Update TODO.md: standard structure and Workflow section (#44)

Reviewed-on: #44
Co-authored-by: sneak <sneak@sneak.berlin>
Co-committed-by: sneak <sneak@sneak.berlin>

TODO.md

@@ -1,65 +1,85 @@
-# Pixa 1.0 TODO
+# Workflow
 
-Remaining tasks sorted by priority for a working 1.0 release.
+* branch (from `main`)
+* do the work in Next Step
+* move Next Step to the top of Completed Steps
+* move the top item of Future Steps into Next Step
+* commit (`TODO.md` changes in the same commit as the work)
+* merge to `main` if the branch is not protected, otherwise open a PR
+* push
 
-## P0: Critical for 1.0
+# Status
 
-### Image Processing
+pre-1.0. No git tags exist. main (6b4a1d7, 2026-04-07) is current with
-- [x] Add WebP encoding support (currently returns error)
+origin; recent work extracted the internal/magic and internal/allowlist
-- [x] Add AVIF encoding support (implemented via govips)
+packages. The 10 gosec findings from the 2026-07-06 morning survey are
+NOT fixed on main: the newest gosec/lint fix commits are from
+2026-02-25 (85729d9, ce6db76) and nothing since touches gosec, so those
+findings remain open.
 
-### Manual Testing (verify auth/encrypted URLs work)
+# Next Step
-- [ ] Manual test: visit `/`, see login form
-- [ ] Manual test: enter wrong key, see error
-- [ ] Manual test: enter correct signing key, see generator form
-- [ ] Manual test: generate encrypted URL, verify it works
-- [ ] Manual test: wait for expiration or use short TTL, verify expired URL returns 410
-- [ ] Manual test: logout, verify redirected to login
 
-### Cache Management
+Fix the 10 open gosec lint findings so make check passes on main again
-- [ ] Implement cache size management/eviction (prevent disk from filling up)
+(main must always be green; no gosec fix commits have landed since
+2026-02-25). No blanket suppressions; fix or justify each finding
+individually.
 
-### Configuration
+# Completed Steps
-- [ ] Validate configuration on startup (fail fast on bad config)
 
-## P1: Important for Production
+- 2026-04-07 extract magic byte detection into internal/magic (#42)
+- 2026-03-25 extract allowlist package from internal/imgcache (#41)
+- 2026-03-25 move schema_migrations table creation into 000.sql (#36)
+- 2026-03-20 enforce and document exact-match-only signature
+  verification (#40)
+- 2026-03-20 bound imageprocessor.Process input read to prevent
+  unbounded memory use (#37); consolidate appname into an
+  internal/globals constant (#34)
+- 2026-03-18 parse version prefix from migration filenames (#33)
+- 2026-03-15 QA audit fixes for 1.0/MVP readiness (#25)
+- 2026-03-02 split Dockerfile with pre-built golangci-lint stage for
+  faster CI (#23)
+- 2026-02-25 repo policy compliance: CI workflow, hash-pinned images,
+  golangci-lint and gosec fixes of that date (#14); arm64 Docker build
+  fix (#16)
+- 2026-01-08 WebP and AVIF encoding support via govips (both former P0
+  image processing items, now done)
 
-### Security
+# Future Steps
-- [ ] Implement blocked networks configuration (extend SSRF protection)
-- [ ] Add rate limiting global concurrent fetches (prevent resource exhaustion)
 
