Remove what is about deploying behind Gitea (closes #209)

Delete the Gitea compose setup, its document, its two scripts and their
make targets. Documents and tests no longer use Gitea as the example
deployment. The Core Rule Set exclusions for Gitea's false positives in
internal/waf stay, with their comments and tests.

Model: opus-5-5

script/gitea-requests

@@ -1,350 +0,0 @@
-#!/bin/sh
-# script/gitea-requests: build the image and run gitea 1.27.3 behind rproxy
-# and servewaf, three containers on one network. Every setting is at its
-# default but these: SWRP_UPSTREAM_URL names gitea's container, SWRP_WAF_BACKEND
-# names servewaf's, and SWWAF_LOG_REQUEST_HEADERS adds the header that labels a
-# request. Then send through rproxy the gitea requests that reading gitea's
-# source found the Core Rule Set refuses, which docs/gitea.md records, and a
-# short sample of gitea's ordinary use: signing in, pages of files and commits,
-# a diff, the API, a push, clone and fetch over HTTP, and two container image
-# pushes. Last, print each request servewaf logged, with what it did with it and
-# the ids of the Core Rule Set's rules that matched it.
-# Every request comes from one client, docker's gateway, so more than
-# SWWAF_ERROR_BURST_THRESHOLD, 30, refusals in a minute would ban it, and
-# the requests after would show as banned. The containers, the network,
-# the images and the files the script makes are removed however it ends;
-# gitea's own image stays, as the base images of a build do. It needs
-# network access, and a docker daemon that pushes to a registry on
-# localhost over plain HTTP, as docker does by default. script/check does
-# not run this.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
-
-# gitea 1.27.3, 2026-08-29
-GITEA_IMAGE="gitea/gitea@sha256:87a67ee09d3ae0d1df5fda5dcda3e2a1f9236a45b0a59025d6e00e46adc43bef"
-
-# Named after this run, so that runs in other clones on the same host
-# never touch each other's.
-NAME="$("$SCRIPT_DIR/projectname")-gitea-$$"
-IMAGE="$NAME-image"
-NETWORK="$NAME"
-RPROXY="$NAME-rproxy"
-SERVEWAF="$NAME-servewaf"
-GITEA="$NAME-gitea"
-
-# gitea's one user, who owns the repository and the container images.
-PASSWORD="owner-password"
-
-BROWSER="Mozilla/5.0 (X11; Linux x86_64; rv:131.0) Gecko/20100101 Firefox/131.0"
-
-# The header that labels a request in the report. rproxy makes every request's
-# id itself, so a label cannot be the X-Request-ID.
-LABEL_HEADER="X-Case"
-
-# The default of SWWAF_LOG_REQUEST_HEADERS, and the header above.
-LOGGED_HEADERS="accept,accept-language,accept-encoding,content-type,origin,range,x-case"
-
-# The files the script makes, and rproxy's address once it runs, localhost and
-# the port docker publishes it on: a host name, since the Core Rule Set takes a
-# Host that is an IP address for a warning (920350).
-WORK=""
-address=""
-
-cleanup() {
-    # So that a signal cannot stop it partway through.
-    trap '' HUP INT TERM
-    docker rm --force --volumes "$RPROXY" "$SERVEWAF" "$GITEA" >/dev/null 2>&1 || true
-    docker network rm "$NETWORK" >/dev/null 2>&1 || true
-    docker rmi --force "$IMAGE" >/dev/null 2>&1 || true
-    if [ -n "$address" ]; then
-        docker rmi --force "$address/owner/python3-app:1" "$address/owner/app:1" \
-            >/dev/null 2>&1 || true
-    fi
-    rm -rf "$WORK"
-}
-
-fail() {
-    echo "gitea-requests: $*" >&2
-    report
-    exit 1
-}
-
-# wait_for <what fails> <command>...: run the command every second until
-# it succeeds, for at most a minute.
-wait_for() {
-    failure="$1"
-    shift
-    tries=0
-    until "$@"; do
-        tries=$((tries + 1))
-        [ "$tries" -lt 60 ] || fail "$failure"
-        sleep 1
-    done
-}
-
-# healthy <container>: docker says the container's health check passes.
-healthy() {
-    status="$(docker inspect --format '{{.State.Health.Status}}' "$1")"
-    [ "$status" = healthy ]
-}
-
-# logged <text>...: a line of servewaf's output holds every text, in any order.
