Default request limits per hour and per day, sized for API use (closes #176)

The default request limits now suit programmatic use of an API, such
as an automation fleet on another host, and still catch crawlers:

- per minute: off;
- per hour: 30000, passed by a crawler that keeps up 10 a second;
- per day: 300000, passed by one that keeps up 4 a second.

The byte limits and ban lengths are unchanged. SPEC.md, README.md and
docs/settings.md give the reasons and what counting cannot catch;
docs/gitea.md redoes the Actions runner sums.

Judgement call: the ban alert example in docs/alerts.md now shows the
hour limit, since the minute limit is off by default.

Model: opus-5-5

internal/config/config.go

@@ -506,9 +506,9 @@ func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 		AllowNets:               env.netblocks("SWWAF_ALLOW_NETS", ""),
 		RateLimitExemptNets:     env.netblocks("SWWAF_RATE_LIMIT_EXEMPT_NETS", ""),
 		DenyNets:                env.netblocks("SWWAF_DENY_NETS", ""),
-		RateLimitPerMinute:      env.count("SWWAF_RATE_LIMIT_PER_MINUTE", "6000"),
-		RateLimitPerHour:        env.count("SWWAF_RATE_LIMIT_PER_HOUR", "100000"),
-		RateLimitPerDay:         env.count("SWWAF_RATE_LIMIT_PER_DAY", "1000000"),
+		RateLimitPerMinute:      env.count("SWWAF_RATE_LIMIT_PER_MINUTE", off),
+		RateLimitPerHour:        env.count("SWWAF_RATE_LIMIT_PER_HOUR", "30000"),
+		RateLimitPerDay:         env.count("SWWAF_RATE_LIMIT_PER_DAY", "300000"),
 		RateLimitExemptPaths:    env.pathPrefixes("SWWAF_RATE_LIMIT_EXEMPT_PATHS", ""),
 		BytesLimitPerMinute:     env.size("SWWAF_BYTES_LIMIT_PER_MINUTE", "4G"),
 		BytesLimitPerHour:       env.size("SWWAF_BYTES_LIMIT_PER_HOUR", "20G"),

internal/config/config_test.go

@@ -262,9 +262,9 @@ func TestDefaults(t *testing.T) {
 		UpstreamResponseTimeout:     30 * time.Minute,
 		RequestMaxBytes:             100 << 20,
 		ResponseMaxBytes:            1 << 30,
-		RateLimitPerMinute:          6000,
-		RateLimitPerHour:            100000,
-		RateLimitPerDay:             1000000,
+		RateLimitPerMinute:          0,
+		RateLimitPerHour:            30000,
+		RateLimitPerDay:             300000,
 		BanResponse:                 403,
 		LimitBanDuration:            time.Hour,
 		LimitBanRepeatWindow:        24 * time.Hour,
@@ -2375,9 +2375,9 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
 		allowNets:               "",
 		rateLimitExemptNets:     "",
 		denyNets:                "",
-		rateLimitPerMinute:      "6000",
-		rateLimitPerHour:        "100000",
-		rateLimitPerDay:         "1000000",
+		rateLimitPerMinute:      off,
+		rateLimitPerHour:        "30000",
+		rateLimitPerDay:         "300000",
 		rateLimitExemptPaths:    "",
 		bytesLimitPerMinute:     "4G",
 		bytesLimitPerHour:       "20G",

internal/smallwebwaf/smallwebwaf_test.go

@@ -54,6 +54,8 @@ const (
 	greeting = "hello from the app"
 	// placed is the client the tests' lookup databases place.
 	placed = "203.0.113.9"
+	// off is the value that switches a setting off.
+	off = "off"
 )
 
 // output collects what smallwebwaf writes on stdout.
@@ -118,7 +120,7 @@ func run(ctx context.Context, env map[string]string, out *output) int {
 		LookupEnv: func(name string) (string, bool) {
 			value, ok := env[name]
 			if !ok && name == "SWWAF_LOOKUP_SOURCE" {
-				return "off", true
+				return off, true
 			}
 
 			return value, ok
@@ -502,7 +504,7 @@ func TestRuleFileAddedWhileRunningTakesEffect(t *testing.T) {
 		rulesDir:    dir,
 		// The requests sent until the rule takes effect must not break a
 		// rate limit, whose ban would refuse them too.
-		"SWWAF_RATE_LIMIT_PER_MINUTE": "off",
+		"SWWAF_RATE_LIMIT_PER_MINUTE": off,
 	}
 
 	out := runUntilStopped(t, env, func(url string) {
@@ -1244,9 +1246,9 @@ func wantStartingLine(t *testing.T, line map[string]any, appURL, dir string) {
 		"SWWAF_ALLOW_NETS":                      "",
 		rateLimitExemptNets:                     "",
 		"SWWAF_DENY_NETS":                       "",
-		"SWWAF_RATE_LIMIT_PER_MINUTE":           "6000",
-		"SWWAF_RATE_LIMIT_PER_HOUR":             "100000",
-		rateLimitPerDay:                         "1000000",
+		"SWWAF_RATE_LIMIT_PER_MINUTE":           off,
+		"SWWAF_RATE_LIMIT_PER_HOUR":             "30000",
+		rateLimitPerDay:                         "300000",
 		"SWWAF_RATE_LIMIT_EXEMPT_PATHS":         "",
 		"SWWAF_DENIED_COUNTRIES":                "",
 		"SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES":   "",