-### Image Processing
+- P0: manual test pass of the auth and encrypted URL flows, then
-- [ ] Implement EXIF/metadata stripping (privacy)
+  commit the checked-off results to TODO.md: visit / and see the login
-
+  form; wrong key shows an error; correct signing key shows the
-## P2: Nice to Have
+  generator form; a generated encrypted URL serves the image; an
-
+  expired URL (short TTL) returns 410; logout redirects back to login
-### Security
+- P0: implement cache size management and eviction so the disk cannot
-- [ ] Implement referer blacklist
+  fill up
-- [ ] Add rate limiting per-IP
+- P0: validate configuration on startup, fail fast on bad config
-- [ ] Add rate limiting per-origin
+- P1: implement blocked networks configuration to extend SSRF
-
+  protection
-### HTTP Response Handling
+- P1: rate limit global concurrent upstream fetches to prevent
-- [ ] Implement Last-Modified headers
+  resource exhaustion
-- [ ] Implement Vary header for content negotiation
+- P1: strip EXIF and other metadata from processed images (privacy)
-- [ ] Implement X-Request-ID propagation
+- P2: security
-
+    - referer blacklist
-### Additional Endpoints
+    - per-IP rate limiting
-- [ ] Implement auto-format selection (format=auto based on Accept header)
+    - per-origin rate limiting
-
+- P2: HTTP response handling
-### Configuration
+    - Last-Modified headers
-- [ ] Add all configuration options from README
+    - Vary header for content negotiation
-- [ ] Implement environment variable overrides
+    - X-Request-ID propagation
-- [ ] Implement YAML config file support
+- P2: auto format selection (format=auto based on Accept header)
-
+- P2: configuration
-### Operational
+    - add all configuration options from README
-- [ ] Implement Sentry error reporting (optional)
+    - environment variable overrides
-- [ ] Add comprehensive request logging
+    - YAML config file support
-- [ ] Add performance metrics (Prometheus)
+- P2: operational
-- [ ] Write integration tests for image proxy flow
+    - optional Sentry error reporting
-- [ ] Write load tests to verify 1-5k req/s target
+    - comprehensive request logging
-
+    - Prometheus performance metrics
-### Documentation
+    - integration tests for the image proxy flow
-- [ ] Document configuration options
+    - load tests to verify the 1k to 5k req/s target
-- [ ] Document API endpoints
+- P2: documentation
-- [ ] Document deployment guide
+    - configuration options
-- [ ] Add example nginx/caddy reverse proxy config
+    - API endpoints
+    - deployment guide
+    - example nginx or caddy reverse proxy config

internal/handlers/handlers.go

@@ -13,7 +13,6 @@ import (
 	"sneak.berlin/go/pixa/internal/database"
 	"sneak.berlin/go/pixa/internal/encurl"
 	"sneak.berlin/go/pixa/internal/healthcheck"
-	"sneak.berlin/go/pixa/internal/httpfetcher"
 	"sneak.berlin/go/pixa/internal/imgcache"
 	"sneak.berlin/go/pixa/internal/logger"
 	"sneak.berlin/go/pixa/internal/session"
@@ -73,7 +72,7 @@ func (s *Handlers) initImageService() error {
 	s.imgCache = cache
 
 	// Create the fetcher config
-	fetcherCfg := httpfetcher.DefaultConfig()
+	fetcherCfg := imgcache.DefaultFetcherConfig()
 	fetcherCfg.AllowHTTP = s.config.AllowHTTP
 	if s.config.UpstreamConnectionsPerHost > 0 {
 		fetcherCfg.MaxConnectionsPerHost = s.config.UpstreamConnectionsPerHost

internal/handlers/handlers_test.go

@@ -18,7 +18,6 @@ import (
 
 	"github.com/go-chi/chi/v5"
 	"sneak.berlin/go/pixa/internal/database"
-	"sneak.berlin/go/pixa/internal/httpfetcher"
 	"sneak.berlin/go/pixa/internal/imgcache"
 )
 
@@ -117,16 +116,16 @@ func newMockFetcher(fs fs.FS) *mockFetcher {
 	return &mockFetcher{fs: fs}
 }
 
-func (f *mockFetcher) Fetch(ctx context.Context, url string) (*httpfetcher.FetchResult, error) {
+func (f *mockFetcher) Fetch(ctx context.Context, url string) (*imgcache.FetchResult, error) {
 	// Remove https:// prefix
 	path := url[8:] // Remove "https://"
 
 	data, err := fs.ReadFile(f.fs, path)
 	if err != nil {
-		return nil, httpfetcher.ErrUpstreamError
+		return nil, imgcache.ErrUpstreamError
 	}
 
-	return &httpfetcher.FetchResult{
+	return &imgcache.FetchResult{
 		Content:       io.NopCloser(bytes.NewReader(data)),
 		ContentLength: int64(len(data)),
 		ContentType:   "image/jpeg",

internal/handlers/image.go

@@ -8,7 +8,6 @@ import (
 	"time"
 
