.Parallel()
-
-	_, srv := newCSRFTestRouter(t)
-
-	rec := httptest.NewRecorder()
-	srv.ServeHTTP(rec, httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, "/", nil))
-
-	if rec.Code != http.StatusOK {
-		t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK)
-	}
-
-	body := rec.Body.String()
-	if !strings.Contains(body, loginForm) || !strings.Contains(body, loginKeyInput) {
-		t.Errorf("page is not the login form: %s", body)
-	}
-}
-
-// TestLoginPost_WrongKey_ShowsErrorWithoutSession verifies that a wrong key
-// shows the login form again with an error, and sets no session cookie.
-func TestLoginPost_WrongKey_ShowsErrorWithoutSession(t *testing.T) {
-	t.Parallel()
-
-	_, srv := newCSRFTestRouter(t)
-
-	cookies, token := csrfCredentials(t, srv, nil)
-
-	rec := postForm(srv, "/", cookies, url.Values{
-		loginKeyField:  {"wrong-signing-key-fedcba9876543210"},
-		csrfTokenField: {token},
-	})
-
-	if rec.Code != http.StatusOK {
-		t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK)
-	}
-
-	body := rec.Body.String()
-	if !strings.Contains(body, loginForm) || !strings.Contains(body, loginKeyInput) {
-		t.Errorf("page is not the login form: %s", body)
-	}
-
-	if !strings.Contains(body, "Invalid signing key") {
-		t.Error("login form does not show the error")
-	}
-
-	if c := findSessionCookie(rec); c != nil {
-		t.Errorf("wrong key set a session cookie: %s", c)
-	}
-}
-
-// TestLoginPost_RightKey_SetsSessionCookie verifies that the right key answers
-// 303 to / with a session cookie marked Secure, HttpOnly and SameSite=Strict,
-// and that GET / with that cookie shows the generator page.
-func TestLoginPost_RightKey_SetsSessionCookie(t *testing.T) {
-	t.Parallel()
-
-	_, srv := newCSRFTestRouter(t)
-
-	cookies, token := csrfCredentials(t, srv, nil)
-
-	rec := postForm(srv, "/", cookies, url.Values{
-		loginKeyField:  {testSigningKey},
-		csrfTokenField: {token},
-	})
-
-	if rec.Code != http.StatusSeeOther || rec.Header().Get("Location") != "/" {
-		t.Fatalf("status = %d, Location = %q, want %d to /",
-			rec.Code, rec.Header().Get("Location"), http.StatusSeeOther)
-	}
-
-	sessionCookie := findSessionCookie(rec)
-	if sessionCookie == nil {
-		t.Fatal("right key set no session cookie")
-	}
-
-	t.Logf("Set-Cookie: %s", sessionCookie)
-
-	if !sessionCookie.Secure {
-		t.Error("session cookie is not Secure")
-	}
-
-	if !sessionCookie.HttpOnly {
-		t.Error("session cookie is not HttpOnly")
-	}
-
-	if sessionCookie.SameSite != http.SameSiteStrictMode {
-		t.Errorf("session cookie SameSite = %v, want Strict", sessionCookie.SameSite)
-	}
-
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
-	req.AddCookie(sessionCookie)
-
-	rec = httptest.NewRecorder()
-	srv.ServeHTTP(rec, req)
-
-	if rec.Code != http.StatusOK ||
-		!strings.Contains(rec.Body.String(), generatorForm) {
-		t.Errorf("GET / with the session cookie: status = %d, "+
-			"want %d and the generator page", rec.Code, http.StatusOK)
-	}
-}
-
-// TestHandleLogout_ClearsSessionCookie verifies that GET /logout answers 303
-// to / and replaces the session cookie with an empty one sent with
-// Max-Age=0, which makes the browser delete it.
-func TestHandleLogout_ClearsSessionCookie(t *testing.T) {
-	t.Parallel()
-
-	h, _ := newCSRFTestRouter(t)
-
-	req := httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, "/logout", nil)
-	req.AddCookie(newSessionCookie(t, h))
-
-	rec := httptest.NewRecorder()
-	h.HandleLogout().ServeHTTP(rec, req)
-
-	if rec.Code != http.StatusSeeOther || rec.Header().Get("Location") != "/" {
-		t.Fatalf("status = %d, Location = %q, want %d to /",
-			rec.Code, rec.Header().Get("Location"), http.StatusSeeOther)
-	}
-
-	t.Logf("Set-Cookie: %s", rec.Header().Get("Set-Cookie"))
-
-	sessionCookie := findSessionCookie(rec)
-	if sessionCookie == nil {
-		t.Fatal("logout did not set the session cookie")
-	}
-
-	if sessionCookie.Value != "" {
-		t.Errorf("session cookie value = %q, want empty", sessionCookie.Value)
-	}
-
-	// net/http reads a Max-Age=0 attribute back as MaxAge -1.
-	if sessionCookie.MaxAge != -1 {
-		t.Errorf("session cookie MaxAge = %d, want -1 (Max-Age=0)",
-			sessionCookie.MaxAge)
-	}
-}
-
-// TestGeneratePost_NoSession_RedirectsToLogin verifies that POST /generate
-// with a valid CSRF token but no login session answers 303 to / and makes no
-// URL.
-func TestGeneratePost_NoSession_RedirectsToLogin(t *testing.T) {
-	t.Parallel()
-
-	_, srv := newCSRFTestRouter(t)
-
-	cookies, token := csrfCredentials(t, srv, nil)
-
-	rec := postForm(srv, "/generate", cookies, url.Values{
-		sourceURLField: {testSourceURL},
-		csrfTokenField: {token},
-	})
-
-	if rec.Code != http.StatusSeeOther || rec.Header().Get("Location") != "/" {
-		t.Fatalf("status = %d, Location = %q, want %d to /",
-			rec.Code, rec.Header().Get("Location"), http.StatusSeeOther)
-	}
-
-	if strings.Contains(rec.Body.String(), "/v1/e/") {
-		t.Error("a URL was made without a login session")
-	}
-}
-
-// TestGeneratePost_URLServesImage verifies that the URL the generator page
-// makes is served by /v1/e/. The image route runs on handlers of its own,
-// made with the same signing key.
-func TestGeneratePost_URLServesImage(t *testing.T) {
-	t.Parallel()
-
-	_, imageSrv := newSignedHostServer(t, slog.New(slog.DiscardHandler))
-
-	rec := generatePost(t, url.Values{
-		sourceURLField: {"https://" + signedHost + photoPath},
-		widthField:     {"50"},
-		heightField:    {"50"},
-		formatField:    {string(imgcache.FormatJPEG)},
-	})
-
-	if rec.Code != http.StatusOK {
-		t.Fatalf("POST /generate status = %d, want %d", rec.Code, http.StatusOK)
-	}
-
-	match := generatedURLPattern.FindStringSubmatch(rec.Body.String())
-	if match == nil {
-		t.Fatalf("generator page shows no URL: %s", rec.Body.String())
-	}
-
-	t.Logf("generated URL path: %s", match[1])
-
-	imageRec := httptest.NewRecorder()
-	imageSrv.ServeHTTP(imageRec, httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, match[1], nil))
-
-	requireServedPhoto(t, imageRec)
-}
-
-// TestGeneratePost_URLWithTTLExpires verifies that a URL the generator page
-// makes with a ttl of one second is served by /v1/e/ at once and answers 410
-// once the ttl has passed.
-func TestGeneratePost_URLWithTTLExpires(t *testing.T) {
-	t.Parallel()
-
-	_, imageSrv := newSignedHostServer(t, slog.New(slog.DiscardHandler))
-
-	rec := generatePost(t, url.Values{
-		sourceURLField: {"https://" + signedHost + photoPath},
-		widthField:     {"50"},
-		heightField:    {"50"},
-		formatField:    {string(imgcache.FormatJPEG)},
-		ttlField:       {"1"},
-	})
-
-	if rec.Code != http.StatusOK {
-		t.Fatalf("POST /generate status = %d, want %d", rec.Code, http.StatusOK)
-	}
-
-	match := generatedURLPattern.FindStringSubmatch(rec.Body.String())
-	if match == nil {
-		t.Fatalf("generator page shows no URL: %s", rec.Body.String())
-	}
-
-	imageRec := httptest.NewRecorder()
-	imageSrv.ServeHTTP(imageRec, httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, match[1], nil))
-
-	requireServedPhoto(t, imageRec)
-
-	// The URL keeps the time it expires in whole seconds and is served
-	// through the whole of that second, so a ttl of one second has passed
-	// for certain two seconds after the URL was made.
-	time.Sleep(2 * time.Second)
-
-	imageRec = httptest.NewRecorder()
-	imageSrv.ServeHTTP(imageRec, httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, match[1], nil))
-
-	t.Logf("GET %s after the ttl: %d %q", match[1], imageRec.Code, imageRec.Body)
-
-	if imageRec.Code != http.StatusGone {
-		t.Errorf("status after the ttl = %d, want %d",
-			imageRec.Code, http.StatusGone)
-	}
-}

internal/handlers/cache_max_bytes_internal_test.go

@@ -1,147 +0,0 @@
-package handlers
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"go.uber.org/fx/fxtest"
-
-	"sneak.berlin/go/pixa/internal/config"
-	"sneak.berlin/go/pixa/internal/database"
-	"sneak.berlin/go/pixa/internal/globals"
-	"sneak.berlin/go/pixa/internal/logger"
-)
-
-// TestNewCacheConfigFromCacheMaxBytes checks the cache configuration
-// built from cache_max_bytes: omitted, the cache works out the default
-// limit; 0 turns the disk cache off; a positive value is the limit,
-// unchanged.
-func TestNewCacheConfigFromCacheMaxBytes(t *testing.T) {
-	t.Parallel()
-
-	const oneGiB = 1 << 30
-
-	cases := []struct {
-		name                   string
-		cacheMaxBytes          int64
-		cacheMaxBytesExplicit  bool
-		wantMaxBytes           int64
-		wantUseDefaultMaxBytes bool
-		wantDisableDiskCache   bool
-	}{
-		{
-			name:                   "cache_max_bytes omitted",
-			cacheMaxBytes:          0,
-			cacheMaxBytesExplicit:  false,
-			wantMaxBytes:           0,
-			wantUseDefaultMaxBytes: true,
-			wantDisableDiskCache:   false,
-		},
-		{
-			name:                   "cache_max_bytes: 0",
-			cacheMaxBytes:          0,
-			cacheMaxBytesExplicit:  true,
-			wantMaxBytes:           0,
-			wantUseDefaultMaxBytes: false,
-			wantDisableDiskCache:   true,
-		},
-		{
-			name:                   "cache_max_bytes: 1 GiB",
-			cacheMaxBytes:          oneGiB,
-			cacheMaxBytesExplicit:  true,
-			wantMaxBytes:           oneGiB,
-			wantUseDefaultMaxBytes: false,
-			wantDisableDiskCache:   false,
-		},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			cfg := &config.Config{
-				CacheMaxBytes:         tc.cacheMaxBytes,
-				CacheMaxBytesExplicit: tc.cacheMaxBytesExplicit,
-			}
-
-			got := newCacheConfig(cfg, nil)
-			t.Logf("MaxBytes = %d, UseDefaultMaxBytes = %v, DisableDiskCache = %v",
-				got.MaxBytes, got.UseDefaultMaxBytes, got.DisableDiskCache)
-
-			if got.MaxBytes != tc.wantMaxBytes {
-				t.Errorf("MaxBytes = %d, want %d", got.MaxBytes, tc.wantMaxBytes)
-			}
-
-			if got.UseDefaultMaxBytes != tc.wantUseDefaultMaxBytes {
-				t.Errorf("UseDefaultMaxBytes = %v, want %v",
-					got.UseDefaultMaxBytes, tc.wantUseDefaultMaxBytes)
-			}
-
-			if got.DisableDiskCache != tc.wantDisableDiskCache {
-				t.Errorf("DisableDiskCache = %v, want %v",
-					got.DisableDiskCache, tc.wantDisableDiskCache)
-			}
-		})
-	}
-}
-
-// TestDiskCacheOffOnlyForExplicitZeroCacheMaxBytes starts the handlers
-// once with cache_max_bytes omitted and once with cache_max_bytes: 0,
-// and checks by whether the cache directories were created that the
-// disk cache is on in the first case and off in the second.
-func TestDiskCacheOffOnlyForExplicitZeroCacheMaxBytes(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		name                  string
-		cacheMaxBytesExplicit bool
-		wantDiskCache         bool
-	}{
-		{name: "cache_max_bytes omitted", cacheMaxBytesExplicit: false, wantDiskCache: true},
-		{name: "cache_max_bytes: 0", cacheMaxBytesExplicit: true, wantDiskCache: false},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			stateDir := t.TempDir()
-			cfg := &config.Config{
-				SigningKey:            testSigningKey,
-				StateDir:              stateDir,
-				DBURL:                 "file:" + filepath.Join(stateDir, "state.sqlite3"),
-				CacheMaxBytes:         0,
-				CacheMaxBytesExplicit: tc.cacheMaxBytesExplicit,
-			}
-
-			lc := fxtest.NewLifecycle(t)
-
-			log, err := logger.New(lc, logger.Params{Globals: &globals.Globals{}})
-			if err != nil {
-				t.Fatalf("logger.New() error = %v", err)
-			}
-
-			db, err := database.New(lc, database.Params{Logger: log, Config: cfg})
-			if err != nil {
-				t.Fatalf("database.New() error = %v", err)
-			}
-
-			_, err = New(lc, Params{Logger: log, Database: db, Config: cfg})
-			if err != nil {
-				t.Fatalf("New() error = %v", err)
-			}
-
-			lc.RequireStart()
-			t.Cleanup(lc.RequireStop)
-
-			_, err = os.Stat(filepath.Join(stateDir, "cache", "variants"))
-			gotDiskCache := err == nil
-
-			if gotDiskCache != tc.wantDiskCache {
-				t.Errorf("cache directories created = %v, want %v",
-					gotDiskCache, tc.wantDiskCache)
-			}
-		})
-	}
-}

internal/handlers/fetcher_internal_test.go

@@ -1,61 +0,0 @@
-package handlers
-
-import (
-	"net/http"
-	"net/netip"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/go-chi/chi/v5"
-	"go.uber.org/fx"
-	"go.uber.org/fx/fxtest"
-
-	"sneak.berlin/go/pixa/internal/config"
-	"sneak.berlin/go/pixa/internal/database"
-	"sneak.berlin/go/pixa/internal/globals"
-	"sneak.berlin/go/pixa/internal/healthcheck"
-	"sneak.berlin/go/pixa/internal/logger"
-)
-
-// TestHandlersBuildTheirOwnFetcherWhenNoneIsProvided builds the handlers as
-// pixad does, in an fx app that provides no fetcher, and requests an image
-// from 192.0.2.10, which is on the allowlist and in blocked_networks. The URL
-// check accepts that address; only the dialer that refuses internal
-// addresses checks blocked_networks, so the answer is 403 only if the
-// fetcher the handlers build from the config connects with that dialer. Any
-// other dialer would try to connect until the upstream fetch timeout, which
-// is short so that the test then fails quickly.
-func TestHandlersBuildTheirOwnFetcherWhenNoneIsProvided(t *testing.T) {
-	t.Parallel()
-
-	const host = "192.0.2.10"
-
-	stateDir := t.TempDir()
-	cfg := &config.Config{
-		SigningKey:           testSigningKey,
-		StateDir:             stateDir,
-		DBURL:                "file:" + filepath.Join(stateDir, "state.sqlite3"),
-		AllowlistHosts:       []string{host},
-		BlockedNetworks:      []netip.Prefix{netip.MustParsePrefix("192.0.2.0/24")},
-		UpstreamFetchTimeout: 2 * time.Second,
-		// With no connection slots, the fetch would fail before dialing.
-		UpstreamConnections: config.DefaultUpstreamConnections,
-	}
-
-	var h *Handlers
-
-	app := fxtest.New(t,
-		fx.Supply(cfg),
-		fx.Provide(globals.New, logger.New, database.New, healthcheck.New, New),
-		fx.Populate(&h),
-	)
-	app.RequireStart()
-	t.Cleanup(app.RequireStop)
-
-	r := chi.NewRouter()
-	r.Get("/v1/image/*", h.HandleImage())
-
-	rec := sendGet(t, r, photoURL(host))
-	checkErrorBody(t, rec, http.StatusForbidden, "forbidden")
-}

internal/handlers/handlers.go

@@ -9,7 +9,6 @@ import (
 	"time"
 
 	"go.uber.org/fx"
-	"sneak.berlin/go/pixa/internal/allowlist"
 	"sneak.berlin/go/pixa/internal/config"
 	"sneak.berlin/go/pixa/internal/database"
 	"sneak.berlin/go/pixa/internal/encurl"
@@ -28,11 +27,6 @@ type Params struct {
 	Healthcheck *healthcheck.Healthcheck
 	Database    *database.Database
 	Config      *config.Config
-
-	// Fetcher, when provided, fetches upstream images in place of the
-	// fetcher the handlers build from the config. Only tests provide one;
-	// pixad does not.
-	Fetcher httpfetcher.Fetcher `optional:"true"`
 }
 
 // Handlers provides HTTP request handlers.
@@ -41,16 +35,11 @@ type Handlers struct {
 	hc          *healthcheck.Healthcheck
 	db          *database.Database
 	config      *config.Config
-	fetcher     httpfetcher.Fetcher
 	imgSvc      *imgcache.Service
 	imgCache    *imgcache.Cache
 	sessMgr     *session.Manager
 	encGen      *encurl.Generator
 	csrfProtect func(http.Handler) http.Handler
-
-	// refererBlocklist matches the hosts of referer_blocklist; its IsAllowed
-	// reports whether a URL's host is on that list.
-	refererBlocklist *allowlist.HostAllowList
 }
 
 // New creates a new Handlers instance.
@@ -61,26 +50,31 @@ func New(lc fx.Lifecycle, params Params) (*Handlers, error) {
 	}
 
 	s := &Handlers{
-		log:              params.Logger.Get(),
+		log:         params.Logger.Get(),
-		hc:               params.Healthcheck,
+		hc:          params.Healthcheck,
-		db:               params.Database,
+		db:          params.Database,
-		config:           params.Config,
+		config:      params.Config,
-		fetcher:          params.Fetcher,
+		csrfProtect: csrfProtect,
-		csrfProtect:      csrfProtect,
-		refererBlocklist: allowlist.New(params.Config.RefererBlocklist),
 	}
 
 	lc.Append(fx.Hook{
-		//nolint:contextcheck // the eviction loop outlives OnStart; OnStop cancels it
+		// The eviction goroutine must outlive OnStart, so it cannot
+		// inherit this hook's context. It makes its own instead, which
+		// leaves it uncancellable: an in-flight pass runs to completion
+		// during OnStop regardless of the shutdown deadline. Making the
+		// loop cancellable changes shutdown semantics and is tracked
+		// separately in issue #102, rather than being folded into the
+		// lint-conformance change that surfaced it.
+		//nolint:contextcheck // see issue #102
 		OnStart: func(_ context.Context) error {
 			return s.initImageService()
 		},
-		OnStop: func(ctx context.Context) error {
+		OnStop: func(_ context.Context) error {
-			if s.imgCache == nil {
+			if s.imgCache != nil {
-				return nil
+				s.imgCache.StopEviction()
 			}
 
-			return s.imgCache.StopEviction(ctx)
+			return nil
 		},
 	})
 
@@ -93,25 +87,18 @@ func (s *Handlers) WaitForProcessing(ctx context.Context) int {
 	return s.imgSvc.WaitForProcessing(ctx)
 }
 
