rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

`smallwebwaf` with no command now prints the commands and exits with status 2. The image runs rproxy, or servewaf with SMALLWEBWAF_COMMAND=servewaf. The passing-on code, its settings and its log fields and metric go. internal/proxy keeps the checks, answers, reports and own endpoints; its tests run through the real rproxy. The documents describe the pair. Judgement call: clients.json keeps token_refused, since state files refuse unknown fields. Deviation: script/gitea-requests sets SWWAF_LOG_REQUEST_HEADERS, to label requests. Partially verified: make example-app and make gitea-requests never built the image, as Ubuntu's snapshot service answered 5xx. Model: opus-5-5
2026-11-05 13:15:05 +01:00
parent 17c5dd2438
commit 344ce13c96
71 changed files with 2653 additions and 5493 deletions
@@ -212,8 +212,7 @@ type Result struct {
 // method, its URL with the query, and its headers, the Cookie header
 // without the cookies in cookiesNotRead, and on body, r's body as the
 // caller has it, as readBody reads it. It returns what it found, what it
-// read of body, which the app is still to be sent, and the error that
-// ended the reading early, if one did.
+// read of body, and the error that ended the reading early, if one did.
 func (c *CoreRuleSet) Inspect(
 	r *http.Request, client netip.Addr, body io.Reader,
 ) (Result, []byte, error) {