Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.
Every place a name appeared changed: the code, the viper keys, tests,
documents, examples, the README's settings table and the image files.

Model: deepseek-v4-pro

internal/alerts/alerts.go

@@ -1,12 +1,12 @@
 // Package alerts sends alerts on bans, on traffic over an anomaly
 // threshold, on a source that fails and on a file with an error to each
 // destination set: to the webhook
-// SWW_ALERT_WEBHOOK_URL names, each as one JSON object, as "The JSON
+// SWW_WAF_ALERT_WEBHOOK_URL names, each as one JSON object, as "The JSON
 // object" in docs/alerts.md describes, to the Slack incoming
-// webhook SWW_ALERT_SLACK_WEBHOOK_URL names, as a message, and to the
-// ntfy topic SWW_ALERT_NTFY_URL names. A repeat within
-// SWW_ALERT_COOLDOWN is held back, and so is an alert past
-// SWW_ALERT_MAX_PER_HOUR, for the hour's summary. The others wait in a
+// webhook SWW_WAF_ALERT_SLACK_WEBHOOK_URL names, as a message, and to the
+// ntfy topic SWW_WAF_ALERT_NTFY_URL names. A repeat within
+// SWW_WAF_ALERT_COOLDOWN is held back, and so is an alert past
+// SWW_WAF_ALERT_MAX_PER_HOUR, for the hour's summary. The others wait in a
 // bounded queue of each destination's own, so that a destination that is
 // slow or unreachable holds up neither the others nor any request. The
 // state is written to alerts.json and read from it by the state package.
@@ -34,7 +34,7 @@ import (
 	"time"
 )
 
-// The events an alert is for, as SWW_ALERT_EVENTS names them.
+// The events an alert is for, as SWW_WAF_ALERT_EVENTS names them.
 const (
 	// EventBan is a ban sww made.
 	EventBan = "ban"
@@ -45,7 +45,7 @@ const (
 	// threshold.
 	EventAnomaly = "anomaly"
 	// EventWAFBlock is a request the Core Rule Set scored at or over
-	// SWW_WAF_ANOMALY_THRESHOLD, refused in block mode, let through in
+	// SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD, refused in block mode, let through in
 	// detect mode.
 	EventWAFBlock = "waf_block"
 	// EventReputationHit is a request whose client a blocklist, the
@@ -61,14 +61,14 @@ const (
 	// cannot be read, or a state file that cannot be written.
 	EventFileError = "file_error"
 	// EventSummary is the summary sent as an hour ends: of the alerts held
-	// back in it past SWW_ALERT_MAX_PER_HOUR, and of the repeats held
+	// back in it past SWW_WAF_ALERT_MAX_PER_HOUR, and of the repeats held
 	// back by the cooldowns dropped as it ends, which no alert let through
-	// has given. It is sent with SWW_ALERT_MAX_PER_HOUR off too, for
-	// those repeats. SWW_ALERT_EVENTS does not name it.
+	// has given. It is sent with SWW_WAF_ALERT_MAX_PER_HOUR off too, for
+	// those repeats. SWW_WAF_ALERT_EVENTS does not name it.
 	EventSummary = "summary"
 )
 
-// Events returns every event SWW_ALERT_EVENTS can name, which is its
+// Events returns every event SWW_WAF_ALERT_EVENTS can name, which is its
 // default.
 func Events() []string {
 	return []string{
@@ -80,12 +80,12 @@ func Events() []string {
 // The destinations alerts are sent to, as the metrics and alerts.json
 // name them.
 const (
-	// DestinationWebhook is the webhook SWW_ALERT_WEBHOOK_URL names.
+	// DestinationWebhook is the webhook SWW_WAF_ALERT_WEBHOOK_URL names.
 	DestinationWebhook = "webhook"
 	// DestinationSlack is the Slack incoming webhook
-	// SWW_ALERT_SLACK_WEBHOOK_URL names.
+	// SWW_WAF_ALERT_SLACK_WEBHOOK_URL names.
 	DestinationSlack = "slack"
-	// DestinationNtfy is the ntfy topic SWW_ALERT_NTFY_URL names.
+	// DestinationNtfy is the ntfy topic SWW_WAF_ALERT_NTFY_URL names.
 	DestinationNtfy = "ntfy"
 )
 
@@ -121,26 +121,26 @@ var (
 // NtfyURL set, no alert is sent.
 type Params struct {
 	// WebhookURL is where each alert is posted as JSON
-	// (SWW_ALERT_WEBHOOK_URL), nil while it is unset. WebhookHeaders
-	// are sent with each (SWW_ALERT_WEBHOOK_HEADERS).
+	// (SWW_WAF_ALERT_WEBHOOK_URL), nil while it is unset. WebhookHeaders
+	// are sent with each (SWW_WAF_ALERT_WEBHOOK_HEADERS).
 	WebhookURL     *url.URL
 	WebhookHeaders http.Header
 	// SlackURL is the Slack incoming webhook each alert is posted to as a
-	// message (SWW_ALERT_SLACK_WEBHOOK_URL), nil while it is unset.
+	// message (SWW_WAF_ALERT_SLACK_WEBHOOK_URL), nil while it is unset.
 	SlackURL *url.URL
 	// NtfyURL is the ntfy topic each alert is published to
-	// (SWW_ALERT_NTFY_URL), nil while it is unset. NtfyToken, unless
-	// empty, is sent with each as a bearer token (SWW_ALERT_NTFY_TOKEN).
+	// (SWW_WAF_ALERT_NTFY_URL), nil while it is unset. NtfyToken, unless
+	// empty, is sent with each as a bearer token (SWW_WAF_ALERT_NTFY_TOKEN).
 	NtfyURL   *url.URL
 	NtfyToken string
-	// Events are the events alerts are sent for (SWW_ALERT_EVENTS).
+	// Events are the events alerts are sent for (SWW_WAF_ALERT_EVENTS).
 	Events []string
 	// Cooldown is how long a repeat of an alert is held back
-	// (SWW_ALERT_COOLDOWN), 0 for no time. MaxPerHour is the most alerts
-	// sent in an hour (SWW_ALERT_MAX_PER_HOUR), 0 for no limit.
+	// (SWW_WAF_ALERT_COOLDOWN), 0 for no time. MaxPerHour is the most alerts
+	// sent in an hour (SWW_WAF_ALERT_MAX_PER_HOUR), 0 for no limit.
 	Cooldown   time.Duration
 	MaxPerHour int
-	// Instance is SWW_INSTANCE_NAME, which every alert gives.
+	// Instance is SWW_WAF_INSTANCE_NAME, which every alert gives.
 	Instance string
 	// Now tells the time of an alert, normally time.Now in UTC.
 	Now func() time.Time
@@ -301,17 +301,17 @@ func New(params Params) *Queue {
 	}
 
 	if params.WebhookURL != nil {
-		q.addDestination(DestinationWebhook, "SWW_ALERT_WEBHOOK_URL",
+		q.addDestination(DestinationWebhook, "SWW_WAF_ALERT_WEBHOOK_URL",
 			params.WebhookURL, q.webhookMessage)
 	}
 
 	if params.SlackURL != nil {
-		q.addDestination(DestinationSlack, "SWW_ALERT_SLACK_WEBHOOK_URL",
+		q.addDestination(DestinationSlack, "SWW_WAF_ALERT_SLACK_WEBHOOK_URL",
 			params.SlackURL, slackMessage)
 	}
 
 	if params.NtfyURL != nil {
-		q.addDestination(DestinationNtfy, "SWW_ALERT_NTFY_URL",
+		q.addDestination(DestinationNtfy, "SWW_WAF_ALERT_NTFY_URL",
 			params.NtfyURL, q.ntfyMessage)
 	}
 
@@ -319,7 +319,7 @@ func New(params Params) *Queue {
 }
 
 // Raise sends alert, which names its event and what is particular to it,
-// unless no destination is set or SWW_ALERT_EVENTS leaves its event
+// unless no destination is set or SWW_WAF_ALERT_EVENTS leaves its event
 // out. It gives alert the instance and the time. An alert that repeats
 // the last one let through less than Cooldown before is held back and
 // counted. The next one let through gives that count, unless an hour of
@@ -363,7 +363,7 @@ func (q *Queue) Raise(alert Alert) {
 }
 
 // WouldSend reports whether Raise would let an alert for event on
-// netblock through now: a destination is set, SWW_ALERT_EVENTS chooses
+// netblock through now: a destination is set, SWW_WAF_ALERT_EVENTS chooses
 // event, no alert for event on netblock was let through less than
 // Cooldown before, and fewer than MaxPerHour alerts have been let through
 // in the hour under way. Unlike Raise, it counts nothing.
@@ -606,13 +606,13 @@ func (q *Queue) endHour(now time.Time) {
 
 	if heldBack > 0 {
 		reasons = append(reasons, fmt.Sprintf("%d alerts held back in the hour from %s, "+
-			"past the %d an hour SWW_ALERT_MAX_PER_HOUR allows", heldBack,
+			"past the %d an hour SWW_WAF_ALERT_MAX_PER_HOUR allows", heldBack,
 			q.hour.Start.Format(time.RFC3339), q.params.MaxPerHour))
 	}
 
 	if repeats > 0 {
 		reasons = append(reasons, fmt.Sprintf("%d repeats held back by "+
-			"SWW_ALERT_COOLDOWN that no later alert gives", repeats))
+			"SWW_WAF_ALERT_COOLDOWN that no later alert gives", repeats))
 	}
 
 	if len(reasons) > 0 {

internal/alerts/alerts_test.go

@@ -132,7 +132,7 @@ func TestWouldSendOnlyForTheChosenEvents(t *testing.T) {
 
 	if q.WouldSend(alerts.EventBan, netblock(1)) ||
 		q.WouldSend(alerts.EventPermanentBan, netblock(1)) {
-		t.Error("a ban alert would be sent, though SWW_ALERT_EVENTS leaves it out")
+		t.Error("a ban alert would be sent, though SWW_WAF_ALERT_EVENTS leaves it out")
 	}
 
 	if !q.WouldSend(alerts.EventFileError, netip.Prefix{}) {
@@ -184,8 +184,8 @@ func TestWouldSendWithOnlySlackOrOnlyNtfySet(t *testing.T) {
 	onlyNtfy.NtfyURL = parseURL(ntfyURL)
 
 	for setting, params := range map[string]alerts.Params{
-		"SWW_ALERT_SLACK_WEBHOOK_URL": onlySlack,
-		"SWW_ALERT_NTFY_URL":          onlyNtfy,
+		"SWW_WAF_ALERT_SLACK_WEBHOOK_URL": onlySlack,
+		"SWW_WAF_ALERT_NTFY_URL":          onlyNtfy,
 	} {
 		if !alerts.New(params).WouldSend(alerts.EventBan, netblock(1)) {
 			t.Errorf("a ban alert would not be sent with only %s set", setting)
@@ -359,7 +359,7 @@ func TestAlertsPastTheHourlyLimitAreRolledIntoOneSummary(t *testing.T) {
 			"as_name":  "",
 			"country":  "",
 			"reason": "3 alerts held back in the hour from 2000-01-01T00:00:00Z, " +
-				"past the 2 an hour SWW_ALERT_MAX_PER_HOUR allows",
+				"past the 2 an hour SWW_WAF_ALERT_MAX_PER_HOUR allows",
 			"detail": map[string]any{
 				"hour":  started,
 				"count": float64(3),
@@ -525,7 +525,7 @@ func TestFailedRequestIsSentAgainWithBackoff(t *testing.T) {
 		wantCounts(t, q, 0, int64(len(want)), 0, 0)
 
 		if !strings.Contains(log.String(),
-			`"msg":"sending an alert to SWW_ALERT_WEBHOOK_URL failed"`) {
+			`"msg":"sending an alert to SWW_WAF_ALERT_WEBHOOK_URL failed"`) {
 			t.Errorf("process log %q names no failure", log.String())
 		}
 