-// newCacheConfig builds the image cache's configuration from cfg.
-// cache_max_bytes: 0 disables the disk cache entirely; any other value
-// is the eviction limit in bytes; when it is omitted, the cache works
-// out the default limit itself.
-func newCacheConfig(cfg *config.Config, log *slog.Logger) imgcache.CacheConfig {
-	return imgcache.CacheConfig{
-		StateDir:           cfg.StateDir,
-		CacheTTL:           imgcache.DefaultCacheTTL,
-		NegativeTTL:        imgcache.DefaultNegativeTTL,
-		MaxBytes:           cfg.CacheMaxBytes,
-		UseDefaultMaxBytes: !cfg.CacheMaxBytesExplicit,
-		DisableDiskCache:   cfg.CacheMaxBytesExplicit && cfg.CacheMaxBytes == 0,
-		Logger:             log,
-	}
-}
-
 // initImageService initializes the image cache and service.
 func (s *Handlers) initImageService() error {
-	cache, err := imgcache.NewCache(s.db.DB(), newCacheConfig(s.config, s.log))
+	// Create the cache. cache_max_bytes: 0 disables the disk cache
+	// entirely; any other value is the eviction limit in bytes.
+	cache, err := imgcache.NewCache(s.db.DB(), imgcache.CacheConfig{
+		StateDir:         s.config.StateDir,
+		CacheTTL:         imgcache.DefaultCacheTTL,
+		NegativeTTL:      imgcache.DefaultNegativeTTL,
+		MaxBytes:         s.config.CacheMaxBytes,
+		DisableDiskCache: s.config.CacheMaxBytes == 0,
+		Logger:           s.log,
+	})
 	if err != nil {
 		return err
 	}
@@ -135,12 +122,10 @@ func (s *Handlers) initImageService() error {
 	fetcherCfg.MaxConnections = s.config.UpstreamConnections
 	fetcherCfg.BlockedNetworks = s.config.BlockedNetworks
 
-	// Create the service. With no fetcher provided, it builds its own from
+	// Create the service
-	// fetcherCfg.
 	svc, err := imgcache.NewService(&imgcache.ServiceConfig{
 		Cache:                   cache,
 		FetcherConfig:           fetcherCfg,
-		Fetcher:                 s.fetcher,
 		SigningKey:              s.config.SigningKey,
 		Allowlist:               s.config.AllowlistHosts,
 		MaxConcurrentProcessing: s.config.MaxConcurrentProcessing,

internal/handlers/image.go

@@ -10,7 +10,6 @@ import (
 	"time"
 
 	"github.com/go-chi/chi/v5"
-	"github.com/go-chi/chi/v5/middleware"
 	"sneak.berlin/go/pixa/internal/encurl"
 	"sneak.berlin/go/pixa/internal/httpfetcher"
 	"sneak.berlin/go/pixa/internal/imageprocessor"
@@ -21,10 +20,6 @@ import (
 // /v1/image/<host>/<path>/<width>x<height>.<format>
 func (s *Handlers) HandleImage() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		if s.refuseBlockedReferer(w, r) {
-			return
-		}
-
 		req, ok := s.parseImageRequest(w, r)
 		if !ok {
 			return
@@ -252,42 +247,6 @@ func cacheControl(expires time.Time) string {
 	return fmt.Sprintf("public, max-age=%d, immutable", int64(maxAge/time.Second))
 }
 
-// refuseBlockedReferer answers 403 with a JSON error when the request's Referer
-// names a host on referer_blocklist, and reports whether it answered. A request
-// with no Referer, or one that does not parse as a URL with a host, is not
-// refused.
-func (s *Handlers) refuseBlockedReferer(
-	w http.ResponseWriter, r *http.Request,
-) bool {
-	referer, err := url.Parse(r.Referer())
-	if err != nil || !s.refererBlocklist.IsAllowed(referer) {
-		return false
-	}
-
-	s.respondError(w, "referer blocked", http.StatusForbidden)
-
-	return true
-}
-
-// notModified sets the ETag header to etag and, when the request's
-// If-None-Match is that ETag, answers 304 Not Modified. It reports whether it
-// answered. An empty etag sets no header and never answers.
-func notModified(w http.ResponseWriter, r *http.Request, etag string) bool {
-	if etag == "" {
-		return false
-	}
-
-	w.Header().Set("ETag", etag)
-
-	if r.Header.Get("If-None-Match") != etag {
-		return false
-	}
-
-	w.WriteHeader(http.StatusNotModified)
-
-	return true
-}
-
 // writeImageResponse writes headers and streams the image content,
 // handling conditional and HEAD requests.
 func (s *Handlers) writeImageResponse(
@@ -306,8 +265,17 @@ func (s *Handlers) writeImageResponse(
 	w.Header().Set("Cache-Control", cacheControl(req.Expires))
 	w.Header().Set("X-Pixa-Cache", string(resp.CacheStatus))
 
-	if notModified(w, r, resp.ETag) {
+	if resp.ETag != "" {
-		return
+		w.Header().Set("ETag", resp.ETag)
+
+		// Check for conditional request (If-None-Match)
+		if ifNoneMatch := r.Header.Get("If-None-Match"); ifNoneMatch != "" {
+			if ifNoneMatch == resp.ETag {
+				w.WriteHeader(http.StatusNotModified)
+
+				return
+			}
+		}
 	}
 
 	// Handle HEAD request - return headers only
@@ -330,7 +298,6 @@ func (s *Handlers) writeImageResponse(
 	// Log cache status and timing after serving
 	duration := time.Since(startTime)
 	s.log.Info("image served",
-		"request_id", middleware.GetReqID(r.Context()),
 		"cache_key", cacheKey,
 		"cache_status", resp.CacheStatus,
 		"duration_ms", duration.Milliseconds(),

internal/handlers/image_cache_control_internal_test.go

@@ -23,10 +23,8 @@ const photoPath = "/images/photo.jpg"
 // newSignedHostServer returns a router for both image routes, and the Handlers
 // behind it, whose fetcher serves a JPEG at photoPath on signedHost. signedHost
 // is not on the allowlist, so a /v1/image/ URL for it is served only with a
-// valid signature. The handlers and the image service log to log.
+// valid signature.
-func newSignedHostServer(
+func newSignedHostServer(t *testing.T) (*Handlers, http.Handler) {
-	t *testing.T, log *slog.Logger,
-) (*Handlers, http.Handler) {
 	t.Helper()
 
 	cache, err := imgcache.NewCache(setupTestDB(t), imgcache.CacheConfig{
@@ -46,7 +44,6 @@ func newSignedHostServer(
 			signedHost + photoPath: &fstest.MapFile{Data: jpegData},
 		}),
 		SigningKey: testSigningKey,
-		Logger:     log,
 	})
 	if err != nil {
 		t.Fatalf("imgcache.NewService() error = %v", err)
@@ -58,7 +55,7 @@ func newSignedHostServer(
 	}
 
 	h := &Handlers{
-		log:    log,
+		log:    slog.New(slog.DiscardHandler),
 		imgSvc: svc,
 		encGen: encGen,
 	}
@@ -106,7 +103,7 @@ func getMaxAge(t *testing.T, srv http.Handler, target string) int {
 func TestHandleImage_SignedURL_MaxAgeEndsAtExp(t *testing.T) {
 	t.Parallel()
 
-	h, srv := newSignedHostServer(t, slog.New(slog.DiscardHandler))
+	h, srv := newSignedHostServer(t)
 
 	signedURL, err := h.imgSvc.GenerateSignedURL("", &imgcache.ImageRequest{
 		SourceHost: signedHost,
@@ -182,7 +179,7 @@ func TestHandleImageEnc_MaxAge(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
-			h, srv := newSignedHostServer(t, slog.New(slog.DiscardHandler))
+			h, srv := newSignedHostServer(t)
 
 			token, err := h.encGen.Generate(&encurl.Payload{
 				SourceHost: signedHost,

internal/handlers/image_errors_internal_test.go

@@ -1,267 +0,0 @@
-package handlers
-
-import (
-	"encoding/json"
-	"fmt"
-	"image/color"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-	"testing/fstest"
-	"time"
-
-	"github.com/go-chi/chi/v5"
-	"sneak.berlin/go/pixa/internal/httpfetcher"
-	"sneak.berlin/go/pixa/internal/imgcache"
-	"sneak.berlin/go/pixa/internal/signature"
-)
-
-// allowlistedHost is the only host on the allowlist of the image route
-// newImageRoute builds.
-const allowlistedHost = "allowed.example.com"
-
-// newImageRoute returns the image route of a Handlers whose service fetches
-// with fetcher and checks signatures with testSigningKey.
-func newImageRoute(t *testing.T, fetcher httpfetcher.Fetcher) http.Handler {
-	t.Helper()
-
-	cache, err := imgcache.NewCache(setupTestDB(t), imgcache.CacheConfig{
-		StateDir:    t.TempDir(),
-		CacheTTL:    time.Hour,
-		NegativeTTL: 5 * time.Minute,
-	})
-	if err != nil {
-		t.Fatalf("failed to create cache: %v", err)
-	}
-
-	svc, err := imgcache.NewService(&imgcache.ServiceConfig{
-		Cache:      cache,
-		Fetcher:    fetcher,
-		SigningKey: testSigningKey,
-		Allowlist:  []string{allowlistedHost},
-	})
-	if err != nil {
-		t.Fatalf("failed to create service: %v", err)
-	}
-
-	h := &Handlers{imgSvc: svc, log: slog.New(slog.DiscardHandler)}
-
-	r := chi.NewRouter()
-	r.Get("/v1/image/*", h.HandleImage())
-
-	return r
-}
-
-// newPhotoFetcher returns a mock fetcher that serves a JPEG at photoPath on
-// each of hosts, and answers any other URL with an upstream error.
-func newPhotoFetcher(t *testing.T, hosts ...string) *httpfetcher.MockFetcher {
-	t.Helper()
-
-	photo := &fstest.MapFile{
-		Data: generateTestJPEG(t, 100, 100, color.RGBA{255, 0, 0, 255}),
-	}
-
-	files := fstest.MapFS{}
-	for _, host := range hosts {
-		files[host+photoPath] = photo
-	}
-
-	return httpfetcher.NewMock(files)
-}
-
-// photoURL returns the image route URL of photoPath on host, as a 50x50 JPEG.
-func photoURL(host string) string {
-	return "/v1/image/" + host + photoPath + "/50x50.jpeg"
-}
-
-// photoURLWithSig returns photoURL(host) with sig and expires as its sig and
-// exp.
-func photoURLWithSig(host, sig string, expires time.Time) string {
-	return fmt.Sprintf("%s?sig=%s&exp=%d", photoURL(host), sig, expires.Unix())
-}
-
-// photoSignature returns the signature of photoURL(host) at the default
-// quality and fit, made with key and expiring at expires.
-func photoSignature(key, host string, expires time.Time) string {
-	return signature.New(key).Sign(&signature.Request{
-		SourceHost: host,
-		SourcePath: photoPath,
-		Width:      50,
-		Height:     50,
-		Format:     string(imgcache.FormatJPEG),
-		Quality:    85,
-		FitMode:    string(imgcache.FitCover),
-		Expires:    expires,
-	})
-}
-
-// sendGet sends a GET for target to route and returns the response.
-func sendGet(
-	t *testing.T, route http.Handler, target string,
-) *httptest.ResponseRecorder {
-	t.Helper()
-
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, target, nil)
-	rec := httptest.NewRecorder()
-
-	route.ServeHTTP(rec, req)
-	t.Logf("GET %s: %d", target, rec.Code)
-
-	return rec
-}
-
-// checkErrorBody checks that rec has status wantStatus and the JSON error body
-// the image route sends: wantError, wantStatus and the time in RFC 3339.
-func checkErrorBody(
-	t *testing.T, rec *httptest.ResponseRecorder, wantStatus int, wantError string,
-) {
-	t.Helper()
-
-	if rec.Code != wantStatus {
-		t.Errorf("status = %d, want %d", rec.Code, wantStatus)
-	}
-
-	if ct := rec.Header().Get("Content-Type"); ct != "application/json" {
-		t.Errorf("Content-Type = %q, want application/json", ct)
-	}
-
-	var body struct {
-		Error     string `json:"error"`
-		Status    int    `json:"status"`
-		Timestamp string `json:"timestamp"`
-	}
-
-	err := json.NewDecoder(rec.Body).Decode(&body)
-	if err != nil {
-		t.Fatalf("decoding response body: %v", err)
-	}
-
-	if body.Error != wantError || body.Status != wantStatus {
-		t.Errorf("body error and status = %q %d, want %q %d",
-			body.Error, body.Status, wantError, wantStatus)
-	}
-
-	_, err = time.Parse(time.RFC3339, body.Timestamp)
-	if err != nil {
-		t.Errorf("body timestamp: %v", err)
-	}
-}
-
-// TestHandleImage_ErrorAnswers checks the status and the JSON error body the
-// image route answers each request below with. The JPEG at photoPath exists on
-// signedHost and on each host below that differs from it, so a request refused
-// with 401 would otherwise be served.
-func TestHandleImage_ErrorAnswers(t *testing.T) {
-	t.Parallel()
-
-	// A signature for signedHost must not verify for any of these.
-	parentHost := "example.com"
-	siblingHost := "other.example.com"
-	subdomainHost := "img." + signedHost
-	appendedHost := signedHost + ".example.net"
-
-	photos := newPhotoFetcher(t,
-		signedHost, parentHost, siblingHost, subdomainHost, appendedHost)
-	// The real fetcher refuses localhost before any lookup or connection.
-	realFetcher := httpfetcher.New(httpfetcher.DefaultConfig())
-
-	exp := time.Now().Add(time.Hour)
-	expired := time.Now().Add(-time.Hour)
-	sig := photoSignature(testSigningKey, signedHost, exp)
-	otherKeySig := photoSignature("another-signing-key", signedHost, exp)
-	expiredSig := photoSignature(testSigningKey, signedHost, expired)
-	localhostSig := photoSignature(testSigningKey, "localhost", exp)
-
-	// The error every request refused for its signature gets.
-	const unauthorized = "unauthorized"
-
-	tests := []struct {
-		name       string
-		fetcher    httpfetcher.Fetcher
-		target     string
-		wantStatus int
-		wantError  string
-	}{
-		{"no sig or exp", photos, photoURL(signedHost),
-			http.StatusUnauthorized, unauthorized},
-		{"exp but no sig", photos,
-			fmt.Sprintf("%s?exp=%d", photoURL(signedHost), exp.Unix()),
-			http.StatusUnauthorized, unauthorized},
-		{"sig made with another key", photos,
-			photoURLWithSig(signedHost, otherKeySig, exp),
-			http.StatusUnauthorized, unauthorized},
-		{"sig without its = padding", photos,
-			photoURLWithSig(signedHost, strings.TrimRight(sig, "="), exp),
-			http.StatusUnauthorized, unauthorized},
-		{"sig in upper case", photos,
-			photoURLWithSig(signedHost, strings.ToUpper(sig), exp),
-			http.StatusUnauthorized, unauthorized},
-		{"expired sig", photos, photoURLWithSig(signedHost, expiredSig, expired),
-			http.StatusUnauthorized, unauthorized},
-		{"sig sent for the parent domain", photos,
-			photoURLWithSig(parentHost, sig, exp),
-			http.StatusUnauthorized, unauthorized},
-		{"sig sent for a sibling host", photos,
-			photoURLWithSig(siblingHost, sig, exp),
-			http.StatusUnauthorized, unauthorized},
-		{"sig sent for a subdomain", photos,
-			photoURLWithSig(subdomainHost, sig, exp),
-			http.StatusUnauthorized, unauthorized},
-		{"sig sent with another domain appended", photos,
-			photoURLWithSig(appendedHost, sig, exp),
-			http.StatusUnauthorized, unauthorized},
-		{"unparseable path", photos,
-			"/v1/image/" + allowlistedHost + photoPath + "/big.jpeg",
-			http.StatusBadRequest, "invalid image URL: invalid size format"},
-		{"blocked upstream address", realFetcher,
-			photoURLWithSig("localhost", localhostSig, exp),
-			http.StatusForbidden, "forbidden"},
-		{"upstream error", photos,
-			"/v1/image/" + allowlistedHost + "/images/missing.jpg/50x50.jpeg",
-			http.StatusBadGateway, "upstream error"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			rec := sendGet(t, newImageRoute(t, tt.fetcher), tt.target)
-			checkErrorBody(t, rec, tt.wantStatus, tt.wantError)
-		})
-	}
-}
-
-// TestHandleImage_AllowlistOrSignature checks that the image route serves an
-// image without a signature for a host on the allowlist only, and for another
-// host only with a valid signature.
-func TestHandleImage_AllowlistOrSignature(t *testing.T) {
-	t.Parallel()
-
-	photos := newPhotoFetcher(t, allowlistedHost, signedHost)
-	exp := time.Now().Add(time.Hour)
-	sig := photoSignature(testSigningKey, signedHost, exp)
-
-	tests := []struct {
-		name       string
-		target     string
-		wantStatus int
-	}{
-		{"allowlisted host, no sig", photoURL(allowlistedHost), http.StatusOK},
-		{"other host, no sig", photoURL(signedHost), http.StatusUnauthorized},
-		{"other host, valid sig", photoURLWithSig(signedHost, sig, exp),
-			http.StatusOK},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			rec := sendGet(t, newImageRoute(t, photos), tt.target)
-			if rec.Code != tt.wantStatus {
-				t.Errorf("status = %d, want %d", rec.Code, tt.wantStatus)
-			}
-		})
-	}
-}

internal/handlers/imageenc.go

@@ -9,7 +9,6 @@ import (
 	"time"
 
 	"github.com/go-chi/chi/v5"
-	"github.com/go-chi/chi/v5/middleware"
 
 	"sneak.berlin/go/pixa/internal/encurl"
 	"sneak.berlin/go/pixa/internal/httpfetcher"
@@ -22,15 +21,46 @@ import (
 // browsers identify the content type.
 func (s *Handlers) HandleImageEnc() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		if s.refuseBlockedReferer(w, r) {
-			return
-		}
-
 		ctx := r.Context()
 		start := time.Now()
 
-		req, ok := s.parseImageEncRequest(w, r)
+		// Extract token from URL
-		if !ok {
+		token := chi.URLParam(r, "token")
+		if token == "" {
+			s.respondError(w, "missing token", http.StatusBadRequest)
+
+			return
+		}
+
+		// Decrypt and validate the payload
+		payload, err := s.encGen.Parse(token)
+		if err != nil {
+			if errors.Is(err, encurl.ErrExpired) {
+				s.log.Debug("encrypted URL expired", "error", err)
+				s.respondError(w, "URL has expired", http.StatusGone)
+
+				return
+			}
+
+			s.log.Debug("failed to decrypt URL", "error", err)
+			s.respondError(w, "invalid encrypted URL", http.StatusBadRequest)
+
+			return
+		}
+
+		// Convert payload to ImageRequest
+		req := payload.ToImageRequest()
+
+		// Apply the same dimension and fit-mode bounds as the plain image
+		// route: a sealed payload is trusted for its origin, not for staying
+		// within limits, so an over-limit size or unknown fit mode is a 400
+		// here rather than an out-of-memory or a 500 from the processor.
+		err = imgcache.ValidateImageRequest(req)
+		if err != nil {
+			s.log.Debug("encrypted URL failed validation", "error", err)
+			s.respondError(w, "invalid encrypted URL: "+err.Error(),
+				http.StatusBadRequest)
+
 			return
 		}
 
@@ -64,17 +94,6 @@ func (s *Handlers) HandleImageEnc() http.HandlerFunc {
 		w.Header().Set("Cache-Control", cacheControl(req.Expires))
 		w.Header().Set("X-Pixa-Cache", string(resp.CacheStatus))
 
-		if notModified(w, r, resp.ETag) {
-			return
-		}
-
-		// A HEAD request gets the headers only
-		if r.Method == http.MethodHead {
-			w.WriteHeader(http.StatusOK)
-
-			return
-		}
-
 		// Stream the response
 		written, err := io.Copy(w, resp.Content)
 		if err != nil {
@@ -86,7 +105,6 @@ func (s *Handlers) HandleImageEnc() http.HandlerFunc {
 		// Log completion
 		duration := time.Since(start)
 		s.log.Info("image served",
-			"request_id", middleware.GetReqID(ctx),
 			"cache_key", imgcache.CacheKey(req),
 			"host", req.SourceHost,
 			"path", req.SourcePath,
@@ -98,56 +116,6 @@ func (s *Handlers) HandleImageEnc() http.HandlerFunc {
 	}
 }
 
