SWW_APPS: an app's Core Rule Set fixes apply only to the hostnames that serve it (closes #220)

gitea's fixes (its parameters, its cookies and gitea.conf) now apply
only to a hostname SWW_APPS lists gitea for, or to every hostname while
it is unset. Each app's fixes are one .conf file, whose first rule skips
the rest unless Inspect sets tx.app_<name>, and one entry in apps.

A hostname in SWW_APPS that is not a DNS name, such as *.example.com,
stops the start. Unset, SWW_APPS is logged at start as null; set
empty, as "".

Model: opus-5-5

internal/config/config_test.go

@@ -88,6 +88,7 @@ const (
 	wafExemptPaths       = "SWW_WAF_EXEMPT_PATHS"
 	wafBodyLimit         = "SWW_WAF_BODY_LIMIT"
 	exclusionsFile       = "SWW_CORE_RULE_SET_EXCLUSIONS_FILE"
+	apps                 = "SWW_APPS"
 	trapPaths            = "SWW_TRAP_PATHS"
 	errorBurstThreshold  = "SWW_ERROR_BURST_THRESHOLD"
 	logRemoteURL         = "SWW_LOG_REMOTE_URL"
@@ -576,6 +577,92 @@ func TestCoreRuleSetSettings(t *testing.T) {
 	}
 }
 
+func TestApps(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		env  environment
+		want map[string][]string
+	}{
+		{environment{}, nil},
+		{environment{apps: ""}, map[string][]string{}},
+		{
+			environment{apps: "Git.Example.com:gitea; cloud.example.com : gitea "},
+			map[string][]string{
+				"git.example.com": {"gitea"}, "cloud.example.com": {"gitea"},
+			},
+		},
+	} {
+		cfg := fromEnvironment(t, tc.env)
+		if !reflect.DeepEqual(cfg.Apps, tc.want) {
+			t.Errorf("%v gave %#v, want %#v", tc.env, cfg.Apps, tc.want)
+		}
+	}
+}
+
+// Unset and set empty, SWW_APPS has opposite effects, so it logs differently.
+func TestUnsetAndEmptyAppsAreLoggedDifferently(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		env  environment
+		want string
+	}{
+		{environment{}, `"` + apps + `":null`},
+		{environment{apps: ""}, `"` + apps + `":""`},
+	} {
+		var out bytes.Buffer
+
+		slog.New(slog.NewJSONHandler(&out, nil)).
+			Info("starting", "settings", fromEnvironment(t, tc.env))
+
+		if !strings.Contains(out.String(), tc.want) {
+			t.Errorf("%v logged %s, want %s in it", tc.env, out.String(), tc.want)
+		}
+	}
+}
+
+func TestInvalidAppsStopsTheStart(t *testing.T) {
+	t.Parallel()
+
+	const (
+		notEntry = " is not a hostname, : and a list of apps, " +
+			"such as git.example.com:gitea"
+		notHostname = " is not a DNS name such as git.example.com"
+	)
+
+	for _, tc := range []struct{ value, want string }{
+		{"git.example.com:gitea;blog.example.com", `"blog.example.com"` + notEntry},
+		{"git.example.com:gitea;", `""` + notEntry},
+		{":gitea", `":gitea"` + notEntry},
+		{"git.example.com:", `"git.example.com:"` + notEntry},
+		{"*.example.com:gitea", `"*.example.com"` + notHostname},
+		{"git.example.com/:gitea", `"git.example.com/"` + notHostname},
+		{"git example.com:gitea", `"git example.com"` + notHostname},
+		{
+			"git.example.com:gitea,nextcloud",
+			`"nextcloud" is not an app sww has fixes for; the apps are gitea`,
+		},
+		{
+			"git.example.com:gitea;GIT.example.com:gitea",
+			`"git.example.com" is listed twice`,
+		},
+		{"git.example.com:gitea,gitea", `"gitea" is listed twice`},
+		{"git.example.com:gitea,", `"gitea," has an empty item in its list`},
+	} {
+		t.Run(tc.value, func(t *testing.T) {
+			t.Parallel()
+
+			_, err := config.FromEnvironment(environment{apps: tc.value}.lookupEnv)
+
+			want := apps + ": " + tc.want
+			if err == nil || err.Error() != want {
+				t.Errorf("error %v, want %s", err, want)
+			}
+		})
+	}
+}
+
 func TestWAFBodyLimitOf64K(t *testing.T) {
 	t.Parallel()
 
@@ -2332,6 +2419,7 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
 		wafExemptPaths:       "",
 		wafBodyLimit:         off,
 		exclusionsFile:       "",
+		apps:                 "", // logged as null, which decodes as ""
 		trapPaths:            "",
 		errorBurstThreshold:  "30",
 		logRemoteURL:         "",