-logged() {
-    lines="$(docker logs "$SERVEWAF" 2>&1)"
-    for text in "$@"; do
-        lines="$(printf '%s\n' "$lines" | grep -F "$text")" || return 1
-    done
-}
-
-# send <label> <path> <curl option>...: send a request for path to rproxy, with
-# label in LABEL_HEADER, which the report gives, and keep the body of the answer
-# in $WORK/answer. The Core Rule Set reads that header too, so a label names no
-# file the cases name.
-send() {
-    label="$1"
-    path="$2"
-    shift 2
-    curl --silent --show-error --max-time 30 --output "$WORK/answer" \
-        --header "$LABEL_HEADER: $label" "$@" "http://$address$path"
-}
-
-# page <label> <path> <curl option>...: send the request as a browser
-# does, with the cookies gitea has set. Its Referer is the repository's
-# page, which links to the others, and never a page the Core Rule Set
-# refused: its address would have the next request refused too.
-page() {
-    label="$1"
-    path="$2"
-    shift 2
-    send "$label" "$path" --compressed --user-agent "$BROWSER" \
-        --header "Accept: text/html,application/xhtml+xml,*/*;q=0.8" \
-        --header "Accept-Language: en-US,en;q=0.5" \
-        --cookie "$WORK/cookies" --cookie-jar "$WORK/cookies" \
-        --referer "http://$address/owner/repo" "$@"
-}
-
-# api <label> <path> <curl option>...: send the request as a client of
-# gitea's API does, as the owner.
-api() {
-    label="$1"
-    path="$2"
-    shift 2
-    send "$label" "$path" --user "owner:$PASSWORD" \
-        --header "Accept: application/json" "$@"
-}
-
-# repo_git <git argument>...: run git as the owner, without the host's
-# own git settings, so that nothing it does is kept outside $WORK.
-repo_git() {
-    GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1 git \
-        -c user.name=owner -c user.email=owner@example.invalid "$@"
-}
-
-# lines: forty lines of text, enough for a diff to hide some of them.
-lines() {
-    i=1
-    while [ "$i" -le 40 ]; do
-        echo "line $i"
-        i=$((i + 1))
-    done
-}
-
-# make_repository: create the repository owner/repo, holding a file of
-# each name the cases name, and push it, which is the push over HTTP of
-# the sample. The second commit adds a line at the end of Runtime.java,
-# so that its diff hides the lines above.
-make_repository() {
-    status="$(api create-repository /api/v1/user/repos \
-        --header "Content-Type: application/json" --data '{"name":"repo"}' \
-        --write-out '%{http_code}')"
-    [ "$status" = 201 ] || fail "creating the repository was answered $status"
-
-    dir="$WORK/repo"
-    repo_git init --quiet --initial-branch=main "$dir"
-    for file in \
-        src/java.base/share/classes/java/lang/Runtime.java \
-        java.lang.String.md \
-        META-INF/services/org.apache.commons.logging.LogFactory \
-        document.write.js \
-        process.env.d.ts \
-        test/fixtures/__proto__.json \
-        install-script.sh \
-        src/backend/catalog/information_schema.sql \
-        .../notes.txt \
-        README.md; do
-        mkdir -p "$dir/$(dirname "$file")"
-        lines >"$dir/$file"
-        repo_git -C "$dir" add "$file"
-    done
-    repo_git -C "$dir" commit --quiet --message "Add the files"
-    echo "line 41" >>"$dir/src/java.base/share/classes/java/lang/Runtime.java"
-    repo_git -C "$dir" commit --quiet --all --message "Add a line"
-
-    repo_git -C "$dir" -c "http.extraHeader=$LABEL_HEADER: git-push" push --quiet \
-        "http://owner:$PASSWORD@$address/owner/repo.git" main ||
-        fail "the push of the repository failed"
-}
-
-# browse: sign in, then open pages as a person does. The cases are those
-# of https://git.eeqj.de/sneak/smallwebwaf/issues/30.
-browse() {
-    # Case: gitea sends a visitor who is not signed in to the sign-in
-    # page, with the page asked for in redirect_to, when that page needs
-    # signing in, as a file's edit page does.
-    page issue-30-case /owner/repo/_edit/main/document.write.js --location
-
-    page sign-in /user/login
-    status="$(page sign-in /user/login --header "Origin: http://$address" \
-        --data-urlencode user_name=owner --data-urlencode "password=$PASSWORD" \
-        --write-out '%{http_code}')"
-    [ "$status" = 303 ] || fail "signing in was answered $status"
-
-    page browse /
-    page browse /owner/repo
-    page browse /owner/repo/src/branch/main/README.md
-    page browse /owner/repo/commits/branch/main
-    page browse "/owner/repo/commit/$(repo_git -C "$WORK/repo" rev-parse HEAD)"
-
-    # Case: expanding the lines the diff hides, by the link the diff's
-    # page gives for it.