-// parseImageEncRequest decrypts the token of an encrypted image URL into an
-// ImageRequest and checks it. On a token that is missing, does not decrypt,
-// has expired or asks for something not valid, it writes an error response
-// and returns false.
-func (s *Handlers) parseImageEncRequest(
-	w http.ResponseWriter, r *http.Request,
-) (*imgcache.ImageRequest, bool) {
-	// Extract token from URL
-	token := chi.URLParam(r, "token")
-	if token == "" {
-		s.respondError(w, "missing token", http.StatusBadRequest)
-
-		return nil, false
-	}
-
-	// Decrypt and validate the payload
-	payload, err := s.encGen.Parse(token)
-	if err != nil {
-		if errors.Is(err, encurl.ErrExpired) {
-			s.log.Debug("encrypted URL expired", "error", err)
-			s.respondError(w, "URL has expired", http.StatusGone)
-
-			return nil, false
-		}
-
-		s.log.Debug("failed to decrypt URL", "error", err)
-		s.respondError(w, "invalid encrypted URL", http.StatusBadRequest)
-
-		return nil, false
-	}
-
-	// Convert payload to ImageRequest
-	req := payload.ToImageRequest()
-
-	// Apply the same dimension and fit-mode bounds as the plain image
-	// route: a sealed payload is trusted for its origin, not for staying
-	// within limits, so an over-limit size or unknown fit mode is a 400
-	// here rather than an out-of-memory or a 500 from the processor.
-	err = imgcache.ValidateImageRequest(req)
-	if err != nil {
-		s.log.Debug("encrypted URL failed validation", "error", err)
-		s.respondError(w, "invalid encrypted URL: "+err.Error(),
-			http.StatusBadRequest)
-
-		return nil, false
-	}
-
-	return req, true
-}
-
 // handleImageError converts image service errors to HTTP responses.
 func (s *Handlers) handleImageError(w http.ResponseWriter, err error) {
 	switch {

internal/handlers/imageenc_internal_test.go

@@ -96,70 +96,3 @@ func TestHandleImageEnc_InvalidFitMode_Returns400(t *testing.T) {
 		t.Fatalf("status = %d, want %d", rec.Code, http.StatusBadRequest)
 	}
 }
-
-// TestHandleImageEnc_IfNoneMatch_Returns304 verifies that an image served
-// through an encrypted URL carries an ETag, and that a request whose
-// If-None-Match is that ETag is answered 304 Not Modified with no body.
-func TestHandleImageEnc_IfNoneMatch_Returns304(t *testing.T) {
-	t.Parallel()
-
-	h, srv := newSignedHostServer(t, slog.New(slog.DiscardHandler))
-	target := encPhotoURL(t, h)
-
-	rec := httptest.NewRecorder()
-	srv.ServeHTTP(rec, httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, target, nil))
-
-	etag := rec.Header().Get("ETag")
-	t.Logf("GET: %d, ETag %q", rec.Code, etag)
-
-	if rec.Code != http.StatusOK || etag == "" {
-		t.Fatalf("GET: status = %d, ETag = %q, want %d and an ETag",
-			rec.Code, etag, http.StatusOK)
-	}
-
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, target, nil)
-	req.Header.Set("If-None-Match", etag)
-
-	rec = httptest.NewRecorder()
-	srv.ServeHTTP(rec, req)
-	t.Logf("GET with If-None-Match: %d, %d body bytes", rec.Code, rec.Body.Len())
-
-	if rec.Code != http.StatusNotModified || rec.Body.Len() != 0 {
-		t.Errorf("status = %d with %d body bytes, want %d with none",
-			rec.Code, rec.Body.Len(), http.StatusNotModified)
-	}
-}
-
-// TestHandleImageEnc_HEAD_ReturnsHeadersOnly verifies that HEAD on an
-// encrypted URL is answered 200 with the headers GET sends and no body.
-func TestHandleImageEnc_HEAD_ReturnsHeadersOnly(t *testing.T) {
-	t.Parallel()
-
-	h, _ := newSignedHostServer(t, slog.New(slog.DiscardHandler))
-
-	r := chi.NewRouter()
-	r.Head("/v1/e/{token}/*", h.HandleImageEnc())
-
-	rec := httptest.NewRecorder()
-	r.ServeHTTP(rec, httptest.NewRequestWithContext(
-		t.Context(), http.MethodHead, encPhotoURL(t, h), nil))
-	t.Logf("HEAD: %d, headers %v, %d body bytes",
-		rec.Code, rec.Header(), rec.Body.Len())
-
-	if rec.Code != http.StatusOK {
-		t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK)
-	}
-
-	for _, name := range []string{
-		"Content-Type", "Content-Length", "Cache-Control", "ETag",
-	} {
-		if rec.Header().Get(name) == "" {
-			t.Errorf("HEAD response has no %s", name)
-		}
-	}
-
-	if rec.Body.Len() != 0 {
-		t.Errorf("HEAD response body has %d bytes, want none", rec.Body.Len())
-	}
-}

internal/handlers/imageenc_token_internal_test.go

@@ -1,126 +0,0 @@
-package handlers
-
-import (
-	"image/jpeg"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-	"time"
-
-	"sneak.berlin/go/pixa/internal/encurl"
-)
-
-// requireServedPhoto requires that rec answers 200 with the JPEG at photoPath
-// on signedHost at the 50x50 that encPhotoURL and the generator tests ask for.
-func requireServedPhoto(t *testing.T, rec *httptest.ResponseRecorder) {
-	t.Helper()
-
-	if rec.Code != http.StatusOK {
-		t.Fatalf("status = %d, want %d; body %q",
-			rec.Code, http.StatusOK, rec.Body.String())
-	}
-
-	contentType := rec.Header().Get("Content-Type")
-	if contentType != "image/jpeg" {
-		t.Errorf("Content-Type = %q, want image/jpeg", contentType)
-	}
-
-	img, err := jpeg.DecodeConfig(rec.Body)
-	if err != nil {
-		t.Fatalf("body is not a JPEG: %v", err)
-	}
-
-	if img.Width != 50 || img.Height != 50 {
-		t.Errorf("image is %dx%d, want 50x50", img.Width, img.Height)
-	}
-}
-
-// TestHandleImageEnc_ValidToken_ServesImage verifies that a token made with
-// the signing key serves the image it asks for.
-func TestHandleImageEnc_ValidToken_ServesImage(t *testing.T) {
-	t.Parallel()
-
-	h, srv := newSignedHostServer(t, slog.New(slog.DiscardHandler))
-
-	rec := httptest.NewRecorder()
-	srv.ServeHTTP(rec, httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, encPhotoURL(t, h), nil))
-
-	requireServedPhoto(t, rec)
-}
-
-// TestHandleImageEnc_RejectedToken verifies that a token that has expired
-// answers 410, and that a token with one character changed, a token cut
-// short, and a token made with another signing key answer 400. The server
-// would serve the photo for a token it accepted.
-func TestHandleImageEnc_RejectedToken(t *testing.T) {
-	t.Parallel()
-
-	h, srv := newSignedHostServer(t, slog.New(slog.DiscardHandler))
-
-	photo := encurl.Payload{
-		SourceHost: signedHost,
-		SourcePath: photoPath,
-		Width:      50,
-		Height:     50,
-	}
-
-	valid, err := h.encGen.Generate(&photo)
-	if err != nil {
-		t.Fatalf("Generate() error = %v", err)
-	}
-
-	expiredPhoto := photo
-	expiredPhoto.ExpiresAt = time.Now().Add(-time.Minute).Unix()
-
-	expired, err := h.encGen.Generate(&expiredPhoto)
-	if err != nil {
-		t.Fatalf("Generate() error = %v", err)
-	}
-
-	otherGen, err := encurl.NewGenerator("another-signing-key-fedcba9876543210")
-	if err != nil {
-		t.Fatalf("encurl.NewGenerator() error = %v", err)
-	}
-
-	otherKey, err := otherGen.Generate(&photo)
-	if err != nil {
-		t.Fatalf("Generate() error = %v", err)
-	}
-
-	// Changing a character in the middle always changes the decoded bytes;
-	// the last character of unpadded base64 can carry unused bits.
-	middle := len(valid) / 2
-
-	replacement := "A"
-	if valid[middle] == 'A' {
-		replacement = "B"
-	}
-
-	changed := valid[:middle] + replacement + valid[middle+1:]
-
-	tests := []struct {
-		name       string
-		token      string
-		wantStatus int
-	}{
-		{"expired", expired, http.StatusGone},
-		{"one character changed", changed, http.StatusBadRequest},
-		{"cut short", valid[:middle], http.StatusBadRequest},
-		{"another signing key", otherKey, http.StatusBadRequest},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			rec := getEncToken(srv, tt.token)
-			t.Logf("GET /v1/e/%s/img.jpg: %d %s", tt.token, rec.Code, rec.Body)
-
-			if rec.Code != tt.wantStatus {
-				t.Errorf("status = %d, want %d", rec.Code, tt.wantStatus)
-			}
-		})
-	}
-}

internal/handlers/referer_blocklist_internal_test.go

@@ -1,185 +0,0 @@
-package handlers
-
-import (
-	"context"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/go-chi/chi/v5"
-	"sneak.berlin/go/pixa/internal/allowlist"
-	"sneak.berlin/go/pixa/internal/encurl"
-	"sneak.berlin/go/pixa/internal/httpfetcher"
-	"sneak.berlin/go/pixa/internal/imgcache"
-)
-
-// blockedReferer is a page on leech.example, which newRefererRoutes puts on
-// referer_blocklist.
-const blockedReferer = "https://leech.example/page.html"
-
-// countingFetcher passes each fetch on to the fetcher it holds and counts it.
-type countingFetcher struct {
-	httpfetcher.Fetcher
-
-	fetches atomic.Int32
-}
-
-// Fetch counts the fetch and passes it on.
-func (f *countingFetcher) Fetch(
-	ctx context.Context, url string,
-) (*httpfetcher.FetchResult, error) {
-	f.fetches.Add(1)
-
-	return f.Fetcher.Fetch(ctx, url)
-}
-
-// newRefererRoutes returns both image routes of a Handlers whose
-// referer_blocklist is "leech.example" and ".hotlinker.example", the
-// Handlers, and the fetcher the routes fetch through. The JPEG at photoPath
-// exists on allowlistedHost and on signedHost.
-func newRefererRoutes(t *testing.T) (http.Handler, *Handlers, *countingFetcher) {
-	t.Helper()
-
-	fetcher := &countingFetcher{
-		Fetcher: newPhotoFetcher(t, allowlistedHost, signedHost),
-	}
-
-	cache, err := imgcache.NewCache(setupTestDB(t), imgcache.CacheConfig{
-		StateDir:    t.TempDir(),
-		CacheTTL:    time.Hour,
-		NegativeTTL: 5 * time.Minute,
-	})
-	if err != nil {
-		t.Fatalf("imgcache.NewCache() error = %v", err)
-	}
-
-	svc, err := imgcache.NewService(&imgcache.ServiceConfig{
-		Cache:      cache,
-		Fetcher:    fetcher,
-		SigningKey: testSigningKey,
-		Allowlist:  []string{allowlistedHost},
-	})
-	if err != nil {
-		t.Fatalf("imgcache.NewService() error = %v", err)
-	}
-
-	encGen, err := encurl.NewGenerator(testSigningKey)
-	if err != nil {
-		t.Fatalf("encurl.NewGenerator() error = %v", err)
-	}
-
-	h := &Handlers{
-		log:    slog.New(slog.DiscardHandler),
-		imgSvc: svc,
-		encGen: encGen,
-		refererBlocklist: allowlist.New(
-			[]string{"leech.example", ".hotlinker.example"}),
-	}
-
-	r := chi.NewRouter()
-	r.Get("/v1/image/*", h.HandleImage())
-	r.Get("/v1/e/{token}/*", h.HandleImageEnc())
-
-	return r, h, fetcher
-}
-
-// getWithReferer sends a GET for target to routes with referer as its
-// Referer header, or with none when referer is empty, and returns the
-// response.
-func getWithReferer(
-	t *testing.T, routes http.Handler, target, referer string,
-) *httptest.ResponseRecorder {
-	t.Helper()
-
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, target, nil)
-	if referer != "" {
-		req.Header.Set("Referer", referer)
-	}
-
-	rec := httptest.NewRecorder()
-
-	routes.ServeHTTP(rec, req)
-	t.Logf("GET %s with Referer %q: %d", target, referer, rec.Code)
-
-	return rec
-}
-
-// TestRefererBlocklist verifies that both image routes refuse a request whose
-// Referer names a host on referer_blocklist with 403 and the JSON error,
-// without fetching from the upstream host, and serve a request with no
-// Referer, one that does not parse, or one naming any other host. Hosts are
-// matched as allowlist_hosts matches them.
-func TestRefererBlocklist(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		name    string
-		referer string
-		want    int
-	}{
-		{"no referer", "", http.StatusOK},
-		{"unlisted host", "https://unlisted.example/page.html", http.StatusOK},
-		{"unparseable", "%zz", http.StatusOK},
-		{"listed host", blockedReferer, http.StatusForbidden},
-		{"subdomain of listed host", "https://www.leech.example/", http.StatusOK},
-		{"subdomain of dot pattern", "https://www.hotlinker.example/a.html",
-			http.StatusForbidden},
-		{"dot pattern without its dot", "https://hotlinker.example/",
-			http.StatusForbidden},
-		{"host continuing past dot pattern",
-			"https://hotlinker.example.evil.example/", http.StatusOK},
-	}
-
-	// The photo's URL on each image route.
-	photoURLs := map[string]func(t *testing.T, h *Handlers) string{
-		"plain URL": func(t *testing.T, _ *Handlers) string {
-			t.Helper()
-
-			return photoURL(allowlistedHost)
-		},
-		"encrypted URL": encPhotoURL,
-	}
-
-	for urlName, photoURLFor := range photoURLs {
-		for _, tc := range cases {
-			t.Run(urlName+", "+tc.name, func(t *testing.T) {
-				t.Parallel()
-
-				routes, h, fetcher := newRefererRoutes(t)
-
-				rec := getWithReferer(t, routes, photoURLFor(t, h), tc.referer)
-
-				if tc.want == http.StatusOK {
-					requireServedPhoto(t, rec)
-
-					return
-				}
-
-				checkErrorBody(t, rec, http.StatusForbidden, "referer blocked")
-
-				if n := fetcher.fetches.Load(); n != 0 {
-					t.Errorf("upstream fetched %d times, want 0", n)
-				}
-			})
-		}
-	}
-}
-
-// TestBlockedRefererRefusedWhenImageIsCached verifies that a request whose
-// Referer is on referer_blocklist is refused even when the image it asks for
-// is already cached, so the answer does not depend on the cache.
-func TestBlockedRefererRefusedWhenImageIsCached(t *testing.T) {
-	t.Parallel()
-
-	routes, h, _ := newRefererRoutes(t)
-
-	for _, target := range []string{photoURL(allowlistedHost), encPhotoURL(t, h)} {
-		requireServedPhoto(t, getWithReferer(t, routes, target, ""))
-
-		rec := getWithReferer(t, routes, target, blockedReferer)
-		checkErrorBody(t, rec, http.StatusForbidden, "referer blocked")
-	}
-}

internal/handlers/request_id_internal_test.go

@@ -1,131 +0,0 @@
-package handlers
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"io"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-	"time"
-
-	"github.com/go-chi/chi/v5/middleware"
-
-	"sneak.berlin/go/pixa/internal/encurl"
-	"sneak.berlin/go/pixa/internal/imgcache"
-)
-
-// signedPhotoURL returns a signed /v1/image/ URL, valid for a minute, for the
-// JPEG at photoPath on signedHost at 50x50, made with h's image service.
-func signedPhotoURL(t *testing.T, h *Handlers) string {
-	t.Helper()
-
-	signedURL, err := h.imgSvc.GenerateSignedURL("", &imgcache.ImageRequest{
-		SourceHost: signedHost,
-		SourcePath: photoPath,
-		Size:       imgcache.Size{Width: 50, Height: 50},
-		Format:     imgcache.FormatJPEG,
-	}, time.Minute)
-	if err != nil {
-		t.Fatalf("GenerateSignedURL() error = %v", err)
-	}
-
-	return signedURL
-}
-
-// encPhotoURL returns an encrypted /v1/e/ URL, which never expires, for the
-// JPEG at photoPath on signedHost at 50x50, made with h's generator.
-func encPhotoURL(t *testing.T, h *Handlers) string {
-	t.Helper()
-
-	token, err := h.encGen.Generate(&encurl.Payload{
-		SourceHost: signedHost,
-		SourcePath: photoPath,
-		Width:      50,
-		Height:     50,
-		Format:     imgcache.FormatJPEG,
-	})
-	if err != nil {
-		t.Fatalf("Generate() error = %v", err)
-	}
-
-	return "/v1/e/" + token + "/img.jpg"
-}
-
-// requestIDByMessage reads the JSON log lines in logs and returns the
-// request_id of each line, by its message.
-func requestIDByMessage(t *testing.T, logs io.Reader) map[string]string {
-	t.Helper()
-
-	logged := make(map[string]string)
-
-	dec := json.NewDecoder(logs)
-	for dec.More() {
-		var line map[string]any
-
-		err := dec.Decode(&line)
-		if err != nil {
-			t.Fatalf("decoding log line: %v", err)
-		}
-
-		msg, _ := line["msg"].(string)
-		requestID, _ := line["request_id"].(string)
-		logged[msg] = requestID
-	}
-
-	return logged
-}
-
-// TestImageLogLinesCarryRequestID verifies that the lines logged when an image
-// is fetched, converted and served through either image route carry the
-// request's ID as request_id, as the request log line does, so they can be
-// found from it.
-func TestImageLogLinesCarryRequestID(t *testing.T) {
-	t.Parallel()
-
-	const requestID = "test-request-id"
-
-	imageURLs := map[string]func(*testing.T, *Handlers) string{
-		"/v1/image/": signedPhotoURL,
-		"/v1/e/":     encPhotoURL,
-	}
-
-	for route, imageURL := range imageURLs {
-		t.Run(route, func(t *testing.T) {
-			t.Parallel()
-
-			var logs bytes.Buffer
-
-			h, srv := newSignedHostServer(t,
-				slog.New(slog.NewJSONHandler(&logs, nil)))
-
-			ctx := context.WithValue(t.Context(),
-				middleware.RequestIDKey, requestID)
-			rec := httptest.NewRecorder()
-			srv.ServeHTTP(rec, httptest.NewRequestWithContext(
-				ctx, http.MethodGet, imageURL(t, h), nil))
-
-			if rec.Code != http.StatusOK {
-				t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK)
-			}
-
-			t.Logf("logged:\n%s", logs.String())
-
-			logged := requestIDByMessage(t, &logs)
-
-			for _, msg := range []string{
-				"upstream fetched", "image converted", "image served",
-			} {
-				got, ok := logged[msg]
-				if !ok {
-					t.Errorf("no %q line logged", msg)
-				} else if got != requestID {
-					t.Errorf("%q line has request_id %q, want %q",
-						msg, got, requestID)
-				}
-			}
-		})
-	}
-}

