2025-11-06 - 2026-11-06
Overview
2 Releases published by 1 user
Published
v1.0.0-rc2
Published
v1.0.0-rc1
81 Pull requests merged by 1 user
Merged
#189 README: sections, compose examples, env var table (closes #188)
Merged
#186 rproxy tests give a loaded host time before their limits run out (closes #185)
Merged
#184 rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)
Merged
#181 rproxy, the proxy in front of each app, asks servewaf and fails open (closes #171)
Merged
#183 servewaf always answers rproxy well within its time limit (closes #182)
Merged
#180 servewaf answers rproxy's question about each request and takes its report (closes #170)
Merged
#179 Default request limits per minute, hour and day, sized for API use (closes #176)
Merged
#164 Health check test uses addresses nothing can connect to (closes #158)
Merged
#162 New defaults for the request and byte limits (closes #161)
Merged
#160 next into main
Merged
#159 SPEC, README and docs rewritten from scratch (closes #154, closes #155, closes #156)
Merged
#40 Milestones 1 and 2: proxy with timeouts and size limits, rate limits, country lists and the image
Merged
#152 README and SPEC name every offence that has a client checked (closes #151)
Merged
#153 A ban in bans.json that ends at or before its start is refused, as other malformed entries are (closes #150)
Merged
#142 smallwebwaf starts with SWWAF_STATE_DIR given as a file on a new volume (closes #137)
Merged
#148 An answer from the app without a Content-Type reaches the client without one (closes #127)
Merged
#145 README and SPEC say a client too slow to send its request line and headers may get an error answer (closes #138)
Merged
#149 A path holding a character Go escapes reaches the app as the client sent it (closes #126)
Merged
#147 An upgrade the app accepts under another protocol name is answered 502 (closes #131)
Merged
#146 README and SPEC say what docker stop does to requests in progress when the app exits at once (closes #139)
Merged
#144 A client that stops sending with little of its body left after the app has answered is timed out (closes #136)
Merged
#134 script/gitea-requests, and the gitea refusals it confirms named in SPEC.md (closes #30)
Merged
#143 A ban's earlier_bans counts a ban dropped after an admin's ban (closes #128)
Merged
#135 A client that stops sending after the app answers is timed out
Merged
#141 The image build rides out a brief 503 from Ubuntu's snapshot server (closes #132)
Merged
#133 A request that waited for its lookup is counted when it goes on
Merged
#125 Path rules and trap paths match the path decoded once too
Merged
#122 Core Rule Set reads request bodies up to SWWAF_WAF_BODY_LIMIT
Merged
#121 The Core Rule Set, run by Coraza, on each request's method, URL and headers
Merged
#120 Tests that wait for a lookup answer give it an hour
Merged
#118 Trap paths, and the error burst banning a client refused too often
Merged
#117 CrowdSec decision list fetched, kept, and its clients banned until the decision ends
Merged
#114 Ban notes name the reputation sources that listed the client
Merged
#113 SWWAF_IPV6_GROUP_PREFIX, SWWAF_MAX_TRACKED_CLIENTS and SWWAF_LOG_LEVEL
Merged
#111 AbuseIPDB scores for clients that committed an offence, within a daily budget
Merged
#110 DNS blocklists asked in the background, verdicts kept
Merged
#108 Blocklists and an AS percentage file fetched by URL
Merged
#107 Anomaly thresholds: alerts for unusual traffic, nothing refused
Merged
#103 Lower limits for listed AS numbers and countries
Merged
#102 Byte limits per client over a minute, an hour and a day
Merged
#100 make tidy, and make check failing on an untidy go.mod or go.sum
Merged
#98 Look clients up in the IPinfo Lite file with SWWAF_LOOKUP_SOURCE=file
Merged
#97 AS number and country looked up for every client
Merged
#96 Instance name on process log lines and every metric
Merged
#94 Alerts to Slack and ntfy, each destination with its own queue
Merged
#93 Alerts to a JSON webhook, with a cooldown and an hourly summary
Merged
#92 Admin endpoints for bans and clients on the single listener
Merged
#89 Settings given as files: the _FILE form of every setting
Merged
#88 Bans an admin makes or lifts: the admin cause, a reason, lifted bans kept
Merged
#84 Send every log line to a syslog server as well
Merged
#83 Rule files, and bans for a clear sign of attack
Merged
#80 Leave SWWAF_RATE_LIMIT_EXEMPT_PATHS out of the request rate limits
Merged
#82 Log the rest of the request log's fields
Merged
#75 Take in an admin's edits of the state files while running