-    excerpt="$(sed -n 's/.*data-fetch-url="\([^"]*blob_excerpt[^"]*\)".*/\1/p' \
-        "$WORK/answer" | head -n 1 | sed 's/&amp;/\&/g')"
-    [ -n "$excerpt" ] || fail "the diff's page has no link to its hidden lines"
-    page issue-30-case "$excerpt"
-
-    # Cases: the commit graph of one file, and the pages of files whose
-    # path the Core Rule Set takes for an attack.
-    page issue-30-case "/owner/repo/graph?file=src/java.base/share/classes/java/lang/Runtime.java"
-    page issue-30-case /owner/repo/src/branch/main/META-INF/services/org.apache.commons.logging.LogFactory
-    page issue-30-case /owner/repo/src/branch/main/java.lang.String.md
-    page issue-30-case /owner/repo/src/branch/main/process.env.d.ts
-    page issue-30-case /owner/repo/src/branch/main/.../notes.txt
-}
-
-# call_api: the API's calls the cases name: the commits of a file, for a
-# file of each name the Core Rule Set takes for an attack in the query
-# parameter path, and the file-contents call, which takes its list of
-# files as JSON in the query parameter body.
-call_api() {
-    for file in \
-        src/java.base/share/classes/java/lang/Runtime.java \
-        java.lang.String.md \
-        document.write.js \
-        process.env.d.ts \
-        test/fixtures/__proto__.json \
-        install-script.sh \
-        src/backend/catalog/information_schema.sql; do
-        api issue-30-case /api/v1/repos/owner/repo/commits --get --data-urlencode "path=$file"
-    done
-    api issue-30-case /api/v1/repos/owner/repo/file-contents --get \
-        --data-urlencode 'body={"files":["src/java.base/share/classes/java/lang/Runtime.java"]}'
-}
-
-# push_images: push a container image to owner/python3-app, then the same
-# image to owner/app. For the second, the case, docker asks gitea to take
-# its layer from owner/python3-app, naming it in the query parameter
-# from. docker sends no label, so the report gives its requests none. The image
-# is one small file, imported rather than built.
-push_images() {
-    echo "$NAME" >"$WORK/layer.txt"
-    tar -cf - -C "$WORK" layer.txt |
-        docker import - "$address/owner/python3-app:1" >/dev/null
-    docker tag "$address/owner/python3-app:1" "$address/owner/app:1"
-
-    # The login is written here rather than made with docker login, which
-    # would keep it in the host's credential helper when it has one.
-    mkdir "$WORK/docker"
-    printf '{"auths":{"%s":{"auth":"%s"}}}\n' "$address" \
-        "$(printf 'owner:%s' "$PASSWORD" | base64)" >"$WORK/docker/config.json"
-    for image in "$address/owner/python3-app:1" "$address/owner/app:1"; do
-        DOCKER_CONFIG="$WORK/docker" docker push --quiet "$image" >/dev/null ||
-            echo "gitea-requests: the push of $image failed" >&2
-    done
-}
-
-# clone_and_fetch: the clone and fetch over HTTP of the sample.
-clone_and_fetch() {
-    repo_git -c "http.extraHeader=$LABEL_HEADER: git-clone" clone --quiet \
-        "http://owner:$PASSWORD@$address/owner/repo.git" "$WORK/clone" ||
-        fail "the clone failed"
-    repo_git -C "$WORK/clone" -c "http.extraHeader=$LABEL_HEADER: git-fetch" fetch --quiet ||
-        fail "the fetch failed"
-}
-
-# field <name> <line>: the text of the field name in line, a line of the
-# request log, or nothing when it has none.
-field() {
-    printf '%s\n' "$2" | sed -n "s/.*\"$1\":\"\([^\"]*\)\".*/\1/p"
-}
-
-# report: print a line for each request rproxy reported to servewaf: what
-# servewaf did with the request, the ids of the Core Rule Set's rules that
-# matched it, its label, and the request. waf_blocked is a refusal by the Core
-# Rule Set, and forward a request passed on to gitea, whatever gitea answered.