internal/handlers/robots_healthcheck_internal_test.go

@@ -1,90 +0,0 @@
-package handlers
-
-import (
-	"encoding/json"
-	"log/slog"
-	"net/http"
-	"testing"
-
-	"go.uber.org/fx/fxtest"
-	"sneak.berlin/go/pixa/internal/config"
-	"sneak.berlin/go/pixa/internal/globals"
-	"sneak.berlin/go/pixa/internal/healthcheck"
-	"sneak.berlin/go/pixa/internal/logger"
-)
-
-// TestHandleRobotsTxt checks that /robots.txt asks every crawler to stay off
-// the whole site.
-func TestHandleRobotsTxt(t *testing.T) {
-	t.Parallel()
-
-	h := &Handlers{log: slog.New(slog.DiscardHandler)}
-	rec := sendGet(t, h.HandleRobotsTxt(), "/robots.txt")
-
-	if rec.Code != http.StatusOK {
-		t.Errorf("status = %d, want %d", rec.Code, http.StatusOK)
-	}
-
-	if ct := rec.Header().Get("Content-Type"); ct != "text/plain" {
-		t.Errorf("Content-Type = %q, want text/plain", ct)
-	}
-
-	want := "User-agent: *\nDisallow: /\n"
-	if rec.Body.String() != want {
-		t.Errorf("body = %q, want %q", rec.Body.String(), want)
-	}
-}
-
-// TestHandleHealthCheck checks that the health check answers 200 with status
-// ok, the app's name and version, now, uptime_seconds, uptime_human and
-// maintenance_mode, which is true here: the health check stays 200 while
-// maintenance mode is on.
-func TestHandleHealthCheck(t *testing.T) {
-	t.Parallel()
-
-	lc := fxtest.NewLifecycle(t)
-
-	log, err := logger.New(lc, logger.Params{Globals: &globals.Globals{}})
-	if err != nil {
-		t.Fatalf("logger.New() error = %v", err)
-	}
-
-	hc, err := healthcheck.New(lc, healthcheck.Params{
-		Globals: &globals.Globals{Appname: "pixad", Version: "v1.2.3"},
-		Config:  &config.Config{MaintenanceMode: true},
-		Logger:  log,
-	})
-	if err != nil {
-		t.Fatalf("healthcheck.New() error = %v", err)
-	}
-
-	h := &Handlers{hc: hc, log: slog.New(slog.DiscardHandler)}
-	rec := sendGet(t, h.HandleHealthCheck(), "/.well-known/healthcheck.json")
-
-	if rec.Code != http.StatusOK {
-		t.Errorf("status = %d, want %d", rec.Code, http.StatusOK)
-	}
-
-	if ct := rec.Header().Get("Content-Type"); ct != "application/json" {
-		t.Errorf("Content-Type = %q, want application/json", ct)
-	}
-
-	var body map[string]any
-
-	err = json.NewDecoder(rec.Body).Decode(&body)
-	if err != nil {
-		t.Fatalf("decoding response body: %v", err)
-	}
-
-	if body["status"] != "ok" || body["appname"] != "pixad" ||
-		body["version"] != "v1.2.3" || body["maintenance_mode"] != true {
-		t.Errorf("body = %v, want status ok, appname pixad, version v1.2.3 "+
-			"and maintenance_mode true", body)
-	}
-
-	for _, key := range []string{"now", "uptime_seconds", "uptime_human"} {
-		if _, ok := body[key]; !ok {
-			t.Errorf("body = %v, has no %s", body, key)
-		}
-	}
-}

internal/httpfetcher/dial_context_internal_test.go

@@ -1,66 +0,0 @@
-package httpfetcher
-
-import (
-	"errors"
-	"net"
-	"testing"
-)
-
-// TestNewUsesCheckedDialerWithoutDialContext checks that a fetcher built
-// without DialContext, as pixa builds it, refuses to connect to a local
-// server.
-func TestNewUsesCheckedDialerWithoutDialContext(t *testing.T) {
-	t.Parallel()
-
-	srv := startUpstream(t)
-	transport := transportOf(t, New(DefaultConfig()))
-
-	addr := srv.Listener.Addr().String()
-
-	_, err := transport.DialContext(testContext(t), "tcp", addr)
-	if !errors.Is(err, ErrSSRFBlocked) {
-		t.Fatalf("DialContext(%s) error = %v, want ErrSSRFBlocked", addr, err)
-	}
-}
-
-// TestDialContextReplacesOnlyTheDialer checks that a fetcher built with
-// DialContext connects through it, while the URL check still refuses a
-// loopback URL and the redirect check a redirect to a link-local address.
-func TestDialContextReplacesOnlyTheDialer(t *testing.T) {
-	t.Parallel()
-
-	srv := startUpstream(t)
-	dialer := &recordingDialer{target: srv.Listener.Addr().String()}
-
-	cfg := DefaultConfig()
-	cfg.AllowHTTP = true
-	cfg.DialContext = dialer.dialContext
-	f := New(cfg)
-
-	if body := fetchBody(t, f, "/image"); body != imagePayload {
-		t.Errorf("body = %q, want %q", body, imagePayload)
-	}
-
-	_, err := f.Fetch(testContext(t), "http://127.0.0.1/image")
-	if !errors.Is(err, ErrSSRFBlocked) {
-		t.Errorf("Fetch(loopback URL) error = %v, want ErrSSRFBlocked", err)
-	}
-
-	_, err = f.Fetch(testContext(t), upstreamURL("/redirect/private"))
-	if !errors.Is(err, ErrSSRFBlocked) {
-		t.Errorf("Fetch(/redirect/private) error = %v, want ErrSSRFBlocked", err)
-	}
-
-	// The upstream server is reached through DialContext, and nothing else
-	// is asked of it.
-	dialed := dialer.dialedAddrs()
-	if len(dialed) == 0 {
-		t.Error("DialContext was never called")
-	}
-
-	for _, addr := range dialed {
-		if addr != net.JoinHostPort(testPublicHost, "80") {
-			t.Errorf("DialContext was asked to connect to %s", addr)
-		}
-	}
-}

internal/httpfetcher/httpfetcher.go

@@ -18,8 +18,6 @@ import (
 	"strings"
 	"sync"
 	"time"
-
-	"github.com/go-chi/chi/v5/middleware"
 )
 
 // Fetcher configuration constants.
@@ -137,11 +135,6 @@ type Config struct {
 	// BlockedNetworks are operator-supplied CIDR ranges refused by the
 	// dialer, in addition to the always-enforced built-in ranges.
 	BlockedNetworks []netip.Prefix
-	// DialContext, when set, makes the fetcher's connections in place of
-	// the dialer that refuses internal addresses; the URL and redirect
-	// checks still run. Only tests set it, to reach a local server; the
-	// config file and the environment cannot.
-	DialContext func(ctx context.Context, network, addr string) (net.Conn, error)
 }
 
 // DefaultConfig returns a Config with sensible defaults.
@@ -195,19 +188,13 @@ func New(config *Config) *HTTPFetcher {
 		config = DefaultConfig()
 	}
 
-	// Unless config.DialContext replaces it, the transport connects with
+	// Create transport with SSRF-safe dialer. The dialer re-resolves and
-	// the SSRF-safe dialer, which re-resolves and re-checks at connect time
+	// re-checks at connect time (closing the DNS-rebinding window) against
-	// (closing the DNS-rebinding window) against both the built-in ranges
+	// both the built-in ranges and the operator-supplied blocklist.
-	// and the operator-supplied blocklist.
-	dialContext := config.DialContext
-	if dialContext == nil {
-		dialContext = func(ctx context.Context, network, addr string) (net.Conn, error) {
-			return dialSSRFSafe(ctx, network, addr, config.BlockedNetworks)
-		}
-	}
-
 	transport := &http.Transport{
-		DialContext:         dialContext,
+		DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
+			return dialSSRFSafe(ctx, network, addr, config.BlockedNetworks)
+		},
 		TLSHandshakeTimeout: DefaultTLSTimeout,
 		MaxIdleConns:        DefaultMaxIdleConns,
 		IdleConnTimeout:     DefaultIdleConnTimeout,
@@ -280,13 +267,6 @@ func (f *HTTPFetcher) Fetch(ctx context.Context, url string) (*FetchResult, erro
 	req.Header.Set("User-Agent", f.config.UserAgent)
 	req.Header.Set("Accept", strings.Join(f.config.AllowedContentTypes, ", "))
 
-	// The ID of the request this fetch serves, so the fetch can be found in
-	// the upstream host's logs
-	requestID := middleware.GetReqID(ctx)
-	if requestID != "" {
-		req.Header.Set(middleware.RequestIDHeader, requestID)
-	}
-
 	// Use httptrace to capture connection details
 	var remoteAddr string
 

internal/httpfetcher/request_id_internal_test.go

@@ -1,50 +0,0 @@
-package httpfetcher
-
-import (
-	"context"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/go-chi/chi/v5/middleware"
-)
-
-// TestFetchSendsRequestID verifies that a fetch sends the ID of the request
-// it serves, which the RequestID middleware stores in the request context,
-// to the upstream host as X-Request-Id, so the fetch can be found in that
-// host's logs.
-func TestFetchSendsRequestID(t *testing.T) {
-	t.Parallel()
-
-	const requestID = "test-request-id"
-
-	received := make(chan string, 1)
-
-	srv := httptest.NewServer(http.HandlerFunc(
-		func(w http.ResponseWriter, r *http.Request) {
-			received <- r.Header.Get("X-Request-Id")
-
-			w.Header().Set("Content-Type", contentTypeJPEG)
-			_, _ = io.WriteString(w, imagePayload)
-		}))
-	t.Cleanup(srv.Close)
-
-	f, _ := newServerFetcher(t, srv, nil)
-
-	ctx := context.WithValue(testContext(t), middleware.RequestIDKey, requestID)
-
-	res, err := f.Fetch(ctx, upstreamURL("/image"))
-	if err != nil {
-		t.Fatalf("Fetch() error = %v", err)
-	}
-
-	_ = res.Content.Close()
-
-	got := <-received
-	t.Logf("upstream received X-Request-Id %q", got)
-
-	if got != requestID {
-		t.Errorf("upstream X-Request-Id = %q, want %q", got, requestID)
-	}
-}

internal/imgcache/cache.go

@@ -11,6 +11,7 @@ import (
 	"io"
 	"log/slog"
 	"path/filepath"
+	"sync"
 	"time"
 
 	lru "github.com/hashicorp/golang-lru/v2"
@@ -37,16 +38,11 @@ type CacheConfig struct {
 	NegativeTTL time.Duration
 
 	// MaxBytes is the disk cache size limit in bytes that eviction
-	// enforces. Zero means no limit is enforced (no eviction).
+	// enforces. Zero means no limit is enforced (no eviction). The
+	// config layer supplies the computed default when the operator
+	// omits cache_max_bytes.
 	MaxBytes int64
 
-	// UseDefaultMaxBytes makes NewCache replace MaxBytes with the
-	// default limit: 75% of the sum of the space free on the filesystem
-	// holding the cache and the bytes the cache already holds, at least
-	// DefaultCacheMaxBytesFloor. The config layer sets this when the
-	// operator omits cache_max_bytes.
-	UseDefaultMaxBytes bool
-
 	// DisableDiskCache turns the disk cache off entirely: no cache
 	// directories are created, lookups always miss, stores are
 	// no-ops, and no eviction machinery runs. The config layer sets
@@ -73,11 +69,11 @@ type Cache struct {
 
 	// Eviction machinery. The channels are created in NewCache so
 	// stores can signal write pressure without racing StartEviction.
-	// evictionCancel, set by StartEviction, cancels the eviction
-	// goroutine's context.
 	evictionPressure chan struct{}
+	evictionStop     chan struct{}
 	evictionDone     chan struct{}
-	evictionCancel   context.CancelFunc
+	evictionStarted  bool
+	evictionStopOnce sync.Once
 
 	// metaCache holds the content types of the variants most recently
 	// stored or served, so a hit does not read the variant's .meta file.
@@ -100,14 +96,6 @@ type Cache struct {
 
 // NewCache creates a new cache instance.
 func NewCache(db *sql.DB, config CacheConfig) (*Cache, error) {
-	return newCache(db, config, defaultFreeSpaceProbe)
-}
-
-// newCache is NewCache with the free-space probe passed in, so tests
-// can fake the free space the default limit is worked out from.
-func newCache(
-	db *sql.DB, config CacheConfig, probe FreeSpaceProbeFunc,
-) (*Cache, error) {
 	log := config.Logger
 	if log == nil {
 		log = slog.Default()
@@ -124,6 +112,7 @@ func newCache(
 		log:              log,
 		disabled:         config.DisableDiskCache,
 		evictionPressure: make(chan struct{}, 1),
+		evictionStop:     make(chan struct{}),
 		evictionDone:     make(chan struct{}),
 		metaCache:        metaCache,
 		contentLocks:     newContentLock(),
@@ -158,20 +147,6 @@ func newCache(
 	c.variants = variants
 	c.srcMetadata = srcMetadata
 
-	if config.UseDefaultMaxBytes {
-		limit, err := c.computeDefaultMaxBytes(context.Background(), probe)
-		if err != nil {
-			return nil, err
-		}
-
-		c.config.MaxBytes = limit
-
-		log.Info("computed default cache size limit from free space and cache contents",
-			"cache_max_bytes", limit,
-			"cache_dir", filepath.Join(config.StateDir, "cache"),
-		)
-	}
-
 	return c, nil
 }
 

internal/imgcache/cachesize.go

@@ -1,89 +0,0 @@
-package imgcache
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"math"
-	"path/filepath"
-	"syscall"
-)
-
-// DefaultCacheMaxBytesFloor is the minimum computed default for the
-// cache_max_bytes setting: 500 MiB. The floor applies only to the
-// computed default (when the key is omitted from the configuration),
-// never to explicitly configured values.
-const DefaultCacheMaxBytesFloor int64 = 524288000
-
-// freeSpaceFractionNumerator and freeSpaceFractionDenominator express
-// the 75% share used for the computed default limit as integer
-// arithmetic (dividing before multiplying avoids overflow).
-const (
-	freeSpaceFractionNumerator   uint64 = 3
-	freeSpaceFractionDenominator uint64 = 4
-)
-
-var errNegativeBlockSize = errors.New("statfs reported negative block size")
-
-// FreeSpaceProbeFunc reports the number of free bytes available on the
-// filesystem containing path. It is a function type so tests can
-// inject a fake probe instead of depending on the host disk.
-type FreeSpaceProbeFunc func(path string) (uint64, error)
-
-// defaultFreeSpaceProbe reports free filesystem bytes via statfs on
-// the given path, as available to unprivileged processes.
-func defaultFreeSpaceProbe(path string) (uint64, error) {
-	var stat syscall.Statfs_t
-
-	err := syscall.Statfs(path, &stat)
-	if err != nil {
-		return 0, err
-	}
-
-	if stat.Bsize < 0 {
-		return 0, fmt.Errorf("%w %d for %q", errNegativeBlockSize, stat.Bsize, path)
-	}
-
-	blockSize := uint64(stat.Bsize)
-
-	return stat.Bavail * blockSize, nil
-}
-
-// computeDefaultMaxBytes returns the default cache size limit: 75% of
-// the sum of the free bytes probe reports for <state_dir>/cache/ and
-// the bytes the cache already holds, with a floor of
-// DefaultCacheMaxBytesFloor. Counting what the cache holds keeps the
-// limit from shrinking as the cache fills.
-func (c *Cache) computeDefaultMaxBytes(
-	ctx context.Context, probe FreeSpaceProbeFunc,
-) (int64, error) {
-	cacheDir := filepath.Join(c.config.StateDir, "cache")
-
-	freeBytes, err := probe(cacheDir)
-	if err != nil {
-		return 0, fmt.Errorf(
-			"default cache_max_bytes: cannot determine free space for %q: %w",
-			cacheDir, err)
-	}
-
-	usedBytes, err := c.UsageBytes(ctx)
-	if err != nil {
-		return 0, err
-	}
-
-	// Both terms are at most math.MaxInt64, so the sum cannot overflow.
-	//nolint:gosec // G115: UsageBytes sums file sizes, never negative
-	spaceBytes := min(freeBytes, math.MaxInt64) + uint64(usedBytes)
-
-	computed := spaceBytes / freeSpaceFractionDenominator * freeSpaceFractionNumerator
-	computed = min(computed, math.MaxInt64)
-
-	// gosec cannot see that min() above bounds computed, so it reads
-	// this conversion as potentially overflowing. It cannot: computed is
-	// at most math.MaxInt64 on every path here.
-	//nolint:gosec // G115: clamped to MaxInt64 by min above
-	limit := int64(computed)
-	limit = max(limit, DefaultCacheMaxBytesFloor)
-
-	return limit, nil
-}

internal/imgcache/cachesize_internal_test.go

@@ -1,188 +0,0 @@
-package imgcache
-
-import (
-	"errors"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// Static errors returned by the stub free-space probes below.
-var (
-	errTestStatfsFailed     = errors.New("statfs failed")
-	errTestProbeNotExpected = errors.New("probe must not be called")
-)
-
-// TestComputeDefaultMaxBytesCountsWhatTheCacheHolds verifies that the
-// default limit is 75% of the free space plus what the cache already
-// holds, so a cache filled to its limit keeps that limit across a
-// restart instead of shrinking to 75% of the space left free.
-func TestComputeDefaultMaxBytesCountsWhatTheCacheHolds(t *testing.T) {
-	t.Parallel()
-
-	cache, _ := newEvictionTestCache(t, 1<<30)
-
-	// Empty cache, 4 GiB free -> 3 GiB default.
-	got, err := cache.computeDefaultMaxBytes(t.Context(),
-		func(string) (uint64, error) { return 4294967296, nil })
-	if err != nil {
-		t.Fatalf("computeDefaultMaxBytes returned error: %v", err)
-	}
-
-	t.Logf("default for an empty cache with 4 GiB free: %d", got)
-
-	if got != 3221225472 {
-		t.Errorf("default for an empty cache = %d, want 3221225472 (75%% of 4 GiB)",
-			got)
-	}
-
-	// The cache now holds those 3 GiB, which leaves 1 GiB free.
-	_, err = cache.db.ExecContext(t.Context(),
-		`INSERT INTO variant_content (cache_key, size_bytes, content_type)
-		 VALUES (?, ?, ?)`,
-		string(testVariantKeyOne), 3221225472, testContentTypeWebP,
-	)
-	if err != nil {
-		t.Fatalf("failed to insert variant accounting row: %v", err)
-	}
-
-	got, err = cache.computeDefaultMaxBytes(t.Context(),
-		func(string) (uint64, error) { return 1073741824, nil })
-	if err != nil {
-		t.Fatalf("computeDefaultMaxBytes returned error: %v", err)
-	}
-
-	t.Logf("default for a cache holding 3 GiB with 1 GiB free: %d", got)
-
-	if got != 3221225472 {
-		t.Errorf("default for a cache holding 3 GiB with 1 GiB free = %d, "+
-			"want 3221225472 (75%% of 1 GiB + 3 GiB)", got)
-	}
-}
-
-// TestComputeDefaultMaxBytesAppliesFloor verifies that when 75% of the
-// free space plus what the cache holds is below 500 MiB, the default
-// is floored at DefaultCacheMaxBytesFloor.
-func TestComputeDefaultMaxBytesAppliesFloor(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		name      string
-		freeBytes uint64
-	}{
-		{name: "100 MiB free", freeBytes: 104857600},
-		{name: "zero free", freeBytes: 0},
-		{name: "just below floor threshold", freeBytes: 699050665},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			cache, _ := newEvictionTestCache(t, 1<<30)
-
-			got, err := cache.computeDefaultMaxBytes(t.Context(),
-				func(string) (uint64, error) { return tc.freeBytes, nil })
-			if err != nil {
-				t.Fatalf("computeDefaultMaxBytes returned error: %v", err)
-			}
-
-			if got != DefaultCacheMaxBytesFloor {
-				t.Errorf("computeDefaultMaxBytes = %d, want floor %d",
-					got, DefaultCacheMaxBytesFloor)
-			}
-		})
-	}
-}
-
-// TestComputeDefaultMaxBytesPropagatesProbeError verifies that a
-// failing free-space probe produces an error naming cache_max_bytes,
-// instead of a silently wrong default.
-func TestComputeDefaultMaxBytesPropagatesProbeError(t *testing.T) {
-	t.Parallel()
-
-	cache, _ := newEvictionTestCache(t, 1<<30)
-
-	_, err := cache.computeDefaultMaxBytes(t.Context(),
-		func(string) (uint64, error) { return 0, errTestStatfsFailed })
-	if err == nil {
-		t.Fatal("probe failure must produce an error, got nil")
-	}
-
-	t.Logf("got expected error: %v", err)
-
-	if !strings.Contains(err.Error(), "cache_max_bytes") {
-		t.Errorf("error %q does not name cache_max_bytes", err.Error())
-	}
-}
-
-// TestNewCacheComputesDefaultMaxBytesWhenAsked verifies that with
-// UseDefaultMaxBytes set, the cache's limit becomes the computed
-// default, and that the probe is pointed at <state_dir>/cache/, which
-// must be created first so statfs measures the right filesystem.
-func TestNewCacheComputesDefaultMaxBytesWhenAsked(t *testing.T) {
-	t.Parallel()
-
-	stateDir := t.TempDir()
-	wantCacheDir := filepath.Join(stateDir, "cache")
-
-	var probedPath string
-
-	// 4 GiB free -> 3 GiB default.
-	probe := func(path string) (uint64, error) {
-		probedPath = path
-
-		info, err := os.Stat(path)
-		if err != nil || !info.IsDir() {
-			t.Errorf("cache directory %q was not created before probing: info=%v err=%v",
-				path, info, err)
-		}
-
-		return 4294967296, nil
-	}
-
-	cache, err := newCache(evictionTestDB(t), CacheConfig{
-		StateDir:           stateDir,
-		UseDefaultMaxBytes: true,
-	}, probe)
-	if err != nil {
-		t.Fatalf("newCache returned error: %v", err)
-	}
-
-	if cache.config.MaxBytes != 3221225472 {
-		t.Errorf("MaxBytes = %d, want computed default 3221225472",
-			cache.config.MaxBytes)
-	}
-
-	if probedPath != wantCacheDir {
-		t.Errorf("free space probed at %q, want cache directory %q",
-			probedPath, wantCacheDir)
-	}
-}
-
-// TestNewCacheKeepsExplicitMaxBytes verifies that without
-// UseDefaultMaxBytes the cache keeps MaxBytes exactly as given and
-// never consults the free-space probe.
-func TestNewCacheKeepsExplicitMaxBytes(t *testing.T) {
-	t.Parallel()
-
-	probe := func(string) (uint64, error) {
-		t.Error("free-space probe must not be consulted for explicit values")
-
-		return 0, errTestProbeNotExpected
-	}
-
-	cache, err := newCache(evictionTestDB(t), CacheConfig{
-		StateDir: t.TempDir(),
-		MaxBytes: 1024,
-	}, probe)
-	if err != nil {
-		t.Fatalf("newCache returned error: %v", err)
-	}
-
-	if cache.config.MaxBytes != 1024 {
-		t.Errorf("MaxBytes = %d, want explicit 1024 (no floor, no recompute)",
-			cache.config.MaxBytes)
-	}
-}