Merged
#81 Observe mode: log what would be refused, refuse nothing
Merged
#76 Serve Prometheus metrics behind SWWAF_METRICS_TOKEN
Merged
#74 Run the GeoJS lookup tests on a clock the test controls
Merged
#72 Keep the bans, the clients and GeoJS's answers in state files
Merged
#69 Ban the netblock of a client that breaks a rate limit, in memory
Merged
#71 The header size and the idle time as settings
Merged
#67 Re-vendor the canonical files from sneak/prompts at dd4027b
Merged
#66 Network lists: always allowed, exempt from rate limits, always refused
Merged
#62 Derive the proxy tests' short timeout setting from the timeout
Merged
#60 Quiet the useradd and Perl warnings in the image build
Merged
#59 Spend less of make test writing the image and waiting
Merged
#57 The image apps build FROM, with its health check
Merged
#54 Country allow and deny lists, looked up through GeoJS
Merged
#55 Proxy timing tests outlast a hold-up of the test process
Merged
#52 Point the unreachable-app test at port 1
Merged
#50 TestRequestTimeouts expects 504 when none of the body reached the app
Merged
#48 Per-client request rate limits over a minute, an hour and a day
Merged
#47 Add the MIT licence
Merged
#46 Settle the spec's open points after milestones 1 and 2
Merged
#42 Settle the open points of the Ubuntu and nixpkgs image
Merged
#41 Deploy model: listen port, token files, state directory owner
Merged
#39 Pass-through proxy with timeouts, size limits and a request log
Merged
#31 Spec: SPEC.md and README.md to sneak's rulings, deploy model, milestones and Ubuntu base
Merged
#37 Build the smallwebwaf image on Ubuntu 26.04 LTS with nixpkgs
Merged
#35 SPEC follows milestones 1 and 2: build order, two size limits, GeoJS answers in memory
Merged
#32 Deploy model: apps build FROM the smallwebwaf image, settings prefixed SWWAF_
Merged
#9 SPEC and README: owner rulings, issues 2 to 5, internet-ready defaults
3 Pull requests proposed by 1 user
Proposed
#163 next into main
Proposed
#187 deploy/gitea: Gitea behind traefik, rproxy and servewaf, with its test (closes #178)
Proposed
#191 Install the image's Ubuntu packages from the normal mirrors (closes #190)
95 Issues closed from 2 users
Closed
#188 README: rewrite on Fable into sections, with compose examples and an env var table
Closed
#185 rproxy test of an answer cut off after its start fails under load
Closed
#172 rproxy and servewaf replace the one-process smallwebwaf
Closed
#165 Tiny per-app reverse proxy that asks a separate smallwebwaf whether to pass each request
Closed
#171 rproxy: the proxy in front of each app that asks servewaf and fails open
Closed
#182 servewaf always answers rproxy well within its time limit
Closed
#170 servewaf: answer rproxy's question about each request, and take its report
Closed
#176 Default request limits per minute, hour and day, sized for API use
Closed
#177 Secrets in query strings never reach the log, ban notes or alerts
Closed
#158 TestHealthCheck fails when another process takes the closed test server's port
Closed
#161 defaults are insane
Closed
#155 Rewrite README.md from scratch so a newcomer can follow it
Closed
#154 use fable on xhigh to rewrite the readme for comprehensibility
Closed
#156 Rewrite SPEC.md from scratch, short and plain
Closed
#116 Body inspection by the Core Rule Set (SWWAF_WAF_BODY_LIMIT)
Closed
#101 Anomaly thresholds: alerts for unusual traffic, nothing refused
Closed
#104 Reputation: DNS blocklists
Closed
#105 Reputation: AbuseIPDB
Closed
#106 Reputation: the CrowdSec decision feed
Closed
#29 Reputation: downloaded blocklists
Closed
#25 The Core Rule Set, run by Coraza
Closed
#109 Ban notes name the reputation sources that listed the client
Closed
#21 Lower limits for listed AS numbers and countries
Closed
#112 SWWAF_IPV6_GROUP_PREFIX, SWWAF_MAX_TRACKED_CLIENTS and SWWAF_LOG_LEVEL
Closed
#115 Trap paths and the error burst
Closed
#90 Alerts to Slack and ntfy
Closed
#87 Settings given as files: the _FILE form of every setting
Closed
#91 SWWAF_INSTANCE_NAME on process log lines and metrics
Closed
#95 AS number and country looked up for every client
Closed
#99 make tidy, and make check failing on an untidy go.mod or go.sum
Closed
#86 Bans an admin makes or lifts: the admin cause, a reason, lifted bans kept
Closed
#22 The IPinfo Lite file as a second lookup source
Closed
#28 Remote log sending
Closed
#27 Admin listener
Closed
#26 Alerts: the queue and the JSON webhook
Closed
#24 Rule files
Closed
#20 Byte limits per client
Closed