@@ -595,7 +595,7 @@ func TestRefusedAlertIsGivenUpAndTheNextSent(t *testing.T) {
 		wantCounts(t, q, 1, 3, 0, 1)
 
 		if !strings.Contains(log.String(),
-			`"msg":"gave up an alert SWW_ALERT_WEBHOOK_URL refused"`) {
+			`"msg":"gave up an alert SWW_WAF_ALERT_WEBHOOK_URL refused"`) {
 			t.Errorf("process log %q names no alert given up", log.String())
 		}
 	})
@@ -619,7 +619,7 @@ func TestFailedRequestIsLoggedWithoutTheURL(t *testing.T) {
 
 		logged := log.String()
 		if !strings.Contains(logged,
-			`"msg":"sending an alert to SWW_ALERT_WEBHOOK_URL failed"`) ||
+			`"msg":"sending an alert to SWW_WAF_ALERT_WEBHOOK_URL failed"`) ||
 			strings.Contains(logged, "alerts.example") || strings.Contains(logged, "team=ops") {
 			t.Errorf("process log %q names no failure, or names the URL", logged)
 		}
@@ -782,8 +782,8 @@ func TestSlackAndNtfyAreSentTheSummaryAndTheRepeatsHeldBack(t *testing.T) {
 		}
 
 		const summary = "1 alerts held back in the hour from 2000-01-01T00:00:00Z, " +
-			"past the 1 an hour SWW_ALERT_MAX_PER_HOUR allows; 1 repeats held back " +
-			"by SWW_ALERT_COOLDOWN that no later alert gives\nsuppressed repeats: 1"
+			"past the 1 an hour SWW_WAF_ALERT_MAX_PER_HOUR allows; 1 repeats held back " +
+			"by SWW_WAF_ALERT_COOLDOWN that no later alert gives\nsuppressed repeats: 1"
 
 		wantSlackMessage(t, slack[1], "*"+instance+": summary*\n"+summary)
 		wantNtfyMessage(t, ntfy[1], instance+": summary", "default bar_chart", summary)
@@ -901,7 +901,7 @@ func TestDestinationThatDoesNotAnswerHoldsUpNeitherOther(t *testing.T) {
 
 		logged := log.String()
 		if !strings.Contains(logged,
-			`"msg":"sending an alert to SWW_ALERT_SLACK_WEBHOOK_URL failed"`) ||
+			`"msg":"sending an alert to SWW_WAF_ALERT_SLACK_WEBHOOK_URL failed"`) ||
 			strings.Contains(logged, "hooks.slack.example") ||
 			strings.Contains(logged, "T0123") {
 			t.Errorf("process log %q names no failure, or names the URL", logged)
@@ -1254,7 +1254,7 @@ type eventMessage struct {
 	title, priorityAndTag, text string
 }
 
-// anAlertForEachEvent returns an alert for each event SWW_ALERT_EVENTS
+// anAlertForEachEvent returns an alert for each event SWW_WAF_ALERT_EVENTS
 // names, the first in observe mode, each with its message.
 func anAlertForEachEvent() []eventMessage {
 	return []eventMessage{

internal/anomaly/anomaly.go

@@ -28,16 +28,16 @@ const maxCounters = 20000
 // alerts name them.
 const (
 	// ScopeClient is one client: an IPv4 address, or an IPv6 netblock of
-	// SWW_IPV6_GROUP_PREFIX.
+	// SWW_WAF_IPV6_GROUP_PREFIX.
 	ScopeClient = "client"
-	// ScopeNet is the netblock around a client, SWW_ANOMALY_NET_V4_PREFIX
-	// or SWW_ANOMALY_NET_V6_PREFIX long.
+	// ScopeNet is the netblock around a client, SWW_WAF_ANOMALY_NET_V4_PREFIX
+	// or SWW_WAF_ANOMALY_NET_V6_PREFIX long.
 	ScopeNet = "net"
 	// ScopeASN is an AS number.
 	ScopeASN = "asn"
 	// ScopeTotal is the whole service.
 	ScopeTotal = "total"
-	// ScopeWatch is a named netblock of SWW_WATCH_NETS.
+	// ScopeWatch is a named netblock of SWW_WAF_WATCH_NETS.
 	ScopeWatch = "watch"
 )
 
@@ -62,7 +62,7 @@ type Thresholds struct {
 	BytesPerHour      int64
 }
 
-// NamedNetblock is a netblock SWW_WATCH_NETS names.
+// NamedNetblock is a netblock SWW_WAF_WATCH_NETS names.
 type NamedNetblock struct {
 	Name     string
 	Netblock netip.Prefix
@@ -70,14 +70,14 @@ type NamedNetblock struct {
 
 // Params are what New needs.
 type Params struct {
-	// The thresholds of each scope: SWW_ANOMALY_CLIENT_*,
-	// SWW_ANOMALY_NET_*, SWW_ANOMALY_ASN_*, SWW_ANOMALY_TOTAL_* and
-	// SWW_WATCH_*.
+	// The thresholds of each scope: SWW_WAF_ANOMALY_CLIENT_*,
+	// SWW_WAF_ANOMALY_NET_*, SWW_WAF_ANOMALY_ASN_*, SWW_WAF_ANOMALY_TOTAL_* and
+	// SWW_WAF_WATCH_*.
 	Client, Net, ASN, Total, Watch Thresholds
 	// NetV4Prefix and NetV6Prefix are the lengths of the netblock around a
-	// client (SWW_ANOMALY_NET_V4_PREFIX and SWW_ANOMALY_NET_V6_PREFIX).
+	// client (SWW_WAF_ANOMALY_NET_V4_PREFIX and SWW_WAF_ANOMALY_NET_V6_PREFIX).
 	NetV4Prefix, NetV6Prefix int
-	// NamedNetblocks are SWW_WATCH_NETS.
+	// NamedNetblocks are SWW_WAF_WATCH_NETS.
 	NamedNetblocks []NamedNetblock
 	// Alerts receive the anomaly alerts.
 	Alerts *alerts.Queue
@@ -107,13 +107,13 @@ type Request struct {
 	Host string
 	// Client is the client's address, and ClientGroup the client it is
 	// counted as: its IPv4 address, or the IPv6 netblock of
-	// SWW_IPV6_GROUP_PREFIX its address is in.
+	// SWW_WAF_IPV6_GROUP_PREFIX its address is in.
 	Client      netip.Addr
 	ClientGroup netip.Prefix
 	// ASN, ASName and Country are the client's as looked up, each "" when
 	// unknown.
 	ASN, ASName, Country string
-	// Bytes are the request's bytes, as SWW_BYTES_COUNT counts them.
+	// Bytes are the request's bytes, as SWW_WAF_BYTES_COUNT counts them.
 	Bytes int64
 }
 

internal/bans/bans.go

@@ -123,7 +123,7 @@ type Notes struct {
 	LimitPercentSetting string `json:"limit_percent_setting,omitempty"`
 	// RuleID and Target are, for a ban for a clear sign of attack, the id
 	// of the rule file rule that matched, and its target; TrapPath is, for
-	// one for a request for a path in SWW_TRAP_PATHS, that path as the
+	// one for a request for a path in SWW_WAF_TRAP_PATHS, that path as the
 	// client sent it.
 	RuleID   string `json:"rule_id,omitempty"`
 	Target   string `json:"target,omitempty"`
@@ -199,7 +199,7 @@ type Ledger struct {
 	// v4Lengths and v6Lengths are the lengths of the IPv4 and IPv6
 	// netblocks that have been banned. Check looks for a ban at each of
 	// them, so that a ban read from bans.json refuses every client in its
-	// netblock even when it was made with another SWW_BAN_SCOPE_V4_PREFIX,
+	// netblock even when it was made with another SWW_WAF_BAN_SCOPE_V4_PREFIX,
 	// or another length of an IPv6 client's netblock.
 	v4Lengths, v6Lengths []int
 }

internal/config/config.go

@@ -1,10 +1,9 @@
 // Package config reads sww's settings, and is the one place they are
 // read. Every setting is an environment variable. The settings of `sww
-// discriminator` start with SWW_, every one of them has a default, and most can be
-// given as a file instead. Those of `sww rproxy` start with SWRP_. Each
-// of them but SWRP_WAF_BACKEND has a default, and none can be given as a file,
-// since rproxy never touches disk. SWW_COMMAND chooses which of the two
-// the image runs.
+// discriminator` start with SWW_WAF_, every one of them has a default, and most can be
+// given as a file instead. Those of `sww rproxy` start with SWW_RPROXY_. Each
+// of them but SWW_RPROXY_WAF_BACKEND has a default, and each can be given as a file
+// too. SWW_COMMAND chooses which of the two the image runs.
 package config
 
 import (
@@ -26,6 +25,8 @@ import (
 	"unicode"
 	"unicode/utf8"
 