internal/imgcache/eviction.go

@@ -117,10 +117,7 @@ func (c *Cache) EvictToLimit(ctx context.Context) error {
 
 // evictBatch fetches one batch of LRU candidates across variants and
 // source blobs and evicts them oldest-first until excessBytes are
-// freed or the batch is exhausted. It returns the bytes freed. A
+// freed or the batch is exhausted. It returns the bytes freed.
-// candidate that fails once ctx is cancelled (every one started after
-// that fails at its first database call) ends the batch with ctx's
-// error, without a warning.
 func (c *Cache) evictBatch(ctx context.Context, excessBytes int64) (int64, error) {
 	candidates, err := c.evictionCandidates(ctx)
 	if err != nil {
@@ -136,10 +133,6 @@ func (c *Cache) evictBatch(ctx context.Context, excessBytes int64) (int64, error
 
 		err := c.evictCandidate(ctx, candidate)
 		if err != nil {
-			if ctx.Err() != nil {
-				return freed, ctx.Err()
-			}
-
 			c.log.Warn("failed to evict cache entry",
 				"cache_key", candidate.cacheKey,
 				"content_hash", candidate.contentHash,
@@ -431,44 +424,37 @@ func (c *Cache) notifyWritePressure() {
 // startup and again on every periodic tick thereafter, and evicts to
 // the configured limit on the given periodic interval and on
 // write-pressure notifications. It is a no-op on a disabled cache or
-// when already started. The goroutine outlives the caller, so it runs
+// when already started.
-// with its own context, which StopEviction cancels.
 func (c *Cache) StartEviction(interval time.Duration) {
-	if c.disabled || c.evictionCancel != nil {
+	if c.disabled || c.evictionStarted {
 		return
 	}
 
-	ctx, cancel := context.WithCancel(context.Background())
+	c.evictionStarted = true
-	c.evictionCancel = cancel
 
-	go c.evictionLoop(ctx, interval)
+	go c.evictionLoop(interval)
 }
 
-// StopEviction cancels the background eviction goroutine, which
+// StopEviction stops the background eviction goroutine and waits for
-// interrupts a pass in progress, and waits for it to exit or for ctx to
+// it to exit. It is safe to call when eviction was never started, and
-// end, whichever comes first. In the second case it returns an error
+// safe to call more than once.
-// wrapping ctx's error. It is safe to call when eviction was never
+func (c *Cache) StopEviction() {
-// started, and safe to call more than once.
+	if !c.evictionStarted {
-func (c *Cache) StopEviction(ctx context.Context) error {
+		return
-	if c.evictionCancel == nil {
-		return nil
 	}
 
-	c.evictionCancel()
+	c.evictionStopOnce.Do(func() {
-
+		close(c.evictionStop)
-	select {
+		<-c.evictionDone
-	case <-c.evictionDone:
+	})
-		return nil
-	case <-ctx.Done():
-		return fmt.Errorf("cache eviction still running: %w", ctx.Err())
-	}
 }
 
-// evictionLoop is the body of the background eviction goroutine. It
+// evictionLoop is the body of the background eviction goroutine.
-// returns when ctx is cancelled, and starts no pass after that.
+func (c *Cache) evictionLoop(interval time.Duration) {
-func (c *Cache) evictionLoop(ctx context.Context, interval time.Duration) {
 	defer close(c.evictionDone)
 
+	ctx := context.Background()
+
 	c.runReconciliationPass(ctx)
 	c.runEvictionPass(ctx)
 
@@ -477,7 +463,7 @@ func (c *Cache) evictionLoop(ctx context.Context, interval time.Duration) {
 
 	for {
 		select {
-		case <-ctx.Done():
+		case <-c.evictionStop:
 			return
 		case <-ticker.C:
 			// Reconciliation walks the cache directories, so it only
@@ -498,13 +484,8 @@ func (c *Cache) evictionLoop(ctx context.Context, interval time.Duration) {
 }
 
 // runEvictionPass runs one eviction pass, logging failures instead of
-// propagating them (the loop must keep running). It does nothing once
+// propagating them (the loop must keep running).
-// ctx is cancelled.
 func (c *Cache) runEvictionPass(ctx context.Context) {
-	if ctx.Err() != nil {
-		return
-	}
-
 	err := c.EvictToLimit(ctx)
 	if err != nil {
 		c.log.Warn("cache eviction pass failed", "error", err)
@@ -512,13 +493,8 @@ func (c *Cache) runEvictionPass(ctx context.Context) {
 }
 
 // runReconciliationPass runs one reconciliation pass, logging failures
-// instead of propagating them (the loop must keep running). It does
+// instead of propagating them (the loop must keep running).
-// nothing once ctx is cancelled.
 func (c *Cache) runReconciliationPass(ctx context.Context) {
-	if ctx.Err() != nil {
-		return
-	}
-
 	err := c.reconcileAccounting(ctx)
 	if err != nil {
 		c.log.Warn("cache accounting reconciliation failed", "error", err)
@@ -535,8 +511,7 @@ func (c *Cache) runReconciliationPass(ctx context.Context) {
 // know (and rows whose files are gone), and sweeps stale temp files
 // left behind by crashed writes. Running it periodically, not just
 // once, bounds how long such drift can accumulate unaccounted for on a
-// long-running process to one eviction interval. Once ctx is cancelled,
+// long-running process to one eviction interval.
-// it stops at the next file or row and returns ctx's error.
 func (c *Cache) reconcileAccounting(ctx context.Context) error {
 	if c.disabled {
 		return nil
@@ -571,10 +546,6 @@ func (c *Cache) reconcileVariantFiles(ctx context.Context) error {
 	return filepath.WalkDir(
 		c.variants.baseDir,
 		func(path string, entry fs.DirEntry, err error) error {
-			if ctx.Err() != nil {
-				return ctx.Err()
-			}
-
 			if err != nil || entry.IsDir() {
 				return err
 			}
@@ -663,10 +634,6 @@ func (c *Cache) reconcileVariantRows(ctx context.Context) error {
 	}
 
 	for _, key := range keys {
-		if ctx.Err() != nil {
-			return ctx.Err()
-		}
-
 		if c.variants.Exists(key) {
 			continue
 		}
@@ -732,10 +699,6 @@ func (c *Cache) reconcileSourceFiles(ctx context.Context) error {
 	return filepath.WalkDir(
 		c.srcContent.baseDir,
 		func(path string, entry fs.DirEntry, err error) error {
-			if ctx.Err() != nil {
-				return ctx.Err()
-			}
-
 			if err != nil || entry.IsDir() {
 				return err
 			}
@@ -797,10 +760,6 @@ func (c *Cache) reconcileSourceRows(ctx context.Context) error {
 	}
 
 	for _, hash := range hashes {
-		if ctx.Err() != nil {
-			return ctx.Err()
-		}
-
 		if c.srcContent.Exists(hash) {
 			continue
 		}

internal/imgcache/eviction_internal_test.go

@@ -4,12 +4,9 @@ import (
 	"bytes"
 	"context"
 	"database/sql"
-	"errors"
 	"io/fs"
-	"log/slog"
 	"os"
 	"path/filepath"
-	"strings"
 	"testing"
 	"time"
 
@@ -660,7 +657,7 @@ func TestEvictionRunsUnderWritePressure(t *testing.T) {
 	// An interval far longer than the test ensures only write
 	// pressure can trigger eviction here.
 	cache.StartEviction(time.Hour)
-	defer func() { _ = cache.StopEviction(t.Context()) }()
+	defer cache.StopEviction()
 
 	keys := []VariantKey{
 		testVariantKeyOne, testVariantKeyTwo, testVariantKeyThree,
@@ -681,11 +678,6 @@ func TestEvictionRunsUnderWritePressure(t *testing.T) {
 	assertNoDanglingReferences(t, cache)
 }
 
-// TestEvictionRunsOnPeriodicSchedule writes three variant files straight
-// to disk, bypassing StoreVariant, so they have no accounting rows and no
-// write-pressure notification fires. Only a periodic reconciliation pass
-// can then adopt them, and only the eviction pass that follows it can
-// evict them.
 func TestEvictionRunsOnPeriodicSchedule(t *testing.T) {
 	t.Parallel()
 
@@ -693,28 +685,12 @@ func TestEvictionRunsOnPeriodicSchedule(t *testing.T) {
 
 	cache, _ := newEvictionTestCache(t, limit)
 
-	// Hold the test database's only connection, so the startup pass
+	// Start the evictor while the cache is empty, then create tracked
-	// waits for it after walking the still empty variant directory: the
+	// over-limit state WITHOUT going through the store methods, so no
-	// files written while it waits are first seen by a periodic pass.
+	// write-pressure notification fires and only the periodic ticker
-	conn, err := cache.db.Conn(t.Context())
+	// can trigger eviction.
-	if err != nil {
-		t.Fatalf("failed to take the database connection: %v", err)
-	}
-
-	defer func() { _ = conn.Close() }()
-
 	cache.StartEviction(100 * time.Millisecond)
-	defer func() { _ = cache.StopEviction(t.Context()) }()
+	defer cache.StopEviction()
-
-	deadline := time.Now().Add(5 * time.Second)
-
-	for cache.db.Stats().WaitCount == 0 {
-		if time.Now().After(deadline) {
-			t.Fatal("the startup pass never waited for the database")
-		}
-
-		time.Sleep(10 * time.Millisecond)
-	}
 
 	keys := []VariantKey{
 		testVariantKeyOne, testVariantKeyTwo, testVariantKeyThree,
@@ -724,43 +700,25 @@ func TestEvictionRunsOnPeriodicSchedule(t *testing.T) {
 	for i, key := range keys {
 		content := bytes.Repeat([]byte{fills[i]}, 1000)
 
-		_, err = cache.variants.Store(key, bytes.NewReader(content), "image/webp")
+		_, err := cache.variants.Store(key, bytes.NewReader(content), "image/webp")
 		if err != nil {
 			t.Fatalf("failed to store variant file: %v", err)
 		}
-	}
 
-	_ = conn.Close()
+		_, err = cache.db.ExecContext(t.Context(),
-
+			`INSERT INTO variant_content (cache_key, size_bytes, content_type)
-	// Only one of the 1000-byte files fits under the limit: wait until
+			 VALUES (?, ?, ?)`,
-	// the evictor has removed the other two.
+			string(key), len(content), "image/webp",
-	stored := len(keys)
+		)
-	deadline = time.Now().Add(5 * time.Second)
+		if err != nil {
-
+			t.Fatalf("failed to insert variant accounting row: %v", err)
-	for stored > 1 && time.Now().Before(deadline) {
-		time.Sleep(25 * time.Millisecond)
-
-		stored = 0
-
-		for _, key := range keys {
-			if cache.variants.Exists(key) {
-				stored++
-			}
 		}
 	}
 
-	if stored > 1 {
+	usage := waitForUsageAtOrBelow(t, cache, limit, 5*time.Second)
-		t.Fatalf("periodic schedule did not trigger eviction: %d of %d "+
-			"variant files still on disk, want at most 1", stored, len(keys))
-	}
-
-	usage, err := cache.UsageBytes(t.Context())
-	if err != nil {
-		t.Fatalf("UsageBytes failed: %v", err)
-	}
-
 	if usage > limit {
-		t.Errorf("usage after eviction = %d, want <= %d", usage, limit)
+		t.Errorf("periodic schedule did not trigger eviction: usage = %d, want <= %d",
+			usage, limit)
 	}
 
 	assertNoDanglingReferences(t, cache)
@@ -793,7 +751,7 @@ func TestStartEvictionReconcilesAccountingWithDisk(t *testing.T) {
 	}
 
 	cache.StartEviction(time.Hour)
-	defer func() { _ = cache.StopEviction(t.Context()) }()
+	defer cache.StopEviction()
 
 	deadline := time.Now().Add(5 * time.Second)
 
@@ -847,28 +805,15 @@ func TestPeriodicReconciliationAdoptsFileThatAppearsAfterStartup(t *testing.T) {
 
 	cache, _ := newEvictionTestCache(t, 1<<30)
 
-	// Hold the test database's only connection, so the startup pass
+	const interval = 100 * time.Millisecond
-	// waits for it after walking the still empty variant directory: the
-	// file written while it waits is first seen by a periodic pass.
-	conn, err := cache.db.Conn(t.Context())
-	if err != nil {
-		t.Fatalf("failed to take the database connection: %v", err)
-	}
 
-	defer func() { _ = conn.Close() }()
+	cache.StartEviction(interval)
+	defer cache.StopEviction()
 
-	cache.StartEviction(100 * time.Millisecond)
+	// Let startup reconciliation run and settle on an empty cache
-	defer func() { _ = cache.StopEviction(t.Context()) }()
+	// before introducing the untracked file, so the adoption we assert
-
+	// below can only be the work of a later, periodic pass.
-	deadline := time.Now().Add(5 * time.Second)
+	time.Sleep(3 * interval)
-
-	for cache.db.Stats().WaitCount == 0 {
-		if time.Now().After(deadline) {
-			t.Fatal("the startup pass never waited for the database")
-		}
-
-		time.Sleep(10 * time.Millisecond)
-	}
 
 	// Simulate a variant whose accounting insert failed after the
 	// process was already running and serving requests: the content
@@ -877,16 +822,14 @@ func TestPeriodicReconciliationAdoptsFileThatAppearsAfterStartup(t *testing.T) {
 	// insert had failed and only the file write had succeeded.
 	untracked := bytes.Repeat([]byte{0x41}, 900)
 
-	_, err = cache.variants.Store(
+	_, err := cache.variants.Store(
 		"aabbccdd0099", bytes.NewReader(untracked), "image/webp",
 	)
 	if err != nil {
 		t.Fatalf("failed to store untracked variant file: %v", err)
 	}
 
-	_ = conn.Close()
+	deadline := time.Now().Add(5 * time.Second)
-
-	deadline = time.Now().Add(5 * time.Second)
 
 	var usage int64
 
@@ -919,242 +862,6 @@ func TestPeriodicReconciliationAdoptsFileThatAppearsAfterStartup(t *testing.T) {
 	}
 }
 
