rproxy, the proxy in front of each app, asks servewaf and fails open (closes #171)

`smallwebwaf rproxy` reads the first 64 KiB of each body, asks servewaf over HTTP/1.1, and passes what servewaf allows to the app within its own limits. Any other answer goes to the visitor as servewaf gave it. SWRP_DEFAULT_DISPOSITION decides only when servewaf cannot be connected to, does not answer at all, or does not answer within SWRP_TIMEOUT_MS. Only the methods SPEC.md lists pass on; any other gets 405. Duplication: internal/rproxy copies passing-on code from internal/proxy until #172 removes the originals. Rule suppressed: gosec G704 and G705; paralleltest on one test. Judgement call: an answer over 1 MiB, or with a status below 100, gets 502. Judgement call: every target not starting with one / gets 400. Model: opus-5-5
2026-11-05 03:07:45 +00:00
parent 2eeea136e8
commit 33b8d81be1
23 changed files with 5869 additions and 59 deletions
@@ -51,3 +51,9 @@ curl -H "Authorization: Bearer $TOKEN" \

 `smallwebwaf servewaf` answers these endpoints at its own address. No check runs
 on those requests (see "`servewaf`" in [`SPEC.md`](../SPEC.md)).
+
+## `rproxy`
+
+`smallwebwaf rproxy` answers only the health check, at its own address. It asks
+`servewaf` about any other request under `/_smallwebwaf/` (see "`rproxy`" in
+[`SPEC.md`](../SPEC.md)).