+	"github.com/spf13/viper"
+
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/anomaly"
 	"sneak.berlin/go/smallwebwaf/internal/remotelog"
@@ -34,85 +35,85 @@ import (
 // Config is the settings of `sww discriminator`. A time or size limit of
 // zero is off.
 type Config struct {
-	// ListenAddr is where discriminator listens (SWW_LISTEN_ADDR).
+	// ListenAddr is where discriminator listens (SWW_WAF_LISTEN_ADDR).
 	ListenAddr string
 	// InstanceName is the name every log line and alert gives as instance,
-	// and every metric carries as its label instance (SWW_INSTANCE_NAME),
+	// and every metric carries as its label instance (SWW_WAF_INSTANCE_NAME),
 	// by default the host's name, which docker sets to the first 12
 	// characters of the container's id.
 	InstanceName string
-	// Observe is true in observe mode, when SWW_MODE is observe rather
-	// than enforce: a request that SWW_DENY_NETS, a ban, the country
+	// Observe is true in observe mode, when SWW_WAF_MODE is observe rather
+	// than enforce: a request that SWW_WAF_DENY_NETS, a ban, the country
 	// lists, a rate limit, a rule or the Core Rule Set would refuse is
 	// allowed instead, and no ban is made.
 	Observe bool
 	// IPv6GroupPrefix is the length of the IPv6 netblock that is one client
-	// (SWW_IPV6_GROUP_PREFIX), from 32 to 128.
+	// (SWW_WAF_IPV6_GROUP_PREFIX), from 32 to 128.
 	IPv6GroupPrefix int
 	// MaxTrackedClients is the most clients the table of clients holds, in
-	// memory and in clients.json (SWW_MAX_TRACKED_CLIENTS).
+	// memory and in clients.json (SWW_WAF_MAX_TRACKED_CLIENTS).
 	MaxTrackedClients int
 	// AllowNets are the netblocks whose clients skip every check
-	// (SWW_ALLOW_NETS). RateLimitExemptNets are those whose clients the
-	// rate limits neither count nor refuse (SWW_RATE_LIMIT_EXEMPT_NETS).
+	// (SWW_WAF_ALLOW_NETS). RateLimitExemptNets are those whose clients the
+	// rate limits neither count nor refuse (SWW_WAF_RATE_LIMIT_EXEMPT_NETS).
 	// DenyNets are those whose clients are always refused
-	// (SWW_DENY_NETS).
+	// (SWW_WAF_DENY_NETS).
 	AllowNets           []netip.Prefix
 	RateLimitExemptNets []netip.Prefix
 	DenyNets            []netip.Prefix
 	// RateLimitPerMinute, RateLimitPerHour and RateLimitPerDay are the
 	// most requests a client may make in a minute, an hour and a day
-	// (SWW_RATE_LIMIT_PER_MINUTE, SWW_RATE_LIMIT_PER_HOUR and
-	// SWW_RATE_LIMIT_PER_DAY).
+	// (SWW_WAF_RATE_LIMIT_PER_MINUTE, SWW_WAF_RATE_LIMIT_PER_HOUR and
+	// SWW_WAF_RATE_LIMIT_PER_DAY).
 	RateLimitPerMinute int64
 	RateLimitPerHour   int64
 	RateLimitPerDay    int64
 	// RateLimitExemptPaths are the path prefixes whose requests the rate
-	// limits neither count nor refuse (SWW_RATE_LIMIT_EXEMPT_PATHS).
+	// limits neither count nor refuse (SWW_WAF_RATE_LIMIT_EXEMPT_PATHS).
 	// Each starts with /.
 	RateLimitExemptPaths []string
 	// BytesLimitPerMinute, BytesLimitPerHour and BytesLimitPerDay are the
 	// most bytes a client's requests may carry in a minute, an hour and a
-	// day (SWW_BYTES_LIMIT_PER_MINUTE, SWW_BYTES_LIMIT_PER_HOUR and
-	// SWW_BYTES_LIMIT_PER_DAY). BytesCount is which body bytes count
-	// toward them (SWW_BYTES_COUNT): response, request or both.
+	// day (SWW_WAF_BYTES_LIMIT_PER_MINUTE, SWW_WAF_BYTES_LIMIT_PER_HOUR and
+	// SWW_WAF_BYTES_LIMIT_PER_DAY). BytesCount is which body bytes count
+	// toward them (SWW_WAF_BYTES_COUNT): response, request or both.
 	BytesLimitPerMinute int64
 	BytesLimitPerHour   int64
 	BytesLimitPerDay    int64
 	BytesCount          string
 	// LookupSource is where each client's AS number and country are
-	// looked up (SWW_LOOKUP_SOURCE): geojs, file, or off for nowhere.
+	// looked up (SWW_WAF_LOOKUP_SOURCE): geojs, file, or off for nowhere.
 	// LookupDBPath is the lookup database, the IPinfo Lite file looked up
-	// in while LookupSource is file (SWW_LOOKUP_DB_PATH), and "" for any
+	// in while LookupSource is file (SWW_WAF_LOOKUP_DB_PATH), and "" for any
 	// other source. A request waits up to LookupTimeout for its client's
 	// first answer from GeoJS while a setting needs it
-	// (SWW_LOOKUP_TIMEOUT), which cannot be off. AddLookupHeaders is true
+	// (SWW_WAF_LOOKUP_TIMEOUT), which cannot be off. AddLookupHeaders is true
 	// when the app is passed the client's AS number and country in headers
-	// (SWW_ADD_LOOKUP_HEADERS).
+	// (SWW_WAF_ADD_LOOKUP_HEADERS).
 	LookupSource     string
 	LookupDBPath     string
 	LookupTimeout    time.Duration
 	AddLookupHeaders bool
 	// DeniedCountries are the countries whose clients are refused
-	// (SWW_DENIED_COUNTRIES). ExclusivelyAllowedCountries, when not
+	// (SWW_WAF_DENIED_COUNTRIES). ExclusivelyAllowedCountries, when not
 	// empty, are the only countries whose clients are let through
-	// (SWW_EXCLUSIVELY_ALLOWED_COUNTRIES). Both hold two-letter codes in
+	// (SWW_WAF_EXCLUSIVELY_ALLOWED_COUNTRIES). Both hold two-letter codes in
 	// capitals, as GeoJS gives them.
 	DeniedCountries             []string
 	ExclusivelyAllowedCountries []string
 	// The biased thresholds. ASNLimitPercent and CountryLimitPercent give
 	// the clients of the AS numbers and the countries they list that
 	// percentage of every rate limit and byte limit
-	// (SWW_ASN_LIMIT_PERCENT and SWW_COUNTRY_LIMIT_PERCENT).
+	// (SWW_WAF_ASN_LIMIT_PERCENT and SWW_WAF_COUNTRY_LIMIT_PERCENT).
 	// ASNBytesPercent and CountryBytesPercent give those they list a
 	// percentage of the byte limits in place of that one
-	// (SWW_ASN_BYTES_PERCENT and SWW_COUNTRY_BYTES_PERCENT). Each holds
+	// (SWW_WAF_ASN_BYTES_PERCENT and SWW_WAF_COUNTRY_BYTES_PERCENT). Each holds
 	// percentages from 0 to 100, by AS number, written as AS64496, or by
 	// country, a two-letter code in capitals, as the lookup gives them.
 	// UnknownLimitPercent is the percentage of every limit a client without
-	// a country gets (SWW_UNKNOWN_LIMIT_PERCENT). ASNLimitPercentURL is
+	// a country gets (SWW_WAF_UNKNOWN_LIMIT_PERCENT). ASNLimitPercentURL is
 	// where a file of AS:percent lines is fetched from, whose percentages
-	// count as those of ASNLimitPercent do (SWW_ASN_LIMIT_PERCENT_URL), ""
+	// count as those of ASNLimitPercent do (SWW_WAF_ASN_LIMIT_PERCENT_URL), ""
 	// while it is unset.
 	ASNLimitPercent     map[string]int64
 	CountryLimitPercent map[string]int64
@@ -121,30 +122,30 @@ type Config struct {
 	UnknownLimitPercent int64
 	ASNLimitPercentURL  string
 	// BlocklistURLs are where the blocklists are fetched from
-	// (SWW_BLOCKLIST_URLS). Each list, and ASNLimitPercentURL's, is
+	// (SWW_WAF_BLOCKLIST_URLS). Each list, and ASNLimitPercentURL's, is
 	// fetched again BlocklistRefresh after it was last fetched or tried
-	// (SWW_BLOCKLIST_REFRESH), which is never less than an hour.
+	// (SWW_WAF_BLOCKLIST_REFRESH), which is never less than an hour.
 	// BlocklistAction is what is done with a client a blocklist lists
-	// (SWW_BLOCKLIST_ACTION): deny, limit or log; for limit,
+	// (SWW_WAF_BLOCKLIST_ACTION): deny, limit or log; for limit,
 	// BlocklistLimitPercent is the percentage of every limit it gets.
 	BlocklistURLs         []string
 	BlocklistRefresh      time.Duration
 	BlocklistAction       string
 	BlocklistLimitPercent int64
 	// DNSBLZones are the DNSBL zones clients are asked about
-	// (SWW_DNSBL_ZONES), through DNSBLResolver (SWW_DNSBL_RESOLVER), or
+	// (SWW_WAF_DNSBL_ZONES), through DNSBLResolver (SWW_WAF_DNSBL_RESOLVER), or
 	// the host's resolver while that is the zero AddrPort.
 	// AbuseIPDBKey is the key of the AbuseIPDB account clients are checked
-	// with (SWW_ABUSEIPDB_KEY), "" while it is unset and none is. A score
-	// of AbuseIPDBMinScore or more is a hit (SWW_ABUSEIPDB_MIN_SCORE), and
+	// with (SWW_WAF_ABUSEIPDB_KEY), "" while it is unset and none is. A score
+	// of AbuseIPDBMinScore or more is a hit (SWW_WAF_ABUSEIPDB_MIN_SCORE), and
 	// at most AbuseIPDBDailyBudget checks are made a day
-	// (SWW_ABUSEIPDB_DAILY_BUDGET).
+	// (SWW_WAF_ABUSEIPDB_DAILY_BUDGET).
 	// ReputationAction is what is done with a client a zone's verdict lists,
-	// or whose score is a hit (SWW_REPUTATION_ACTION): deny, limit or log;
+	// or whose score is a hit (SWW_WAF_REPUTATION_ACTION): deny, limit or log;
 	// for limit, ReputationLimitPercent is the percentage of every limit it
 	// gets. A verdict or a score is used for ReputationCacheTTL after it was
-	// fetched (SWW_REPUTATION_CACHE_TTL), and a query or a check may take
-	// ReputationTimeout (SWW_REPUTATION_TIMEOUT). Neither can be off.
+	// fetched (SWW_WAF_REPUTATION_CACHE_TTL), and a query or a check may take
+	// ReputationTimeout (SWW_WAF_REPUTATION_TIMEOUT). Neither can be off.
 	DNSBLZones             []string
 	DNSBLResolver          netip.AddrPort
 	AbuseIPDBKey           string
@@ -155,74 +156,74 @@ type Config struct {
 	ReputationCacheTTL     time.Duration
 	ReputationTimeout      time.Duration
 	// CrowdSecDecisionsURL is where the decision list of the CrowdSec
-	// engine whose local API SWW_CROWDSEC_LAPI_URL names is fetched from:
+	// engine whose local API SWW_WAF_CROWDSEC_LAPI_URL names is fetched from:
 	// that URL with v1/decisions added to its path, "" while it is unset and
 	// none is. CrowdSecKey is the key the engine is asked with
-	// (SWW_CROWDSEC_LAPI_KEY).
+	// (SWW_WAF_CROWDSEC_LAPI_KEY).
 	CrowdSecDecisionsURL string
 	CrowdSecKey          string
 	// BanResponse is the status a refused client is answered with, 403
 	// or 429, or 0 to close the connection without an answer
-	// (SWW_BAN_RESPONSE). It answers a banned client, a request that
-	// breaks a rate limit or matches a ban rule, SWW_DENY_NETS and the
+	// (SWW_WAF_BAN_RESPONSE). It answers a banned client, a request that
+	// breaks a rate limit or matches a ban rule, SWW_WAF_DENY_NETS and the
 	// country lists.
 	BanResponse int
 	// LimitBanDuration is the ban for a first broken rate limit
-	// (SWW_LIMIT_BAN_DURATION). A limit broken again within
+	// (SWW_WAF_LIMIT_BAN_DURATION). A limit broken again within
 	// LimitBanRepeatWindow after the last ban ended bans for three times
-	// as long as that ban (SWW_LIMIT_BAN_REPEAT_WINDOW), and a ban that
+	// as long as that ban (SWW_WAF_LIMIT_BAN_REPEAT_WINDOW), and a ban that
 	// would be longer than MaxBanDuration is permanent instead
-	// (SWW_MAX_BAN_DURATION). None of them can be off.
+	// (SWW_WAF_MAX_BAN_DURATION). None of them can be off.
 	LimitBanDuration     time.Duration
 	LimitBanRepeatWindow time.Duration
 	MaxBanDuration       time.Duration
 	// AttackBanDuration is the ban for a first clear sign of attack
-	// (SWW_ATTACK_BAN_DURATION). It cannot be off.
+	// (SWW_WAF_ATTACK_BAN_DURATION). It cannot be off.
 	AttackBanDuration time.Duration
-	// MaxBans is the most bans held (SWW_MAX_BANS).
+	// MaxBans is the most bans held (SWW_WAF_MAX_BANS).
 	MaxBans int
 	// BanScopeV4Prefix is the length of the netblock around an IPv4
-	// client that a ban covers (SWW_BAN_SCOPE_V4_PREFIX).
+	// client that a ban covers (SWW_WAF_BAN_SCOPE_V4_PREFIX).
 	BanScopeV4Prefix int
 	// StateDir is the directory of the state files, an absolute path
-	// (SWW_STATE_DIR). bans.json is written StateWriteDelay after a ban
-	// is made (SWW_STATE_WRITE_DELAY), and every state file every
-	// StateCounterInterval (SWW_STATE_COUNTER_INTERVAL). Neither can be
+	// (SWW_WAF_STATE_DIR). bans.json is written StateWriteDelay after a ban
+	// is made (SWW_WAF_STATE_WRITE_DELAY), and every state file every
+	// StateCounterInterval (SWW_WAF_STATE_COUNTER_INTERVAL). Neither can be
 	// off.
 	StateDir             string
 	StateWriteDelay      time.Duration
 	StateCounterInterval time.Duration
 	// LogRequestHeaders are the request headers whose values the request
-	// log gives, in lower case (SWW_LOG_REQUEST_HEADERS).
+	// log gives, in lower case (SWW_WAF_LOG_REQUEST_HEADERS).
 	LogRequestHeaders []string
 	// LogLevel is the least severe of the process's own messages that are
-	// written (SWW_LOG_LEVEL). It holds back no request log line.
+	// written (SWW_WAF_LOG_LEVEL). It holds back no request log line.
 	LogLevel slog.Level
 	// AdminToken is the bearer token an admin sends for the ban endpoints
-	// and /_sww/clients/<ip> (SWW_ADMIN_TOKEN), "" while it is
+	// and /_sww/clients/<ip> (SWW_WAF_ADMIN_TOKEN), "" while it is
 	// unset and they are off.
 	AdminToken string
 	// MetricsToken is the bearer token a scraper sends for the metrics
-	// (SWW_METRICS_TOKEN), "" while it is unset and the metrics are off.
+	// (SWW_WAF_METRICS_TOKEN), "" while it is unset and the metrics are off.
 	// MetricsTopN is how many AS numbers and how many countries get series
-	// of their own in the metrics (SWW_METRICS_TOP_N).
+	// of their own in the metrics (SWW_WAF_METRICS_TOP_N).
 	MetricsToken string
 	MetricsTopN  int
-	// RulesDir is the directory of the rule files (SWW_RULES_DIR), read
-	// unless RulesEnabled is false (SWW_RULES_ENABLED).
+	// RulesDir is the directory of the rule files (SWW_WAF_RULES_DIR), read
+	// unless RulesEnabled is false (SWW_WAF_RULES_ENABLED).
 	RulesDir     string
 	RulesEnabled bool
-	// WAFMode is what the Core Rule Set does (SWW_WAF_MODE): WAFModeOff,
+	// WAFMode is what the Core Rule Set does (SWW_WAF_CORE_RULE_SET_MODE): WAFModeOff,
 	// WAFModeDetect or WAFModeBlock. WAFParanoiaLevel is its paranoia
-	// level, from 1 to 4 (SWW_WAF_PARANOIA_LEVEL), and
+	// level, from 1 to 4 (SWW_WAF_CORE_RULE_SET_PARANOIA_LEVEL), and
 	// WAFAnomalyThreshold the anomaly score at which a request is a match
-	// (SWW_WAF_ANOMALY_THRESHOLD), 0 while it is off. WAFDisabledRules
-	// are the ids of its rules switched off (SWW_WAF_DISABLED_RULES),
+	// (SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD), 0 while it is off. WAFDisabledRules
+	// are the ids of its rules switched off (SWW_WAF_CORE_RULE_SET_DISABLED_RULES),
 	// WAFExemptPaths the path prefixes it does not inspect
-	// (SWW_WAF_EXEMPT_PATHS), and WAFBodyLimit the most of a request body
-	// it reads (SWW_WAF_BODY_LIMIT), 0 while it is off and it reads none.
+	// (SWW_WAF_CORE_RULE_SET_EXEMPT_PATHS), and WAFBodyLimit the most of a request body
+	// it reads (SWW_WAF_CORE_RULE_SET_BODY_LIMIT), 0 while it is off and it reads none.
 	// CoreRuleSetExclusionsFile is the path of the file of its exclusions
-	// (SWW_CORE_RULE_SET_EXCLUSIONS_FILE), "" while there is none.
+	// (SWW_WAF_CORE_RULE_SET_EXCLUSIONS_FILE), "" while there is none.
 	WAFMode                   string
 	WAFParanoiaLevel          int
 	WAFAnomalyThreshold       int
@@ -231,21 +232,21 @@ type Config struct {
 	WAFBodyLimit              int64
 	CoreRuleSetExclusionsFile string
 	// TrapPaths are the paths a request for which is a clear sign of
-	// attack (SWW_TRAP_PATHS), each starting with / and without a ?.
+	// attack (SWW_WAF_TRAP_PATHS), each starting with / and without a ?.
 	TrapPaths []string
 	// ErrorBurstThreshold is the most requests of a client within a minute
 	// that discriminator may refuse after a rule file or Core Rule Set match; one
-	// more breaks a limit (SWW_ERROR_BURST_THRESHOLD). 0 is off.
+	// more breaks a limit (SWW_WAF_ERROR_BURST_THRESHOLD). 0 is off.
 	ErrorBurstThreshold int64
 	// LogRemoteURL is where every line on stdout is also sent
-	// (SWW_LOG_REMOTE_URL), nil while it is unset and nothing is sent.
+	// (SWW_WAF_LOG_REMOTE_URL), nil while it is unset and nothing is sent.
 	// LogRemoteTLSCAs are the certificates a syslog+tls endpoint's
-	// certificate must chain to (SWW_LOG_REMOTE_TLS_CA_FILE), nil while
+	// certificate must chain to (SWW_WAF_LOG_REMOTE_TLS_CA_FILE), nil while
 	// it is unset and the host's own are used. LogRemoteBuffer is the most
-	// lines held while they wait to be sent (SWW_LOG_REMOTE_BUFFER).
+	// lines held while they wait to be sent (SWW_WAF_LOG_REMOTE_BUFFER).
 	// LogRemoteFacility is the number of the syslog facility
-	// (SWW_LOG_REMOTE_FACILITY), and LogRemoteAppName the APP-NAME
-	// (SWW_LOG_REMOTE_APP_NAME, by default InstanceName), of the records
+	// (SWW_WAF_LOG_REMOTE_FACILITY), and LogRemoteAppName the APP-NAME
+	// (SWW_WAF_LOG_REMOTE_APP_NAME, by default InstanceName), of the records
 	// the lines are sent in.
 	LogRemoteURL      *url.URL
 	LogRemoteTLSCAs   *x509.CertPool
@@ -253,18 +254,18 @@ type Config struct {
 	LogRemoteFacility int
 	LogRemoteAppName  string
 	// AlertWebhookURL is where each alert is posted as JSON
-	// (SWW_ALERT_WEBHOOK_URL), nil while it is unset. AlertWebhookHeaders
-	// are sent with each (SWW_ALERT_WEBHOOK_HEADERS).
+	// (SWW_WAF_ALERT_WEBHOOK_URL), nil while it is unset. AlertWebhookHeaders
+	// are sent with each (SWW_WAF_ALERT_WEBHOOK_HEADERS).
 	// AlertSlackWebhookURL is the Slack incoming webhook each alert is
-	// posted to as a message (SWW_ALERT_SLACK_WEBHOOK_URL), and
+	// posted to as a message (SWW_WAF_ALERT_SLACK_WEBHOOK_URL), and
 	// AlertNtfyURL the ntfy topic each is published to
-	// (SWW_ALERT_NTFY_URL), each nil while it is unset; AlertNtfyToken,
-	// unless empty, is sent to ntfy with each (SWW_ALERT_NTFY_TOKEN).
+	// (SWW_WAF_ALERT_NTFY_URL), each nil while it is unset; AlertNtfyToken,
+	// unless empty, is sent to ntfy with each (SWW_WAF_ALERT_NTFY_TOKEN).
 	// With none of the three URLs set, no alert is sent. AlertEvents are
-	// the events alerts are sent for (SWW_ALERT_EVENTS). A repeat of an
-	// alert within AlertCooldown is held back (SWW_ALERT_COOLDOWN), and
+	// the events alerts are sent for (SWW_WAF_ALERT_EVENTS). A repeat of an
+	// alert within AlertCooldown is held back (SWW_WAF_ALERT_COOLDOWN), and
 	// so is an alert past AlertMaxPerHour in an hour, for the hour's
-	// summary (SWW_ALERT_MAX_PER_HOUR); 0 is off for both.
+	// summary (SWW_WAF_ALERT_MAX_PER_HOUR); 0 is off for both.
 	AlertWebhookURL      *url.URL
 	AlertWebhookHeaders  http.Header
 	AlertSlackWebhookURL *url.URL
@@ -274,14 +275,14 @@ type Config struct {
 	AlertCooldown        time.Duration
 	AlertMaxPerHour      int
 	// The anomaly thresholds, which only raise alerts: the most requests
-	// and bytes a minute and an hour per client (SWW_ANOMALY_CLIENT_*),
-	// per netblock around a client (SWW_ANOMALY_NET_*), per AS number
-	// (SWW_ANOMALY_ASN_*), for the whole service (SWW_ANOMALY_TOTAL_*)
-	// and per named netblock (SWW_WATCH_*), each 0 while it is off.
+	// and bytes a minute and an hour per client (SWW_WAF_ANOMALY_CLIENT_*),
+	// per netblock around a client (SWW_WAF_ANOMALY_NET_*), per AS number
+	// (SWW_WAF_ANOMALY_ASN_*), for the whole service (SWW_WAF_ANOMALY_TOTAL_*)
+	// and per named netblock (SWW_WAF_WATCH_*), each 0 while it is off.
 	// AnomalyNetV4Prefix and AnomalyNetV6Prefix are the lengths of the
-	// netblock around a client (SWW_ANOMALY_NET_V4_PREFIX and
-	// SWW_ANOMALY_NET_V6_PREFIX), and WatchNets the named netblocks
-	// (SWW_WATCH_NETS).
+	// netblock around a client (SWW_WAF_ANOMALY_NET_V4_PREFIX and
+	// SWW_WAF_ANOMALY_NET_V6_PREFIX), and WatchNets the named netblocks
+	// (SWW_WAF_WATCH_NETS).
 	AnomalyClient      anomaly.Thresholds
 	AnomalyNet         anomaly.Thresholds
 	AnomalyASN         anomaly.Thresholds
@@ -300,7 +301,7 @@ type Config struct {
 // off.
 const off = "off"
 
