2026-04-13 - 2026-10-13
Overview
54 Pull requests merged by 1 user
Merged
#122 Core Rule Set reads request bodies up to SWWAF_WAF_BODY_LIMIT
Merged
#121 The Core Rule Set, run by Coraza, on each request's method, URL and headers
Merged
#120 Tests that wait for a lookup answer give it an hour
Merged
#118 Trap paths, and the error burst banning a client refused too often
Merged
#117 CrowdSec decision list fetched, kept, and its clients banned until the decision ends
Merged
#114 Ban notes name the reputation sources that listed the client
Merged
#113 SWWAF_IPV6_GROUP_PREFIX, SWWAF_MAX_TRACKED_CLIENTS and SWWAF_LOG_LEVEL
Merged
#111 AbuseIPDB scores for clients that committed an offence, within a daily budget
Merged
#110 DNS blocklists asked in the background, verdicts kept
Merged
#108 Blocklists and an AS percentage file fetched by URL
Merged
#107 Anomaly thresholds: alerts for unusual traffic, nothing refused
Merged
#103 Lower limits for listed AS numbers and countries
Merged
#102 Byte limits per client over a minute, an hour and a day
Merged
#100 make tidy, and make check failing on an untidy go.mod or go.sum
Merged
#98 Look clients up in the IPinfo Lite file with SWWAF_LOOKUP_SOURCE=file
Merged
#97 AS number and country looked up for every client
Merged
#96 Instance name on process log lines and every metric
Merged
#94 Alerts to Slack and ntfy, each destination with its own queue
Merged
#93 Alerts to a JSON webhook, with a cooldown and an hourly summary
Merged
#92 Admin endpoints for bans and clients on the single listener
Merged
#89 Settings given as files: the _FILE form of every setting
Merged
#88 Bans an admin makes or lifts: the admin cause, a reason, lifted bans kept
Merged
#84 Send every log line to a syslog server as well
Merged
#83 Rule files, and bans for a clear sign of attack
Merged
#80 Leave SWWAF_RATE_LIMIT_EXEMPT_PATHS out of the request rate limits
Merged
#82 Log the rest of the request log's fields
Merged
#75 Take in an admin's edits of the state files while running
Merged
#81 Observe mode: log what would be refused, refuse nothing
Merged
#76 Serve Prometheus metrics behind SWWAF_METRICS_TOKEN
Merged
#74 Run the GeoJS lookup tests on a clock the test controls
Merged
#72 Keep the bans, the clients and GeoJS's answers in state files
Merged
#69 Ban the netblock of a client that breaks a rate limit, in memory
Merged
#71 The header size and the idle time as settings
Merged
#67 Re-vendor the canonical files from sneak/prompts at dd4027b
Merged
#66 Network lists: always allowed, exempt from rate limits, always refused
Merged
#62 Derive the proxy tests' short timeout setting from the timeout
Merged
#60 Quiet the useradd and Perl warnings in the image build
Merged
#59 Spend less of make test writing the image and waiting
Merged
#57 The image apps build FROM, with its health check
Merged
#54 Country allow and deny lists, looked up through GeoJS
Merged
#55 Proxy timing tests outlast a hold-up of the test process
Merged
#52 Point the unreachable-app test at port 1
Merged
#50 TestRequestTimeouts expects 504 when none of the body reached the app
Merged
#48 Per-client request rate limits over a minute, an hour and a day
Merged
#47 Add the MIT licence
Merged
#46 Settle the spec's open points after milestones 1 and 2
Merged
#42 Settle the open points of the Ubuntu and nixpkgs image
Merged
#41 Deploy model: listen port, token files, state directory owner
Merged
#39 Pass-through proxy with timeouts, size limits and a request log
Merged
#31 Spec: SPEC.md and README.md to sneak's rulings, deploy model, milestones and Ubuntu base
Merged
#37 Build the smallwebwaf image on Ubuntu 26.04 LTS with nixpkgs
Merged
#35 SPEC follows milestones 1 and 2: build order, two size limits, GeoJS answers in memory
Merged
#32 Deploy model: apps build FROM the smallwebwaf image, settings prefixed SWWAF_
Merged
#9 SPEC and README: owner rulings, issues 2 to 5, internet-ready defaults
1 Pull request proposed by 1 user
Proposed
#40 Milestones 1 and 2: proxy with timeouts and size limits, rate limits, country lists and the image
19 Issues closed from 2 users
Closed
#78 Observe mode: log what would be refused, refuse nothing
Closed
#73 A GeoJS lookup test measures real time and can fail under load
Closed
#63 Pin actions/checkout at a newer release: the runner's copy of the pinned one is broken
Closed
#61 Proxy tests: the short timeout's setting is written apart from the timeout
Closed
#14 Milestone 2: per-IP rate limits and country allow and deny lists, ready for production
Closed
#51 TestAnswers502WhenTheAppCannotBeReached can reach another test's server
Closed
#34 Spec: the smallwebwaf image is built on the latest Ubuntu LTS with nixpkgs installed
Closed
#16 SPEC.md follows milestones 1 and 2: build order, one size limit per direction, GeoJS answers in memory
Closed
#12 Deploy model: apps build FROM the smallwebwaf image, with smallwebwaf on :8080 in front of the app on 127.0.0.1:8081
Closed
#6 SPEC update: fold the seven resolutions, issues 2 to 5 and the internet-ready directive (issue 7) into SPEC.md
Closed
#11 how about we use geojs (free json geoip api) instead of a local database file? maybe a config flag for it?