-report() {
-    docker logs "$SERVEWAF" 2>/dev/null | grep '"servewaf_line":"report"' |
-        sed 's/\\u0026/\&/g' >"$WORK/requests"
-    while IFS= read -r line; do
-        ids="$(printf '%s\n' "$line" | sed -n 's/.*"waf_rule_ids":\[\([0-9,]*\)\].*/\1/p')"
-        query="$(field query "$line")"
-        label="$(field x-case "$line")"
-        printf '%-11s %-13s %-17s %s %s%s\n' "$(field action "$line")" "${ids:--}" \
-            "${label:--}" "$(field method "$line")" \
-            "$(field path "$line")" "${query:+?$query}"
-    done <"$WORK/requests"
-    echo "gitea-requests: $(grep -c . "$WORK/requests") requests," \
-        "$(grep -c '"action":"waf_blocked"' "$WORK/requests") refused by the Core Rule Set"
-}
-
-main() {
-    cd "$ROOT"
-    trap cleanup EXIT
-    trap 'exit 1' HUP INT TERM
-    WORK="$(mktemp -d)"
-
-    docker build --no-cache -t "$IMAGE" .
-
-    # rproxy first, so that gitea can be given the address it is reached at,
-    # and gitea's image pulled before, so that gitea starts within the minute
-    # rproxy's health check waits for it.
-    docker pull --quiet "$GITEA_IMAGE" >/dev/null
-    docker network create "$NETWORK" >/dev/null
-    docker run --detach --name "$SERVEWAF" --network "$NETWORK" \
-        --env SMALLWEBWAF_COMMAND=servewaf \
-        --env SWWAF_LOG_REQUEST_HEADERS="$LOGGED_HEADERS" \
-        "$IMAGE" >/dev/null
-    wait_for "servewaf's health check did not pass" healthy "$SERVEWAF"
-    docker run --detach --name "$RPROXY" --network "$NETWORK" \
-        --publish 127.0.0.1::8080 \
-        --env SWRP_UPSTREAM_URL="http://$GITEA:3000" \
-        --env SWRP_WAF_BACKEND="http://$SERVEWAF:8080" \
-        "$IMAGE" >/dev/null
-    published="$(docker port "$RPROXY" 8080/tcp)"
-    address="localhost:${published##*:}"
-
-    docker run --detach --name "$GITEA" --network "$NETWORK" \
-        --env GITEA__security__INSTALL_LOCK=true \
-        --env GITEA__server__ROOT_URL="http://$address/" \
-        "$GITEA_IMAGE" >/dev/null
-    # rproxy's health check passes once gitea takes connections.
-    wait_for "rproxy's health check did not pass" healthy "$RPROXY"
-    docker exec --user git "$GITEA" gitea admin user create --admin \
-        --username owner --password "$PASSWORD" --email owner@example.invalid \
-        --must-change-password=false >/dev/null
-
-    make_repository
-    browse
-    call_api
-    push_images
-    clone_and_fetch
-
-    # The fetch's last request is the last of all; once it is logged, so
-    # is every other.
-    wait_for "servewaf logged no report of the fetch" \
-        logged '"x-case":"git-fetch"' '"method":"POST"' '"servewaf_line":"report"'
-    report
-}
-
-main "$@"

script/gitea-setup

@@ -1,216 +0,0 @@
-#!/bin/sh
-# script/gitea-setup: build the image, bring up deploy/gitea under a project
-# name of its own, and check it:
-#   - that a page load, a push and a clone sent through traefik pass through
-#     rproxy, and that servewaf checks them;
-#   - that gitea logs the visitor's address, not rproxy's;
-#   - that a request from a container on the shared network skips the checks;
-#   - that with servewaf stopped, gitea still answers through rproxy.
-# It publishes no port of traefik's, since this host's ports 80 and 443 may be
-# taken. It reaches traefik at its address on the shared network instead, so
-# its own requests come from the network's gateway, which servewaf checks like
-# any visitor. Two runs at once on one docker host cannot both start, since
-# both would use the subnet compose.yaml names. The containers, the network,
-# the volumes, the image and the files the script makes are removed however it
-# ends; the gitea and traefik images stay, as the base images of a build do.
-# It needs network access. script/check does not run this.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
-
-# Named after this run, so that runs in other clones on the same host
-# never touch each other's.
-NAME="$("$SCRIPT_DIR/projectname")-gitea-setup-$$"
-IMAGE="$NAME-image"
-NETWORK="${NAME}_shared"
-VISITOR="$NAME-visitor"
-
-# The site's host name and gitea's image, as deploy/gitea/compose.yaml names
-# them. gitea's image also runs the container on the shared network.
