clawbot 1798cba96c Take the image signing key from PIXA_SIGNING_KEY and refuse the example placeholder (closes #110) ...

The Docker image now ships config.docker.yml, which sets only signing_key (read from the PIXA_SIGNING_KEY environment variable), state_dir and port. The placeholder key and the five-host allowlist from config.example.yml are no longer in the image; anything else is configured by mounting a file over /etc/pixa/config.yml. A container started without PIXA_SIGNING_KEY exits naming it.

Startup now refuses the exact placeholder signing_key from config.example.yml. It is 45 characters long and used to pass the length check, so a deployment could sign URLs with a key that is public in this repository. README Getting Started is corrected to match.

What a reader would trip over: the unset-variable error comes from config interpolation, not from validate(); the signing key checks moved into validateSigningKey to stay under the complexity limit.

Disclosure: TODO.md is not updated by this change.

Model: opus-4-8 (implementation, review); fable-5-1 (landing message)

2026-09-21 21:59:24 +02:00

..

cache_max_bytes_internal_test.go

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

cachesize.go

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

config_internal_test.go

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

config_validation_internal_test.go

Take the image signing key from PIXA_SIGNING_KEY and refuse the example placeholder (closes #110)

2026-09-21 21:59:24 +02:00

config.go

Take the image signing key from PIXA_SIGNING_KEY and refuse the example placeholder (closes #110)

2026-09-21 21:59:24 +02:00