 	"github.com/go-chi/chi/v5"
-	"sneak.berlin/go/pixa/internal/httpfetcher"
 	"sneak.berlin/go/pixa/internal/imgcache"
 )
 
@@ -98,13 +97,13 @@ func (s *Handlers) HandleImage() http.HandlerFunc {
 			)
 
 			// Check for specific error types
-			if errors.Is(err, httpfetcher.ErrSSRFBlocked) {
+			if errors.Is(err, imgcache.ErrSSRFBlocked) {
 				s.respondError(w, "forbidden", http.StatusForbidden)
 
 				return
 			}
 
-			if errors.Is(err, httpfetcher.ErrUpstreamError) {
+			if errors.Is(err, imgcache.ErrUpstreamError) {
 				s.respondError(w, "upstream error", http.StatusBadGateway)
 
 				return

internal/handlers/imageenc.go

@@ -11,7 +11,6 @@ import (
 	"github.com/go-chi/chi/v5"
 
 	"sneak.berlin/go/pixa/internal/encurl"
-	"sneak.berlin/go/pixa/internal/httpfetcher"
 	"sneak.berlin/go/pixa/internal/imgcache"
 )
 
@@ -101,11 +100,11 @@ func (s *Handlers) HandleImageEnc() http.HandlerFunc {
 // handleImageError converts image service errors to HTTP responses.
 func (s *Handlers) handleImageError(w http.ResponseWriter, err error) {
 	switch {
-	case errors.Is(err, httpfetcher.ErrSSRFBlocked):
+	case errors.Is(err, imgcache.ErrSSRFBlocked):
 		s.respondError(w, "forbidden", http.StatusForbidden)
-	case errors.Is(err, httpfetcher.ErrUpstreamError):
+	case errors.Is(err, imgcache.ErrUpstreamError):
 		s.respondError(w, "upstream error", http.StatusBadGateway)
-	case errors.Is(err, httpfetcher.ErrUpstreamTimeout):
+	case errors.Is(err, imgcache.ErrUpstreamTimeout):
 		s.respondError(w, "upstream timeout", http.StatusGatewayTimeout)
 	default:
 		s.log.Error("image request failed", "error", err)

