Read every setting through viper and rename the settings (closes #211)

Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/coreruleset/coreruleset.go

@@ -1,8 +1,8 @@
 // Package coreruleset runs the OWASP Core Rule Set 4.25.0, through Coraza, on the
 // method, the URL with its query and the headers of a request, and on its
-// body while SWW_WAF_BODY_LIMIT is set, with the five changes sww
-// makes to it, the fixes for the apps SWW_APPS names, and the exclusions in
-// SWW_CORE_RULE_SET_EXCLUSIONS_FILE, as "Attack detection" under "Settings"
+// body while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set, with the five changes sww
+// makes to it, the fixes for the apps SWW_WAF_APPS names, and the exclusions in
+// SWW_WAF_CORE_RULE_SET_EXCLUSIONS_FILE, as "Attack detection" under "Settings"
 // in SPEC.md describes them. It reads no response.
 //
 // sww writes only to its state directory, so Coraza is built with
@@ -34,16 +34,16 @@ import (
 
 // directives are the Core Rule Set as sww runs it, with the
 // paranoia level for %d, bodyDirectives for the first %s while
-// SWW_WAF_BODY_LIMIT is set, the exclusions file for the second, and the
-// directives of every app in apps for the third.
+// SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set, the exclusions file for the second,
+// and the directives of every app in apps for the third.
 // Each rule sww adds has an id from 900000 to 900999, the ids the
 // Core Rule Set keeps for the rules that set it up, which
-// SWW_WAF_DISABLED_RULES and the exclusions file refuse, so that no
+// SWW_WAF_CORE_RULE_SET_DISABLED_RULES and the exclusions file refuse, so that no
 // setting switches one off. Coraza joins a line ending in \ to the next,
 // without the spaces at the start of the next.
 const directives = `
 # The engine only detects. sww compares the request's anomaly
-# score with SWW_WAF_ANOMALY_THRESHOLD itself, in block and detect mode
+# score with SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD itself, in block and detect mode
 # alike. It reads no body, unless bodyDirectives switch that on.
 SecRuleEngine DetectionOnly
 SecRequestBodyAccess Off
@@ -188,7 +188,7 @@ var forgejoDirectives string
 //go:embed ghost.conf
 var ghostDirectives string
 
-// apps are the apps whose fixes sww has, by the name SWW_APPS gives each.
+// apps are the apps whose fixes sww has, by the name SWW_WAF_APPS gives each.
 // flash is Forgejo's name for gitea_flash.
 //
 //nolint:gochecknoglobals // a constant cannot be a map
@@ -219,20 +219,20 @@ func AppNames() []string {
 
 // Params are what New needs.
 type Params struct {
-	// ParanoiaLevel is SWW_WAF_PARANOIA_LEVEL, from 1 to 4.
+	// ParanoiaLevel is SWW_WAF_CORE_RULE_SET_PARANOIA_LEVEL, from 1 to 4.
 	ParanoiaLevel int
 	// DisabledRules are the ids of the rules switched off
-	// (SWW_WAF_DISABLED_RULES).
+	// (SWW_WAF_CORE_RULE_SET_DISABLED_RULES).
 	DisabledRules []int
 	// BodyLimit is the most of a request body the Core Rule Set reads
-	// (SWW_WAF_BODY_LIMIT), 0 while it is off and it reads none.
+	// (SWW_WAF_CORE_RULE_SET_BODY_LIMIT), 0 while it is off and it reads none.
 	BodyLimit int64
 	// ExclusionsFile is the path of a file of exclusions loaded before the
-	// Core Rule Set's rules (SWW_CORE_RULE_SET_EXCLUSIONS_FILE), "" while
+	// Core Rule Set's rules (SWW_WAF_CORE_RULE_SET_EXCLUSIONS_FILE), "" while
 	// there is none.
 	ExclusionsFile string
 	// Apps are the names of the apps each hostname serves, by hostname in
-	// lowercase (SWW_APPS). A request gets only the fixes of its hostname's
+	// lowercase (SWW_WAF_APPS). A request gets only the fixes of its hostname's
 	// apps and of the apps they are forks of, or of every app while Apps is
 	// nil.
 	Apps map[string][]string
@@ -260,7 +260,7 @@ var errSwwRuleID = errors.New("an id of sww's own rules")
 // the directive finds none of them.
 var errChangesNoRule = errors.New(
 	"the Core Rule Set's rules load after the file; " +
-		"switch a rule off with SWW_WAF_DISABLED_RULES, or on some requests " +
+		"switch a rule off with SWW_WAF_CORE_RULE_SET_DISABLED_RULES, or on some requests " +
 		"with a ctl exclusion",
 )
 
@@ -339,7 +339,7 @@ type CoreRuleSet struct {
 	engine    coraza.WAF
 	bodyLimit int64
 	// appsByHostname are the names of the apps each hostname serves, by
-	// hostname in lowercase (SWW_APPS), nil while SWW_APPS is unset.
+	// hostname in lowercase (SWW_WAF_APPS), nil while SWW_WAF_APPS is unset.
 	appsByHostname map[string][]string
 }
 
@@ -481,7 +481,7 @@ func (c *CoreRuleSet) Inspect(
 }
 
 // readBody reads body, the body of the request in tx, which has run on
-// the request's headers, while SWW_WAF_BODY_LIMIT is set and the body is
+// the request's headers, while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set and the body is
 // of a kind the Core Rule Set reads: form data and multipart, of which it
 // reads the first c.bodyLimit bytes, and JSON and XML, which it reads only
 // when they are no longer than that, since they cannot be read in part.
@@ -538,8 +538,8 @@ func score(tx types.Transaction) int {
 }
 
 // appsFor returns the names of the apps whose fixes a request for host,
-// its Host header, gets: every app while SWW_APPS is unset, and otherwise
-// those SWW_APPS lists for host's name, without the port and in
+// its Host header, gets: every app while SWW_WAF_APPS is unset, and otherwise
+// those SWW_WAF_APPS lists for host's name, without the port and in
 // lowercase, each followed by the app it is a fork of, if any.
 func (c *CoreRuleSet) appsFor(host string) []string {
 	if c.appsByHostname == nil {