servewaf answers rproxy's question about each request and takes its report (closes #170)

`smallwebwaf servewaf` runs today's checks on the visitor's request each question carries, answers rproxy, and passes nothing to an app. rproxy reports every request servewaf answered. A report counts an allowed request's bytes and writes servewaf's second log line. The table holds a copy of what a report needs, never the request, so a report cannot reach a request being handled. Judgement call: a question's body is read before any check; over 64 KiB gets 400. Judgement call: a report's bytes and durations have ceilings, so they cannot overflow. Judgement call: a `close` disposition for SWWAF_BAN_RESPONSE=close. Model: opus-5-5
2026-11-04 21:10:03 +00:00
parent fdabf4974b
commit 4a2d57dca2
27 changed files with 2779 additions and 141 deletions
@@ -2,7 +2,8 @@

 The endpoints under `/_smallwebwaf/`, what each takes and what each answers.
 "Admin endpoints" in [`SPEC.md`](../SPEC.md) says which checks they go through
-and how their tokens work.
+and how their tokens work. `smallwebwaf servewaf` answers them at its own
+address, without those checks (see "`servewaf`" in [`SPEC.md`](../SPEC.md)).

 - `GET /_smallwebwaf/healthz`: `200` and `ok`, to anyone.
 - `GET /_smallwebwaf/metrics`: the metrics, for `SWWAF_METRICS_TOKEN` (see