clawbot
1b920fe000
check / check (push) Successful in 14s
The README told operators to set trusted_proxies to the proxy's own address. A proxy on the Docker host that connects over 127.0.0.1 reaches pixa from the Docker network's gateway, so that advice made pixa count every user as one client for the login limit. The login-limit paragraph, the trusted_proxies entry and config.example.yml now say to use the address pixa sees for requests through the proxy, that a proxy connecting through another host address is seen with that address, and how to read it from the request log. The signature section now says sig is base64url with the = padding kept, since pixa compares it exactly, and shows the example's sig for a stated key, computed with pixa's signer. Model: opus-5-5
84 lines
3.4 KiB
YAML
84 lines
3.4 KiB
YAML
# Pixa Example Configuration
|
|
#
|
|
# Every key can also be set by an environment variable, which wins over
|
|
# this file: PIXA_ plus the key in upper case, with "." written as "_"
|
|
# (state_dir is PIXA_STATE_DIR, metrics.username is
|
|
# PIXA_METRICS_USERNAME). The one exception is port, which is set by
|
|
# PORT. In a variable, a list is comma-separated. A variable named in
|
|
# this file's env: section is set while the file loads, so it overrides
|
|
# both the environment the process was started with and this file's own
|
|
# key.
|
|
|
|
# Server settings
|
|
port: 8080
|
|
debug: false
|
|
maintenance_mode: false
|
|
|
|
# Data directory for SQLite database and cache files
|
|
state_dir: ./data
|
|
|
|
# Image proxy settings
|
|
# HMAC signing key for URL signatures (required, at least 32 characters)
|
|
# Generate with: openssl rand -base64 32
|
|
signing_key: "CHANGE_ME_generate_with_openssl_rand_base64_32"
|
|
|
|
# Hosts that don't require signatures
|
|
# Use "." prefix for wildcard subdomain matching (e.g., ".example.com" matches "cdn.example.com")
|
|
allowlist_hosts:
|
|
- s3.sneak.cloud
|
|
- static.sneak.cloud
|
|
- sneak.berlin
|
|
- github.com
|
|
- user-images.githubusercontent.com
|
|
|
|
# Additional CIDR ranges to refuse when fetching upstream, extending the
|
|
# SSRF protection. These are added to the always-enforced built-in ranges
|
|
# (loopback, RFC 1918 private, link-local, CGNAT, benchmark, NAT64, and
|
|
# similar), never replacing them. Each entry must be a valid CIDR in IPv4
|
|
# or IPv6 form; an invalid entry aborts startup.
|
|
# blocked_networks:
|
|
# - 100.64.0.0/10
|
|
# - 2001:db8::/32
|
|
|
|
# CIDR ranges of the reverse proxies in front of pixa. X-Forwarded-For
|
|
# is believed only when the direct peer is inside one of these ranges;
|
|
# the client address in the access log and login records is then the
|
|
# rightmost forwarded entry that is not itself a trusted proxy. A client
|
|
# connecting directly (peer outside these ranges) cannot spoof its
|
|
# address: the header is ignored and the peer address is used. When
|
|
# omitted, this defaults to the RFC 1918 private ranges (10.0.0.0/8,
|
|
# 172.16.0.0/12, 192.168.0.0/16), since pixa is deployed behind a proxy on
|
|
# a private network. An explicitly empty list ([]) trusts no one; an
|
|
# explicit list replaces the default. An invalid CIDR aborts startup.
|
|
# Uncomment to override the defaults with the address pixa sees for
|
|
# requests that come through your proxy. That is not always the proxy's own
|
|
# address: a proxy on the Docker host that connects over 127.0.0.1 is seen
|
|
# as the gateway of the container's Docker network (172.17.0.1 on the
|
|
# default bridge), and one that connects through another host address is
|
|
# seen with that address. To be sure, look it up in the request log as the
|
|
# trusted_proxies entry in README.md describes.
|
|
# trusted_proxies:
|
|
# - 10.0.0.0/8
|
|
# - 2001:db8::/32
|
|
|
|
# Allow HTTP upstream (only for testing, always use HTTPS in production)
|
|
allow_http: false
|
|
|
|
# Maximum concurrent connections per upstream host (default: 20)
|
|
upstream_connections_per_host: 20
|
|
|
|
# Maximum disk cache size in bytes. Explicit values are used exactly as
|
|
# given; 0 disables the disk cache entirely (every request fetches and
|
|
# processes uncached). When omitted, the default is 75% of the free
|
|
# space on the filesystem containing <state_dir>/cache/ at startup,
|
|
# with a minimum of 500 MiB.
|
|
# cache_max_bytes: 10737418240
|
|
|
|
# Sentry error reporting (optional)
|
|
sentry_dsn: ""
|
|
|
|
# Metrics endpoint authentication (optional)
|
|
# metrics:
|
|
# username: "admin"
|
|
# password: "secret"
|