-// TestStopEvictionInterruptsPassInProgress holds the test database's
-// only connection, so the startup reconciliation pass waits for it, and
-// checks that StopEviction stops that pass instead of waiting for the
-// connection to come free, and that the stop logs one warning: the
-// interrupted reconciliation's, with no eviction pass started after it.
-func TestStopEvictionInterruptsPassInProgress(t *testing.T) {
-	t.Parallel()
-
-	cache, _ := newEvictionTestCache(t, 1<<30)
-
-	var logBuf bytes.Buffer
-
-	cache.log = slog.New(slog.NewJSONHandler(&logBuf, nil))
-
-	conn, err := cache.db.Conn(t.Context())
-	if err != nil {
-		t.Fatalf("failed to take the database connection: %v", err)
-	}
-
-	defer func() { _ = conn.Close() }()
-
-	cache.StartEviction(time.Hour)
-
-	// The pass is in progress once it waits for the connection.
-	deadline := time.Now().Add(5 * time.Second)
-
-	for cache.db.Stats().WaitCount == 0 {
-		if time.Now().After(deadline) {
-			t.Fatal("the reconciliation pass never waited for the database")
-		}
-
-		time.Sleep(10 * time.Millisecond)
-	}
-
-	ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
-	defer cancel()
-
-	err = cache.StopEviction(ctx)
-	t.Logf("StopEviction() error = %v", err)
-
-	if err != nil {
-		t.Fatalf("StopEviction() error = %v, want nil: the pass waiting for "+
-			"the database did not stop", err)
-	}
-
-	t.Logf("log output: %s", logBuf.String())
-
-	warnings := strings.Count(logBuf.String(), `"level":"WARN"`)
-	if warnings != 1 {
-		t.Errorf("the stop logged %d warnings, want 1", warnings)
-	}
-}
-
-// TestEvictToLimitStopsAtNextCandidateOnceCancelled cancels the context
-// while the oldest of three source blobs is being evicted, and checks that
-// EvictToLimit then returns context.Canceled without evicting the other
-// two or logging a warning for either of them.
-func TestEvictToLimitStopsAtNextCandidateOnceCancelled(t *testing.T) {
-	t.Parallel()
-
-	cache, _ := newEvictionTestCache(t, 1)
-
-	var logBuf bytes.Buffer
-
-	cache.log = slog.New(slog.NewJSONHandler(&logBuf, nil))
-
-	hashes := []ContentHash{
-		storeEvictionTestSource(t, cache, "cancel.example.com", "/a.jpg",
-			bytes.Repeat([]byte{0x61}, 1000)),
-		storeEvictionTestSource(t, cache, "cancel.example.com", "/b.jpg",
-			bytes.Repeat([]byte{0x62}, 1000)),
-		storeEvictionTestSource(t, cache, "cancel.example.com", "/c.jpg",
-			bytes.Repeat([]byte{0x63}, 1000)),
-	}
-
-	base := time.Now().Add(-time.Hour)
-
-	for i, hash := range hashes {
-		setSourceLastAccessed(t, cache, hash, base.Add(time.Duration(i)*time.Minute))
-	}
-
-	ctx, cancel := context.WithCancel(t.Context())
-	defer cancel()
-
-	cache.evictSourceBlobTestHook = func(ContentHash) { cancel() }
-
-	err := cache.EvictToLimit(ctx)
-	t.Logf("EvictToLimit() error = %v", err)
-	t.Logf("log output: %s", logBuf.String())
-
-	if !errors.Is(err, context.Canceled) {
-		t.Errorf("EvictToLimit() error = %v, want context.Canceled", err)
-	}
-
-	if cache.srcContent.Exists(hashes[0]) {
-		t.Errorf("source blob %s, evicted when the context was cancelled, "+
-			"is still on disk", hashes[0])
-	}
-
-	for _, hash := range hashes[1:] {
-		if !cache.srcContent.Exists(hash) {
-			t.Errorf("source blob %s was evicted after the context was cancelled", hash)
-		}
-	}
-
-	if strings.Contains(logBuf.String(), `"level":"WARN"`) {
-		t.Errorf("EvictToLimit logged a warning after the context was cancelled")
-	}
-
-	assertNoDanglingReferences(t, cache)
-}
-
-// TestStopEvictionReturnsWhenItsContextEnds pauses an eviction pass where
-// cancellation cannot reach it, after a source blob's rows are deleted and
-// before its file is removed, and checks that StopEviction returns its
-// context's error when that context ends instead of waiting for the pass.
-// Once the pass goes on, the goroutine exits and no row points at a
-// missing file.
-func TestStopEvictionReturnsWhenItsContextEnds(t *testing.T) {
-	t.Parallel()
-
-	cache, _ := newEvictionTestCache(t, 1)
-
-	paused := make(chan struct{})
-	resume := make(chan struct{})
-
-	cache.evictSourceBlobTestHook = func(ContentHash) {
-		close(paused)
-		<-resume
-	}
-
-	hash := storeEvictionTestSource(t, cache, "stop.example.com", "/a.jpg",
-		bytes.Repeat([]byte{0x61}, 1000))
-
-	cache.StartEviction(time.Hour)
-
-	select {
-	case <-paused:
-	case <-time.After(5 * time.Second):
-		t.Fatal("the eviction pass never reached the source blob")
-	}
-
-	ctx, cancel := context.WithTimeout(t.Context(), 50*time.Millisecond)
-	defer cancel()
-
-	err := cache.StopEviction(ctx)
-	t.Logf("StopEviction() error = %v", err)
-
-	if !errors.Is(err, context.DeadlineExceeded) {
-		t.Errorf("StopEviction() error = %v, want context.DeadlineExceeded", err)
-	}
-
-	close(resume)
-
-	err = cache.StopEviction(t.Context())
-	if err != nil {
-		t.Fatalf("second StopEviction() error = %v, want nil", err)
-	}
-
-	assertNoDanglingReferences(t, cache)
-
-	if cache.srcContent.Exists(hash) {
-		t.Errorf("source blob %s is still on disk after its rows were deleted", hash)
-	}
-}
-
-// TestReconciliationWalksStopOnceCancelled checks that both directory
-// walks of a reconciliation pass return the context's error once it is
-// cancelled, leaving in place a stale temp file they would otherwise
-// remove.
-func TestReconciliationWalksStopOnceCancelled(t *testing.T) {
-	t.Parallel()
-
-	cache, _ := newEvictionTestCache(t, 1<<30)
-
-	ctx, cancel := context.WithCancel(t.Context())
-	cancel()
-
-	staleTime := time.Now().Add(-2 * staleTempFileAge)
-
-	walks := map[string]func(context.Context) error{
-		cache.variants.baseDir:   cache.reconcileVariantFiles,
-		cache.srcContent.baseDir: cache.reconcileSourceFiles,
-	}
-
-	for dir, walk := range walks {
-		tempFile := filepath.Join(dir, tempFilePrefix+"stale")
-
-		err := os.WriteFile(tempFile, []byte("partial"), 0o600)
-		if err != nil {
-			t.Fatalf("failed to write temp file: %v", err)
-		}
-
-		err = os.Chtimes(tempFile, staleTime, staleTime)
-		if err != nil {
-			t.Fatalf("failed to backdate temp file: %v", err)
-		}
-
-		err = walk(ctx)
-		t.Logf("walk of %s: error = %v", dir, err)
-
-		if !errors.Is(err, context.Canceled) {
-			t.Errorf("walk of %s: error = %v, want context.Canceled", dir, err)
-		}
-
-		_, err = os.Stat(tempFile)
-		if err != nil {
-			t.Errorf("walk of %s went on after cancellation: %v", dir, err)
-		}
-	}
-}
-
-// TestReconciliationPassLogsNoWarningOnceCancelled checks that a
-// reconciliation pass run with an already cancelled context logs no
-// warning, so a periodic tick the loop takes after a stop adds no
-// warning to the one from the pass the stop interrupted.
-func TestReconciliationPassLogsNoWarningOnceCancelled(t *testing.T) {
-	t.Parallel()
-
-	cache, _ := newEvictionTestCache(t, 1<<30)
-
-	var logBuf bytes.Buffer
-
-	cache.log = slog.New(slog.NewJSONHandler(&logBuf, nil))
-
-	ctx, cancel := context.WithCancel(t.Context())
-	cancel()
-
-	cache.runReconciliationPass(ctx)
-	t.Logf("log output: %s", logBuf.String())
-
-	if strings.Contains(logBuf.String(), `"level":"WARN"`) {
-		t.Errorf("runReconciliationPass logged a warning with a cancelled context")
-	}
-}
-
 // TestEvictSourceBlobExcludesConcurrentStoreOfIdenticalContent exercises
 // the exact TOCTOU window between evictSourceBlob's row-deletion
 // transaction commit and its content file unlink: a concurrent

internal/imgcache/imgcache.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"errors"
 	"io"
+	"net/url"
 	"time"
 )
 
@@ -153,6 +154,9 @@ type ImageCache interface {
 	// Warm pre-fetches and caches an image without returning it
 	Warm(ctx context.Context, req *ImageRequest) error
 
+	// Purge removes a cached image
+	Purge(ctx context.Context, req *ImageRequest) error
+
 	// Stats returns cache statistics
 	Stats(ctx context.Context) (*CacheStats, error)
 }
@@ -172,3 +176,29 @@ type CacheStats struct {
 	// HitRate is HitCount / (HitCount + MissCount)
 	HitRate float64
 }
+
+// SignatureValidator validates request signatures
+type SignatureValidator interface {
+	// Validate checks if the signature is valid for the request
+	Validate(req *ImageRequest) error
+	// Generate creates a signature for a request
+	Generate(req *ImageRequest) string
+}
+
+// Allowlist checks if a URL is allowlisted (no signature required)
+type Allowlist interface {
+	// IsAllowlisted returns true if the URL doesn't require a signature
+	IsAllowlisted(u *url.URL) bool
+}
+
+// Storage handles persistent storage of cached content
+type Storage interface {
+	// Store saves content and returns its hash
+	Store(ctx context.Context, content io.Reader) (hash string, err error)
+	// Load retrieves content by hash
+	Load(ctx context.Context, hash string) (io.ReadCloser, error)
+	// Delete removes content by hash
+	Delete(ctx context.Context, hash string) error
+	// Exists checks if content exists
+	Exists(ctx context.Context, hash string) (bool, error)
+}

internal/imgcache/service.go

@@ -13,7 +13,6 @@ import (
 
 	"github.com/dustin/go-humanize"
 	"github.com/getsentry/sentry-go"
-	"github.com/go-chi/chi/v5/middleware"
 	"golang.org/x/sync/singleflight"
 	"sneak.berlin/go/pixa/internal/allowlist"
 	"sneak.berlin/go/pixa/internal/httpfetcher"
@@ -42,8 +41,7 @@ type Service struct {
 type ServiceConfig struct {
 	// Cache is the cache instance
 	Cache *Cache
-	// FetcherConfig configures the upstream fetcher built when Fetcher is
+	// FetcherConfig configures the upstream fetcher (ignored if Fetcher is set)
-	// not set. Its AllowHTTP and MaxResponseSize are used either way.
 	FetcherConfig *httpfetcher.Config
 	// Fetcher is an optional custom fetcher (for testing)
 	Fetcher httpfetcher.Fetcher
@@ -58,10 +56,11 @@ type ServiceConfig struct {
 	Logger *slog.Logger
 }
 
-// Static errors for service construction.
+// Static errors for service construction and unimplemented operations.
 var (
-	errCacheRequired      = errors.New("cache is required")
+	errCacheRequired       = errors.New("cache is required")
-	errSigningKeyRequired = errors.New("signing key is required")
+	errSigningKeyRequired  = errors.New("signing key is required")
+	errPurgeNotImplemented = errors.New("purge not implemented")
 )
 
 // NewService creates a new image service.
@@ -190,6 +189,11 @@ func (s *Service) Warm(ctx context.Context, req *ImageRequest) error {
 	return err
 }
 
+// Purge removes a cached image. Purging is not implemented yet.
+func (s *Service) Purge(_ context.Context, _ *ImageRequest) error {
+	return errPurgeNotImplemented
+}
+
 // Stats returns cache statistics.
 func (s *Service) Stats(ctx context.Context) (*CacheStats, error) {
 	return s.cache.Stats(ctx)
@@ -463,7 +467,6 @@ func (s *Service) fetchAndProcess(
 
 	// Log upstream fetch details
 	s.log.Info("upstream fetched",
-		"request_id", middleware.GetReqID(ctx),
 		"host", req.SourceHost,
 		"path", req.SourcePath,
 		"bytes", fetchBytes,
@@ -548,7 +551,6 @@ func (s *Service) processAndStore(
 	}
 
 	s.log.Info("image converted",
-		"request_id", middleware.GetReqID(ctx),
 		"host", req.SourceHost,
 		"path", req.SourcePath,
 		"src_format", processResult.InputFormat,

internal/middleware/middleware.go

@@ -2,12 +2,9 @@
 package middleware
 
 import (
-	"context"
-	"crypto/rand"
 	"log/slog"
 	"net/http"
 	"net/netip"
-	"regexp"
 	"time"
 
 	basicauth "github.com/99designs/basicauth-go"
@@ -35,10 +32,13 @@ const HSTSValue = "max-age=31536000; includeSubDomains"
 
 // ContentSecurityPolicyValue is the Content-Security-Policy header value.
 // default-src 'self' is the baseline and frame-ancestors 'none' is the primary
-// clickjacking control.
+// clickjacking control. 'unsafe-inline' is required in script-src and style-src
+// because the served templates carry inline onclick handlers (generator page)
+// and the bundled Tailwind asset injects a runtime <style> element; dropping it
+// needs template changes outside this issue's scope.
 const ContentSecurityPolicyValue = "default-src 'self'; " +
-	"script-src 'self'; " +
+	"script-src 'self' 'unsafe-inline'; " +
-	"style-src 'self'; " +
+	"style-src 'self' 'unsafe-inline'; " +
 	"object-src 'none'; " +
 	"base-uri 'self'; " +
 	"form-action 'self'; " +
@@ -115,32 +115,6 @@ func (s *Middleware) RateLimit(
 		})
 }
 
-// requestIDPattern is what a request's own X-Request-Id must look like to be
-// kept as its ID: 1 to 64 letters, digits, '-', '_' or '.'.
-var requestIDPattern = regexp.MustCompile(`^[A-Za-z0-9._-]{1,64}$`)
-
-// RequestID returns a middleware that gives each request an ID and sends it as
-// the X-Request-Id response header, so a client can quote it when reporting a
-// problem. The ID is the request's own X-Request-Id when that matches
-// requestIDPattern, and otherwise a random one, which tells nothing about the
-// machine or the traffic. It is stored in the request context under chi's
-// RequestIDKey, where the logging middleware, the handlers and the upstream
-// fetch read it.
-func (s *Middleware) RequestID() func(http.Handler) http.Handler {
-	return func(next http.Handler) http.Handler {
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			id := r.Header.Get(middleware.RequestIDHeader)
-			if !requestIDPattern.MatchString(id) {
-				id = rand.Text()
-			}
-
-			w.Header().Set(middleware.RequestIDHeader, id)
-			ctx := context.WithValue(r.Context(), middleware.RequestIDKey, id)
-			next.ServeHTTP(w, r.WithContext(ctx))
-		})
-	}
-}
-
 type loggingResponseWriter struct {
 	http.ResponseWriter
 

internal/middleware/middleware_internal_test.go

@@ -1,16 +1,11 @@
 package middleware
 
 import (
-	"bytes"
 	"log/slog"
 	"net/http"
 	"net/http/httptest"
-	"net/url"
-	"strings"
 	"testing"
 
-	"github.com/prometheus/client_golang/prometheus/promhttp"
-
 	"sneak.berlin/go/pixa/internal/config"
 )
 
@@ -61,203 +56,6 @@ func TestCORSAnswersWithConfiguredOrigin(t *testing.T) {
 	}
 }
 
-// TestCORSAnswersPreflightWithConfiguredOrigin checks that the CORS
-// middleware answers a preflight request, which the CORS library handles
-// apart from other requests, the same way: "*" lets any origin read
-// responses and a single origin lets only that origin read them.
-func TestCORSAnswersPreflightWithConfiguredOrigin(t *testing.T) {
-	t.Parallel()
-
-	const appOrigin = "https://app.example.com"
-
-	cases := []struct {
-		configured    string
-		requestOrigin string
-		want          string
-	}{
-		{"*", "https://any.example.com", "*"},
-		{appOrigin, appOrigin, appOrigin},
-		{appOrigin, "https://other.example.com", ""},
-	}
-
-	testHandler := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		w.WriteHeader(http.StatusOK)
-	})
-
-	for _, tc := range cases {
-		mw := &Middleware{
-			log:    slog.Default(),
-			config: &config.Config{AccessControlAllowOrigin: tc.configured},
-		}
-
-		handler := mw.CORS()(testHandler)
-
-		// An OPTIONS request naming the method it asks about is the
-		// preflight a browser sends before some cross-origin requests.
-		req := httptest.NewRequestWithContext(
-			t.Context(), http.MethodOptions, "/v1/image/example.com/a.jpg/1x1.png", nil)
-		req.Header.Set("Origin", tc.requestOrigin)
-		req.Header.Set("Access-Control-Request-Method", http.MethodGet)
-
-		rec := httptest.NewRecorder()
-
-		handler.ServeHTTP(rec, req)
-
-		got := rec.Header().Get("Access-Control-Allow-Origin")
-		if got != tc.want {
-			t.Errorf("configured %q, preflight from %q: "+
-				"Access-Control-Allow-Origin = %q, want %q",
-				tc.configured, tc.requestOrigin, got, tc.want)
-		}
-	}
-}
-
-// TestMetricsAuthRequiresConfiguredCredentials checks that MetricsAuth on
-// its own answers 401 with a challenge to a request without credentials or
-// with a wrong username or password, and lets a request with the configured
-// username and password through. That the router puts it in front of
-// /metrics is not tested.
-func TestMetricsAuthRequiresConfiguredCredentials(t *testing.T) {
-	t.Parallel()
-
-	const (
-		username  = "metricsuser"
-		password  = "metricspass"
-		challenge = `Basic realm="metrics"`
-	)
-
-	// An empty username stands for a request sent without credentials.
-	cases := []struct {
-		name        string
-		username    string
-		password    string
-		wantReached bool
-	}{
-		{"no credentials", "", "", false},
-		{"wrong username", "someone", password, false},
-		{"wrong password", username, "wrongpass", false},
-		{"configured credentials", username, password, true},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			mw := &Middleware{
-				log: slog.Default(),
-				config: &config.Config{
-					MetricsUsername: username,
-					MetricsPassword: password,
-				},
-			}
-
-			reached := false
-			handler := mw.MetricsAuth()(http.HandlerFunc(
-				func(http.ResponseWriter, *http.Request) {
-					reached = true
-				}))
-
-			req := httptest.NewRequestWithContext(
-				t.Context(), http.MethodGet, "/metrics", nil)
-
-			if tc.username != "" {
-				req.SetBasicAuth(tc.username, tc.password)
-			}
-
-			rec := httptest.NewRecorder()
-
-			handler.ServeHTTP(rec, req)
-
-			if reached != tc.wantReached {
-				t.Fatalf("request reached /metrics = %v, want %v",
-					reached, tc.wantReached)
-			}
-
-			if tc.wantReached {
-				return
-			}
-
-			if rec.Code != http.StatusUnauthorized {
-				t.Errorf("status = %d, want %d",
-					rec.Code, http.StatusUnauthorized)
-			}
-
-			if got := rec.Header().Get("WWW-Authenticate"); got != challenge {
-				t.Errorf("WWW-Authenticate = %q, want %q", got, challenge)
-			}
-		})
-	}
-}
-
-// TestMetricsRecordsServedRequest checks that the metrics middleware
-// records a request it served, so /metrics reports it. It is the only test
-// in this package that sets up the metrics middleware, which registers with
-// the process-wide Prometheus registry and can do so only once.
-func TestMetricsRecordsServedRequest(t *testing.T) {
-	t.Parallel()
-
-	// The line /metrics shows once one GET /test has been served.
-	const want = `http_request_duration_seconds_count{` +
-		`code="200",handler="/test",method="GET",service=""} 1`
-
-	mw := &Middleware{log: slog.Default(), config: &config.Config{}}
-
-	handler := mw.Metrics()(http.HandlerFunc(
-		func(w http.ResponseWriter, _ *http.Request) {
-			w.WriteHeader(http.StatusOK)
-		}))
-
-	handler.ServeHTTP(httptest.NewRecorder(), httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, "/test", nil))
-
-	rec := httptest.NewRecorder()
-	promhttp.Handler().ServeHTTP(rec, httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, "/metrics", nil))
-
-	if !strings.Contains(rec.Body.String(), want) {
-		t.Errorf("/metrics does not report the GET /test served; "+
-			"want the line %q in:\n%s", want, rec.Body.String())
-	}
-}
-
-// TestLoggingLeavesOutSubmittedSigningKey checks that a login, a POST /
-// whose form carries the signing key, leaves no trace of the key in the
-// request's log line.
-func TestLoggingLeavesOutSubmittedSigningKey(t *testing.T) {
-	t.Parallel()
-
-	const signingKey = "test-signing-key-0123456789abcdef"
-
-	var buf bytes.Buffer
-
-	mw := newTestMiddleware(t, &buf)
-
-	// The handler reads the key from the form, as the login handler does.
-	handler := mw.Logging()(http.HandlerFunc(
-		func(w http.ResponseWriter, r *http.Request) {
-			if got := r.FormValue("key"); got != signingKey {
-				t.Errorf("key in form = %q, want %q", got, signingKey)
-			}
-
-			w.WriteHeader(http.StatusSeeOther)
-		}))
-
-	form := url.Values{"key": {signingKey}}
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/",
-		strings.NewReader(form.Encode()))
-	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-
-	handler.ServeHTTP(httptest.NewRecorder(), req)
-
-	if !strings.Contains(buf.String(), `"method":"POST"`) {
-		t.Fatalf("no log line for the request; got %q", buf.String())
-	}
-
-	if strings.Contains(buf.String(), signingKey) {
-		t.Errorf("log output contains the signing key; got %q", buf.String())
-	}
-}
-
 func TestSecurityHeaders(t *testing.T) {
 	t.Parallel()
 
@@ -325,13 +123,6 @@ func TestSecurityHeaders_PolicyHeaders(t *testing.T) {
 
 	handler.ServeHTTP(rec, req)
 