internal/httpfetcher/httpfetcher_test.go

@@ -1,329 +0,0 @@
-package httpfetcher
-
-import (
-	"context"
-	"errors"
-	"io"
-	"net"
-	"testing"
-	"testing/fstest"
-)
-
-func TestDefaultConfig(t *testing.T) {
-	cfg := DefaultConfig()
-
-	if cfg.Timeout != DefaultFetchTimeout {
-		t.Errorf("Timeout = %v, want %v", cfg.Timeout, DefaultFetchTimeout)
-	}
-
-	if cfg.MaxResponseSize != DefaultMaxResponseSize {
-		t.Errorf("MaxResponseSize = %d, want %d", cfg.MaxResponseSize, DefaultMaxResponseSize)
-	}
-
-	if cfg.MaxConnectionsPerHost != DefaultMaxConnectionsPerHost {
-		t.Errorf("MaxConnectionsPerHost = %d, want %d",
-			cfg.MaxConnectionsPerHost, DefaultMaxConnectionsPerHost)
-	}
-
-	if cfg.AllowHTTP {
-		t.Error("AllowHTTP should default to false")
-	}
-
-	if len(cfg.AllowedContentTypes) == 0 {
-		t.Error("AllowedContentTypes should not be empty")
-	}
-}
-
-func TestNewWithNilConfigUsesDefaults(t *testing.T) {
-	f := New(nil)
-
-	if f == nil {
-		t.Fatal("New(nil) returned nil")
-	}
-
-	if f.config == nil {
-		t.Fatal("config should be populated from DefaultConfig")
-	}
-
-	if f.config.Timeout != DefaultFetchTimeout {
-		t.Errorf("Timeout = %v, want %v", f.config.Timeout, DefaultFetchTimeout)
-	}
-}
-
-func TestIsAllowedContentType(t *testing.T) {
-	f := New(DefaultConfig())
-
-	tests := []struct {
-		contentType string
-		want        bool
-	}{
-		{"image/jpeg", true},
-		{"image/png", true},
-		{"image/webp", true},
-		{"image/jpeg; charset=utf-8", true},
-		{"IMAGE/JPEG", true},
-		{"text/html", false},
-		{"application/octet-stream", false},
-		{"", false},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.contentType, func(t *testing.T) {
-			got := f.isAllowedContentType(tc.contentType)
-			if got != tc.want {
-				t.Errorf("isAllowedContentType(%q) = %v, want %v", tc.contentType, got, tc.want)
-			}
-		})
-	}
-}
-
-func TestExtractHost(t *testing.T) {
-	tests := []struct {
-		url  string
-		want string
-	}{
-		{"https://example.com/path", "example.com"},
-		{"http://example.com:8080/path", "example.com:8080"},
-		{"https://example.com", "example.com"},
-		{"https://example.com?q=1", "example.com"},
-		{"example.com/path", "example.com"},
-		{"", ""},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.url, func(t *testing.T) {
-			got := extractHost(tc.url)
-			if got != tc.want {
-				t.Errorf("extractHost(%q) = %q, want %q", tc.url, got, tc.want)
-			}
-		})
-	}
-}
-
-func TestIsLocalhost(t *testing.T) {
-	tests := []struct {
-		host string
-		want bool
-	}{
-		{"localhost", true},
-		{"LOCALHOST", true},
-		{"127.0.0.1", true},
-		{"::1", true},
-		{"[::1]", true},
-		{"foo.localhost", true},
-		{"foo.local", true},
-		{"example.com", false},
-		{"127.0.0.2", false}, // Handled by isPrivateIP, not isLocalhost string match
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.host, func(t *testing.T) {
-			got := isLocalhost(tc.host)
-			if got != tc.want {
-				t.Errorf("isLocalhost(%q) = %v, want %v", tc.host, got, tc.want)
-			}
-		})
-	}
-}
-
-func TestIsPrivateIP(t *testing.T) {
-	tests := []struct {
-		ip   string
-		want bool
-	}{
-		{"127.0.0.1", true},             // loopback
-		{"10.0.0.1", true},              // private
-		{"192.168.1.1", true},           // private
-		{"172.16.0.1", true},            // private
-		{"169.254.1.1", true},           // link-local
-		{"0.0.0.0", true},               // unspecified
-		{"224.0.0.1", true},             // multicast
-		{"::1", true},                   // IPv6 loopback
-		{"fe80::1", true},               // IPv6 link-local
-		{"8.8.8.8", false},              // public
-		{"2001:4860:4860::8888", false}, // public IPv6
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.ip, func(t *testing.T) {
-			ip := net.ParseIP(tc.ip)
-			if ip == nil {
-				t.Fatalf("failed to parse IP %q", tc.ip)
-			}
-
-			got := isPrivateIP(ip)
-			if got != tc.want {
-				t.Errorf("isPrivateIP(%q) = %v, want %v", tc.ip, got, tc.want)
-			}
-		})
-	}
-
-	if !isPrivateIP(nil) {
-		t.Error("isPrivateIP(nil) should return true")
-	}
-}
-
-func TestValidateURL_RejectsNonHTTPS(t *testing.T) {
-	err := validateURL("http://example.com/path", false)
-	if !errors.Is(err, ErrUnsupportedScheme) {
-		t.Errorf("validateURL http = %v, want ErrUnsupportedScheme", err)
