Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

internal/coreruleset/coreruleset.go

@@ -1,7 +1,7 @@
 // Package coreruleset runs the OWASP Core Rule Set 4.25.0, through Coraza, on the
 // method, the URL with its query and the headers of a request, and on its
-// body while SWW_WAF_BODY_LIMIT is set, with the twelve changes sww
-// makes to it and the exclusions in SWW_CORE_RULE_SET_EXCLUSIONS_FILE, as
+// body while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set, with the twelve changes sww
+// makes to it and the exclusions in SWW_WAF_CORE_RULE_SET_EXCLUSIONS_FILE, as
 // "Attack detection" under "Settings" in SPEC.md describes them. It reads no
 // response.
 //
@@ -32,18 +32,18 @@ import (
 
 // directives are the Core Rule Set as sww runs it, with the
 // paranoia level for %d, bodyDirectives for the first %s while
-// SWW_WAF_BODY_LIMIT is set, the exclusions file for the second,
+// SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set, the exclusions file for the second,
 // giteaExclusions for the third, wordpressExclusions for the fourth,
 // drupalExclusions for the fifth, mediawikiExclusions for the sixth, and
 // mastodonExclusions for the seventh.
 // Each rule sww adds has an id from 900000 to 900999, the ids the
 // Core Rule Set keeps for the rules that set it up, which
-// SWW_WAF_DISABLED_RULES and the exclusions file refuse, so that no
+// SWW_WAF_CORE_RULE_SET_DISABLED_RULES and the exclusions file refuse, so that no
 // setting switches one off. Coraza joins a line ending in \ to the next,
 // without the spaces at the start of the next.
 const directives = `
 # The engine only detects. sww compares the request's anomaly
-# score with SWW_WAF_ANOMALY_THRESHOLD itself, in block and detect mode
+# score with SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD itself, in block and detect mode
 # alike. It reads no body, unless bodyDirectives switch that on.
 SecRuleEngine DetectionOnly
 SecRequestBodyAccess Off
@@ -225,16 +225,16 @@ var cookiesNotRead = []string{"gitea_flash", "redirect_to"}
 
 // Params are what New needs.
 type Params struct {
-	// ParanoiaLevel is SWW_WAF_PARANOIA_LEVEL, from 1 to 4.
+	// ParanoiaLevel is SWW_WAF_CORE_RULE_SET_PARANOIA_LEVEL, from 1 to 4.
 	ParanoiaLevel int
 	// DisabledRules are the ids of the rules switched off
-	// (SWW_WAF_DISABLED_RULES).
+	// (SWW_WAF_CORE_RULE_SET_DISABLED_RULES).
 	DisabledRules []int
 	// BodyLimit is the most of a request body the Core Rule Set reads
-	// (SWW_WAF_BODY_LIMIT), 0 while it is off and it reads none.
+	// (SWW_WAF_CORE_RULE_SET_BODY_LIMIT), 0 while it is off and it reads none.
 	BodyLimit int64
 	// ExclusionsFile is the path of a file of exclusions loaded before the
-	// Core Rule Set's rules (SWW_CORE_RULE_SET_EXCLUSIONS_FILE), "" while
+	// Core Rule Set's rules (SWW_WAF_CORE_RULE_SET_EXCLUSIONS_FILE), "" while
 	// there is none.
 	ExclusionsFile string
 }
@@ -260,7 +260,7 @@ var errSwwRuleID = errors.New("an id of sww's own rules")
 // SecRuleRemoveById. The Core Rule Set's rules load after the file, so
 // the directive finds none of them.
 var errChangesNoRule = errors.New("the Core Rule Set's rules load after the file; " +
-	"switch a rule off with SWW_WAF_DISABLED_RULES, or on some requests " +
+	"switch a rule off with SWW_WAF_CORE_RULE_SET_DISABLED_RULES, or on some requests " +
 	"with a ctl exclusion")
 
 // directivesIn returns the directives in text as Coraza reads them: it
@@ -447,7 +447,7 @@ func (c *CoreRuleSet) Inspect(
 }
 
 // readBody reads body, the body of the request in tx, which has run on
-// the request's headers, while SWW_WAF_BODY_LIMIT is set and the body is
+// the request's headers, while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set and the body is
 // of a kind the Core Rule Set reads: form data and multipart, of which it
 // reads the first c.bodyLimit bytes, and JSON and XML, which it reads only
 // when they are no longer than that, since they cannot be read in part.

internal/coreruleset/coreruleset_test.go

@@ -19,7 +19,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
 )
 
-// defaultDisabledRules are the rules SWW_WAF_DISABLED_RULES switches off
+// defaultDisabledRules are the rules SWW_WAF_CORE_RULE_SET_DISABLED_RULES switches off
 // by default.
 //
 //nolint:gochecknoglobals // a constant cannot be a list
@@ -624,7 +624,7 @@ var hardValues = []string{"python3", "powershell", "ls%20-la", ".htaccess"}
 func wantRecordedRequestsPass(t *testing.T, name string) {
 	t.Helper()
 
-	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
 
 	defaults, bodies := atDefaults(t), readingBodies(t)
 
