Update docs: gb view, extras, WEBHOOK_SECRET, PORT, webhook signature

Author: Kevin Allioli

docs/api.md

@@ -136,6 +136,26 @@ When `webhook_url` is set, Ghostbit sends a `POST` request on each view:
 
 The request has a 5-second timeout and is fire-and-forget (failures are not retried).
 
+### Webhook signature
+
+If `WEBHOOK_SECRET` is configured on the server, every delivery includes an HMAC-SHA256 signature:
+
+```
+X-Ghostbit-Signature: sha256=<hex>
+```
+
+The signature is computed over the raw JSON body. Verify it on the receiving end:
+
+```python
+import hmac, hashlib
+
+def verify(secret: str, body: bytes, header: str) -> bool:
+    expected = "sha256=" + hmac.new(secret.encode(), body, hashlib.sha256).hexdigest()
+    return hmac.compare_digest(expected, header)
+```
+
+Always use constant-time comparison to prevent timing attacks. See the [Encryption](encryption.md#webhook-signatures) page for more details and Node.js examples.
+
 ---
 
 ## Example — create and read with curl

docs/cli.md

@@ -6,7 +6,15 @@
 pip install ghostbit-cli
 ```
 
-This installs the `gb` command.
+This installs the `gb` and `ghostbit` commands.
+
+With optional extras for terminal rendering:
+
+```bash
+pip install "ghostbit-cli[all]"       # pygments + rich (recommended)
+pip install "ghostbit-cli[color]"     # pygments — syntax highlighting
+pip install "ghostbit-cli[markdown]"  # rich — Markdown rendering
+```
 
 ---
 
@@ -63,6 +71,28 @@ Language is auto-detected from the file extension.
 
 ---
 
+## View a paste
+
+Download, decrypt, and display a paste directly in the terminal:
+
+```bash
+# Non-password paste (key is in the URL fragment)
+gb view https://paste.example.com/abc123#KEY~TOKEN
+
+# Password-protected paste (prompts for password interactively)
+gb view https://paste.example.com/abc123#~TOKEN
+
+# Pipe to another tool
+gb view https://paste.example.com/abc123#KEY~TOKEN | less
+```
+
+- Markdown pastes are rendered with titles, bold, lists, and code blocks (requires `rich`)
+- Other languages are syntax-highlighted (requires `pygments`)
+- Falls back to plain text if neither is installed
+- Burn-after-read pastes display a warning on stderr after decryption
+
+---
+
 ## Examples
 
 ```bash

docs/configuration.md

@@ -8,9 +8,11 @@ All configuration is done via environment variables (or a `.env` file at the pro
 |----------|---------|----------|-------------|
 | `ENCRYPTION_KEY` | — | **Yes** | Hex-encoded 32-byte server key. Used to hash delete tokens. |
 | `STORAGE_BACKEND` | `sqlite` | No | `sqlite` or `redis` |
-| `SQLITE_PATH` | `ghostbit.db` | No | Path to the SQLite database file |
+| `SQLITE_PATH` | `/data/ghostbit.db` | No | Path to the SQLite database file |
 | `REDIS_URL` | `redis://localhost:6379` | No | Redis connection URL |
 | `MAX_PASTE_SIZE` | `524288` | No | Maximum paste size in bytes (default: 512 KB) |
+| `PORT` | `8000` | No | HTTP port the server listens on |
+| `WEBHOOK_SECRET` | — | No | If set, signs webhook deliveries with HMAC-SHA256 (`X-Ghostbit-Signature`) |
 
 ## Generating an encryption key
 
@@ -53,4 +55,8 @@ ENCRYPTION_KEY=your_hex_encoded_32_byte_key_here
 STORAGE_BACKEND=sqlite
 SQLITE_PATH=/data/ghostbit.db
 MAX_PASTE_SIZE=524288
+PORT=8000
+
+# Optional: sign webhook deliveries
+# WEBHOOK_SECRET=your_hex_encoded_secret_here
 ```