-	}
-}
-
-func TestValidateURL_AllowsHTTPWhenConfigured(t *testing.T) {
-	// Use a host that won't resolve (explicit .invalid TLD) so we don't hit DNS.
-	err := validateURL("http://nonexistent.invalid/path", true)
-	// We expect a host resolution error, not ErrUnsupportedScheme.
-	if errors.Is(err, ErrUnsupportedScheme) {
-		t.Error("validateURL with AllowHTTP should not return ErrUnsupportedScheme")
-	}
-}
-
-func TestValidateURL_RejectsLocalhost(t *testing.T) {
-	err := validateURL("https://localhost/path", false)
-	if !errors.Is(err, ErrSSRFBlocked) {
-		t.Errorf("validateURL localhost = %v, want ErrSSRFBlocked", err)
-	}
-}
-
-func TestValidateURL_EmptyHost(t *testing.T) {
-	err := validateURL("https:///path", false)
-	if !errors.Is(err, ErrInvalidHost) {
-		t.Errorf("validateURL empty host = %v, want ErrInvalidHost", err)
-	}
-}
-
-func TestMockFetcher_FetchesFile(t *testing.T) {
-	mockFS := fstest.MapFS{
-		"example.com/images/photo.jpg": &fstest.MapFile{Data: []byte("fake-jpeg-data")},
-	}
-
-	m := NewMock(mockFS)
-
-	result, err := m.Fetch(context.Background(), "https://example.com/images/photo.jpg")
-	if err != nil {
-		t.Fatalf("Fetch() error = %v", err)
-	}
-	defer func() { _ = result.Content.Close() }()
-
-	if result.ContentType != "image/jpeg" {
-		t.Errorf("ContentType = %q, want image/jpeg", result.ContentType)
-	}
-
-	data, err := io.ReadAll(result.Content)
-	if err != nil {
-		t.Fatalf("read content: %v", err)
-	}
-
-	if string(data) != "fake-jpeg-data" {
-		t.Errorf("Content = %q, want %q", string(data), "fake-jpeg-data")
-	}
-
-	if result.ContentLength != int64(len("fake-jpeg-data")) {
-		t.Errorf("ContentLength = %d, want %d", result.ContentLength, len("fake-jpeg-data"))
-	}
-}
-
-func TestMockFetcher_MissingFileReturnsUpstreamError(t *testing.T) {
-	mockFS := fstest.MapFS{}
-	m := NewMock(mockFS)
-
-	_, err := m.Fetch(context.Background(), "https://example.com/missing.jpg")
-	if !errors.Is(err, ErrUpstreamError) {
-		t.Errorf("Fetch() error = %v, want ErrUpstreamError", err)
-	}
-}
-
-func TestMockFetcher_RespectsContextCancellation(t *testing.T) {
-	mockFS := fstest.MapFS{
-		"example.com/photo.jpg": &fstest.MapFile{Data: []byte("data")},
-	}
-	m := NewMock(mockFS)
-
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-
-	_, err := m.Fetch(ctx, "https://example.com/photo.jpg")
-	if !errors.Is(err, context.Canceled) {
-		t.Errorf("Fetch() error = %v, want context.Canceled", err)
-	}
-}
-
-func TestDetectContentTypeFromPath(t *testing.T) {
-	tests := []struct {
-		path string
-		want string
-	}{
-		{"foo/bar.jpg", "image/jpeg"},
-		{"foo/bar.JPG", "image/jpeg"},
-		{"foo/bar.jpeg", "image/jpeg"},
-		{"foo/bar.png", "image/png"},
-		{"foo/bar.gif", "image/gif"},
-		{"foo/bar.webp", "image/webp"},
-		{"foo/bar.avif", "image/avif"},
-		{"foo/bar.svg", "image/svg+xml"},
-		{"foo/bar.bin", "application/octet-stream"},
-		{"foo/bar", "application/octet-stream"},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.path, func(t *testing.T) {
-			got := detectContentTypeFromPath(tc.path)
-			if got != tc.want {
-				t.Errorf("detectContentTypeFromPath(%q) = %q, want %q", tc.path, got, tc.want)
-			}
-		})
-	}
-}
-
-func TestLimitedReader_EnforcesLimit(t *testing.T) {
-	src := make([]byte, 100)
-	r := &limitedReader{
-		reader:    &byteReader{data: src},
-		remaining: 50,
-	}
-
-	buf := make([]byte, 100)
-
-	n, err := r.Read(buf)
-	if err != nil {
-		t.Fatalf("first Read error = %v", err)
-	}
-
-	if n > 50 {
-		t.Errorf("read %d bytes, should be capped at 50", n)
-	}
-
-	// Drain until limit is exhausted.
-	total := n
-	for total < 50 {
-		nn, err := r.Read(buf)
-		total += nn
-		if err != nil {
-			t.Fatalf("during drain: %v", err)
-		}
-	}
-
-	// Now the limit is exhausted — next read should error.
-	_, err = r.Read(buf)
-	if !errors.Is(err, ErrResponseTooLarge) {
-		t.Errorf("exhausted Read error = %v, want ErrResponseTooLarge", err)
-	}
-}
-
-// byteReader is a minimal io.Reader over a byte slice for testing.
-type byteReader struct {
-	data []byte
-	pos  int
-}
-
-func (r *byteReader) Read(p []byte) (int, error) {
-	if r.pos >= len(r.data) {
-		return 0, io.EOF
-	}
-
-	n := copy(p, r.data[r.pos:])
-	r.pos += n
-
-	return n, nil
-}

