2026-10-06 - 2026-11-06
Overview
2 Releases published by 1 user
Published
v1.0.0-rc2
Published
v1.0.0-rc1
53 Pull requests merged by 1 user
Merged
#189 README: sections, compose examples, env var table (closes #188)
Merged
#186 rproxy tests give a loaded host time before their limits run out (closes #185)
Merged
#184 rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)
Merged
#181 rproxy, the proxy in front of each app, asks servewaf and fails open (closes #171)
Merged
#183 servewaf always answers rproxy well within its time limit (closes #182)
Merged
#180 servewaf answers rproxy's question about each request and takes its report (closes #170)
Merged
#179 Default request limits per minute, hour and day, sized for API use (closes #176)
Merged
#164 Health check test uses addresses nothing can connect to (closes #158)
Merged
#162 New defaults for the request and byte limits (closes #161)
Merged
#160 next into main
Merged
#159 SPEC, README and docs rewritten from scratch (closes #154, closes #155, closes #156)
Merged
#40 Milestones 1 and 2: proxy with timeouts and size limits, rate limits, country lists and the image
Merged
#152 README and SPEC name every offence that has a client checked (closes #151)
Merged
#153 A ban in bans.json that ends at or before its start is refused, as other malformed entries are (closes #150)
Merged
#142 smallwebwaf starts with SWWAF_STATE_DIR given as a file on a new volume (closes #137)
Merged
#148 An answer from the app without a Content-Type reaches the client without one (closes #127)
Merged
#145 README and SPEC say a client too slow to send its request line and headers may get an error answer (closes #138)
Merged
#149 A path holding a character Go escapes reaches the app as the client sent it (closes #126)
Merged
#147 An upgrade the app accepts under another protocol name is answered 502 (closes #131)
Merged
#146 README and SPEC say what docker stop does to requests in progress when the app exits at once (closes #139)
Merged
#144 A client that stops sending with little of its body left after the app has answered is timed out (closes #136)
Merged
#134 script/gitea-requests, and the gitea refusals it confirms named in SPEC.md (closes #30)
Merged
#143 A ban's earlier_bans counts a ban dropped after an admin's ban (closes #128)
Merged
#135 A client that stops sending after the app answers is timed out
Merged
#141 The image build rides out a brief 503 from Ubuntu's snapshot server (closes #132)
Merged
#133 A request that waited for its lookup is counted when it goes on
Merged
#125 Path rules and trap paths match the path decoded once too
Merged
#122 Core Rule Set reads request bodies up to SWWAF_WAF_BODY_LIMIT
Merged
#121 The Core Rule Set, run by Coraza, on each request's method, URL and headers
Merged
#120 Tests that wait for a lookup answer give it an hour
Merged
#118 Trap paths, and the error burst banning a client refused too often
Merged
#117 CrowdSec decision list fetched, kept, and its clients banned until the decision ends
Merged
#114 Ban notes name the reputation sources that listed the client
Merged
#113 SWWAF_IPV6_GROUP_PREFIX, SWWAF_MAX_TRACKED_CLIENTS and SWWAF_LOG_LEVEL
Merged
#111 AbuseIPDB scores for clients that committed an offence, within a daily budget
Merged
#110 DNS blocklists asked in the background, verdicts kept
Merged
#108 Blocklists and an AS percentage file fetched by URL
Merged
#107 Anomaly thresholds: alerts for unusual traffic, nothing refused
Merged
#103 Lower limits for listed AS numbers and countries
Merged
#102 Byte limits per client over a minute, an hour and a day
Merged
#100 make tidy, and make check failing on an untidy go.mod or go.sum
Merged
#98 Look clients up in the IPinfo Lite file with SWWAF_LOOKUP_SOURCE=file
Merged
#97 AS number and country looked up for every client
Merged
#96 Instance name on process log lines and every metric
Merged
#94 Alerts to Slack and ntfy, each destination with its own queue
Merged
#93 Alerts to a JSON webhook, with a cooldown and an hourly summary
Merged
#92 Admin endpoints for bans and clients on the single listener
Merged
#89 Settings given as files: the _FILE form of every setting
Merged
#88 Bans an admin makes or lifts: the admin cause, a reason, lifted bans kept
Merged
#84 Send every log line to a syslog server as well
Merged
#83 Rule files, and bans for a clear sign of attack
Merged
#80 Leave SWWAF_RATE_LIMIT_EXEMPT_PATHS out of the request rate limits
Merged
#82 Log the rest of the request log's fields
3 Pull requests proposed by 1 user
Proposed
#163 next into main
Proposed
#187 deploy/gitea: Gitea behind traefik, rproxy and servewaf, with its test (closes #178)
Proposed
#191 Install the image's Ubuntu packages from the normal mirrors (closes #190)
76 Issues closed from 2 users
Closed
#188 README: rewrite on Fable into sections, with compose examples and an env var table
Closed
#185 rproxy test of an answer cut off after its start fails under load
Closed
#172 rproxy and servewaf replace the one-process smallwebwaf
