Rename the settings whose names do not say what they control (closes #234)

Applies the setting renames of the naming audit under the SWW_WAF_ and
SWW_RPROXY_ prefixes, with sneak's names for the IP reputation cache
time and the two time limits, which now take milliseconds. The rproxy
log field default_disposition becomes waf_backend_no_answer, and
config.Config and config.FromEnvironment become config.WAF and
config.WAFFromEnvironment. Go fields, test names and prose follow. No
aliases; nothing reads the old names.

Model: opus-5-5

internal/waf/metrics_test.go

@@ -18,7 +18,8 @@ import (
 
 const (
 	metricsToken = "SWW_WAF_METRICS_TOKEN" //nolint:gosec // the setting's name
-	metricsTopN  = "SWW_WAF_METRICS_TOP_N"
+
+	metricsBusiestCountriesAndASNs = "SWW_WAF_METRICS_BUSIEST_COUNTRIES_AND_ASNS"
 	// token is the SWW_WAF_METRICS_TOKEN the tests set, and bearer how a
 	// request carries it.
 	token  = "0123456789abcdef0123456789abcdef"
@@ -133,12 +134,12 @@ func TestMetricsCountLimitsAndBans(t *testing.T) {
 	const denied = "192.0.2.50" // in SWW_WAF_DENY_NETS
 
 	s, clk, _ := startWithClock(t, "", map[string]string{
-		metricsToken:       token,
-		rateLimitPerMinute: "1",
-		denyNets:           denied,
-		banResponse:        banResponseClose,
-		limitBanDuration:   "1h",
-		maxBanDuration:     "2h",
+		metricsToken:           token,
+		rateLimitPerMinute:     "1",
+		denyNets:               denied,
+		banResponse:            banResponseClose,
+		limitBanDuration:       "1h",
+		limitBanPermanentAbove: "2h",
 	})
 
 	// SWW_WAF_BAN_RESPONSE=close sends no status at all.
@@ -176,7 +177,7 @@ func TestMetricsCountLimitsAndBans(t *testing.T) {
 	wantMetric(t, s.scrape(), `sww_active_bans{instance="app"}`, 0)
 
 	// A limit broken again right after would ban for three hours, longer
-	// than SWW_WAF_MAX_BAN_DURATION, so the ban is permanent.
+	// than SWW_WAF_LIMIT_BAN_PERMANENT_ABOVE, so the ban is permanent.
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 	s.get(client, 0, requestlog.ActionClientIsRateLimited)
 
@@ -236,10 +237,10 @@ func TestMetricsByCountryKeepTheBusiestAndCountTheRestAsOther(t *testing.T) {
 		_, _ = io.WriteString(w, "hello")
 	})
 	env := map[string]string{
-		trustedProxies:   trustLocalhost,
-		metricsToken:     token,
-		metricsTopN:      "2",
-		allowedCountries: "de,fr",
+		trustedProxies:                 trustLocalhost,
+		metricsToken:                   token,
+		metricsBusiestCountriesAndASNs: "2",
+		allowedCountries:               "de,fr",
 	}
 	geojsURL, _ := startGeoJS(t)
 	addr, out, server := startProxyWithClock(t, app.URL, geojsURL,
@@ -322,8 +323,8 @@ func TestMetricsByASNumberKeepTheBusiestAndCountTheRestAsOther(
 
 	geojsURL, _ := startGeoJS(t)
 	s, clk, server := startWithClock(t, geojsURL, map[string]string{
-		metricsToken: token,
-		metricsTopN:  "1",
+		metricsToken:                   token,
+		metricsBusiestCountriesAndASNs: "1",
 	})
 
 	// The answers are kept before the requests, so that GeoJS gives none
@@ -379,8 +380,9 @@ func TestMetricsCountGeoJSRequestsAndFailures(t *testing.T) {
 	req.Header.Set(forwardedFor, fromDE)
 	wantStatus(t, do(t, req), http.StatusOK)
 
-	// The client stops waiting for GeoJS once SWW_WAF_LOOKUP_TIMEOUT is up, so
-	// GeoJS's failure can come after its request has ended.
+	// The client stops waiting for GeoJS once
+	// SWW_WAF_ASN_AND_COUNTRY_LOOKUP_TIMEOUT_MS is up, so GeoJS's failure can
+	// come after its request has ended.
 	deadline := time.Now().Add(waitLimit)
 	metrics := scrape(t, server.Addr)