Add Redis cache, origin validation, SSRF hardening, and code quality refactor

.env.example

@@ -6,6 +6,7 @@ PORT=3000
 #   disk   - Persist to disk only (survives restarts)
 #   memory - In-memory only (fastest, lost on restart)
 #   hybrid - Memory (L1) + Disk (L2) for speed and persistence
+#   redis  - Redis/Valkey (uses Bun's built-in Redis client)
 #   none   - No caching
 CACHE_MODE=disk
 CACHE_DIR=./cache            # Directory for disk cache (disk/hybrid modes)
@@ -23,5 +24,11 @@ ALLOW_SELF_REFERENCE=false   # Allow /image to fetch from own /og endpoint (for
 MAX_IMAGE_SIZE=10485760      # Max image size in bytes (default: 10MB)
 REQUEST_TIMEOUT=30000        # Request timeout in ms (default: 30s)
 
+# Redis cache settings (only used when CACHE_MODE=redis)
+REDIS_URL=redis://localhost:6379   # Redis connection URL (supports redis://, rediss://, redis+unix://)
+REDIS_KEY_PREFIX=ps:               # Key prefix to namespace cache entries
+REDIS_CONNECTION_TIMEOUT=5000      # Connection timeout in ms
+REDIS_MAX_RETRIES=10               # Max reconnection attempts
+
 # Custom OG Templates
 TEMPLATES_DIR=./templates    # Directory for custom OG image templates (JSON files)

package.json

@@ -12,16 +12,16 @@
   },
   "devDependencies": {
     "@biomejs/biome": "2.3.8",
-    "@types/bun": "^1.3.4"
+    "@types/bun": "^1.3.11"
   },
   "peerDependencies": {
     "typescript": "^5.9.3"
   },
   "dependencies": {
-    "@elysiajs/cors": "^1.4.0",
+    "@elysiajs/cors": "^1.4.1",
     "@resvg/resvg-js": "^2.6.2",
-    "elysia": "^1.4.18",
-    "satori": "^0.18.3",
+    "elysia": "^1.4.28",
+    "satori": "^0.18.4",
     "sharp": "^0.34.5"
   }
 }

src/config.ts

@@ -6,6 +6,7 @@ const CacheModeSchema = Type.Union([
   Type.Literal("disk"),
   Type.Literal("memory"),
   Type.Literal("hybrid"),
+  Type.Literal("redis"),
   Type.Literal("none"),
 ]);
 
@@ -57,6 +58,12 @@ const ConfigSchema = Type.Object({
   // Custom templates directory
   templatesDir: Type.String({ default: "./templates" }),
 
+  // Redis cache settings
+  redisUrl: Type.String({ default: "redis://localhost:6379" }),
+  redisKeyPrefix: Type.String({ default: "ps:" }),
+  redisConnectionTimeout: Type.Number({ default: 5000, minimum: 0 }),
+  redisMaxRetries: Type.Number({ default: 10, minimum: 0 }),
+
   // Clustering
   clusterWorkers: Type.Number({ default: 0, minimum: 0 }), // 0 = auto (CPU cores)
 });
@@ -104,6 +111,13 @@ const rawConfig = {
   ogDefaultBg: "1a1a2e",
   ogDefaultFg: "ffffff",
   templatesDir: process.env.TEMPLATES_DIR || "./templates",
+  redisUrl: process.env.REDIS_URL || "redis://localhost:6379",
+  redisKeyPrefix: process.env.REDIS_KEY_PREFIX || "ps:",
+  redisConnectionTimeout: parseInt(
+    process.env.REDIS_CONNECTION_TIMEOUT || "5000",
+    10,
+  ),
+  redisMaxRetries: parseInt(process.env.REDIS_MAX_RETRIES || "10", 10),
   clusterWorkers: parseInt(process.env.CLUSTER_WORKERS || "0", 10),
 };
 

src/index.ts

@@ -4,7 +4,11 @@ import { config } from "./config";
 import { healthRoutes } from "./routes/health";
 import { imageRoutes } from "./routes/image";
 import { ogRoutes } from "./routes/og";
-import { startCacheCleanup } from "./services/cache";
+import {
+  disconnectRedisCache,
+  initRedisCache,
+  startCacheCleanup,
+} from "./services/cache";
 