internal/imgcache/cache.go

@@ -9,8 +9,6 @@ import (
 	"io"
 	"path/filepath"
 	"time"
-
-	"sneak.berlin/go/pixa/internal/httpfetcher"
 )
 
 // Cache errors.
@@ -113,7 +111,7 @@ func (c *Cache) StoreSource(
 	ctx context.Context,
 	req *ImageRequest,
 	content io.Reader,
-	result *httpfetcher.FetchResult,
+	result *FetchResult,
 ) (ContentHash, error) {
 	// Store content
 	contentHash, size, err := c.srcContent.Store(content)

internal/imgcache/cache_test.go

@@ -9,7 +9,6 @@ import (
 	"time"
 
 	_ "modernc.org/sqlite"
-	"sneak.berlin/go/pixa/internal/httpfetcher"
 )
 
 func setupTestDB(t *testing.T) *sql.DB {
@@ -153,7 +152,7 @@ func TestCache_StoreAndLookup(t *testing.T) {
 
 	// Store source content
 	sourceContent := []byte("fake jpeg data")
-	fetchResult := &httpfetcher.FetchResult{
+	fetchResult := &FetchResult{
 		ContentType: "image/jpeg",
 		Headers:     map[string][]string{"Content-Type": {"image/jpeg"}},
 	}

internal/imgcache/fetcher.go

@@ -1,6 +1,4 @@
-// Package httpfetcher fetches content from upstream HTTP origins with SSRF
+package imgcache
-// protection, per-host connection limits, and content-type validation.
-package httpfetcher
 
 import (
 	"context"
@@ -39,55 +37,25 @@ var (
 	ErrUpstreamTimeout    = errors.New("upstream request timeout")
 )
 
-// Fetcher retrieves content from upstream origins.
+// FetcherConfig holds configuration for the upstream fetcher.
-type Fetcher interface {
+type FetcherConfig struct {
-	// Fetch retrieves content from the given URL.
+	// Timeout for upstream requests
-	Fetch(ctx context.Context, url string) (*FetchResult, error)
-}
-
-// FetchResult contains the result of fetching from upstream.
-type FetchResult struct {
-	// Content is the raw image data.
-	Content io.ReadCloser
-	// ContentLength is the size in bytes (-1 if unknown).
-	ContentLength int64
-	// ContentType is the MIME type from upstream.
-	ContentType string
-	// Headers contains all response headers from upstream.
-	Headers map[string][]string
-	// StatusCode is the HTTP status code from upstream.
-	StatusCode int
-	// FetchDurationMs is how long the fetch took in milliseconds.
-	FetchDurationMs int64
-	// RemoteAddr is the IP:port of the upstream server.
-	RemoteAddr string
-	// HTTPVersion is the protocol version (e.g., "1.1", "2.0").
-	HTTPVersion string
-	// TLSVersion is the TLS protocol version (e.g., "TLS 1.3").
-	TLSVersion string
-	// TLSCipherSuite is the negotiated cipher suite name.
-	TLSCipherSuite string
-}
-
-// Config holds configuration for the upstream fetcher.
-type Config struct {
-	// Timeout for upstream requests.
 	Timeout time.Duration
-	// MaxResponseSize is the maximum allowed response body size.
+	// MaxResponseSize is the maximum allowed response body size
 	MaxResponseSize int64
-	// UserAgent to send to upstream servers.
+	// UserAgent to send to upstream servers
 	UserAgent string
-	// AllowedContentTypes is an allow list of MIME types to accept.
+	// AllowedContentTypes is a whitelist of MIME types to accept
 	AllowedContentTypes []string
-	// AllowHTTP allows non-TLS connections (for testing only).
+	// AllowHTTP allows non-TLS connections (for testing only)
 	AllowHTTP bool
-	// MaxConnectionsPerHost limits concurrent connections to each upstream host.
+	// MaxConnectionsPerHost limits concurrent connections to each upstream host
 	MaxConnectionsPerHost int
 }
 