Closed
#165 Tiny per-app reverse proxy that asks a separate smallwebwaf whether to pass each request
Closed
#171 rproxy: the proxy in front of each app that asks servewaf and fails open
Closed
#182 servewaf always answers rproxy well within its time limit
Closed
#170 servewaf: answer rproxy's question about each request, and take its report
Closed
#176 Default request limits per minute, hour and day, sized for API use
Closed
#177 Secrets in query strings never reach the log, ban notes or alerts
Closed
#158 TestHealthCheck fails when another process takes the closed test server's port
Closed
#161 defaults are insane
Closed
#155 Rewrite README.md from scratch so a newcomer can follow it
Closed
#154 use fable on xhigh to rewrite the readme for comprehensibility
Closed
#156 Rewrite SPEC.md from scratch, short and plain
Closed
#116 Body inspection by the Core Rule Set (SWWAF_WAF_BODY_LIMIT)
Closed
#101 Anomaly thresholds: alerts for unusual traffic, nothing refused
Closed
#115 Trap paths and the error burst
Closed
#112 SWWAF_IPV6_GROUP_PREFIX, SWWAF_MAX_TRACKED_CLIENTS and SWWAF_LOG_LEVEL
Closed
#109 Ban notes name the reputation sources that listed the client
Closed
#106 Reputation: the CrowdSec decision feed
Closed
#105 Reputation: AbuseIPDB
Closed
#104 Reputation: DNS blocklists
Closed
#29 Reputation: downloaded blocklists
Closed
#21 Lower limits for listed AS numbers and countries
Closed
#25 The Core Rule Set, run by Coraza
Closed
#95 AS number and country looked up for every client
Closed
#22 The IPinfo Lite file as a second lookup source
Closed
#20 Byte limits per client
Closed
#24 Rule files
Closed
#26 Alerts: the queue and the JSON webhook
Closed
#27 Admin listener
Closed
#99 make tidy, and make check failing on an untidy go.mod or go.sum
Closed
#91 SWWAF_INSTANCE_NAME on process log lines and metrics
Closed
#90 Alerts to Slack and ntfy
Closed
#86 Bans an admin makes or lifts: the admin cause, a reason, lifted bans kept
Closed
#87 Settings given as files: the _FILE form of every setting
Closed
#28 Remote log sending
Closed
#23 Metrics endpoint
Closed
#18 Bans: the ban model of issue 2, with the notes of issue 4
Closed
#68 State files: take in an admin's edits while running
Closed
#77 Paths the request rate limits do not count (SWWAF_RATE_LIMIT_EXEMPT_PATHS)
Closed
#79 The rest of the request log's fields
Closed
#17 Keep state across restarts: GeoJS answers and rate counters on disk
Closed
#43 Milestone 2, part 1: per-IP rate limits
Closed
#44 Milestone 2, part 2: country allow and deny lists, with GeoJS lookup
Closed
#70 The header size and the idle time as settings
Closed
#45 Milestone 2, part 3: the image apps build FROM, with its health check
Closed
#19 Network lists: always allowed, exempt from limits, always refused
Closed
#65 Re-vendor the canonical files from sneak/prompts at dd4027b
Closed
#58 Image build warnings: useradd uid range, a Perl warning while installing, runsvinit at stop
Closed
#15 LICENSE: sneak picks the licence
Closed
#33 Deploy model: points the spec leaves open, from the review of issue 12
Closed
#36 Spec after the milestones: points left open, from the review of issue 16
Closed
#38 Ubuntu and nixpkgs image: points left open, from the review of issue 34
Closed
#13 Milestone 1: pass-through proxy with read and write timeouts, size limits and a request log
Closed
#151 The README's AbuseIPDB section leaves out three of the offences that have a client checked
Closed
#150 A ban edited into bans.json with expires before start makes the netblock's next limit ban already expired
Closed
#56 make test runs past the 20-second target
Closed
#53 Proxy timing tests can fail when the test process is held up for 300 ms
Closed
#49 TestRequestTimeouts can answer 504 instead of 408 when the client stops sending
Closed
#119 TestBanNotes can fail when the test process is held up past the lookup timeout
Closed
#85 Default rule file: a probe sent percent-encoded gets past its path rules
Closed
#137 SWWAF_STATE_DIR given as a file: the run script gives the default directory to the smallwebwaf user, and the start fails
Closed
#127 An answer from the app without a Content-Type can reach the client with one Go guessed
Closed
#138 A client too slow to send its request line is answered 400, not left without an answer
Closed
#126 A path holding a character Go escapes reaches the app re-encoded, with an encoded slash turned into a slash
Closed
#131 An upgrade the app accepts under another protocol name is answered 200 with an empty body
Closed
#139 docker stop: requests in progress get 502 at once when the app exits on SIGTERM, not five seconds to finish
Closed
#136 A client that stops sending with little of its body left after the app has answered is never timed out
Closed
#30 Gitea requests the Core Rule Set may refuse at the defaults, to be checked against a running gitea when milestone 1 is built
Closed
#128 A ban's earlier_bans undercounts once a ban after an admin's ban is dropped
Closed
