sneak 6453b9a125 Say the source host is signed as the URL writes it (part of #246) ...

The Signature Specification read as though the hostname were signed
with ":" and the port appended. The code signs the host segment as the
URL writes it up to the first "/", lower-cased, so IPv6 brackets and a
":" with or without a port are kept. The README line, the TODO.md entry
and the parser comment now say so.

Model: opus-5-5

2026-10-15 10:03:47 +00:00

..

allowlist

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

app

Move pixad's startup from cmd/pixad into internal/app (closes #206)

2026-10-05 01:07:47 +02:00

clientip

Resolve real client IP behind trusted proxies (closes #94)

2026-09-22 10:25:41 +02:00

config

Allowlist no host in the example config (closes #249)

2026-10-15 06:26:23 +02:00

database

Queue SQLite writes on one connection so none fails as locked (closes #223)

2026-10-08 04:50:31 +02:00

db/migrations

Eviction no longer reads a whole table while requests wait on the database (closes #227)

2026-10-08 07:12:02 +02:00

encurl

Serve JPEG XL when a request names no format (closes #222)

2026-10-08 12:49:56 +02:00

globals

Move pixad's startup from cmd/pixad into internal/app (closes #206)

2026-10-05 01:07:47 +02:00

handlers

Refuse a size whose computed side exceeds the maximum (closes #241)

2026-10-13 09:44:44 +02:00

healthcheck

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

httpfetcher

Accept a chunked upstream body of exactly the maximum size (closes #248)

2026-10-15 07:44:09 +02:00

imageprocessor

Refuse a fit=outside size whose output exceeds the maximum (closes #257)

2026-10-13 10:44:45 +02:00

imgcache

Say the source host is signed as the URL writes it (part of #246)

2026-10-15 10:03:47 +00:00

loadtestorigin

Add script/loadtest to measure throughput, latency and memory (closes #81)

2026-10-05 02:58:41 +02:00

logger

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

magic

Serve and accept JPEG XL as an image format (part of #222)

2026-10-08 11:01:12 +02:00

middleware

Limit each client's requests to the image routes (closes #236)

2026-10-13 01:36:18 +02:00

seal

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

server

Refuse a fit=outside size whose output exceeds the maximum (closes #257)

2026-10-13 10:44:45 +02:00

session

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

signature

Escape : and % in the signed and cached path and query (closes #247)

2026-10-15 09:37:01 +02:00

static

Remove unsafe-inline from the Content-Security-Policy (closes #125)

2026-10-04 18:58:40 +02:00

templates

Serve JPEG XL when a request names no format (closes #222)

2026-10-08 12:49:56 +02:00