-	// The login and generator pages load their script and stylesheet from
-	// /static, so the policy allows no inline script or style.
-	csp := rec.Header().Get("Content-Security-Policy")
-	if strings.Contains(csp, "unsafe-inline") {
-		t.Errorf("Content-Security-Policy allows unsafe-inline: %q", csp)
-	}
-
 	tests := []struct {
 		header string
 		want   string
@@ -340,8 +131,8 @@ func TestSecurityHeaders_PolicyHeaders(t *testing.T) {
 		{
 			"Content-Security-Policy",
 			"default-src 'self'; " +
-				"script-src 'self'; " +
+				"script-src 'self' 'unsafe-inline'; " +
-				"style-src 'self'; " +
+				"style-src 'self' 'unsafe-inline'; " +
 				"object-src 'none'; " +
 				"base-uri 'self'; " +
 				"form-action 'self'; " +

internal/middleware/request_id_internal_test.go

@@ -1,118 +0,0 @@
-package middleware
-
-import (
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/go-chi/chi/v5/middleware"
-
-	"sneak.berlin/go/pixa/internal/config"
-)
-
-// sendRequestID sends a request through the RequestID middleware, carrying
-// incoming as its X-Request-Id unless that is empty. It returns the ID the
-// next handler found in the request context, which the upstream fetch sends
-// and the log lines carry, and the X-Request-Id of the response.
-func sendRequestID(t *testing.T, incoming string) (string, string) {
-	t.Helper()
-
-	mw := &Middleware{log: slog.Default(), config: &config.Config{}}
-
-	var inContext string
-
-	handler := mw.RequestID()(http.HandlerFunc(
-		func(_ http.ResponseWriter, r *http.Request) {
-			inContext = middleware.GetReqID(r.Context())
-		}))
-
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
-	if incoming != "" {
-		req.Header.Set("X-Request-Id", incoming)
-	}
-
-	rec := httptest.NewRecorder()
-	handler.ServeHTTP(rec, req)
-
-	return inContext, rec.Header().Get("X-Request-Id")
-}
-
-// TestRequestIDKeepsShortPlainID verifies that a request's own X-Request-Id of
-// at most 64 letters, digits, '-', '_' or '.' is kept as its ID.
-func TestRequestIDKeepsShortPlainID(t *testing.T) {
-	t.Parallel()
-
-	for _, incoming := range []string{
-		"client-request-id",
-		"A1_b2.c3-d4",
-		strings.Repeat("a", 64),
-	} {
-		inContext, inResponse := sendRequestID(t, incoming)
-
-		if inContext != incoming || inResponse != incoming {
-			t.Errorf("incoming %q: context has %q, response %q, want both %q",
-				incoming, inContext, inResponse, incoming)
-		}
-	}
-}
-
-// TestRequestIDReplacesLongOrUnusualID verifies that a request's own
-// X-Request-Id that is over 64 characters or holds anything but letters,
-// digits, '-', '_' or '.' is neither sent back nor sent upstream: the request
-// gets a fresh ID instead.
-func TestRequestIDReplacesLongOrUnusualID(t *testing.T) {
-	t.Parallel()
-
-	for _, incoming := range []string{
-		strings.Repeat("a", 65),
-		strings.Repeat("a", 9000),
-		"has space",
-		"a/b",
-		"a,b",
-		"<script>",
-		"ünicode",
-	} {
-		inContext, inResponse := sendRequestID(t, incoming)
-		t.Logf("incoming %.20q: made up %q", incoming, inResponse)
-
-		if inResponse == "" || inResponse == incoming {
-			t.Errorf("incoming %.20q: response has %q, want a fresh ID",
-				incoming, inResponse)
-		}
-
-		if inContext != inResponse {
-			t.Errorf("incoming %.20q: context has %q, want the response's %q",
-				incoming, inContext, inResponse)
-		}
-	}
-}
-
-// TestRequestIDMadeUpTellsNothing verifies that the ID made up for a request
-// that sent none differs for every request and does not hold the host name.
-func TestRequestIDMadeUpTellsNothing(t *testing.T) {
-	t.Parallel()
-
-	hostname, err := os.Hostname()
-	if err != nil {
-		t.Fatalf("os.Hostname() error = %v", err)
-	}
-
-	firstInContext, first := sendRequestID(t, "")
-	_, second := sendRequestID(t, "")
-	t.Logf("host %q, made up %q and %q", hostname, first, second)
-
-	if first == "" || first == second {
-		t.Errorf("made up %q and %q, want two different IDs", first, second)
-	}
-
-	if firstInContext != first {
-		t.Errorf("context has %q, want the response's %q", firstInContext, first)
-	}
-
-	if strings.Contains(first, hostname) {
-		t.Errorf("made-up ID %q holds the host name %q", first, hostname)
-	}
-}

internal/server/image_proxy_internal_test.go

@@ -1,302 +0,0 @@
-package server
-
-import (
-	"bytes"
-	"context"
-	"crypto/sha256"
-	"database/sql"
-	"encoding/hex"
-	"image"
-	"image/color"
-	"image/jpeg"
-	"image/png"
-	"io"
-	"net"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"sync/atomic"
-	"testing"
-
-	"go.uber.org/fx"
-	"go.uber.org/fx/fxtest"
-
-	"sneak.berlin/go/pixa/internal/config"
-	"sneak.berlin/go/pixa/internal/database"
-	"sneak.berlin/go/pixa/internal/globals"
-	"sneak.berlin/go/pixa/internal/handlers"
-	"sneak.berlin/go/pixa/internal/healthcheck"
-	"sneak.berlin/go/pixa/internal/httpfetcher"
-	"sneak.berlin/go/pixa/internal/logger"
-	"sneak.berlin/go/pixa/internal/middleware"
-)
-
-// upstreamHost is the upstream host of the image URLs below. It is a
-// documentation address (RFC 5737), which the fetcher's URL check accepts as
-// public; the fetcher's dial function connects it to the test upstream server.
-const upstreamHost = "192.0.2.10"
-
-// TestImageProxyFlow requests images through pixa's router, handlers,
-// upstream fetcher, image processor, disk cache and database, with only the
-// upstream origin replaced by a local test server. The first request for a URL
-// is fetched and converted; the second is served from the cache without
-// another upstream request. The source and the converted image are then on
-// disk, with their rows in the database.
-func TestImageProxyFlow(t *testing.T) {
-	t.Parallel()
-
-	source := encodeTestPNG(t, 64, 48)
-
-	tests := []struct {
-		name          string
-		sizeFormat    string // the <size>.<format> part of the image URL
-		contentType   string
-		decodeConfig  func(io.Reader) (image.Config, error)
-		width, height int
-	}{
-		{"resize and convert to JPEG", "32x24.jpeg", "image/jpeg",
-			jpeg.DecodeConfig, 32, 24},
-		{"orig", "orig.orig", "image/png", png.DecodeConfig, 64, 48},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			var upstreamRequests atomic.Int32
-
-			upstream := httptest.NewServer(http.HandlerFunc(
-				func(w http.ResponseWriter, _ *http.Request) {
-					upstreamRequests.Add(1)
-					w.Header().Set("Content-Type", "image/png")
-					_, _ = w.Write(source)
-				}))
-			t.Cleanup(upstream.Close)
-
-			s, db, stateDir := startImageProxy(t, upstream)
-			target := "/v1/image/" + upstreamHost + "/photo.png/" + tt.sizeFormat
-
-			first := getImage(t, s, target)
-
-			if got := first.Header().Get("X-Pixa-Cache"); got != "MISS" {
-				t.Errorf("first X-Pixa-Cache = %q, want MISS", got)
-			}
-
-			if got := first.Header().Get("Content-Type"); got != tt.contentType {
-				t.Errorf("Content-Type = %q, want %q", got, tt.contentType)
-			}
-
-			decoded, err := tt.decodeConfig(bytes.NewReader(first.Body.Bytes()))
-			if err != nil {
-				t.Fatalf("decoding the image: %v", err)
-			}
-
-			if decoded.Width != tt.width || decoded.Height != tt.height {
-				t.Errorf("image is %dx%d, want %dx%d",
-					decoded.Width, decoded.Height, tt.width, tt.height)
-			}
-
-			second := getImage(t, s, target)
-
-			if got := second.Header().Get("X-Pixa-Cache"); got != "HIT" {
-				t.Errorf("second X-Pixa-Cache = %q, want HIT", got)
-			}
-
-			if !bytes.Equal(second.Body.Bytes(), first.Body.Bytes()) {
-				t.Error("the second response is not the image the first served")
-			}
-
-			if got := upstreamRequests.Load(); got != 1 {
-				t.Errorf("upstream received %d requests, want 1", got)
-			}
-
-			checkSourceCached(t, db, stateDir, source)
-			checkVariantCached(t, db, stateDir, first.Body.Bytes(), tt.contentType)
-		})
-	}
-}
-
-// startImageProxy starts the components pixad's fx app builds, from a config
-// with a fresh state directory and upstreamHost on the allowlist, and with an
-// upstream fetcher that connects every upstream address to upstream. It
-// returns the server with its routes, the database and the state directory.
-func startImageProxy(
-	t *testing.T, upstream *httptest.Server,
-) (*Server, *sql.DB, string) {
-	t.Helper()
-
-	stateDir := t.TempDir()
-	cfg := &config.Config{
-		SigningKey:     testSigningKey,
-		StateDir:       stateDir,
-		DBURL:          "file:" + filepath.Join(stateDir, "state.sqlite3"),
-		AllowlistHosts: []string{upstreamHost},
-		// The test upstream server has no TLS.
-		AllowHTTP: true,
-		// A limit of its own, so the cache does not size itself from the
-		// host's free disk space.
-		CacheMaxBytes:           64 << 20,
-		CacheMaxBytesExplicit:   true,
-		UpstreamMaxResponseSize: config.DefaultUpstreamMaxResponseSize,
-		DownstreamTimeout:       config.DefaultDownstreamTimeout,
-	}
-
-	fetcherCfg := httpfetcher.DefaultConfig()
-	fetcherCfg.AllowHTTP = true
-	fetcherCfg.DialContext = func(
-		ctx context.Context, network, _ string,
-	) (net.Conn, error) {
-		var dialer net.Dialer
-
-		return dialer.DialContext(ctx, network, upstream.Listener.Addr().String())
-	}
-	fetcher := httpfetcher.New(fetcherCfg)
-
-	var (
-		h  *handlers.Handlers
-		mw *middleware.Middleware
-		db *database.Database
-	)
-
-	app := fxtest.New(t,
-		fx.Supply(cfg),
-		fx.Provide(
-			globals.New,
-			logger.New,
-			database.New,
-			healthcheck.New,
-			handlers.New,
-			middleware.New,
-			func() httpfetcher.Fetcher { return fetcher },
-		),
-		fx.Populate(&h, &mw, &db),
-	)
-	app.RequireStart()
-	t.Cleanup(app.RequireStop)
-
-	// Requests go straight to the router, as in newTestServer; the server's
-	// own start hook, which listens on a port, is left out.
-	s := &Server{config: cfg, mw: mw, h: h}
-	s.SetupRoutes()
-
-	return s, db.DB(), stateDir
-}
-
-// getImage sends a GET for target to s and fails unless it answers 200.
-func getImage(t *testing.T, s *Server, target string) *httptest.ResponseRecorder {
-	t.Helper()
-
-	rec := httptest.NewRecorder()
-	s.ServeHTTP(rec, httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, target, nil))
-	t.Logf("GET %s: %d, X-Pixa-Cache %s",
-		target, rec.Code, rec.Header().Get("X-Pixa-Cache"))
-
-	if rec.Code != http.StatusOK {
-		t.Fatalf("GET %s status = %d, want %d; body %s",
-			target, rec.Code, http.StatusOK, rec.Body.String())
-	}
-
-	return rec
-}
-
-// checkSourceCached checks that source is stored under its SHA-256 in
-// cache/sources, recorded in source_content, and that the source URL's row in
-// source_metadata points at it.
-func checkSourceCached(t *testing.T, db *sql.DB, stateDir string, source []byte) {
-	t.Helper()
-
-	sum := sha256.Sum256(source)
-	hash := hex.EncodeToString(sum[:])
-
-	checkFile(t, filepath.Join(stateDir, "cache", "sources", hash[0:2], hash[2:4], hash),
-		source)
-
-	var rows int
-
-	err := db.QueryRowContext(t.Context(),
-		"SELECT COUNT(*) FROM source_content WHERE content_hash = ?", hash,
-	).Scan(&rows)
-	if err != nil || rows != 1 {
-		t.Errorf("source_content rows for the source = %d (error %v), want 1",
-			rows, err)
-	}
-
-	var metadataHash string
-
-	err = db.QueryRowContext(t.Context(),
-		`SELECT content_hash FROM source_metadata
-			WHERE source_host = ? AND source_path = ?`,
-		upstreamHost, "/photo.png",
-	).Scan(&metadataHash)
-	if err != nil || metadataHash != hash {
-		t.Errorf("source_metadata content_hash = %q (error %v), want %q",
-			metadataHash, err, hash)
-	}
-}
-
-// checkVariantCached checks that the converted image served is recorded in
-// variant_content with contentType, and stored under its cache key in
-// cache/variants.
-func checkVariantCached(
-	t *testing.T, db *sql.DB, stateDir string, served []byte, contentType string,
-) {
-	t.Helper()
-
-	var cacheKey, storedType string
-
-	err := db.QueryRowContext(t.Context(),
-		"SELECT cache_key, content_type FROM variant_content",
-	).Scan(&cacheKey, &storedType)
-	if err != nil {
-		t.Fatalf("variant_content row: %v", err)
-	}
-
-	if storedType != contentType {
-		t.Errorf("variant_content content_type = %q, want %q",
-			storedType, contentType)
-	}
-
-	checkFile(t, filepath.Join(stateDir, "cache", "variants",
-		cacheKey[0:2], cacheKey[2:4], cacheKey), served)
-}
-
-// checkFile checks that the file at path holds want.
-func checkFile(t *testing.T, path string, want []byte) {
-	t.Helper()
-
-	//nolint:gosec // G304: a path under the test's state directory
-	got, err := os.ReadFile(path)
-	if err != nil {
-		t.Errorf("reading %s: %v", path, err)
-
-		return
-	}
-
-	if !bytes.Equal(got, want) {
-		t.Errorf("%s holds %d bytes that are not the %d expected",
-			path, len(got), len(want))
-	}
-}
-
-// encodeTestPNG returns an opaque width x height PNG of one color.
-func encodeTestPNG(t *testing.T, width, height int) []byte {
-	t.Helper()
-
-	img := image.NewRGBA(image.Rect(0, 0, width, height))
-	for y := range height {
-		for x := range width {
-			img.Set(x, y, color.RGBA{R: 200, G: 40, B: 40, A: 255})
-		}
-	}
-
-	var buf bytes.Buffer
-
-	err := png.Encode(&buf, img)
-	if err != nil {
-		t.Fatalf("encoding the test PNG: %v", err)
-	}
-
-	return buf.Bytes()
-}

internal/server/metrics_internal_test.go

@@ -1,32 +0,0 @@
-package server
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	"github.com/prometheus/client_golang/prometheus/promhttp"
-)
-
-// TestNoMetricsRecordedWithoutMetricsUsername checks that with no metrics
-// username set the router records nothing about the requests it serves.
-// /metrics is not served then, so the process-wide Prometheus registry is
-// read directly. TestMaintenanceModeKeepsOtherRoutes records into the same
-// registry, but never a GET /robots.txt.
-func TestNoMetricsRecordedWithoutMetricsUsername(t *testing.T) {
-	t.Parallel()
-
-	s := newTestServer(t)
-	s.ServeHTTP(httptest.NewRecorder(), httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, "/robots.txt", nil))
-
-	rec := httptest.NewRecorder()
-	promhttp.Handler().ServeHTTP(rec, httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, "/metrics", nil))
-
-	if strings.Contains(rec.Body.String(), `handler="/robots.txt"`) {
-		t.Errorf("with no metrics username GET /robots.txt was recorded:\n%s",
-			rec.Body.String())
-	}
-}

internal/server/request_id_internal_test.go

@@ -1,58 +0,0 @@
-package server
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"testing"
-)
-
-// requestIDHeader is the header that carries a request's ID.
-const requestIDHeader = "X-Request-Id"
-
-// TestResponsesCarryRequestID verifies that every response, whatever its route
-// and status, carries the request's ID as X-Request-Id, so a client can quote
-// it when reporting a problem: one pixa made up when the request brought none,
-// and the request's own X-Request-Id when it brought one.
-func TestResponsesCarryRequestID(t *testing.T) {
-	t.Parallel()
-
-	const clientRequestID = "client-request-id"
-
-	s := newTestServer(t)
-
-	paths := []string{
-		"/robots.txt",
-		"/no-such-path",
-		unsignedImagePath,
-		encryptedImagePath,
-	}
-
-	for _, path := range paths {
-		t.Run(path, func(t *testing.T) {
-			t.Parallel()
-
-			rec := httptest.NewRecorder()
-			s.ServeHTTP(rec, httptest.NewRequestWithContext(
-				t.Context(), http.MethodGet, path, nil))
-			t.Logf("status %d, %s %q",
-				rec.Code, requestIDHeader, rec.Header().Get(requestIDHeader))
-
-			if rec.Header().Get(requestIDHeader) == "" {
-				t.Errorf("response has no %s", requestIDHeader)
-			}
-
-			req := httptest.NewRequestWithContext(
-				t.Context(), http.MethodGet, path, nil)
-			req.Header.Set(requestIDHeader, clientRequestID)
-
-			rec = httptest.NewRecorder()
-			s.ServeHTTP(rec, req)
-
-			got := rec.Header().Get(requestIDHeader)
-			if got != clientRequestID {
-				t.Errorf("%s = %q, want the request's own %q",
-					requestIDHeader, got, clientRequestID)
-			}
-		})
-	}
-}

internal/server/routes.go

@@ -28,7 +28,7 @@ func (s *Server) SetupRoutes() {
 	s.router = chi.NewRouter()
 
 	s.router.Use(middleware.Recoverer)
-	s.router.Use(s.mw.RequestID())
+	s.router.Use(middleware.RequestID)
 	s.router.Use(s.mw.ClientIP())
 	s.router.Use(s.mw.SecurityHeaders())
 	s.router.Use(s.mw.Logging())
@@ -53,7 +53,7 @@ func (s *Server) SetupRoutes() {
 	// Robots.txt
 	s.router.Get("/robots.txt", s.h.HandleRobotsTxt())
 
-	// The login and generator pages' stylesheet and script
+	// Static files (Tailwind CSS, etc.)
 	s.router.Handle("/static/*", http.StripPrefix("/static/", static.Handler()))
 
 	// Login/generator UI. The form routes carry CSRF protection; the
@@ -97,7 +97,6 @@ func (s *Server) SetupRoutes() {
 			// The trailing filename (e.g., /img.jpg) is ignored but helps
 			// browsers with content type
 			r.Get("/e/{token}/*", s.h.HandleImageEnc())
-			r.Head("/e/{token}/*", s.h.HandleImageEnc())
 		})
 	})
 

internal/server/routes_internal_test.go

@@ -1,27 +0,0 @@
-package server
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"testing"
-)
-
-// TestEncryptedImageRouteAnswersHEAD verifies that HEAD on the encrypted image
-// route reaches its handler, as GET does, instead of being answered 405 Method
-// Not Allowed. The handler refuses a token it cannot decrypt with 400, so that
-// status shows the request got through.
-func TestEncryptedImageRouteAnswersHEAD(t *testing.T) {
-	t.Parallel()
-
-	s := newTestServer(t)
-
-	rec := httptest.NewRecorder()
-	s.ServeHTTP(rec, httptest.NewRequestWithContext(
-		t.Context(), http.MethodHead, encryptedImagePath, nil))
-	t.Logf("status %d", rec.Code)
-
-	if rec.Code != http.StatusBadRequest {
-		t.Errorf("status = %d, want %d from the encrypted image handler",
-			rec.Code, http.StatusBadRequest)
-	}
-}

internal/static/generator.js

@@ -1,10 +0,0 @@
-// Generator page: a click on the generated URL selects it, and the Copy
-// button copies it. Both are on the page only once a URL has been generated.
-const generatedURL = document.getElementById("generated-url");
-
-if (generatedURL) {
-    generatedURL.addEventListener("click", () => generatedURL.select());
-    document.getElementById("copy-url").addEventListener("click", () => {
-        navigator.clipboard.writeText(generatedURL.value);
-    });
-}

internal/static/static.go

@@ -7,7 +7,7 @@ import (
 	"net/http"
 )
 