-// DefaultConfig returns a Config with sensible defaults.
+// DefaultFetcherConfig returns sensible defaults.
-func DefaultConfig() *Config {
+func DefaultFetcherConfig() *FetcherConfig {
-	return &Config{
+	return &FetcherConfig{
 		Timeout:         DefaultFetchTimeout,
 		MaxResponseSize: DefaultMaxResponseSize,
 		UserAgent:       "pixa/1.0",
@@ -104,18 +72,18 @@ func DefaultConfig() *Config {
 	}
 }
 
-// HTTPFetcher implements Fetcher with SSRF protection and per-host connection limits.
+// HTTPFetcher implements the Fetcher interface with SSRF protection.
 type HTTPFetcher struct {
 	client    *http.Client
-	config    *Config
+	config    *FetcherConfig
 	hostSems  map[string]chan struct{} // per-host semaphores
 	hostSemMu sync.Mutex               // protects hostSems map
 }
 
-// New creates a new HTTPFetcher with SSRF protection.
+// NewHTTPFetcher creates a new fetcher with SSRF protection.
-func New(config *Config) *HTTPFetcher {
+func NewHTTPFetcher(config *FetcherConfig) *HTTPFetcher {
 	if config == nil {
-		config = DefaultConfig()
+		config = DefaultFetcherConfig()
 	}
 
 	// Create transport with SSRF-safe dialer
@@ -282,7 +250,7 @@ func (f *HTTPFetcher) Fetch(ctx context.Context, url string) (*FetchResult, erro
 	}, nil
 }
 
-// isAllowedContentType checks if the content type is in the allow list.
+// isAllowedContentType checks if the content type is in the whitelist.
 func (f *HTTPFetcher) isAllowedContentType(contentType string) bool {
 	// Extract the MIME type without parameters
 	mediaType := strings.TrimSpace(strings.Split(contentType, ";")[0])

internal/imgcache/imgcache.go

@@ -169,6 +169,36 @@ type Whitelist interface {
 	IsWhitelisted(u *url.URL) bool
 }
 
+// Fetcher fetches images from upstream origins
+type Fetcher interface {
+	// Fetch retrieves an image from the origin
+	Fetch(ctx context.Context, url string) (*FetchResult, error)
+}
+
+// FetchResult contains the result of fetching from upstream
+type FetchResult struct {
+	// Content is the raw image data
+	Content io.ReadCloser
+	// ContentLength is the size in bytes (-1 if unknown)
+	ContentLength int64
+	// ContentType is the MIME type from upstream
+	ContentType string
+	// Headers contains all response headers from upstream
+	Headers map[string][]string
+	// StatusCode is the HTTP status code from upstream
+	StatusCode int
+	// FetchDurationMs is how long the fetch took in milliseconds
+	FetchDurationMs int64
+	// RemoteAddr is the IP:port of the upstream server
+	RemoteAddr string
+	// HTTPVersion is the protocol version (e.g., "1.1", "2.0")
+	HTTPVersion string
+	// TLSVersion is the TLS protocol version (e.g., "TLS 1.3")
+	TLSVersion string
+	// TLSCipherSuite is the negotiated cipher suite name
+	TLSCipherSuite string
+}
+
 // Storage handles persistent storage of cached content
 type Storage interface {
 	// Store saves content and returns its hash

internal/imgcache/mock_fetcher.go

@@ -1,4 +1,4 @@
-package httpfetcher
+package imgcache
 
 import (
 	"context"
@@ -10,15 +10,15 @@ import (
 	"strings"
 )
 
-// MockFetcher implements Fetcher using an embedded filesystem.
+// MockFetcher implements the Fetcher interface using an embedded filesystem.
 // Files are organized as: hostname/path/to/file.ext
-// URLs like https://example.com/images/photo.jpg map to example.com/images/photo.jpg.
+// URLs like https://example.com/images/photo.jpg map to example.com/images/photo.jpg
 type MockFetcher struct {
 	fs fs.FS
 }
 