-// The values of SWW_WAF_MODE.
+// The values of SWW_WAF_CORE_RULE_SET_MODE.
 const (
 	// WAFModeOff runs no request through the Core Rule Set.
 	WAFModeOff = off
@@ -310,8 +311,8 @@ const (
 	WAFModeBlock = "block"
 )
 
-// fileSource is the SWW_LOOKUP_SOURCE that looks clients up in the
-// lookup database, the file SWW_LOOKUP_DB_PATH names.
+// fileSource is the SWW_WAF_LOOKUP_SOURCE that looks clients up in the
+// lookup database, the file SWW_WAF_LOOKUP_DB_PATH names.
 const fileSource = "file"
 
 const (
@@ -321,7 +322,7 @@ const (
 	gibibyte = 1 << 30
 	ipv4Bits = 32
 	ipv6Bits = 128
-	// minIPv6GroupPrefix is the shortest SWW_IPV6_GROUP_PREFIX, the
+	// minIPv6GroupPrefix is the shortest SWW_WAF_IPV6_GROUP_PREFIX, the
 	// netblock a provider is usually given: a shorter one would make one
 	// client of the customers of several providers.
 	minIPv6GroupPrefix = 32
@@ -338,8 +339,8 @@ const (
 	// masked is what the log shows for a token that is set, and in place of
 	// a secret in another setting.
 	masked = "********"
-	// defaultListenAddr is the default of SWW_LISTEN_ADDR and
-	// SWRP_LISTEN_ADDR, and defaultUpstreamURL that of SWRP_UPSTREAM_URL.
+	// defaultListenAddr is the default of SWW_WAF_LISTEN_ADDR and
+	// SWW_RPROXY_LISTEN_ADDR, and defaultUpstreamURL that of SWW_RPROXY_UPSTREAM_URL.
 	defaultListenAddr  = ":8080"
 	defaultUpstreamURL = "http://127.0.0.1:8081"
 )
@@ -367,7 +368,7 @@ var (
 	errHeaderTakenOut = errors.New(
 		"is taken out of every request by Go's HTTP server, so it can never " +
 			"be logged")
-	errOnBothLists     = errors.New("is in SWW_DENIED_COUNTRIES too")
+	errOnBothLists     = errors.New("is in SWW_WAF_DENIED_COUNTRIES too")
 	errNotLookupSource = errors.New("is not geojs, file or off")
 	errNeedsLookups    = errors.New("it needs each client looked up")
 	errNeedsDBPath     = errors.New("it names the file to look clients up in")
@@ -435,7 +436,7 @@ var (
 	errNotListURL  = errors.New(
 		"is not an http or https URL without a user or a fragment, " +
 			"such as https://www.spamhaus.org/drop/drop.txt")
-	errInBlocklistURLs = errors.New("is in SWW_BLOCKLIST_URLS too")
+	errInBlocklistURLs = errors.New("is in SWW_WAF_BLOCKLIST_URLS too")
 	errNotAnHourOrMore = errors.New("is not a duration of 1h or more, such as 24h")
 	errNotAction       = errors.New(
 		"is not deny, limit:<percent> such as limit:25, or log")
@@ -450,117 +451,118 @@ var (
 	errNeedsLAPIKey  = errors.New("the engine answers no request without it")
 	errLAPIKeyUnused = errors.New("it is sent only to the engine at that URL")
 	errAnotherList   = errors.New(
-		"is in SWW_BLOCKLIST_URLS or is SWW_ASN_LIMIT_PERCENT_URL too")
+		"is in SWW_WAF_BLOCKLIST_URLS or is SWW_WAF_ASN_LIMIT_PERCENT_URL too")
 )
 