Closed
#8 requirement: very simple way to entirely block a list of countries, or to allow only certain countries
Closed
#7 SPEC: internet-ready out of the box, with 2026 real-world defaults and minimal required configuration
Closed
#4 Ban info
Closed
#5 Limits and timeouts
Closed
#3 Nonsense
Closed
#2 spec updates
Closed
#10 Easier administration: five proposals to pick from
Closed
#1 Land the initial README and SPEC per the owner's design rulings
66 Issues created by 1 user
Opened
#1 Land the initial README and SPEC per the owner's design rulings
Opened
#2 spec updates
Opened
#3 Nonsense
Opened
#4 Ban info
Opened
#5 Limits and timeouts
Opened
#6 SPEC update: fold the seven resolutions, issues 2 to 5 and the internet-ready directive (issue 7) into SPEC.md
Opened
#7 SPEC: internet-ready out of the box, with 2026 real-world defaults and minimal required configuration
Opened
#8 requirement: very simple way to entirely block a list of countries, or to allow only certain countries
Opened
#10 Easier administration: five proposals to pick from
Opened
#11 how about we use geojs (free json geoip api) instead of a local database file? maybe a config flag for it?
Opened
#12 Deploy model: apps build FROM the smallwebwaf image, with smallwebwaf on :8080 in front of the app on 127.0.0.1:8081
Opened
#13 Milestone 1: pass-through proxy with read and write timeouts, size limits and a request log
Opened
#14 Milestone 2: per-IP rate limits and country allow and deny lists, ready for production
Opened
#15 LICENSE: sneak picks the licence
Opened
#16 SPEC.md follows milestones 1 and 2: build order, one size limit per direction, GeoJS answers in memory
Opened
#17 Keep state across restarts: GeoJS answers and rate counters on disk
Opened
#19 Network lists: always allowed, exempt from limits, always refused
Opened
#28 Remote log sending
Opened
#27 Admin listener
Opened
#26 Alerts: the queue and the JSON webhook
Opened
#25 The Core Rule Set, run by Coraza
Opened
#24 Rule files
Opened
#23 Metrics endpoint
Opened
#22 The IPinfo Lite file as a second lookup source
Opened
#21 Lower limits for listed AS numbers and countries
Opened
#20 Byte limits per client
Opened
#18 Bans: the ban model of issue 2, with the notes of issue 4
Opened
#29 Reputation: downloaded blocklists
Opened
#30 Gitea requests the Core Rule Set may refuse at the defaults, to be checked against a running gitea when milestone 1 is built
Opened
#33 Deploy model: points the spec leaves open, from the review of issue 12
Opened
#34 Spec: the smallwebwaf image is built on the latest Ubuntu LTS with nixpkgs installed
Opened
#36 Spec after the milestones: points left open, from the review of issue 16
Opened
#38 Ubuntu and nixpkgs image: points left open, from the review of issue 34
Opened
#43 Milestone 2, part 1: per-IP rate limits
Opened
#45 Milestone 2, part 3: the image apps build FROM, with its health check
Opened
#44 Milestone 2, part 2: country allow and deny lists, with GeoJS lookup
Opened
#49 TestRequestTimeouts can answer 504 instead of 408 when the client stops sending
Opened
#51 TestAnswers502WhenTheAppCannotBeReached can reach another test's server
Opened
#53 Proxy timing tests can fail when the test process is held up for 300 ms
Opened
#56 make test runs past the 20-second target
Opened
#58 Image build warnings: useradd uid range, a Perl warning while installing, runsvinit at stop
Opened
#61 Proxy tests: the short timeout's setting is written apart from the timeout
Opened
#63 Pin actions/checkout at a newer release: the runner's copy of the pinned one is broken
Opened
#65 Re-vendor the canonical files from sneak/prompts at dd4027b
Opened
#68 State files: take in an admin's edits while running
Opened
#70 The header size and the idle time as settings
Opened
#73 A GeoJS lookup test measures real time and can fail under load
Opened
#77 Paths the request rate limits do not count (SWWAF_RATE_LIMIT_EXEMPT_PATHS)
Opened
#78 Observe mode: log what would be refused, refuse nothing
Opened
#79 The rest of the request log's fields
Opened
#85 Default rule file: a probe sent percent-encoded gets past its path rules
Opened
#86 Bans an admin makes or lifts: the admin cause, a reason, lifted bans kept
Opened
#87 Settings given as files: the _FILE form of every setting
Opened
#90 Alerts to Slack and ntfy
Opened
#91 SWWAF_INSTANCE_NAME on process log lines and metrics
Opened
#95 AS number and country looked up for every client
Opened
#99 make tidy, and make check failing on an untidy go.mod or go.sum
Opened
#101 Anomaly thresholds: alerts for unusual traffic, nothing refused
Opened
#104 Reputation: DNS blocklists
Opened
#105 Reputation: AbuseIPDB
Opened
#106 Reputation: the CrowdSec decision feed
Opened
#109 Ban notes name the reputation sources that listed the client
Opened
#112 SWWAF_IPV6_GROUP_PREFIX, SWWAF_MAX_TRACKED_CLIENTS and SWWAF_LOG_LEVEL
Opened
#115 Trap paths and the error burst
Opened
#116 Body inspection by the Core Rule Set (SWWAF_WAF_BODY_LIMIT)
Opened
#119 TestBanNotes can fail when the test process is held up past the lookup timeout