-// NewMock creates a new mock fetcher backed by the given filesystem.
+// NewMockFetcher creates a new mock fetcher backed by the given filesystem.
-func NewMock(fsys fs.FS) *MockFetcher {
+func NewMockFetcher(fsys fs.FS) *MockFetcher {
 	return &MockFetcher{fs: fsys}
 }
 

internal/imgcache/service.go

@@ -12,7 +12,6 @@ import (
 
 	"github.com/dustin/go-humanize"
 	"sneak.berlin/go/pixa/internal/allowlist"
-	"sneak.berlin/go/pixa/internal/httpfetcher"
 	"sneak.berlin/go/pixa/internal/imageprocessor"
 	"sneak.berlin/go/pixa/internal/magic"
 )
@@ -20,7 +19,7 @@ import (
 // Service implements the ImageCache interface, orchestrating cache, fetcher, and processor.
 type Service struct {
 	cache           *Cache
-	fetcher         httpfetcher.Fetcher
+	fetcher         Fetcher
 	processor       *imageprocessor.ImageProcessor
 	signer          *Signer
 	allowlist       *allowlist.HostAllowList
@@ -34,9 +33,9 @@ type ServiceConfig struct {
 	// Cache is the cache instance
 	Cache *Cache
 	// FetcherConfig configures the upstream fetcher (ignored if Fetcher is set)
-	FetcherConfig *httpfetcher.Config
+	FetcherConfig *FetcherConfig
 	// Fetcher is an optional custom fetcher (for testing)
-	Fetcher httpfetcher.Fetcher
+	Fetcher Fetcher
 	// SigningKey is the HMAC signing key (empty disables signing)
 	SigningKey string
 	// Whitelist is the list of hosts that don't require signatures
@@ -58,15 +57,15 @@ func NewService(cfg *ServiceConfig) (*Service, error) {
 	// Resolve fetcher config for defaults
 	fetcherCfg := cfg.FetcherConfig
 	if fetcherCfg == nil {
-		fetcherCfg = httpfetcher.DefaultConfig()
+		fetcherCfg = DefaultFetcherConfig()
 	}
 
 	// Use custom fetcher if provided, otherwise create HTTP fetcher
-	var fetcher httpfetcher.Fetcher
+	var fetcher Fetcher
 	if cfg.Fetcher != nil {
 		fetcher = cfg.Fetcher
 	} else {
-		fetcher = httpfetcher.New(fetcherCfg)
+		fetcher = NewHTTPFetcher(fetcherCfg)
 	}
 
 	signer := NewSigner(cfg.SigningKey)
@@ -114,7 +113,7 @@ func (s *Service) Get(ctx context.Context, req *ImageRequest) (*ImageResponse, e
 			"path", req.SourcePath,
 		)
 
-		return nil, fmt.Errorf("%w: %w", httpfetcher.ErrUpstreamError, ErrNegativeCached)
+		return nil, fmt.Errorf("%w: %w", ErrUpstreamError, ErrNegativeCached)
 	}
 
 	// Check variant cache first (disk only, no DB)
@@ -419,13 +418,13 @@ const (
 
 // isNegativeCacheable returns true if the error should be cached.
 func isNegativeCacheable(err error) bool {
-	return errors.Is(err, httpfetcher.ErrUpstreamError)
+	return errors.Is(err, ErrUpstreamError)
 }
 
 // extractStatusCode extracts HTTP status code from error message.
 func extractStatusCode(err error) int {
 	// Default to 502 Bad Gateway for upstream errors
-	if errors.Is(err, httpfetcher.ErrUpstreamError) {
+	if errors.Is(err, ErrUpstreamError) {
 		return httpStatusBadGateway
 	}
 

internal/imgcache/testutil_test.go

@@ -15,7 +15,6 @@ import (
 	"time"
 
 	"sneak.berlin/go/pixa/internal/database"
-	"sneak.berlin/go/pixa/internal/httpfetcher"
 )
 
 // TestFixtures contains paths to test files in the mock filesystem.
@@ -173,7 +172,7 @@ func SetupTestService(t *testing.T, opts ...TestServiceOption) (*Service, *TestF
 
 	svc, err := NewService(&ServiceConfig{
 		Cache:      cache,
-		Fetcher:    httpfetcher.NewMock(mockFS),
+		Fetcher:    NewMockFetcher(mockFS),
 		SigningKey: cfg.signingKey,
 		Whitelist:  cfg.whitelist,
 	})