#77 Paths the request rate limits do not count (SWWAF_RATE_LIMIT_EXEMPT_PATHS)
Closed
#79 The rest of the request log's fields
Closed
#68 State files: take in an admin's edits while running
Closed
#17 Keep state across restarts: GeoJS answers and rate counters on disk
Closed
#18 Bans: the ban model of issue 2, with the notes of issue 4
Closed
#23 Metrics endpoint
Closed
#58 Image build warnings: useradd uid range, a Perl warning while installing, runsvinit at stop
Closed
#43 Milestone 2, part 1: per-IP rate limits
Closed
#44 Milestone 2, part 2: country allow and deny lists, with GeoJS lookup
Closed
#45 Milestone 2, part 3: the image apps build FROM, with its health check
Closed
#19 Network lists: always allowed, exempt from limits, always refused
Closed
#70 The header size and the idle time as settings
Closed
#65 Re-vendor the canonical files from sneak/prompts at dd4027b
Closed
#13 Milestone 1: pass-through proxy with read and write timeouts, size limits and a request log
Closed
#33 Deploy model: points the spec leaves open, from the review of issue 12
Closed
#15 LICENSE: sneak picks the licence
Closed
#36 Spec after the milestones: points left open, from the review of issue 16
Closed
#38 Ubuntu and nixpkgs image: points left open, from the review of issue 34
Closed
#151 The README's AbuseIPDB section leaves out three of the offences that have a client checked
Closed
#150 A ban edited into bans.json with expires before start makes the netblock's next limit ban already expired
Closed
#56 make test runs past the 20-second target
Closed
#53 Proxy timing tests can fail when the test process is held up for 300 ms
Closed
#49 TestRequestTimeouts can answer 504 instead of 408 when the client stops sending
Closed
#119 TestBanNotes can fail when the test process is held up past the lookup timeout
Closed
#85 Default rule file: a probe sent percent-encoded gets past its path rules
Closed
#137 SWWAF_STATE_DIR given as a file: the run script gives the default directory to the smallwebwaf user, and the start fails
Closed
#127 An answer from the app without a Content-Type can reach the client with one Go guessed
Closed
#138 A client too slow to send its request line is answered 400, not left without an answer
Closed
#126 A path holding a character Go escapes reaches the app re-encoded, with an encoded slash turned into a slash
Closed
#131 An upgrade the app accepts under another protocol name is answered 200 with an empty body
Closed
#139 docker stop: requests in progress get 502 at once when the app exits on SIGTERM, not five seconds to finish
Closed
#136 A client that stops sending with little of its body left after the app has answered is never timed out
Closed
#30 Gitea requests the Core Rule Set may refuse at the defaults, to be checked against a running gitea when milestone 1 is built
Closed
#128 A ban's earlier_bans undercounts once a ban after an admin's ban is dropped
Closed
#130 A client that stops sending its body after the app has answered is never timed out
Closed
#132 The image build fails on a brief 503 from Ubuntu's snapshot server: apt gets no retries
Closed
#123 Run the image as an operator would, in front of a small test backend, and file the defects found
Closed
#129 Requests waiting for a client's first lookup are counted at the time they arrived, and one can wipe another's count
Closed
#124 Read the request filtering, rate limiting and proxy code for correctness, and file the defects found
Closed
#78 Observe mode: log what would be refused, refuse nothing
Closed
#73 A GeoJS lookup test measures real time and can fail under load
Closed
#63 Pin actions/checkout at a newer release: the runner's copy of the pinned one is broken
Closed
#61 Proxy tests: the short timeout's setting is written apart from the timeout
Closed
#14 Milestone 2: per-IP rate limits and country allow and deny lists, ready for production
Closed
#51 TestAnswers502WhenTheAppCannotBeReached can reach another test's server
Closed
#34 Spec: the smallwebwaf image is built on the latest Ubuntu LTS with nixpkgs installed
Closed
#16 SPEC.md follows milestones 1 and 2: build order, one size limit per direction, GeoJS answers in memory
Closed
#12 Deploy model: apps build FROM the smallwebwaf image, with smallwebwaf on :8080 in front of the app on 127.0.0.1:8081
Closed
#6 SPEC update: fold the seven resolutions, issues 2 to 5 and the internet-ready directive (issue 7) into SPEC.md
Closed
#11 how about we use geojs (free json geoip api) instead of a local database file? maybe a config flag for it?