-//go:embed *.css *.js
+//go:embed *.js
 var files embed.FS
 
 // FS returns the embedded filesystem containing static files.

internal/static/style.css

@@ -1,190 +0,0 @@
-/* The login and generator pages. */
-
-* {
-    box-sizing: border-box;
-}
-
-body {
-    margin: 0;
-    min-height: 100vh;
-    background: #f3f4f6;
-    font-family: system-ui, sans-serif;
-    line-height: 1.5;
-}
-
-h1 {
-    margin: 0;
-    font-size: 1.5rem;
-    line-height: 2rem;
-    font-weight: 700;
-    color: #1f2937;
-}
-
-label {
-    display: block;
-    margin-bottom: 0.25rem;
-    font-size: 0.875rem;
-    font-weight: 500;
-    color: #374151;
-}
-
-input,
-select {
-    width: 100%;
-    padding: 0.5rem 0.75rem;
-    border: 1px solid #d1d5db;
-    border-radius: 0.375rem;
-    box-shadow: 0 1px 2px rgb(0 0 0 / 5%);
-    font: inherit;
-}
-
-input:focus,
-select:focus {
-    outline: none;
-    border-color: #3b82f6;
-    box-shadow: 0 0 0 2px #3b82f6;
-}
-
-button {
-    width: 100%;
-    padding: 0.5rem 1rem;
-    border: none;
-    border-radius: 0.375rem;
-    background: #2563eb;
-    color: #fff;
-    font: inherit;
-    cursor: pointer;
-    transition: background-color 0.15s;
-}
-
-button:hover {
-    background: #1d4ed8;
-}
-
-button:focus {
-    outline: 2px solid #3b82f6;
-    outline-offset: 2px;
-}
-
-form > * + * {
-    margin-top: 1rem;
-}
-
-.card {
-    padding: 1.5rem;
-    border-radius: 0.5rem;
-    background: #fff;
-    box-shadow:
-        0 4px 6px -1px rgb(0 0 0 / 10%),
-        0 2px 4px -2px rgb(0 0 0 / 10%);
-}
-
-.error {
-    margin-bottom: 1rem;
-    padding: 0.75rem 1rem;
-    border: 1px solid #f87171;
-    border-radius: 0.25rem;
-    background: #fee2e2;
-    color: #b91c1c;
-}
-
-/* Login page: the card centred on the screen. */
-
-.login {
-    display: flex;
-    align-items: center;
-    justify-content: center;
-}
-
-.login .card {
-    width: 100%;
-    max-width: 28rem;
-    padding: 2rem;
-}
-
-.login h1 {
-    margin-bottom: 1.5rem;
-    text-align: center;
-}
-
-/* Generator page. */
-
-.page {
-    max-width: 42rem;
-    margin: 0 auto;
-    padding: 2rem 1rem;
-}
-
-header {
-    display: flex;
-    justify-content: space-between;
-    align-items: center;
-    margin-bottom: 2rem;
-}
-
-header a {
-    font-size: 0.875rem;
-    color: #4b5563;
-}
-
-header a:hover {
-    color: #1f2937;
-}
-
-.result {
-    margin-bottom: 1.5rem;
-    padding: 1rem;
-    border: 1px solid #bbf7d0;
-    border-radius: 0.5rem;
-    background: #f0fdf4;
-}
-
-.result h2 {
-    margin: 0 0 0.5rem;
-    font-size: 0.875rem;
-    font-weight: 500;
-    color: #166534;
-}
-
-.result div {
-    display: flex;
-    gap: 0.5rem;
-}
-
-.result input {
-    flex: 1;
-    border-color: #86efac;
-    box-shadow: none;
-    font-family: ui-monospace, monospace;
-    font-size: 0.875rem;
-}
-
-.result button {
-    width: auto;
-    padding: 0.5rem 0.75rem;
-    background: #16a34a;
-    font-size: 0.875rem;
-}
-
-.result button:hover {
-    background: #15803d;
-}
-
-.result p {
-    margin: 0.5rem 0 0;
-    font-size: 0.75rem;
-    color: #16a34a;
-}
-
-.columns {
-    display: grid;
-    grid-template-columns: repeat(2, minmax(0, 1fr));
-    gap: 1rem;
-}
-
-.note {
-    margin-top: 1rem;
-    font-size: 0.75rem;
-    color: #6b7280;
-    text-align: center;
-}

internal/templates/generator.html

@@ -4,47 +4,52 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>Pixa - URL Generator</title>
-    <link rel="stylesheet" href="/static/style.css">
+    <script src="/static/tailwind.js"></script>
 </head>
-<body>
+<body class="bg-gray-100 min-h-screen">
-    <div class="page">
+    <div class="max-w-2xl mx-auto py-8 px-4">
-        <header>
+        <div class="flex justify-between items-center mb-8">
-            <h1>Pixa URL Generator</h1>
+            <h1 class="text-2xl font-bold text-gray-800">Pixa URL Generator</h1>
-            <a href="/logout">
+            <a href="/logout" class="text-sm text-gray-600 hover:text-gray-800 underline">
                 Logout
             </a>
-        </header>
+        </div>
 
         {{if .GeneratedURL}}
-        <div class="result">
+        <div class="bg-green-50 border border-green-200 rounded-lg p-4 mb-6">
-            <h2>Generated URL</h2>
+            <h2 class="text-sm font-medium text-green-800 mb-2">Generated URL</h2>
-            <div>
+            <div class="flex gap-2">
                 <input
                     type="text"
                     readonly
                     value="{{.GeneratedURL}}"
                     id="generated-url"
+                    class="flex-1 px-3 py-2 bg-white border border-green-300 rounded-md text-sm font-mono"
+                    onclick="this.select()"
+                >
+                <button
+                    onclick="navigator.clipboard.writeText(document.getElementById('generated-url').value)"
+                    class="px-3 py-2 bg-green-600 text-white rounded-md hover:bg-green-700 text-sm"
                 >
-                <button id="copy-url">
                     Copy
                 </button>
             </div>
-            <p>
+            <p class="text-xs text-green-600 mt-2">
                 Expires: {{.ExpiresAt}}
             </p>
         </div>
         {{end}}
 
         {{if .Error}}
-        <div class="error">
+        <div class="bg-red-100 border border-red-400 text-red-700 px-4 py-3 rounded mb-6">
             {{.Error}}
         </div>
         {{end}}
 
-        <form method="POST" action="/generate" class="card">
+        <form method="POST" action="/generate" class="bg-white rounded-lg shadow-md p-6 space-y-4">
             {{ .CSRFField }}
             <div>
-                <label for="url">
+                <label for="url" class="block text-sm font-medium text-gray-700 mb-1">
                     Source URL
                 </label>
                 <input
@@ -54,12 +59,13 @@
                     required
                     placeholder="https://example.com/image.jpg"
                     value="{{.FormURL}}"
+                    class="w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm focus:outline-none focus:ring-2 focus:ring-blue-500 focus:border-blue-500"
                 >
             </div>
 
-            <div class="columns">
+            <div class="grid grid-cols-2 gap-4">
                 <div>
-                    <label for="width">
+                    <label for="width" class="block text-sm font-medium text-gray-700 mb-1">
                         Width
                     </label>
                     <input
@@ -70,10 +76,11 @@
                         max="8192"
                         value="{{if .FormWidth}}{{.FormWidth}}{{else}}0{{end}}"
                         placeholder="0 = original"
+                        class="w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm focus:outline-none focus:ring-2 focus:ring-blue-500 focus:border-blue-500"
                     >
                 </div>
                 <div>
-                    <label for="height">
+                    <label for="height" class="block text-sm font-medium text-gray-700 mb-1">
                         Height
                     </label>
                     <input
@@ -84,16 +91,21 @@
                         max="8192"
                         value="{{if .FormHeight}}{{.FormHeight}}{{else}}0{{end}}"
                         placeholder="0 = original"
+                        class="w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm focus:outline-none focus:ring-2 focus:ring-blue-500 focus:border-blue-500"
                     >
                 </div>
             </div>
 
-            <div class="columns">
+            <div class="grid grid-cols-2 gap-4">
                 <div>
-                    <label for="format">
+                    <label for="format" class="block text-sm font-medium text-gray-700 mb-1">
                         Format
                     </label>
-                    <select id="format" name="format">
+                    <select
+                        id="format"
+                        name="format"
+                        class="w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm focus:outline-none focus:ring-2 focus:ring-blue-500 focus:border-blue-500"
+                    >
                         <option value="orig" {{if eq .FormFormat "orig"}}selected{{end}}>Original</option>
                         <option value="jpeg" {{if eq .FormFormat "jpeg"}}selected{{end}}>JPEG</option>
                         <option value="png" {{if eq .FormFormat "png"}}selected{{end}}>PNG</option>
@@ -103,10 +115,14 @@
                     </select>
                 </div>
                 <div>
-                    <label for="quality">
+                    <label for="quality" class="block text-sm font-medium text-gray-700 mb-1">
                         Quality
                     </label>
-                    <select id="quality" name="quality">
+                    <select
+                        id="quality"
+                        name="quality"
+                        class="w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm focus:outline-none focus:ring-2 focus:ring-blue-500 focus:border-blue-500"
+                    >
                         <option value="25" {{if eq .FormQuality "25"}}selected{{end}}>Potato</option>
                         <option value="50" {{if eq .FormQuality "50"}}selected{{end}}>Low</option>
                         <option value="70" {{if eq .FormQuality "70"}}selected{{end}}>Medium</option>
@@ -116,12 +132,16 @@
                 </div>
             </div>
 
-            <div class="columns">
+            <div class="grid grid-cols-2 gap-4">
                 <div>
-                    <label for="fit">
+                    <label for="fit" class="block text-sm font-medium text-gray-700 mb-1">
                         Fit Mode
                     </label>
-                    <select id="fit" name="fit">
+                    <select
+                        id="fit"
+                        name="fit"
+                        class="w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm focus:outline-none focus:ring-2 focus:ring-blue-500 focus:border-blue-500"
+                    >
                         <option value="cover" {{if eq .FormFit "cover"}}selected{{end}}>Cover</option>
                         <option value="contain" {{if eq .FormFit "contain"}}selected{{end}}>Contain</option>
                         <option value="fill" {{if eq .FormFit "fill"}}selected{{end}}>Fill</option>
@@ -130,10 +150,14 @@
                     </select>
                 </div>
                 <div>
-                    <label for="ttl">
+                    <label for="ttl" class="block text-sm font-medium text-gray-700 mb-1">
                         Expires In
                     </label>
-                    <select id="ttl" name="ttl">
+                    <select
+                        id="ttl"
+                        name="ttl"
+                        class="w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm focus:outline-none focus:ring-2 focus:ring-blue-500 focus:border-blue-500"
+                    >
                         <option value="0" {{if or (eq .FormTTL "0") (eq .FormTTL "")}}selected{{end}}>Never</option>
                         <option value="60" {{if eq .FormTTL "60"}}selected{{end}}>1 minute</option>
                         <option value="3600" {{if eq .FormTTL "3600"}}selected{{end}}>1 hour</option>
@@ -145,15 +169,17 @@
                 </div>
             </div>
 
-            <button type="submit">
+            <button
+                type="submit"
+                class="w-full bg-blue-600 text-white py-2 px-4 rounded-md hover:bg-blue-700 focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2 transition-colors"
+            >
                 Generate Encrypted URL
             </button>
         </form>
 
-        <p class="note">
+        <p class="text-xs text-gray-500 mt-4 text-center">
             Generated URLs are encrypted and cannot be modified. They will expire at the specified time.
         </p>
     </div>
-    <script src="/static/generator.js"></script>
 </body>
 </html>

internal/templates/login.html

@@ -4,22 +4,22 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>Pixa - Login</title>
-    <link rel="stylesheet" href="/static/style.css">
+    <script src="/static/tailwind.js"></script>
 </head>
-<body class="login">
+<body class="bg-gray-100 min-h-screen flex items-center justify-center">
-    <div class="card">
+    <div class="bg-white p-8 rounded-lg shadow-md w-full max-w-md">
-        <h1>Pixa Image Proxy</h1>
+        <h1 class="text-2xl font-bold text-gray-800 mb-6 text-center">Pixa Image Proxy</h1>
 
         {{if .Error}}
-        <div class="error">
+        <div class="bg-red-100 border border-red-400 text-red-700 px-4 py-3 rounded mb-4">
             {{.Error}}
         </div>
         {{end}}
 
-        <form method="POST" action="/">
+        <form method="POST" action="/" class="space-y-4">
             {{ .CSRFField }}
             <div>
-                <label for="key">
+                <label for="key" class="block text-sm font-medium text-gray-700 mb-1">
                     Signing Key
                 </label>
                 <input
@@ -28,11 +28,15 @@
                     name="key"
                     required
                     autocomplete="current-password"
+                    class="w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm focus:outline-none focus:ring-2 focus:ring-blue-500 focus:border-blue-500"
                     placeholder="Enter your signing key"
                 >
             </div>
 
-            <button type="submit">
+            <button
+                type="submit"
+                class="w-full bg-blue-600 text-white py-2 px-4 rounded-md hover:bg-blue-700 focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2 transition-colors"
+            >
                 Login
             </button>
         </form>

scripts/manual-test.sh

@@ -0,0 +1,147 @@
+#!/bin/bash
+#
+# Manual test script for pixa server
+# Requires: server running on localhost:8080
+#
+set -e
+
+BASE_URL="${BASE_URL:-http://localhost:8080}"
+SIGNING_KEY="${SIGNING_KEY:-test-signing-key-for-development-only}"
+TEST_IMAGE_URL="https://s3.sneak.cloud/sneak-public/2021/2021-04-18.untitled.a7r4.07723.jpg"
+COOKIE_JAR=$(mktemp)
+
+cleanup() {
+    rm -f "$COOKIE_JAR"
+}
+trap cleanup EXIT
+
+pass() {
+    echo "✓ PASS: $1"
+}
+
+fail() {
+    echo "✗ FAIL: $1"
+    exit 1
+}
+
+echo "=== Pixa Manual Test Suite ==="
+echo "Base URL: $BASE_URL"
+echo ""
+
+# Test 1: Healthcheck
+echo "--- Test 1: Healthcheck endpoint ---"
+HEALTH=$(curl -sf "$BASE_URL/.well-known/healthcheck.json")
+if echo "$HEALTH" | grep -q '"status"'; then
+    pass "Healthcheck returns status"
+else
+    fail "Healthcheck did not return expected response"
+fi
+
+# Test 2: Login page displays
+echo "--- Test 2: Login page (GET /) ---"
+LOGIN_PAGE=$(curl -sf "$BASE_URL/")
+if echo "$LOGIN_PAGE" | grep -qi "password\|login\|sign"; then
+    pass "Login page displays password form"
+else
+    fail "Login page did not display expected content"
+fi
+
+# Test 3: Wrong password shows error
+echo "--- Test 3: Login with wrong password ---"
+WRONG_LOGIN=$(curl -sf -X POST "$BASE_URL/" -d "key=wrong-key" -c "$COOKIE_JAR")
+if echo "$WRONG_LOGIN" | grep -qi "invalid\|error\|incorrect\|wrong"; then
+    pass "Wrong password shows error message"
+else
+    fail "Wrong password did not show error"
+fi
+
+# Test 4: Correct password redirects to generator
+echo "--- Test 4: Login with correct signing key ---"
+curl -sf -X POST "$BASE_URL/" -d "key=$SIGNING_KEY" -c "$COOKIE_JAR" -b "$COOKIE_JAR" -L -o /dev/null
+GENERATOR_PAGE=$(curl -sf "$BASE_URL/" -b "$COOKIE_JAR")
+if echo "$GENERATOR_PAGE" | grep -qi "generate\|url\|source\|logout"; then
+    pass "Correct password shows generator page"
+else
+    fail "Generator page not displayed after login"
+fi
+
+# Test 5: Generate encrypted URL
+echo "--- Test 5: Generate encrypted URL ---"
+GEN_RESULT=$(curl -sf -X POST "$BASE_URL/generate" -b "$COOKIE_JAR" \
+    -d "url=$TEST_IMAGE_URL" \
+    -d "width=800" \
+    -d "height=600" \
+    -d "format=jpeg" \
+    -d "quality=85" \
+    -d "fit=cover" \
+    -d "ttl=3600")
+if echo "$GEN_RESULT" | grep -q "/v1/e/"; then
+    pass "Encrypted URL generated"
+    # Extract the encrypted URL
+    ENC_URL=$(echo "$GEN_RESULT" | grep -o '/v1/e/[^"<]*' | head -1)
+    echo "  Generated URL: $ENC_URL"
+else
+    fail "Failed to generate encrypted URL"
+fi
+
+# Test 6: Fetch image via encrypted URL
+echo "--- Test 6: Fetch image via encrypted URL ---"
+if [ -n "$ENC_URL" ]; then
+    HTTP_CODE=$(curl -sf -o /dev/null -w "%{http_code}" "$BASE_URL$ENC_URL")
+    if [ "$HTTP_CODE" = "200" ]; then
+        pass "Encrypted URL returns image (HTTP 200)"
+    else
+        fail "Encrypted URL returned HTTP $HTTP_CODE"
+    fi
+else
+    fail "No encrypted URL to test"
+fi
+
+# Test 7: Fetch image via allowlisted host (direct proxy)
+echo "--- Test 7: Fetch image via direct proxy (allowlisted host) ---"
+# URL format: /v1/image/<host>/<path>/<WxH>.<format>
+PROXY_PATH="/v1/image/s3.sneak.cloud/sneak-public/2021/2021-04-18.untitled.a7r4.07723.jpg/400x300.jpeg"
+HTTP_CODE=$(curl -sf -o /dev/null -w "%{http_code}" "$BASE_URL$PROXY_PATH")
+if [ "$HTTP_CODE" = "200" ]; then
+    pass "Direct proxy returns image (HTTP 200)"
+else
+    fail "Direct proxy returned HTTP $HTTP_CODE"
+fi
+
+# Test 8: Logout
+echo "--- Test 8: Logout ---"
+curl -sf "$BASE_URL/logout" -b "$COOKIE_JAR" -c "$COOKIE_JAR" -L -o /dev/null
+AFTER_LOGOUT=$(curl -sf "$BASE_URL/" -b "$COOKIE_JAR")
+if echo "$AFTER_LOGOUT" | grep -qi "password\|login"; then
+    pass "Logout redirects to login page"
+else
+    fail "Logout did not redirect to login"
+fi
+
+# Test 9: Generate short-TTL URL and verify expiration
+echo "--- Test 9: Expired URL returns 410 ---"
+# Login again
+curl -sf -X POST "$BASE_URL/" -d "key=$SIGNING_KEY" -c "$COOKIE_JAR" -b "$COOKIE_JAR" -L -o /dev/null
+# Generate URL with 1 second TTL
+GEN_RESULT=$(curl -sf -X POST "$BASE_URL/generate" -b "$COOKIE_JAR" \
+    -d "url=$TEST_IMAGE_URL" \
+    -d "width=100" \
+    -d "height=100" \
+    -d "format=jpeg" \
+    -d "ttl=1")
+SHORT_URL=$(echo "$GEN_RESULT" | grep -o '/v1/e/[^"<]*' | head -1)
+if [ -n "$SHORT_URL" ]; then
+    echo "  Waiting 2 seconds for URL to expire..."
+    sleep 2
+    HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" "$BASE_URL$SHORT_URL")
+    if [ "$HTTP_CODE" = "410" ]; then
+        pass "Expired URL returns 410 Gone"
+    else
+        fail "Expired URL returned HTTP $HTTP_CODE (expected 410)"
+    fi
+else
+    fail "Could not generate short-TTL URL"
+fi
+
+echo ""
+echo "=== All tests passed! ==="