@@ -651,7 +651,7 @@ func wantRecordedRequestsPass(t *testing.T, name string) {
 func TestOrdinaryGiteaRequestsPassAndAttacksAreRefused(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
 
 	crs := atDefaults(t)
 
@@ -754,7 +754,7 @@ func recordedRequests(t *testing.T, name string) []recordedRequest {
 }
 
 // readingBodiesUpTo64K returns the Core Rule Set as sww runs it by default,
-// but reading bodies up to the largest SWW_WAF_BODY_LIMIT.
+// but reading bodies up to the largest SWW_WAF_CORE_RULE_SET_BODY_LIMIT.
 func readingBodiesUpTo64K(t *testing.T) *coreruleset.CoreRuleSet {
 	t.Helper()
 
@@ -821,7 +821,7 @@ func wordpressAttackTargets(attack string) []string {
 func TestOrdinaryWordPressRequestsPassAndAttacksAreRefused(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
 
 	defaults, bodies := atDefaults(t), readingBodiesUpTo64K(t)
 
@@ -1370,7 +1370,7 @@ func TestWordPressExclusionsAreNarrow(t *testing.T) {
 	wantBody(t, crs, signIn, body, matched(930120), body)
 }
 
-// bodyLimit is SWW_WAF_BODY_LIMIT in the tests that read bodies.
+// bodyLimit is SWW_WAF_CORE_RULE_SET_BODY_LIMIT in the tests that read bodies.
 const bodyLimit = 8 << 10
 
 // The Content-Type headers of the kinds of body the Core Rule Set reads.

internal/coreruleset/drupal.conf

@@ -4,10 +4,10 @@
 # request, before the rules it switches off, so this file is loaded before the
 # Core Rule Set's rules. Each comment names a request a rule refused. An
 # exclusion on a field of a body applies only when the query has no parameter
-# of that name, so it matters only while SWW_WAF_BODY_LIMIT is set. The
-# exclusions above the comment "The fields below are in bodies" also cover a
-# body field of the same name whatever the query holds, and only those below it
-# need a query without that name.
+# of that name, so it matters only while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is
+# set. The exclusions above the comment "The fields below are in bodies" also
+# cover a body field of the same name whatever the query holds, and only those
+# below it need a query without that name.
 #
 # Each path may start with a language prefix, such as /fr in
 # /fr/admin/content. The prefix is two or three letters, then optionally a

internal/coreruleset/drupal_test.go

@@ -7,7 +7,7 @@ import (
 	"testing"
 )
 
-// drupalThreshold is SWW_WAF_ANOMALY_THRESHOLD's default.
+// drupalThreshold is SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default.
 const drupalThreshold = 5
 
 // drupalAddArticle is Drupal's form for a new article.

internal/coreruleset/mastodon.conf

@@ -4,8 +4,8 @@
 # exclusion runs with the request, before the rules it switches off, so this
 # file is loaded before the Core Rule Set's rules. Each comment names a request
 # a rule refused. An exclusion on a field of a body applies only when the query
-# has no parameter of that name, so it matters only while SWW_WAF_BODY_LIMIT is
-# set.
+# has no parameter of that name, so it matters only while
+# SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set.
 #
 # Gitea serves /api/v1/ too, and Drupal serves /admin/. So only Mastodon's own
 # resources under them count as Mastodon's paths.

internal/coreruleset/mastodon_test.go

@@ -11,7 +11,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
 )
 
-// mastodonThreshold is SWW_WAF_ANOMALY_THRESHOLD's default.
+// mastodonThreshold is SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default.
 const mastodonThreshold = 5
 
 // mastodonStatuses is where Mastodon's apps and web app post.

internal/coreruleset/mediawiki.conf

@@ -5,8 +5,8 @@
 # request, before the rules it switches off, so this file is loaded before the
 # Core Rule Set's rules. Each comment names a request a rule refused. An
 # exclusion on a field of a body applies only when the query has no parameter of
-# that name, so it matters only while SWW_WAF_BODY_LIMIT is set. MediaWiki's
-# paths are matched at the site root and under /w/.
+# that name, so it matters only while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set.
+# MediaWiki's paths are matched at the site root and under /w/.
 #
 # WordPress serves /index.php too. So /index.php counts as MediaWiki's only
 # with a page title, in the query or after the path:

internal/coreruleset/mediawiki_test.go

@@ -6,7 +6,7 @@ import (
 	"testing"
 )
 
-// mediawikiThreshold is SWW_WAF_ANOMALY_THRESHOLD's default.
+// mediawikiThreshold is SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default.
 const mediawikiThreshold = 5
 
 // mediawikiEdit is the address MediaWiki's edit form posts to.

internal/coreruleset/wordpress.conf

@@ -3,7 +3,7 @@
 # the rules it switches off, so this file is loaded before the Core Rule Set's
 # rules. Each comment names a request the rule refused. An exclusion on a field
 # of a body applies only when the query has no parameter of that name, so it
-# matters only while SWW_WAF_BODY_LIMIT is set.
+# matters only while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set.
 
 # WordPress takes a call to its REST API at any of four addresses:
 #   /wp-json/wp/v2/posts/1