# Pixa Example Configuration

# Server settings
port: 8080
debug: false
maintenance_mode: false

# Data directory for SQLite database and cache files
state_dir: ./data

# Image proxy settings
# HMAC signing key for URL signatures (required, at least 32 characters)
# Generate with: openssl rand -base64 32
signing_key: "CHANGE_ME_generate_with_openssl_rand_base64_32"

# Hosts that don't require signatures
# Use "." prefix for wildcard subdomain matching (e.g., ".example.com" matches "cdn.example.com")
allowlist_hosts:
  - s3.sneak.cloud
  - static.sneak.cloud
  - sneak.berlin
  - github.com
  - user-images.githubusercontent.com

# Additional CIDR ranges to refuse when fetching upstream, extending the
# SSRF protection. These are added to the always-enforced built-in ranges
# (loopback, RFC 1918 private, link-local, CGNAT, benchmark, NAT64, and
# similar), never replacing them. Each entry must be a valid CIDR in IPv4
# or IPv6 form; an invalid entry aborts startup.
# blocked_networks:
#   - 100.64.0.0/10
#   - 2001:db8::/32

# CIDR ranges of the reverse proxies in front of pixa. X-Forwarded-For
# is believed only when the direct peer is inside one of these ranges;
# the client address in the access log and login records is then the
# rightmost forwarded entry that is not itself a trusted proxy. A client
# connecting directly (peer outside these ranges) cannot spoof its
# address: the header is ignored and the peer address is used. When
# omitted, this defaults to the RFC 1918 private ranges (10.0.0.0/8,
# 172.16.0.0/12, 192.168.0.0/16), since pixa is deployed behind a proxy on
# a private network. An explicitly empty list ([]) trusts no one; an
# explicit list replaces the default. An invalid CIDR aborts startup.
# Uncomment to override the defaults with your proxy's address range.
# trusted_proxies:
#   - 10.0.0.0/8
#   - 2001:db8::/32

# Allow HTTP upstream (only for testing, always use HTTPS in production)
allow_http: false

# Maximum concurrent connections per upstream host (default: 20)
upstream_connections_per_host: 20

# Maximum disk cache size in bytes. Explicit values are used exactly as
# given; 0 disables the disk cache entirely (every request fetches and
# processes uncached). When omitted, the default is 75% of the free
# space on the filesystem containing <state_dir>/cache/ at startup,
# with a minimum of 500 MiB.
# cache_max_bytes: 10737418240

# Sentry error reporting (optional)
sentry_dsn: ""

# Metrics endpoint authentication (optional)
# metrics:
#   username: "admin"
#   password: "secret"