sneak/pixa
1
0
Fork 0
Code Issues 49 Pull Requests 4 Actions Packages Projects Releases Wiki Activity

Take the image signing key from PIXA_SIGNING_KEY and refuse the example placeholder (closes #110) #120

Merged
clawbot merged 6 commits from issue-110-docker-config-signing-key into next 2026-09-21 21:59:25 +02:00
Conversation 5 Commits 6 Files Changed 5
+61 -9
6 Commits
Author SHA1 Message Date
sneak c9aa48227d docs: use the image name make docker builds in the Docker run example
check / check (push) Failing after 1s
Details 
make docker tags the image pixa:latest via script/projectname, so the
Getting Started run line must reference pixa:latest, not pixad:latest.

Model: opus-4-8
 2026-09-21 19:28:47 +00:00
sneak c32fdefc3b docs: fix Getting Started local-run example for the refused placeholder 
The startup now rejects the config.example.yml placeholder signing_key,
so the documented `pixad --config config.example.yml` command aborts on
first run. Show copying the example to config.yml and setting a real
signing_key before running, matching the code.

Model: opus-4-8
 2026-09-21 19:28:47 +00:00
sneak 37d0e24cfc docs: document the two container config paths (closes #110) 
Getting Started now shows the docker run with PIXA_SIGNING_KEY and a
short paragraph: the key comes from that environment variable, and any
other setting is changed by mounting a file over /etc/pixa/config.yml.

Model: opus-4-8
 2026-09-21 19:28:47 +00:00
sneak 30e4e3d968 feat: ship image config that reads signing_key from the environment 
The runtime stage now copies config.docker.yml, which sets only
signing_key (from PIXA_SIGNING_KEY), state_dir, and port. This drops
the public placeholder key and the baked-in allowlist from the image,
matching how upaas configures apps: environment variables and mounts,
no injected config file.

Model: opus-4-8
 2026-09-21 19:28:47 +00:00
sneak 8ed7f7e3c7 fix: refuse the example placeholder signing_key at startup 
Reject the exact config.example.yml placeholder in validate() with an
error naming signing_key, so a container or file-based deployment that
never changed it fails fast instead of signing URLs with a public key.
The signing-key checks move into a validateSigningKey helper, keeping
validate() within the cyclomatic-complexity limit.

Model: opus-4-8
 2026-09-21 19:28:47 +00:00
sneak 3bb992fc1b test: reject the config.example.yml placeholder signing_key 
The placeholder is 45 characters, so it passes the length check and a
deployment could unknowingly sign URLs with a key that is public in
this repository. Add a failing validation case (and the placeholder
constant it references); the rejection follows.

Model: opus-4-8
 2026-09-21 19:28:47 +00:00