#130 A client that stops sending its body after the app has answered is never timed out
Closed
#132 The image build fails on a brief 503 from Ubuntu's snapshot server: apt gets no retries
Closed
#123 Run the image as an operator would, in front of a small test backend, and file the defects found
Closed
#129 Requests waiting for a client's first lookup are counted at the time they arrived, and one can wipe another's count
Closed
#124 Read the request filtering, rate limiting and proxy code for correctness, and file the defects found
56 Issues created by 2 users
Opened
#85 Default rule file: a probe sent percent-encoded gets past its path rules
Opened
#86 Bans an admin makes or lifts: the admin cause, a reason, lifted bans kept
Opened
#87 Settings given as files: the _FILE form of every setting
Opened
#90 Alerts to Slack and ntfy
Opened
#91 SWWAF_INSTANCE_NAME on process log lines and metrics
Opened
#95 AS number and country looked up for every client
Opened
#99 make tidy, and make check failing on an untidy go.mod or go.sum
Opened
#101 Anomaly thresholds: alerts for unusual traffic, nothing refused
Opened
#104 Reputation: DNS blocklists
Opened
#105 Reputation: AbuseIPDB
Opened
#106 Reputation: the CrowdSec decision feed
Opened
#109 Ban notes name the reputation sources that listed the client
Opened
#112 SWWAF_IPV6_GROUP_PREFIX, SWWAF_MAX_TRACKED_CLIENTS and SWWAF_LOG_LEVEL
Opened
#115 Trap paths and the error burst
Opened
#116 Body inspection by the Core Rule Set (SWWAF_WAF_BODY_LIMIT)
Opened
#119 TestBanNotes can fail when the test process is held up past the lookup timeout
Opened
#123 Run the image as an operator would, in front of a small test backend, and file the defects found
Opened
#124 Read the request filtering, rate limiting and proxy code for correctness, and file the defects found
Opened
#126 A path holding a character Go escapes reaches the app re-encoded, with an encoded slash turned into a slash
Opened
#127 An answer from the app without a Content-Type can reach the client with one Go guessed
Opened
#128 A ban's earlier_bans undercounts once a ban after an admin's ban is dropped
Opened
#129 Requests waiting for a client's first lookup are counted at the time they arrived, and one can wipe another's count
Opened
#130 A client that stops sending its body after the app has answered is never timed out
Opened
#131 An upgrade the app accepts under another protocol name is answered 200 with an empty body
Opened
#132 The image build fails on a brief 503 from Ubuntu's snapshot server: apt gets no retries
Opened
#136 A client that stops sending with little of its body left after the app has answered is never timed out
Opened
#139 docker stop: requests in progress get 502 at once when the app exits on SIGTERM, not five seconds to finish
Opened
#137 SWWAF_STATE_DIR given as a file: the run script gives the default directory to the smallwebwaf user, and the start fails
Opened
#138 A client too slow to send its request line is answered 400, not left without an answer
Opened
#140 1.0: what stands between next and a release candidate
Opened
#150 A ban edited into bans.json with expires before start makes the netblock's next limit ban already expired
Opened
#151 The README's AbuseIPDB section leaves out three of the offences that have a client checked
Opened
#154 use fable on xhigh to rewrite the readme for comprehensibility
Opened
#155 Rewrite README.md from scratch so a newcomer can follow it
Opened
#156 Rewrite SPEC.md from scratch, short and plain
Opened
#158 TestHealthCheck fails when another process takes the closed test server's port
Opened
#161 defaults are insane
Opened
#165 Tiny per-app reverse proxy that asks a separate smallwebwaf whether to pass each request
Opened
#166 Does today's one-process smallwebwaf stay beside rproxy and servewaf?
Opened
#167 Does servewaf read request bodies?
Opened
#168 What do the sites behind one servewaf share?
Opened
#169 Run smallwebwaf in front of Gitea: the split built, defaults for API use, tokens out of the log
Opened
#170 servewaf: answer rproxy's question about each request, and take its report
Opened
#171 rproxy: the proxy in front of each app that asks servewaf and fails open
Opened
#172 rproxy and servewaf replace the one-process smallwebwaf
Opened
#173 Rename internal/proxy to internal/servewaf
Opened
#174 Live request viewer in servewaf
Opened
#175 Request tags, with throttling and blocking per tag
Opened
#176 Default request limits per minute, hour and day, sized for API use
Opened
#177 Secrets in query strings never reach the log, ban notes or alerts
Opened
#178 deploy/gitea: Gitea behind traefik, rproxy and servewaf, with its test
Opened
#182 servewaf always answers rproxy well within its time limit
Opened
#185 rproxy test of an answer cut off after its start fails under load
Opened
#188 README: rewrite on Fable into sections, with compose examples and an env var table
Opened
#190 Install the image's Ubuntu packages from the normal mirrors, not a dated snapshot
Opened
#192 audit the symbol names for idiocy