Closed
#8 requirement: very simple way to entirely block a list of countries, or to allow only certain countries
Closed
#7 SPEC: internet-ready out of the box, with 2026 real-world defaults and minimal required configuration
Closed
#4 Ban info
Closed
#5 Limits and timeouts
Closed
#3 Nonsense
Closed
#2 spec updates
Closed
#10 Easier administration: five proposals to pick from
Closed
#1 Land the initial README and SPEC per the owner's design rulings
106 Issues created by 2 users
Opened
#1 Land the initial README and SPEC per the owner's design rulings
Opened
#2 spec updates
Opened
#3 Nonsense
Opened
#4 Ban info
Opened
#5 Limits and timeouts
Opened
#6 SPEC update: fold the seven resolutions, issues 2 to 5 and the internet-ready directive (issue 7) into SPEC.md
Opened
#7 SPEC: internet-ready out of the box, with 2026 real-world defaults and minimal required configuration
Opened
#8 requirement: very simple way to entirely block a list of countries, or to allow only certain countries
Opened
#10 Easier administration: five proposals to pick from
Opened
#11 how about we use geojs (free json geoip api) instead of a local database file? maybe a config flag for it?
Opened
#12 Deploy model: apps build FROM the smallwebwaf image, with smallwebwaf on :8080 in front of the app on 127.0.0.1:8081
Opened
#13 Milestone 1: pass-through proxy with read and write timeouts, size limits and a request log
Opened
#14 Milestone 2: per-IP rate limits and country allow and deny lists, ready for production
Opened
#15 LICENSE: sneak picks the licence
Opened
#16 SPEC.md follows milestones 1 and 2: build order, one size limit per direction, GeoJS answers in memory
Opened
#17 Keep state across restarts: GeoJS answers and rate counters on disk
Opened
#18 Bans: the ban model of issue 2, with the notes of issue 4
Opened
#19 Network lists: always allowed, exempt from limits, always refused
Opened
#20 Byte limits per client
Opened
#21 Lower limits for listed AS numbers and countries
Opened
#22 The IPinfo Lite file as a second lookup source
Opened
#23 Metrics endpoint
Opened
#24 Rule files
Opened
#25 The Core Rule Set, run by Coraza
Opened
#26 Alerts: the queue and the JSON webhook
Opened
#27 Admin listener
Opened
#28 Remote log sending
Opened
#29 Reputation: downloaded blocklists
Opened
#30 Gitea requests the Core Rule Set may refuse at the defaults, to be checked against a running gitea when milestone 1 is built
Opened
#33 Deploy model: points the spec leaves open, from the review of issue 12
Opened
#34 Spec: the smallwebwaf image is built on the latest Ubuntu LTS with nixpkgs installed
Opened
#36 Spec after the milestones: points left open, from the review of issue 16
Opened
#38 Ubuntu and nixpkgs image: points left open, from the review of issue 34
Opened
#43 Milestone 2, part 1: per-IP rate limits
Opened
#44 Milestone 2, part 2: country allow and deny lists, with GeoJS lookup
Opened
#45 Milestone 2, part 3: the image apps build FROM, with its health check
Opened
#49 TestRequestTimeouts can answer 504 instead of 408 when the client stops sending
Opened
#51 TestAnswers502WhenTheAppCannotBeReached can reach another test's server
Opened
#53 Proxy timing tests can fail when the test process is held up for 300 ms
Opened
#56 make test runs past the 20-second target
Opened
#58 Image build warnings: useradd uid range, a Perl warning while installing, runsvinit at stop
Opened
#61 Proxy tests: the short timeout's setting is written apart from the timeout
Opened
#63 Pin actions/checkout at a newer release: the runner's copy of the pinned one is broken
Opened
#65 Re-vendor the canonical files from sneak/prompts at dd4027b
Opened
#68 State files: take in an admin's edits while running
Opened
#70 The header size and the idle time as settings
Opened
#73 A GeoJS lookup test measures real time and can fail under load
Opened
#77 Paths the request rate limits do not count (SWWAF_RATE_LIMIT_EXEMPT_PATHS)
Opened
#78 Observe mode: log what would be refused, refuse nothing
Opened
#79 The rest of the request log's fields
Opened
#85 Default rule file: a probe sent percent-encoded gets past its path rules
Opened
#86 Bans an admin makes or lifts: the admin cause, a reason, lifted bans kept
Opened
#87 Settings given as files: the _FILE form of every setting
