anchor.diff:  $ go-camo -k "somekey"
   ----
   
  -Go-Camo does not daemonize on its own. For production usage, it is recommended
  -to launch in a process supervisor, and drop privileges as appropriate.
  -
  -Examples of supervisors include:
  -http://cr.yp.to/daemontools.html[daemontools],
  -http://smarden.org/runit/[runit],
  -http://upstart.ubuntu.com/[upstart],
  -http://launchd.macosforge.org/[launchd],
  -https://www.freedesktop.org/wiki/Software/systemd/[systemd], and many more.
  -
  -For the reasoning behind lack of daemonization, see
  -http://cr.yp.to/daemontools/faq/create.html#why[daemontools/why]. In addition,
  -the code is much simpler because of it.
  +Go-Camo does not daemonize on its own. For production usage, it is recommended to launch in a process supervisor, and drop privileges as appropriate.
  +
  +Examples of supervisors include: {link-damontools}, {link-runit}, {link-upstart}, {link-launchd}, {link-systemd}, and many more.
  +
  +For the reasoning behind lack of daemonization, see {link-daemontools-why}.
  +In addition, the code is much simpler because of it.
   
   == Running on Heroku
   
   In order to use this on Heroku with the provided Procfile, you need to:
   
  -*   Create an app specifying the https://github.com/kr/heroku-buildpack-go
  -    buildpack
  +*   Create an app specifying the {link-heroku-buildpack-go} buildpack
   *   Set `GOCAMO_HMAC` to the key you are using
   
   == Securing an installation
   
  -go-camo will generally do what you tell it to with regard to fetching signed
  -urls. There is some limited support for trying to prevent
  -https://en.wikipedia.org/wiki/DNS_rebinding[dns rebinding] attacks.
  -
  -go-camo will attempt to reject any address matching an rfc1918 network block,
  -or a private scope ipv6 address, be it in the url or via resulting hostname
  -resolution. Please note, however, that this does not provide protecton for a
  -network that uses public address space (ipv4 or ipv6), or some of the
  -https://en.wikipedia.org/wiki/IPv6_address#Special_addresses[more exotic] ipv6
  -addresses.
  +go-camo will generally do what you tell it to with regard to fetching signed urls.
  +There is some limited support for trying to prevent {link-dns-rebinding} attacks.
  +
  +go-camo will attempt to reject any address matching an rfc1918 network block, or a private scope ipv6 address, be it in the url or via resulting hostname resolution.
  +Please note, however, that this does not provide protecton for a network that uses public address space (ipv4 or ipv6), or some of the {link-ip6-special-addresses}[more exotic] ipv6 addresses.
   
   The list of networks rejected include...
   
  
positive.code: 
  === Metrics
  
  When the `--metrics` flag is used, the service will expose a Prometheus-compatible `/metrics` endpoint. This can be used by monitoring systems to gather data.
  
  The endpoint includes all of the default `go_` and `process_`. In addition, a number of custom metrics.
  
  [%header%autowidth.stretch]
  |===
  
negative.code: *   The original URL in the content is parsed.
  *   An HMAC signature of the url is generated.
  *   The url and hmac are encoded.
  *   The encoded url and hmac are placed into the expected format, creating the signed url.
  *   The signed url replaces the original image URL.
  *   The web app returns the content to the client.
  *   The client requets the signed url from Go-Camo.
  *   Go-Camo validates the HMAC, decodes the URL, then requests the content from the origin server and streams it to the client.
  
  [source,text]
  ----
  