-// FromEnvironment reads the settings with lookupEnv, normally
-// os.LookupEnv. A setting may instead be given as a file: the variable
-// named by the setting's name with _FILE added names the file, which is
-// read now (see lookup). A setting that is not set takes its default. A
-// setting that is set but invalid is an error that names it.
+// FromEnvironment reads the settings through v, normally the viper
+// NewViper returns, bound to the process's environment. A setting may
+// instead be given as a file: the variable named by the setting's name
+// with _FILE added names the file, which is read now (see lookup). A
+// setting that is not set takes its default. A setting that is set but
+// invalid is an error that names it.
 //
 //nolint:funlen // one line for each setting, a list that grows with them
-func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
-	env := &environment{lookupEnv: lookupEnv}
+func FromEnvironment(v *viper.Viper) (*Config, error) {
+	env := &environment{v: v, readFiles: true}
 	cfg := &Config{
-		ListenAddr:           env.address("SWW_LISTEN_ADDR"),
+		ListenAddr:           env.address("SWW_WAF_LISTEN_ADDR"),
 		InstanceName:         env.instanceName(),
-		Observe:              env.observe("SWW_MODE", "enforce"),
-		IPv6GroupPrefix:      env.ipv6GroupPrefix("SWW_IPV6_GROUP_PREFIX", "64"),
-		MaxTrackedClients:    env.numberNotOff("SWW_MAX_TRACKED_CLIENTS", "20000"),
-		AllowNets:            env.netblocks("SWW_ALLOW_NETS", ""),
-		RateLimitExemptNets:  env.netblocks("SWW_RATE_LIMIT_EXEMPT_NETS", ""),
-		DenyNets:             env.netblocks("SWW_DENY_NETS", ""),
-		RateLimitPerMinute:   env.count("SWW_RATE_LIMIT_PER_MINUTE", "120"),
-		RateLimitPerHour:     env.count("SWW_RATE_LIMIT_PER_HOUR", "1500"),
-		RateLimitPerDay:      env.count("SWW_RATE_LIMIT_PER_DAY", "6000"),
-		RateLimitExemptPaths: env.pathPrefixes("SWW_RATE_LIMIT_EXEMPT_PATHS", ""),
-		BytesLimitPerMinute:  env.size("SWW_BYTES_LIMIT_PER_MINUTE", "off"),
-		BytesLimitPerHour:    env.size("SWW_BYTES_LIMIT_PER_HOUR", "50G"),
-		BytesLimitPerDay:     env.size("SWW_BYTES_LIMIT_PER_DAY", "100G"),
-		BytesCount:           env.bytesCount("SWW_BYTES_COUNT", "both"),
-		LookupSource:         env.lookupSource("SWW_LOOKUP_SOURCE", "geojs"),
-		LookupDBPath:         env.value("SWW_LOOKUP_DB_PATH", ""),
-		LookupTimeout:        env.durationNotOff("SWW_LOOKUP_TIMEOUT", "800ms"),
-		AddLookupHeaders:     env.boolean("SWW_ADD_LOOKUP_HEADERS", "false"),
-		DeniedCountries:      env.countries("SWW_DENIED_COUNTRIES", ""),
+		Observe:              env.observe("SWW_WAF_MODE", "enforce"),
+		IPv6GroupPrefix:      env.ipv6GroupPrefix("SWW_WAF_IPV6_GROUP_PREFIX", "64"),
+		MaxTrackedClients:    env.numberNotOff("SWW_WAF_MAX_TRACKED_CLIENTS", "20000"),
+		AllowNets:            env.netblocks("SWW_WAF_ALLOW_NETS", ""),
+		RateLimitExemptNets:  env.netblocks("SWW_WAF_RATE_LIMIT_EXEMPT_NETS", ""),
+		DenyNets:             env.netblocks("SWW_WAF_DENY_NETS", ""),
+		RateLimitPerMinute:   env.count("SWW_WAF_RATE_LIMIT_PER_MINUTE", "120"),
+		RateLimitPerHour:     env.count("SWW_WAF_RATE_LIMIT_PER_HOUR", "1500"),
+		RateLimitPerDay:      env.count("SWW_WAF_RATE_LIMIT_PER_DAY", "6000"),
+		RateLimitExemptPaths: env.pathPrefixes("SWW_WAF_RATE_LIMIT_EXEMPT_PATHS", ""),
+		BytesLimitPerMinute:  env.size("SWW_WAF_BYTES_LIMIT_PER_MINUTE", "off"),
+		BytesLimitPerHour:    env.size("SWW_WAF_BYTES_LIMIT_PER_HOUR", "50G"),
+		BytesLimitPerDay:     env.size("SWW_WAF_BYTES_LIMIT_PER_DAY", "100G"),
+		BytesCount:           env.bytesCount("SWW_WAF_BYTES_COUNT", "both"),
+		LookupSource:         env.lookupSource("SWW_WAF_LOOKUP_SOURCE", "geojs"),
+		LookupDBPath:         env.value("SWW_WAF_LOOKUP_DB_PATH", ""),
+		LookupTimeout:        env.durationNotOff("SWW_WAF_LOOKUP_TIMEOUT", "800ms"),
+		AddLookupHeaders:     env.boolean("SWW_WAF_ADD_LOOKUP_HEADERS", "false"),
+		DeniedCountries:      env.countries("SWW_WAF_DENIED_COUNTRIES", ""),
 		ExclusivelyAllowedCountries: env.countries(
-			"SWW_EXCLUSIVELY_ALLOWED_COUNTRIES", ""),
-		ASNLimitPercent:      env.percents("SWW_ASN_LIMIT_PERCENT", ParseASN),
-		CountryLimitPercent:  env.percents("SWW_COUNTRY_LIMIT_PERCENT", parseCountry),
-		ASNBytesPercent:      env.percents("SWW_ASN_BYTES_PERCENT", ParseASN),
-		CountryBytesPercent:  env.percents("SWW_COUNTRY_BYTES_PERCENT", parseCountry),
-		UnknownLimitPercent:  env.percent("SWW_UNKNOWN_LIMIT_PERCENT", "100"),
-		ASNLimitPercentURL:   env.listURL("SWW_ASN_LIMIT_PERCENT_URL"),
-		BlocklistURLs:        env.listURLs("SWW_BLOCKLIST_URLS"),
-		BlocklistRefresh:     env.refresh("SWW_BLOCKLIST_REFRESH", "24h"),
-		DNSBLZones:           env.zones("SWW_DNSBL_ZONES"),
-		DNSBLResolver:        env.resolver("SWW_DNSBL_RESOLVER"),
-		AbuseIPDBKey:         env.secret("SWW_ABUSEIPDB_KEY"),
-		AbuseIPDBMinScore:    env.percent("SWW_ABUSEIPDB_MIN_SCORE", "75"),
-		AbuseIPDBDailyBudget: env.numberNotOff("SWW_ABUSEIPDB_DAILY_BUDGET", "900"),
-		ReputationCacheTTL:   env.durationNotOff("SWW_REPUTATION_CACHE_TTL", "24h"),
-		ReputationTimeout:    env.durationNotOff("SWW_REPUTATION_TIMEOUT", "2s"),
-		CrowdSecDecisionsURL: env.crowdSecDecisionsURL("SWW_CROWDSEC_LAPI_URL"),
-		CrowdSecKey:          env.secret("SWW_CROWDSEC_LAPI_KEY"),
-		BanResponse:          env.banResponse("SWW_BAN_RESPONSE", "403"),
-		LimitBanDuration:     env.durationNotOff("SWW_LIMIT_BAN_DURATION", "1h"),
-		LimitBanRepeatWindow: env.durationNotOff("SWW_LIMIT_BAN_REPEAT_WINDOW", "24h"),
-		MaxBanDuration:       env.durationNotOff("SWW_MAX_BAN_DURATION", "7d"),
-		AttackBanDuration:    env.durationNotOff("SWW_ATTACK_BAN_DURATION", "7d"),
-		MaxBans:              env.numberNotOff("SWW_MAX_BANS", "5000"),
-		BanScopeV4Prefix:     env.v4Prefix("SWW_BAN_SCOPE_V4_PREFIX", "32"),
-		StateDir:             env.absolutePath("SWW_STATE_DIR", "/var/lib/sww"),
-		StateWriteDelay:      env.durationNotOff("SWW_STATE_WRITE_DELAY", "10s"),
-		StateCounterInterval: env.durationNotOff("SWW_STATE_COUNTER_INTERVAL", "15m"),
-		LogRequestHeaders: env.headerNames("SWW_LOG_REQUEST_HEADERS",
+			"SWW_WAF_EXCLUSIVELY_ALLOWED_COUNTRIES", ""),
+		ASNLimitPercent:      env.percents("SWW_WAF_ASN_LIMIT_PERCENT", ParseASN),
+		CountryLimitPercent:  env.percents("SWW_WAF_COUNTRY_LIMIT_PERCENT", parseCountry),
+		ASNBytesPercent:      env.percents("SWW_WAF_ASN_BYTES_PERCENT", ParseASN),
+		CountryBytesPercent:  env.percents("SWW_WAF_COUNTRY_BYTES_PERCENT", parseCountry),
+		UnknownLimitPercent:  env.percent("SWW_WAF_UNKNOWN_LIMIT_PERCENT", "100"),
+		ASNLimitPercentURL:   env.listURL("SWW_WAF_ASN_LIMIT_PERCENT_URL"),
+		BlocklistURLs:        env.listURLs("SWW_WAF_BLOCKLIST_URLS"),
+		BlocklistRefresh:     env.refresh("SWW_WAF_BLOCKLIST_REFRESH", "24h"),
+		DNSBLZones:           env.zones("SWW_WAF_DNSBL_ZONES"),
+		DNSBLResolver:        env.resolver("SWW_WAF_DNSBL_RESOLVER"),
+		AbuseIPDBKey:         env.secret("SWW_WAF_ABUSEIPDB_KEY"),
+		AbuseIPDBMinScore:    env.percent("SWW_WAF_ABUSEIPDB_MIN_SCORE", "75"),
+		AbuseIPDBDailyBudget: env.numberNotOff("SWW_WAF_ABUSEIPDB_DAILY_BUDGET", "900"),
+		ReputationCacheTTL:   env.durationNotOff("SWW_WAF_REPUTATION_CACHE_TTL", "24h"),
+		ReputationTimeout:    env.durationNotOff("SWW_WAF_REPUTATION_TIMEOUT", "2s"),
+		CrowdSecDecisionsURL: env.crowdSecDecisionsURL("SWW_WAF_CROWDSEC_LAPI_URL"),
+		CrowdSecKey:          env.secret("SWW_WAF_CROWDSEC_LAPI_KEY"),
+		BanResponse:          env.banResponse("SWW_WAF_BAN_RESPONSE", "403"),
+		LimitBanDuration:     env.durationNotOff("SWW_WAF_LIMIT_BAN_DURATION", "1h"),
+		LimitBanRepeatWindow: env.durationNotOff("SWW_WAF_LIMIT_BAN_REPEAT_WINDOW", "24h"),
+		MaxBanDuration:       env.durationNotOff("SWW_WAF_MAX_BAN_DURATION", "7d"),
+		AttackBanDuration:    env.durationNotOff("SWW_WAF_ATTACK_BAN_DURATION", "7d"),
+		MaxBans:              env.numberNotOff("SWW_WAF_MAX_BANS", "5000"),
+		BanScopeV4Prefix:     env.v4Prefix("SWW_WAF_BAN_SCOPE_V4_PREFIX", "32"),
+		StateDir:             env.absolutePath("SWW_WAF_STATE_DIR", "/var/lib/sww"),
+		StateWriteDelay:      env.durationNotOff("SWW_WAF_STATE_WRITE_DELAY", "10s"),
+		StateCounterInterval: env.durationNotOff("SWW_WAF_STATE_COUNTER_INTERVAL", "15m"),
+		LogRequestHeaders: env.headerNames("SWW_WAF_LOG_REQUEST_HEADERS",
 			"accept,accept-language,accept-encoding,content-type,origin,range"),
-		LogLevel:            env.logLevel("SWW_LOG_LEVEL", "info"),
-		AdminToken:          env.token("SWW_ADMIN_TOKEN"),
-		MetricsToken:        env.token("SWW_METRICS_TOKEN"),
-		MetricsTopN:         env.numberNotOff("SWW_METRICS_TOP_N", "50"),
-		RulesDir:            env.value("SWW_RULES_DIR", "/etc/sww/rules.d"),
-		RulesEnabled:        env.boolean("SWW_RULES_ENABLED", "true"),
-		WAFMode:             env.wafMode("SWW_WAF_MODE", WAFModeBlock),
-		WAFParanoiaLevel:    env.paranoiaLevel("SWW_WAF_PARANOIA_LEVEL", "1"),
-		WAFAnomalyThreshold: env.numberOrOff("SWW_WAF_ANOMALY_THRESHOLD", "5"),
-		WAFDisabledRules: env.ruleIDs("SWW_WAF_DISABLED_RULES",
+		LogLevel:            env.logLevel("SWW_WAF_LOG_LEVEL", "info"),
+		AdminToken:          env.token("SWW_WAF_ADMIN_TOKEN"),
+		MetricsToken:        env.token("SWW_WAF_METRICS_TOKEN"),
+		MetricsTopN:         env.numberNotOff("SWW_WAF_METRICS_TOP_N", "50"),
+		RulesDir:            env.value("SWW_WAF_RULES_DIR", "/etc/sww/rules.d"),
+		RulesEnabled:        env.boolean("SWW_WAF_RULES_ENABLED", "true"),
+		WAFMode:             env.wafMode("SWW_WAF_CORE_RULE_SET_MODE", WAFModeBlock),
+		WAFParanoiaLevel:    env.paranoiaLevel("SWW_WAF_CORE_RULE_SET_PARANOIA_LEVEL", "1"),
+		WAFAnomalyThreshold: env.numberOrOff("SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD", "5"),
+		WAFDisabledRules: env.ruleIDs("SWW_WAF_CORE_RULE_SET_DISABLED_RULES",
 			"920340,920420,920440,920640,930130,930140"),
-		WAFExemptPaths: env.pathPrefixes("SWW_WAF_EXEMPT_PATHS", ""),
-		WAFBodyLimit:   env.wafBodyLimit("SWW_WAF_BODY_LIMIT", off),
+		WAFExemptPaths: env.pathPrefixes("SWW_WAF_CORE_RULE_SET_EXEMPT_PATHS", ""),
+		WAFBodyLimit:   env.wafBodyLimit("SWW_WAF_CORE_RULE_SET_BODY_LIMIT", off),
 		CoreRuleSetExclusionsFile: env.filePath(
-			"SWW_CORE_RULE_SET_EXCLUSIONS_FILE"),
-		TrapPaths:            env.trapPaths("SWW_TRAP_PATHS"),
-		ErrorBurstThreshold:  env.count("SWW_ERROR_BURST_THRESHOLD", "30"),
-		LogRemoteURL:         env.logRemoteURL("SWW_LOG_REMOTE_URL"),
-		LogRemoteTLSCAs:      env.certificates("SWW_LOG_REMOTE_TLS_CA_FILE"),
-		LogRemoteBuffer:      env.numberNotOff("SWW_LOG_REMOTE_BUFFER", "10000"),
-		LogRemoteFacility:    env.facility("SWW_LOG_REMOTE_FACILITY", "local0"),
-		AlertWebhookURL:      env.webhookURL("SWW_ALERT_WEBHOOK_URL"),
-		AlertWebhookHeaders:  env.webhookHeaders("SWW_ALERT_WEBHOOK_HEADERS"),
-		AlertSlackWebhookURL: env.webhookURL("SWW_ALERT_SLACK_WEBHOOK_URL"),
-		AlertNtfyURL:         env.webhookURL("SWW_ALERT_NTFY_URL"),
-		AlertNtfyToken:       env.secret("SWW_ALERT_NTFY_TOKEN"),
-		AlertEvents: env.alertEvents("SWW_ALERT_EVENTS",
+			"SWW_WAF_CORE_RULE_SET_EXCLUSIONS_FILE"),
+		TrapPaths:            env.trapPaths("SWW_WAF_TRAP_PATHS"),
+		ErrorBurstThreshold:  env.count("SWW_WAF_ERROR_BURST_THRESHOLD", "30"),
+		LogRemoteURL:         env.logRemoteURL("SWW_WAF_LOG_REMOTE_URL"),
+		LogRemoteTLSCAs:      env.certificates("SWW_WAF_LOG_REMOTE_TLS_CA_FILE"),
+		LogRemoteBuffer:      env.numberNotOff("SWW_WAF_LOG_REMOTE_BUFFER", "10000"),
+		LogRemoteFacility:    env.facility("SWW_WAF_LOG_REMOTE_FACILITY", "local0"),
+		AlertWebhookURL:      env.webhookURL("SWW_WAF_ALERT_WEBHOOK_URL"),
+		AlertWebhookHeaders:  env.webhookHeaders("SWW_WAF_ALERT_WEBHOOK_HEADERS"),
+		AlertSlackWebhookURL: env.webhookURL("SWW_WAF_ALERT_SLACK_WEBHOOK_URL"),
+		AlertNtfyURL:         env.webhookURL("SWW_WAF_ALERT_NTFY_URL"),
+		AlertNtfyToken:       env.secret("SWW_WAF_ALERT_NTFY_TOKEN"),
+		AlertEvents: env.alertEvents("SWW_WAF_ALERT_EVENTS",
 			strings.Join(alerts.Events(), ",")),
-		AlertCooldown:      env.duration("SWW_ALERT_COOLDOWN", "15m"),
-		AlertMaxPerHour:    env.numberOrOff("SWW_ALERT_MAX_PER_HOUR", "60"),
-		AnomalyClient:      env.thresholds("SWW_ANOMALY_CLIENT_"),
-		AnomalyNet:         env.thresholds("SWW_ANOMALY_NET_"),
-		AnomalyASN:         env.thresholds("SWW_ANOMALY_ASN_"),
-		AnomalyTotal:       env.thresholds("SWW_ANOMALY_TOTAL_"),
-		AnomalyWatch:       env.thresholds("SWW_WATCH_"),
-		AnomalyNetV4Prefix: env.v4Prefix("SWW_ANOMALY_NET_V4_PREFIX", "24"),
-		AnomalyNetV6Prefix: env.v6Prefix("SWW_ANOMALY_NET_V6_PREFIX", "48"),
-		WatchNets:          env.namedNetblocks("SWW_WATCH_NETS"),
+		AlertCooldown:      env.duration("SWW_WAF_ALERT_COOLDOWN", "15m"),
+		AlertMaxPerHour:    env.numberOrOff("SWW_WAF_ALERT_MAX_PER_HOUR", "60"),
+		AnomalyClient:      env.thresholds("SWW_WAF_ANOMALY_CLIENT_"),
+		AnomalyNet:         env.thresholds("SWW_WAF_ANOMALY_NET_"),
+		AnomalyASN:         env.thresholds("SWW_WAF_ANOMALY_ASN_"),
+		AnomalyTotal:       env.thresholds("SWW_WAF_ANOMALY_TOTAL_"),
+		AnomalyWatch:       env.thresholds("SWW_WAF_WATCH_"),
+		AnomalyNetV4Prefix: env.v4Prefix("SWW_WAF_ANOMALY_NET_V4_PREFIX", "24"),
+		AnomalyNetV6Prefix: env.v6Prefix("SWW_WAF_ANOMALY_NET_V6_PREFIX", "48"),
+		WatchNets:          env.namedNetblocks("SWW_WAF_WATCH_NETS"),
 	}
 