-SITE="git.example.org"
-# gitea 1.27.3, 2026-08-29
-GITEA_IMAGE="gitea/gitea@sha256:87a67ee09d3ae0d1df5fda5dcda3e2a1f9236a45b0a59025d6e00e46adc43bef"
-
-# gitea's one user, who owns the repository.
-PASSWORD="owner-password"
-
-# The files the script makes, gitea's secret key for this run, and traefik's
-# and the gateway's addresses on the shared network once the setup runs.
-WORK=""
-secret_key=""
-traefik=""
-gateway=""
-
-cleanup() {
-    # So that a signal cannot stop it partway through.
-    trap '' HUP INT TERM
-    docker rm --force "$VISITOR" >/dev/null 2>&1 || true
-    if [ -n "$WORK" ]; then
-        compose down --volumes --remove-orphans --timeout 5 >/dev/null 2>&1 || true
-        rm -rf "$WORK"
-    fi
-    docker rmi --force "$IMAGE" >/dev/null 2>&1 || true
-}
-
-# compose <argument>...: docker compose on the setup, under this run's project
-# name, with the image built here, this run's secret key and no port of
-# traefik's published.
-compose() {
-    SMALLWEBWAF_IMAGE="$IMAGE" GITEA_SECRET_KEY="$secret_key" \
-        docker compose --project-name "$NAME" \
-        --file "$ROOT/deploy/gitea/compose.yaml" --file "$WORK/no-ports.yaml" "$@"
-}
-
-fail() {
-    echo "gitea-setup: $*; the last lines of each container's output:" >&2
-    compose logs --no-color --tail 30 >&2 || true
-    exit 1
-}
-
-# wait_for <what fails> <command>...: run the command every second until
-# it succeeds, for at most a minute.
-wait_for() {
-    failure="$1"
-    shift
-    tries=0
-    until "$@"; do
-        tries=$((tries + 1))
-        [ "$tries" -lt 60 ] || fail "$failure"
-        sleep 1
-    done
-}
-
-# logged <service> <text>...: a line of the service's output holds every text,
-# in any order.
-logged() {
-    lines="$(compose logs --no-color --no-log-prefix "$1" 2>&1)"
-    shift
-    for text in "$@"; do
-        lines="$(printf '%s\n' "$lines" | grep -F -e "$text")" || return 1
-    done
-}
-
-# send <path> <curl option>...: send a request for path to the site, at
-# traefik's address, and print the status of the answer, 000 for none. traefik
-# answers with a certificate it made itself, since the setup names no
-# certificate resolver.
-send() {
-    path="$1"
-    shift
-    curl --silent --show-error --insecure --max-time 30 --output /dev/null \
-        --write-out '%{http_code}' --resolve "$SITE:443:$traefik" "$@" \
-        "https://$SITE$path" || true
-}
-
-# routed: traefik passes a request for the site's front page on to gitea.
-routed() {
-    [ "$(send / 2>/dev/null)" = 200 ]
-}
-
-# site_git <git argument>...: run git as the owner, without the host's own git
-# settings, reaching the site at traefik's address. git gives up on a transfer
-# slower than 1000 bytes a second for 30 seconds.
-site_git() {
-    GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1 git \
-        -c user.name=owner -c user.email=owner@example.invalid \
-        -c http.sslVerify=false -c "http.curloptResolve=$SITE:443:$traefik" \
-        -c http.lowSpeedLimit=1000 -c http.lowSpeedTime=30 "$@"
-}
-
-# address_of <service>: print the service's address on the shared network.
-address_of() {
-    docker inspect --format "{{(index .NetworkSettings.Networks \"$NETWORK\").IPAddress}}" \
-        "$(compose ps --quiet "$1")"
-}
-
-# passed_through <method> <path>: rproxy passed a request from the gateway for
-# path to gitea on servewaf's allow, and servewaf checked it: its report line
-# gives the client's counts and the Core Rule Set's score.
-passed_through() {
-    wait_for "rproxy logged no $1 $2 that servewaf allowed" logged rproxy \
-        "\"method\":\"$1\"" "\"path\":\"$2\"" "\"client_ip\":\"$gateway\"" \
-        '"disposition":"allow"'
-    wait_for "servewaf logged no check of $1 $2" logged servewaf \
-        '"servewaf_line":"report"' "\"method\":\"$1\"" "\"path\":\"$2\"" \
-        "\"client_ip\":\"$gateway\"" '"action":"forward"' '"counts":' '"waf_score":'
-}
-
-main() {
-    cd "$ROOT"
-    trap cleanup EXIT
-    trap 'exit 1' HUP INT TERM
-    WORK="$(mktemp -d)"
-    printf 'services:\n    traefik:\n        ports: !reset []\n' >"$WORK/no-ports.yaml"
-
-    docker build --no-cache -t "$IMAGE" .