 // Detect if running as a cluster worker
 const isWorker = process.env.PIXELSERVE_WORKER_ID !== undefined;
@@ -15,12 +19,55 @@ if (config.cacheMode === "disk" || config.cacheMode === "hybrid") {
   await Bun.$`mkdir -p ${config.cacheDir}`.quiet();
 }
 
+// Initialize Redis cache if configured
+if (config.cacheMode === "redis") {
+  await initRedisCache();
+}
+
 const app = new Elysia()
   .use(
     cors({
       origin: config.allowedOrigins.length > 0 ? config.allowedOrigins : true,
     }),
   )
+  .onRequest(({ request, set }) => {
+    if (config.allowedOrigins.length === 0) return;
+
+    const url = new URL(request.url);
+    if (url.pathname === "/health") return;
+
+    const origin = request.headers.get("Origin");
+    const referer = request.headers.get("Referer");
+
+    if (!origin && !referer) return;
+
+    const sourceOrigin =
+      origin ||
+      (() => {
+        try {
+          return new URL(referer as string).origin;
+        } catch {
+          return referer as string;
+        }
+      })();
+
+    const isAllowed = config.allowedOrigins.some((allowed) => {
+      if (sourceOrigin === allowed) return true;
+      try {
+        const parsed = new URL(sourceOrigin);
+        return (
+          parsed.hostname === allowed || parsed.hostname.endsWith(`.${allowed}`)
+        );
+      } catch {
+        return sourceOrigin === allowed;
+      }
+    });
+
+    if (!isAllowed) {
+      set.status = 403;
+      return { error: "FORBIDDEN", message: "Origin not allowed" };
+    }
+  })
   .onError(({ error, code, set }) => {
     // Don't log Elysia's built-in NOT_FOUND errors (these are normal 404s)
     if (code === "NOT_FOUND") {
@@ -72,6 +119,10 @@ function getCacheInfo(): string {
       return `memory (max ${config.maxMemoryCacheItems} items)`;
     case "hybrid":
       return `hybrid (memory + ${config.cacheDir})`;
+    case "redis": {
+      const masked = config.redisUrl.replace(/:\/\/[^@]*@/, "://***@");
+      return `redis (${masked})`;
+    }
     case "none":
       return "disabled";
   }
@@ -121,4 +172,12 @@ ${c.magenta}  ____  _          _ ____
     ${c.dim}Discord:${c.reset} ${c.blue}https://go.climactic.co/discord${c.reset}
 `);
 
+// Graceful shutdown
+const shutdown = async () => {
+  await disconnectRedisCache();
+  process.exit(0);
+};
+process.on("SIGTERM", shutdown);
+process.on("SIGINT", shutdown);
+
 export type App = typeof app;

src/routes/health.ts

@@ -14,15 +14,20 @@ export const healthRoutes = new Elysia().get("/health", async ({ set }) => {
     version: "1.0.0",
   };
 
-  // Check disk cache directory exists if using disk mode
-  if (config.cacheMode === "disk") {
+  // Check disk cache directory exists if using disk/hybrid mode
+  if (config.cacheMode === "disk" || config.cacheMode === "hybrid") {
     const cacheDir = Bun.file(config.cacheDir);
     const cacheExists = await cacheDir.exists().catch(() => false);
     if (!cacheExists) {
       status.status = "degraded";
     }
   }
 
+  // Check Redis connection health
+  if (config.cacheMode === "redis" && cacheStats.connected === false) {
+    status.status = "degraded";
+  }
+
   set.headers = {
     "Cache-Control": "no-cache, no-store, must-revalidate",
   };