-	cfg.LogRemoteAppName = env.appName("SWW_LOG_REMOTE_APP_NAME",
+	cfg.LogRemoteAppName = env.appName("SWW_WAF_LOG_REMOTE_APP_NAME",
 		cfg.InstanceName, cfg.LogRemoteURL != nil)
 	cfg.BlocklistAction, cfg.BlocklistLimitPercent = env.action(
-		"SWW_BLOCKLIST_ACTION", "deny")
+		"SWW_WAF_BLOCKLIST_ACTION", "deny")
 	cfg.ReputationAction, cfg.ReputationLimitPercent = env.action(
-		"SWW_REPUTATION_ACTION", "limit:25")
+		"SWW_WAF_REPUTATION_ACTION", "limit:25")
 
 	env.checkInstanceNameForNtfy(cfg.InstanceName, cfg.AlertNtfyURL != nil)
 	env.checkLookupDBPath(cfg)
@@ -580,8 +582,8 @@ func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 // Command reads only SWW_COMMAND, the command the image runs and its
 // health check checks: rproxy when it is unset or empty, or discriminator. It cannot
 // be given as a file. Any other value is an error that names the setting.
-func Command(lookupEnv func(string) (string, bool)) (string, error) {
-	command, _ := lookupEnv("SWW_COMMAND")
+func Command(v *viper.Viper) (string, error) {
+	command, _ := readSetting(v, "SWW_COMMAND")
 
 	switch command {
 	case "", "rproxy":
@@ -593,22 +595,22 @@ func Command(lookupEnv func(string) (string, bool)) (string, error) {
 	}
 }
 
-// DiscriminatorListenAddr reads only SWW_LISTEN_ADDR, which may be given as a
+// DiscriminatorListenAddr reads only SWW_WAF_LISTEN_ADDR, which may be given as a
 // file, as FromEnvironment does. The health check in discriminator's container needs
 // no other setting, so it reads no other, nor a file that another names.
-func DiscriminatorListenAddr(lookupEnv func(string) (string, bool)) (string, error) {
-	env := &environment{lookupEnv: lookupEnv}
-	listenAddr := env.address("SWW_LISTEN_ADDR")
+func DiscriminatorListenAddr(v *viper.Viper) (string, error) {
+	env := &environment{v: v, readFiles: true}
+	listenAddr := env.address("SWW_WAF_LISTEN_ADDR")
 
 	return listenAddr, env.err
 }
 
-// InstanceName reads only SWW_INSTANCE_NAME, which may be given as a
+// InstanceName reads only SWW_WAF_INSTANCE_NAME, which may be given as a
 // file, as FromEnvironment does, so that the line saying a setting is
 // invalid carries it too. A file that cannot be read gives the default
 // here, and FromEnvironment then stops the start over it.
-func InstanceName(lookupEnv func(string) (string, bool)) string {
-	env := &environment{lookupEnv: lookupEnv}
+func InstanceName(v *viper.Viper) string {
+	env := &environment{v: v, readFiles: true}
 
 	return env.instanceName()
 }
@@ -624,13 +626,26 @@ func (c *Config) LogValue() slog.Value {
 }
 
 // environment is where FromEnvironment reads the settings: it notes each
-// value for the log, and keeps the first error.
+// value for the log, and keeps the first error. It reads every setting
+// through v, the viper NewViper returns, and, unless readFiles is false,
+// honours each setting's _FILE form too.
 type environment struct {
-	lookupEnv func(string) (string, bool)
+	v         *viper.Viper
+	readFiles bool
 	settings  []slog.Attr
 	err       error
 }
 
+// readSetting returns a setting's value and whether it is set, reading it
+// through v.
+func readSetting(v *viper.Viper, name string) (string, bool) {
+	if !v.IsSet(name) {
+		return "", false
+	}
+
+	return v.GetString(name), true
+}
+
 // value returns a setting's value, or its default when it is not set,
 // and notes it for the log.
 func (e *environment) value(name, defaultValue string) string {
@@ -649,10 +664,14 @@ func (e *environment) value(name, defaultValue string) string {
 // names, less one newline at their end. It notes that file's path for the
 // log. Both variables set, or a file that cannot be read, is an error.
 func (e *environment) lookup(name string) (string, bool) {
-	value, set := e.lookupEnv(name)
+	value, set := readSetting(e.v, name)
+	if !e.readFiles {
+		return value, set
+	}
+
 	fileName := name + "_FILE"
 
-	path, inFile := e.lookupEnv(fileName)
+	path, inFile := readSetting(e.v, fileName)
 	if !inFile {
 		return value, set
 	}
@@ -961,30 +980,30 @@ func (e *environment) lookupSource(name, defaultValue string) string {
 	return source
 }
 
-// checkLookupDBPath refuses SWW_LOOKUP_SOURCE=file without
-// SWW_LOOKUP_DB_PATH, and SWW_LOOKUP_DB_PATH with any other source:
+// checkLookupDBPath refuses SWW_WAF_LOOKUP_SOURCE=file without
+// SWW_WAF_LOOKUP_DB_PATH, and SWW_WAF_LOOKUP_DB_PATH with any other source:
 // one source at a time.
 func (e *environment) checkLookupDBPath(cfg *Config) {
 	switch {
 	case cfg.LookupSource == fileSource && cfg.LookupDBPath == "":
-		e.check("SWW_LOOKUP_SOURCE", fmt.Errorf(
-			"is file while SWW_LOOKUP_DB_PATH is unset; %w", errNeedsDBPath))
+		e.check("SWW_WAF_LOOKUP_SOURCE", fmt.Errorf(
+			"is file while SWW_WAF_LOOKUP_DB_PATH is unset; %w", errNeedsDBPath))
 	case cfg.LookupSource != fileSource && cfg.LookupDBPath != "":
-		e.check("SWW_LOOKUP_DB_PATH", fmt.Errorf(
-			"is set while SWW_LOOKUP_SOURCE is %s; %w", cfg.LookupSource, errDBPathUnused))
+		e.check("SWW_WAF_LOOKUP_DB_PATH", fmt.Errorf(
+			"is set while SWW_WAF_LOOKUP_SOURCE is %s; %w", cfg.LookupSource, errDBPathUnused))
 	}
 }
 
 // checkCountriesAndLookups refuses a country on both country lists, and,
-// while SWW_LOOKUP_SOURCE is off, each setting that needs clients looked
-// up: the country lists, SWW_ADD_LOOKUP_HEADERS, the biased thresholds,
-// SWW_ASN_LIMIT_PERCENT_URL among them, of which
-// SWW_UNKNOWN_LIMIT_PERCENT needs them only below 100, where it lowers a
+// while SWW_WAF_LOOKUP_SOURCE is off, each setting that needs clients looked
+// up: the country lists, SWW_WAF_ADD_LOOKUP_HEADERS, the biased thresholds,
+// SWW_WAF_ASN_LIMIT_PERCENT_URL among them, of which
+// SWW_WAF_UNKNOWN_LIMIT_PERCENT needs them only below 100, where it lowers a
 // limit, and the anomaly thresholds per AS number.
 func (e *environment) checkCountriesAndLookups(cfg *Config) {
 	for _, country := range cfg.ExclusivelyAllowedCountries {
 		if slices.Contains(cfg.DeniedCountries, country) {
-			e.check("SWW_EXCLUSIVELY_ALLOWED_COUNTRIES",
+			e.check("SWW_WAF_EXCLUSIVELY_ALLOWED_COUNTRIES",
 				fmt.Errorf("%q %w", country, errOnBothLists))
 		}
 	}
@@ -997,53 +1016,53 @@ func (e *environment) checkCountriesAndLookups(cfg *Config) {
 		name string
 		set  bool
 	}{
-		{"SWW_DENIED_COUNTRIES", len(cfg.DeniedCountries) > 0},
-		{"SWW_EXCLUSIVELY_ALLOWED_COUNTRIES", len(cfg.ExclusivelyAllowedCountries) > 0},
-		{"SWW_ADD_LOOKUP_HEADERS", cfg.AddLookupHeaders},
-		{"SWW_ASN_LIMIT_PERCENT", len(cfg.ASNLimitPercent) > 0},
-		{"SWW_COUNTRY_LIMIT_PERCENT", len(cfg.CountryLimitPercent) > 0},
-		{"SWW_ASN_BYTES_PERCENT", len(cfg.ASNBytesPercent) > 0},
-		{"SWW_COUNTRY_BYTES_PERCENT", len(cfg.CountryBytesPercent) > 0},
-		{"SWW_UNKNOWN_LIMIT_PERCENT", cfg.UnknownLimitPercent < 100},
-		{"SWW_ASN_LIMIT_PERCENT_URL", cfg.ASNLimitPercentURL != ""},
-		{"SWW_ANOMALY_ASN_REQUESTS_PER_MINUTE", cfg.AnomalyASN.RequestsPerMinute > 0},
-		{"SWW_ANOMALY_ASN_REQUESTS_PER_HOUR", cfg.AnomalyASN.RequestsPerHour > 0},
-		{"SWW_ANOMALY_ASN_BYTES_PER_MINUTE", cfg.AnomalyASN.BytesPerMinute > 0},
-		{"SWW_ANOMALY_ASN_BYTES_PER_HOUR", cfg.AnomalyASN.BytesPerHour > 0},
+		{"SWW_WAF_DENIED_COUNTRIES", len(cfg.DeniedCountries) > 0},
+		{"SWW_WAF_EXCLUSIVELY_ALLOWED_COUNTRIES", len(cfg.ExclusivelyAllowedCountries) > 0},
+		{"SWW_WAF_ADD_LOOKUP_HEADERS", cfg.AddLookupHeaders},
+		{"SWW_WAF_ASN_LIMIT_PERCENT", len(cfg.ASNLimitPercent) > 0},
+		{"SWW_WAF_COUNTRY_LIMIT_PERCENT", len(cfg.CountryLimitPercent) > 0},
+		{"SWW_WAF_ASN_BYTES_PERCENT", len(cfg.ASNBytesPercent) > 0},
+		{"SWW_WAF_COUNTRY_BYTES_PERCENT", len(cfg.CountryBytesPercent) > 0},
+		{"SWW_WAF_UNKNOWN_LIMIT_PERCENT", cfg.UnknownLimitPercent < 100},
+		{"SWW_WAF_ASN_LIMIT_PERCENT_URL", cfg.ASNLimitPercentURL != ""},
+		{"SWW_WAF_ANOMALY_ASN_REQUESTS_PER_MINUTE", cfg.AnomalyASN.RequestsPerMinute > 0},
+		{"SWW_WAF_ANOMALY_ASN_REQUESTS_PER_HOUR", cfg.AnomalyASN.RequestsPerHour > 0},
+		{"SWW_WAF_ANOMALY_ASN_BYTES_PER_MINUTE", cfg.AnomalyASN.BytesPerMinute > 0},
+		{"SWW_WAF_ANOMALY_ASN_BYTES_PER_HOUR", cfg.AnomalyASN.BytesPerHour > 0},
 	} {
 		if setting.set {
-			e.check(setting.name, fmt.Errorf("is set while SWW_LOOKUP_SOURCE is off; %w",
+			e.check(setting.name, fmt.Errorf("is set while SWW_WAF_LOOKUP_SOURCE is off; %w",
 				errNeedsLookups))
 		}
 	}
 }
 
