Default API key role was "admin", which was something that I forgot to fix during testing. We
change it to "read-only".
Additionally repository URLs now reject `file://` scheme (another testing artifact) localhost,
private IP ranges, and cloud metadata endpoints. Nix expressions reject path traversal (`..`)
and absolute paths. Validation is called at the evaluator endtrypoint before command construction.
Signed-off-by: NotAShelf <raf@notashelf.dev>
Change-Id: I35729c6aa9ec4ff8d1ea19bd57ea93646a6a6964
Can be configured from the config file, and also using environment
options.
```toml
[database]
url = "postgresql://fc_ci:password@localhost/fc_ci"
max_connections = 20
min_connections = 5
connect_timeout = 30
idle_timeout = 600
max_lifetime = 1800
```
We'll want to support SQlite in the future, and better secret handling
for database credentials. For now, this is workable.
---
Signed-off-by: NotAShelf <raf@notashelf.dev>
Change-Id: I36b4c1306511052a2748ca9d5d3429366a6a6964