Opened
#90 Alerts to Slack and ntfy
Opened
#91 SWWAF_INSTANCE_NAME on process log lines and metrics
Opened
#95 AS number and country looked up for every client
Opened
#99 make tidy, and make check failing on an untidy go.mod or go.sum
Opened
#101 Anomaly thresholds: alerts for unusual traffic, nothing refused
Opened
#104 Reputation: DNS blocklists
Opened
#105 Reputation: AbuseIPDB
Opened
#106 Reputation: the CrowdSec decision feed
Opened
#109 Ban notes name the reputation sources that listed the client
Opened
#112 SWWAF_IPV6_GROUP_PREFIX, SWWAF_MAX_TRACKED_CLIENTS and SWWAF_LOG_LEVEL
Opened
#115 Trap paths and the error burst
Opened
#116 Body inspection by the Core Rule Set (SWWAF_WAF_BODY_LIMIT)
Opened
#119 TestBanNotes can fail when the test process is held up past the lookup timeout
Opened
#123 Run the image as an operator would, in front of a small test backend, and file the defects found
Opened
#124 Read the request filtering, rate limiting and proxy code for correctness, and file the defects found
Opened
#126 A path holding a character Go escapes reaches the app re-encoded, with an encoded slash turned into a slash
Opened
#127 An answer from the app without a Content-Type can reach the client with one Go guessed
Opened
#128 A ban's earlier_bans undercounts once a ban after an admin's ban is dropped
Opened
#129 Requests waiting for a client's first lookup are counted at the time they arrived, and one can wipe another's count
Opened
#130 A client that stops sending its body after the app has answered is never timed out
Opened
#131 An upgrade the app accepts under another protocol name is answered 200 with an empty body
Opened
#132 The image build fails on a brief 503 from Ubuntu's snapshot server: apt gets no retries
Opened
#136 A client that stops sending with little of its body left after the app has answered is never timed out
Opened
#137 SWWAF_STATE_DIR given as a file: the run script gives the default directory to the smallwebwaf user, and the start fails
Opened
#138 A client too slow to send its request line is answered 400, not left without an answer
Opened
#139 docker stop: requests in progress get 502 at once when the app exits on SIGTERM, not five seconds to finish
Opened
#140 1.0: what stands between next and a release candidate
Opened
#150 A ban edited into bans.json with expires before start makes the netblock's next limit ban already expired
Opened
#151 The README's AbuseIPDB section leaves out three of the offences that have a client checked
Opened
#154 use fable on xhigh to rewrite the readme for comprehensibility
Opened
#155 Rewrite README.md from scratch so a newcomer can follow it
Opened
#156 Rewrite SPEC.md from scratch, short and plain
Opened
#158 TestHealthCheck fails when another process takes the closed test server's port
Opened
#161 defaults are insane
Opened
#165 Tiny per-app reverse proxy that asks a separate smallwebwaf whether to pass each request
Opened
#166 Does today's one-process smallwebwaf stay beside rproxy and servewaf?
Opened
#167 Does servewaf read request bodies?
Opened
#168 What do the sites behind one servewaf share?
Opened
#169 Run smallwebwaf in front of Gitea: the split built, defaults for API use, tokens out of the log
Opened
#170 servewaf: answer rproxy's question about each request, and take its report
Opened
#171 rproxy: the proxy in front of each app that asks servewaf and fails open
Opened
#172 rproxy and servewaf replace the one-process smallwebwaf
Opened
#173 Rename internal/proxy to internal/servewaf
Opened
#174 Live request viewer in servewaf
Opened
#175 Request tags, with throttling and blocking per tag
Opened
#176 Default request limits per minute, hour and day, sized for API use
Opened
#177 Secrets in query strings never reach the log, ban notes or alerts
Opened
#178 deploy/gitea: Gitea behind traefik, rproxy and servewaf, with its test
Opened
#182 servewaf always answers rproxy well within its time limit
Opened
#185 rproxy test of an answer cut off after its start fails under load
Opened
#188 README: rewrite on Fable into sections, with compose examples and an env var table
Opened
#190 Install the image's Ubuntu packages from the normal mirrors, not a dated snapshot
Opened
#192 audit the symbol names for idiocy