-    secret_key="$(docker run --rm "$GITEA_IMAGE" gitea generate secret SECRET_KEY)"
-
-    # rproxy is healthy once gitea takes connections.
-    compose up --detach --quiet-pull --wait --wait-timeout 120 ||
-        fail "the setup did not start"
-    traefik="$(address_of traefik)"
-    gateway="$(docker network inspect --format '{{(index .IPAM.Config 0).Gateway}}' "$NETWORK")"
-    wait_for "traefik did not route the site to rproxy" routed
-
-    compose exec --user git gitea gitea admin user create --admin \
-        --username owner --password "$PASSWORD" --email owner@example.invalid \
-        --must-change-password=false >/dev/null || fail "creating gitea's user failed"
-    status="$(send /api/v1/user/repos --user "owner:$PASSWORD" \
-        --header "Content-Type: application/json" --data '{"name":"repo"}')"
-    [ "$status" = 201 ] || fail "creating the repository was answered $status"
-
-    status="$(send /owner/repo)"
-    [ "$status" = 200 ] || fail "the repository's page was answered $status"
-    passed_through GET /owner/repo
-    echo "gitea-setup: a page load passes through rproxy, and servewaf checks it"
-
-    wait_for "gitea did not log the visitor's address" logged gitea \
-        "GET /owner/repo for $gateway:"
-    echo "gitea-setup: gitea logs the visitor's address, not rproxy's"
-
-    site_git init --quiet --initial-branch=main "$WORK/repo"
-    echo "hello" >"$WORK/repo/README.md"
-    site_git -C "$WORK/repo" add README.md
-    site_git -C "$WORK/repo" commit --quiet --message "Add a README"
-    site_git -C "$WORK/repo" push --quiet \
-        "https://owner:$PASSWORD@$SITE/owner/repo.git" main ||
-        fail "the push failed"
-    passed_through POST /owner/repo.git/git-receive-pack
-    echo "gitea-setup: a push passes through rproxy, and servewaf checks it"
-
-    site_git clone --quiet "https://owner:$PASSWORD@$SITE/owner/repo.git" \
-        "$WORK/clone" || fail "the clone failed"
-    [ "$(cat "$WORK/clone/README.md")" = hello ] || fail "the clone lacks the README"
-    passed_through POST /owner/repo.git/git-upload-pack
-    echo "gitea-setup: a clone passes through rproxy, and servewaf checks it"
-
-    # A container on the shared network, as sandcastle is, asks for the site
-    # by its name, and so reaches traefik from its own address.
-    status="$(docker run --rm --name "$VISITOR" --network "$NETWORK" \
-        --entrypoint curl "$GITEA_IMAGE" --silent --insecure --max-time 30 \
-        --output /dev/null --write-out '%{http_code}' "https://$SITE/api/v1/version" ||
-        true)"
-    [ "$status" = 200 ] || fail "the request from the shared network was answered $status"
-    wait_for "servewaf logged no request from the shared network" logged servewaf \
-        '"servewaf_line":"report"' '"path":"/api/v1/version"' '"action":"forward"'
-    line="$(compose logs --no-color --no-log-prefix servewaf |
-        grep -F '"servewaf_line":"report"' | grep -F '"path":"/api/v1/version"')"
-    case "$line" in
-        *"\"client_ip\":\"$gateway\""*)
-            fail "the request from the shared network came from the gateway" ;;
-        *'"counts":'* | *'"waf_score":'*)
-            fail "servewaf checked the request from the shared network" ;;
-    esac
-    echo "gitea-setup: a request from the shared network skips the checks"
-
-    compose stop servewaf >/dev/null 2>&1 || fail "servewaf did not stop"
-    status="$(send /owner/repo)"
-    [ "$status" = 200 ] ||
-        fail "with servewaf stopped, the repository's page was answered $status"
-    wait_for "rproxy logged no request SWRP_DEFAULT_DISPOSITION decided" \
-        logged rproxy '"path":"/owner/repo"' '"default_disposition":true'
-    echo "gitea-setup: with servewaf stopped, gitea answers through rproxy"
-}
-
-main "$@"