-// checkASNLimitPercentURL refuses SWW_ASN_LIMIT_PERCENT_URL naming a
+// checkASNLimitPercentURL refuses SWW_WAF_ASN_LIMIT_PERCENT_URL naming a
 // blocklist too: the file at a URL is fetched as one list or the other.
 func (e *environment) checkASNLimitPercentURL(cfg *Config) {
 	if slices.Contains(cfg.BlocklistURLs, cfg.ASNLimitPercentURL) {
-		e.check("SWW_ASN_LIMIT_PERCENT_URL",
+		e.check("SWW_WAF_ASN_LIMIT_PERCENT_URL",
 			fmt.Errorf("%q %w", cfg.ASNLimitPercentURL, errInBlocklistURLs))
 	}
 }
 
-// checkCrowdSec refuses SWW_CROWDSEC_LAPI_URL without
-// SWW_CROWDSEC_LAPI_KEY, the key without the URL, and a decision list
+// checkCrowdSec refuses SWW_WAF_CROWDSEC_LAPI_URL without
+// SWW_WAF_CROWDSEC_LAPI_KEY, the key without the URL, and a decision list
 // that is fetched as another list too.
 func (e *environment) checkCrowdSec(cfg *Config) {
 	decisionsURL := cfg.CrowdSecDecisionsURL
 
 	switch {
 	case decisionsURL != "" && cfg.CrowdSecKey == "":
-		e.check("SWW_CROWDSEC_LAPI_URL", fmt.Errorf(
-			"is set while SWW_CROWDSEC_LAPI_KEY is unset; %w", errNeedsLAPIKey))
+		e.check("SWW_WAF_CROWDSEC_LAPI_URL", fmt.Errorf(
+			"is set while SWW_WAF_CROWDSEC_LAPI_KEY is unset; %w", errNeedsLAPIKey))
 	case decisionsURL == "" && cfg.CrowdSecKey != "":
-		e.check("SWW_CROWDSEC_LAPI_KEY", fmt.Errorf(
-			"is set while SWW_CROWDSEC_LAPI_URL is unset; %w", errLAPIKeyUnused))
+		e.check("SWW_WAF_CROWDSEC_LAPI_KEY", fmt.Errorf(
+			"is set while SWW_WAF_CROWDSEC_LAPI_URL is unset; %w", errLAPIKeyUnused))
 	case decisionsURL != "" && (slices.Contains(cfg.BlocklistURLs, decisionsURL) ||
 		decisionsURL == cfg.ASNLimitPercentURL):
-		e.check("SWW_CROWDSEC_LAPI_URL", fmt.Errorf("gives the decision list %q, which %w",
-			decisionsURL, errAnotherList))
+		e.check("SWW_WAF_CROWDSEC_LAPI_URL",
+			fmt.Errorf("gives the decision list %q, which %w", decisionsURL, errAnotherList))
 	}
 }
 
@@ -1198,7 +1217,7 @@ func (e *environment) logRemoteURL(name string) *url.URL {
 // unset. Its value names a file already, so, unlike the other settings,
 // it has no _FILE form. Whoever uses the file reads it.
 func (e *environment) filePath(name string) string {
-	path, _ := e.lookupEnv(name)
+	path, _ := readSetting(e.v, name)
 	e.settings = append(e.settings, slog.String(name, path))
 
 	return path
@@ -1208,7 +1227,7 @@ func (e *environment) filePath(name string) string {
 // certificates. Unset or empty, it is nil. Its value names a file
 // already, so, unlike the other settings, it has no _FILE form.
 func (e *environment) certificates(name string) *x509.CertPool {
-	path, _ := e.lookupEnv(name)
+	path, _ := readSetting(e.v, name)
 	e.settings = append(e.settings, slog.String(name, path))
 
 	if path == "" {
@@ -1241,14 +1260,14 @@ func (e *environment) facility(name, defaultValue string) int {
 	return number
 }
 
-// instanceName reads SWW_INSTANCE_NAME, by default the host's name. It
+// instanceName reads SWW_WAF_INSTANCE_NAME, by default the host's name. It
 // must be valid UTF-8: the metrics library panics on a label that is not.
 func (e *environment) instanceName() string {
 	hostname, _ := os.Hostname() // "" when the host has no name to give
 
-	value := e.value("SWW_INSTANCE_NAME", hostname)
+	value := e.value("SWW_WAF_INSTANCE_NAME", hostname)
 	if !utf8.ValidString(value) {
-		e.check("SWW_INSTANCE_NAME", fmt.Errorf("%q %w", value, errNotUTF8))
+		e.check("SWW_WAF_INSTANCE_NAME", fmt.Errorf("%q %w", value, errNotUTF8))
 	}
 
 	return value
@@ -1270,7 +1289,7 @@ func (e *environment) appName(name, instanceName string, sending bool) string {
 	case set:
 		e.check(name, fmt.Errorf("%q %w", value, errNotAppName))
 	case sending:
-		e.check(name, fmt.Errorf("is unset, and SWW_INSTANCE_NAME %q, its default, %w",
+		e.check(name, fmt.Errorf("is unset, and SWW_WAF_INSTANCE_NAME %q, its default, %w",
 			value, errNotAppName))
 	}
 
@@ -1278,19 +1297,19 @@ func (e *environment) appName(name, instanceName string, sending bool) string {
 }
 
 // checkInstanceNameForNtfy refuses an instance name that holds a control
-// character while ntfySet, SWW_ALERT_NTFY_URL being set: ntfy is sent
+// character while ntfySet, SWW_WAF_ALERT_NTFY_URL being set: ntfy is sent
 // the instance name in a header, which cannot hold one.
 func (e *environment) checkInstanceNameForNtfy(instanceName string, ntfySet bool) {
 	if ntfySet && strings.ContainsFunc(instanceName, unicode.IsControl) {
-		e.check("SWW_INSTANCE_NAME", fmt.Errorf(
-			"%q %w, and is sent to ntfy in a header while SWW_ALERT_NTFY_URL is set",
+		e.check("SWW_WAF_INSTANCE_NAME", fmt.Errorf(
+			"%q %w, and is sent to ntfy in a header while SWW_WAF_ALERT_NTFY_URL is set",
 			instanceName, errControlCharacter))
 	}
 }
 
 // webhookURL reads a setting that is a URL each alert is posted to:
-// SWW_ALERT_WEBHOOK_URL, SWW_ALERT_SLACK_WEBHOOK_URL or
-// SWW_ALERT_NTFY_URL. Unset or empty, it is nil, and no alert is posted
+// SWW_WAF_ALERT_WEBHOOK_URL, SWW_WAF_ALERT_SLACK_WEBHOOK_URL or
+// SWW_WAF_ALERT_NTFY_URL. Unset or empty, it is nil, and no alert is posted
 // there. The log shows ******** in place of its path and query, and an
 // error shows none of it, since a webhook or an ntfy topic can carry its
 // secret there.
@@ -1739,7 +1758,7 @@ func parseCountry(value string) (string, error) {
 
 // ParseASN reads an AS number such as AS64496, in either case, and
 // returns it as the lookup gives it: AS and the number, in capitals and
-// without leading zeros. The file SWW_ASN_LIMIT_PERCENT_URL names is
+// without leading zeros. The file SWW_WAF_ASN_LIMIT_PERCENT_URL names is
 // read with it too.
 func ParseASN(value string) (string, error) {
 	digits, hasAS := strings.CutPrefix(strings.ToUpper(value), "AS")
@@ -1793,7 +1812,7 @@ func parsePercents(
 }
 
 // ParsePercent reads a percentage, a whole number from 0 to 100. The file
-// SWW_ASN_LIMIT_PERCENT_URL names is read with it too.
+// SWW_WAF_ASN_LIMIT_PERCENT_URL names is read with it too.
 func ParsePercent(value string) (int64, error) {
 	percent, err := strconv.ParseInt(value, 10, 64)
 	if err != nil || percent < 0 || percent > 100 {
@@ -2013,7 +2032,7 @@ const (
 	maxLabelLength = 63
 	// labelChars are the characters a label of a DNS zone may hold.
 	labelChars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"
-	// dnsPort is the port a resolver is asked on when SWW_DNSBL_RESOLVER
+	// dnsPort is the port a resolver is asked on when SWW_WAF_DNSBL_RESOLVER
 	// gives none.
 	dnsPort = 53
 )

internal/config/config_test.go

@@ -17,105 +17,107 @@ import (
 	"testing"
 	"time"
 
+	"github.com/spf13/viper"
+
 	"sneak.berlin/go/smallwebwaf/internal/anomaly"
 	"sneak.berlin/go/smallwebwaf/internal/config"
 )
 
 // The settings, by name.
 const (
-	listenAddr           = "SWW_LISTEN_ADDR"
-	mode                 = "SWW_MODE"
-	ipv6GroupPrefix      = "SWW_IPV6_GROUP_PREFIX"
-	maxTrackedClients    = "SWW_MAX_TRACKED_CLIENTS"
-	allowNets            = "SWW_ALLOW_NETS"
-	rateLimitExemptNets  = "SWW_RATE_LIMIT_EXEMPT_NETS"
-	denyNets             = "SWW_DENY_NETS"
-	rateLimitPerMinute   = "SWW_RATE_LIMIT_PER_MINUTE"
-	rateLimitPerHour     = "SWW_RATE_LIMIT_PER_HOUR"
-	rateLimitPerDay      = "SWW_RATE_LIMIT_PER_DAY"
-	rateLimitExemptPaths = "SWW_RATE_LIMIT_EXEMPT_PATHS"
-	bytesLimitPerMinute  = "SWW_BYTES_LIMIT_PER_MINUTE"
-	bytesLimitPerHour    = "SWW_BYTES_LIMIT_PER_HOUR"
-	bytesLimitPerDay     = "SWW_BYTES_LIMIT_PER_DAY"
-	bytesCount           = "SWW_BYTES_COUNT"
-	lookupSource         = "SWW_LOOKUP_SOURCE"
-	lookupDBPath         = "SWW_LOOKUP_DB_PATH"
-	lookupTimeout        = "SWW_LOOKUP_TIMEOUT"
-	addLookupHeaders     = "SWW_ADD_LOOKUP_HEADERS"
-	deniedCountries      = "SWW_DENIED_COUNTRIES"
-	allowedCountries     = "SWW_EXCLUSIVELY_ALLOWED_COUNTRIES"
-	asnLimitPercent      = "SWW_ASN_LIMIT_PERCENT"
-	countryLimitPercent  = "SWW_COUNTRY_LIMIT_PERCENT"
-	asnBytesPercent      = "SWW_ASN_BYTES_PERCENT"
-	countryBytesPercent  = "SWW_COUNTRY_BYTES_PERCENT"
-	unknownLimitPercent  = "SWW_UNKNOWN_LIMIT_PERCENT"
-	asnLimitPercentURL   = "SWW_ASN_LIMIT_PERCENT_URL"
-	blocklistURLs        = "SWW_BLOCKLIST_URLS"
-	blocklistRefresh     = "SWW_BLOCKLIST_REFRESH"
-	blocklistAction      = "SWW_BLOCKLIST_ACTION"
-	dnsblZones           = "SWW_DNSBL_ZONES"
-	dnsblResolver        = "SWW_DNSBL_RESOLVER"
-	abuseIPDBKey         = "SWW_ABUSEIPDB_KEY"
-	abuseIPDBMinScore    = "SWW_ABUSEIPDB_MIN_SCORE"
-	abuseIPDBDailyBudget = "SWW_ABUSEIPDB_DAILY_BUDGET"
-	reputationAction     = "SWW_REPUTATION_ACTION"
-	reputationCacheTTL   = "SWW_REPUTATION_CACHE_TTL"
-	reputationTimeout    = "SWW_REPUTATION_TIMEOUT"
-	crowdSecURL          = "SWW_CROWDSEC_LAPI_URL"
-	crowdSecKey          = "SWW_CROWDSEC_LAPI_KEY"
-	banResponse          = "SWW_BAN_RESPONSE"
-	limitBanDuration     = "SWW_LIMIT_BAN_DURATION"
-	limitBanRepeatWindow = "SWW_LIMIT_BAN_REPEAT_WINDOW"
-	maxBanDuration       = "SWW_MAX_BAN_DURATION"
-	attackBanDuration    = "SWW_ATTACK_BAN_DURATION"
-	maxBans              = "SWW_MAX_BANS"
-	banScopeV4Prefix     = "SWW_BAN_SCOPE_V4_PREFIX"
-	stateDir             = "SWW_STATE_DIR"
-	stateWriteDelay      = "SWW_STATE_WRITE_DELAY"
-	stateCounterInterval = "SWW_STATE_COUNTER_INTERVAL"
-	adminToken           = "SWW_ADMIN_TOKEN"   //nolint:gosec // the setting's name
-	metricsToken         = "SWW_METRICS_TOKEN" //nolint:gosec // the setting's name
-	metricsTopN          = "SWW_METRICS_TOP_N"
-	instanceName         = "SWW_INSTANCE_NAME"
-	logRequestHeaders    = "SWW_LOG_REQUEST_HEADERS"
-	logLevel             = "SWW_LOG_LEVEL"
-	rulesDir             = "SWW_RULES_DIR"
-	rulesEnabled         = "SWW_RULES_ENABLED"
-	wafMode              = "SWW_WAF_MODE"
-	wafParanoiaLevel     = "SWW_WAF_PARANOIA_LEVEL"
-	wafAnomalyThreshold  = "SWW_WAF_ANOMALY_THRESHOLD"
-	wafDisabledRules     = "SWW_WAF_DISABLED_RULES"
-	wafExemptPaths       = "SWW_WAF_EXEMPT_PATHS"
-	wafBodyLimit         = "SWW_WAF_BODY_LIMIT"
-	exclusionsFile       = "SWW_CORE_RULE_SET_EXCLUSIONS_FILE"
-	trapPaths            = "SWW_TRAP_PATHS"
-	errorBurstThreshold  = "SWW_ERROR_BURST_THRESHOLD"
-	logRemoteURL         = "SWW_LOG_REMOTE_URL"
-	logRemoteTLSCAFile   = "SWW_LOG_REMOTE_TLS_CA_FILE"
-	logRemoteBuffer      = "SWW_LOG_REMOTE_BUFFER"
-	logRemoteFacility    = "SWW_LOG_REMOTE_FACILITY"
-	logRemoteAppName     = "SWW_LOG_REMOTE_APP_NAME"
-	alertWebhookURL      = "SWW_ALERT_WEBHOOK_URL"
-	alertWebhookHeaders  = "SWW_ALERT_WEBHOOK_HEADERS"
-	alertSlackWebhookURL = "SWW_ALERT_SLACK_WEBHOOK_URL"
-	alertNtfyURL         = "SWW_ALERT_NTFY_URL"
-	alertNtfyToken       = "SWW_ALERT_NTFY_TOKEN" //nolint:gosec // the setting's name
-	alertEvents          = "SWW_ALERT_EVENTS"
-	alertCooldown        = "SWW_ALERT_COOLDOWN"
-	alertMaxPerHour      = "SWW_ALERT_MAX_PER_HOUR"
-	anomalyNetV4Prefix   = "SWW_ANOMALY_NET_V4_PREFIX"
-	anomalyNetV6Prefix   = "SWW_ANOMALY_NET_V6_PREFIX"
-	watchNets            = "SWW_WATCH_NETS"
+	listenAddr           = "SWW_WAF_LISTEN_ADDR"
+	mode                 = "SWW_WAF_MODE"
+	ipv6GroupPrefix      = "SWW_WAF_IPV6_GROUP_PREFIX"
+	maxTrackedClients    = "SWW_WAF_MAX_TRACKED_CLIENTS"
+	allowNets            = "SWW_WAF_ALLOW_NETS"
+	rateLimitExemptNets  = "SWW_WAF_RATE_LIMIT_EXEMPT_NETS"
+	denyNets             = "SWW_WAF_DENY_NETS"
+	rateLimitPerMinute   = "SWW_WAF_RATE_LIMIT_PER_MINUTE"
+	rateLimitPerHour     = "SWW_WAF_RATE_LIMIT_PER_HOUR"
+	rateLimitPerDay      = "SWW_WAF_RATE_LIMIT_PER_DAY"
+	rateLimitExemptPaths = "SWW_WAF_RATE_LIMIT_EXEMPT_PATHS"
+	bytesLimitPerMinute  = "SWW_WAF_BYTES_LIMIT_PER_MINUTE"
+	bytesLimitPerHour    = "SWW_WAF_BYTES_LIMIT_PER_HOUR"
+	bytesLimitPerDay     = "SWW_WAF_BYTES_LIMIT_PER_DAY"
+	bytesCount           = "SWW_WAF_BYTES_COUNT"
+	lookupSource         = "SWW_WAF_LOOKUP_SOURCE"
+	lookupDBPath         = "SWW_WAF_LOOKUP_DB_PATH"
+	lookupTimeout        = "SWW_WAF_LOOKUP_TIMEOUT"
+	addLookupHeaders     = "SWW_WAF_ADD_LOOKUP_HEADERS"
+	deniedCountries      = "SWW_WAF_DENIED_COUNTRIES"
+	allowedCountries     = "SWW_WAF_EXCLUSIVELY_ALLOWED_COUNTRIES"
+	asnLimitPercent      = "SWW_WAF_ASN_LIMIT_PERCENT"
+	countryLimitPercent  = "SWW_WAF_COUNTRY_LIMIT_PERCENT"
+	asnBytesPercent      = "SWW_WAF_ASN_BYTES_PERCENT"
+	countryBytesPercent  = "SWW_WAF_COUNTRY_BYTES_PERCENT"
+	unknownLimitPercent  = "SWW_WAF_UNKNOWN_LIMIT_PERCENT"
+	asnLimitPercentURL   = "SWW_WAF_ASN_LIMIT_PERCENT_URL"
+	blocklistURLs        = "SWW_WAF_BLOCKLIST_URLS"
+	blocklistRefresh     = "SWW_WAF_BLOCKLIST_REFRESH"
+	blocklistAction      = "SWW_WAF_BLOCKLIST_ACTION"
+	dnsblZones           = "SWW_WAF_DNSBL_ZONES"
+	dnsblResolver        = "SWW_WAF_DNSBL_RESOLVER"
+	abuseIPDBKey         = "SWW_WAF_ABUSEIPDB_KEY"
+	abuseIPDBMinScore    = "SWW_WAF_ABUSEIPDB_MIN_SCORE"
+	abuseIPDBDailyBudget = "SWW_WAF_ABUSEIPDB_DAILY_BUDGET"
+	reputationAction     = "SWW_WAF_REPUTATION_ACTION"
+	reputationCacheTTL   = "SWW_WAF_REPUTATION_CACHE_TTL"
+	reputationTimeout    = "SWW_WAF_REPUTATION_TIMEOUT"
+	crowdSecURL          = "SWW_WAF_CROWDSEC_LAPI_URL"
+	crowdSecKey          = "SWW_WAF_CROWDSEC_LAPI_KEY"
+	banResponse          = "SWW_WAF_BAN_RESPONSE"
+	limitBanDuration     = "SWW_WAF_LIMIT_BAN_DURATION"
+	limitBanRepeatWindow = "SWW_WAF_LIMIT_BAN_REPEAT_WINDOW"
+	maxBanDuration       = "SWW_WAF_MAX_BAN_DURATION"
+	attackBanDuration    = "SWW_WAF_ATTACK_BAN_DURATION"
+	maxBans              = "SWW_WAF_MAX_BANS"
+	banScopeV4Prefix     = "SWW_WAF_BAN_SCOPE_V4_PREFIX"
+	stateDir             = "SWW_WAF_STATE_DIR"
+	stateWriteDelay      = "SWW_WAF_STATE_WRITE_DELAY"
+	stateCounterInterval = "SWW_WAF_STATE_COUNTER_INTERVAL"
+	adminToken           = "SWW_WAF_ADMIN_TOKEN"   //nolint:gosec // the setting's name
+	metricsToken         = "SWW_WAF_METRICS_TOKEN" //nolint:gosec // the setting's name
+	metricsTopN          = "SWW_WAF_METRICS_TOP_N"
+	instanceName         = "SWW_WAF_INSTANCE_NAME"
+	logRequestHeaders    = "SWW_WAF_LOG_REQUEST_HEADERS"
+	logLevel             = "SWW_WAF_LOG_LEVEL"
+	rulesDir             = "SWW_WAF_RULES_DIR"
+	rulesEnabled         = "SWW_WAF_RULES_ENABLED"
+	wafMode              = "SWW_WAF_CORE_RULE_SET_MODE"
+	wafParanoiaLevel     = "SWW_WAF_CORE_RULE_SET_PARANOIA_LEVEL"
+	wafAnomalyThreshold  = "SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD"
+	wafDisabledRules     = "SWW_WAF_CORE_RULE_SET_DISABLED_RULES"
+	wafExemptPaths       = "SWW_WAF_CORE_RULE_SET_EXEMPT_PATHS"
+	wafBodyLimit         = "SWW_WAF_CORE_RULE_SET_BODY_LIMIT"
+	exclusionsFile       = "SWW_WAF_CORE_RULE_SET_EXCLUSIONS_FILE"
+	trapPaths            = "SWW_WAF_TRAP_PATHS"
+	errorBurstThreshold  = "SWW_WAF_ERROR_BURST_THRESHOLD"
+	logRemoteURL         = "SWW_WAF_LOG_REMOTE_URL"
+	logRemoteTLSCAFile   = "SWW_WAF_LOG_REMOTE_TLS_CA_FILE"
+	logRemoteBuffer      = "SWW_WAF_LOG_REMOTE_BUFFER"
+	logRemoteFacility    = "SWW_WAF_LOG_REMOTE_FACILITY"
+	logRemoteAppName     = "SWW_WAF_LOG_REMOTE_APP_NAME"
+	alertWebhookURL      = "SWW_WAF_ALERT_WEBHOOK_URL"
+	alertWebhookHeaders  = "SWW_WAF_ALERT_WEBHOOK_HEADERS"
+	alertSlackWebhookURL = "SWW_WAF_ALERT_SLACK_WEBHOOK_URL"
+	alertNtfyURL         = "SWW_WAF_ALERT_NTFY_URL"
+	alertNtfyToken       = "SWW_WAF_ALERT_NTFY_TOKEN" //nolint:gosec // the setting's name
+	alertEvents          = "SWW_WAF_ALERT_EVENTS"
+	alertCooldown        = "SWW_WAF_ALERT_COOLDOWN"
+	alertMaxPerHour      = "SWW_WAF_ALERT_MAX_PER_HOUR"
+	anomalyNetV4Prefix   = "SWW_WAF_ANOMALY_NET_V4_PREFIX"
+	anomalyNetV6Prefix   = "SWW_WAF_ANOMALY_NET_V6_PREFIX"
+	watchNets            = "SWW_WAF_WATCH_NETS"
 )
 
 // The anomaly thresholds: each of the prefixes below, which name a scope,
 // followed by each of the four ends.
 const (
-	anomalyClient = "SWW_ANOMALY_CLIENT_"
-	anomalyNet    = "SWW_ANOMALY_NET_"
-	anomalyASN    = "SWW_ANOMALY_ASN_"
-	anomalyTotal  = "SWW_ANOMALY_TOTAL_"
-	watch         = "SWW_WATCH_"
+	anomalyClient = "SWW_WAF_ANOMALY_CLIENT_"
+	anomalyNet    = "SWW_WAF_ANOMALY_NET_"
+	anomalyASN    = "SWW_WAF_ANOMALY_ASN_"
+	anomalyTotal  = "SWW_WAF_ANOMALY_TOTAL_"
+	watch         = "SWW_WAF_WATCH_"
 
 	requestsPerMinute = "REQUESTS_PER_MINUTE"
 	requestsPerHour   = "REQUESTS_PER_HOUR"
@@ -156,21 +158,21 @@ func loggedAnomalyDefaults() map[string]string {
 	return logged
 }
 
-// defaultAlertEvents is the default of SWW_ALERT_EVENTS, and
-// defaultAlertCooldown that of SWW_ALERT_COOLDOWN.
+// defaultAlertEvents is the default of SWW_WAF_ALERT_EVENTS, and
+// defaultAlertCooldown that of SWW_WAF_ALERT_COOLDOWN.
 const (
 	defaultAlertEvents = "ban,permanent_ban,waf_block,anomaly,reputation_hit," +
 		"source_failure,file_error"
 	defaultAlertCooldown = "15m"
 )
 
-// defaultReputationCacheTTL is the default of SWW_REPUTATION_CACHE_TTL.
+// defaultReputationCacheTTL is the default of SWW_WAF_REPUTATION_CACHE_TTL.
 const defaultReputationCacheTTL = "24h"
 
-// defaultWAFDisabledRules is the default of SWW_WAF_DISABLED_RULES.
+// defaultWAFDisabledRules is the default of SWW_WAF_CORE_RULE_SET_DISABLED_RULES.
 const defaultWAFDisabledRules = "920340,920420,920440,920640,930130,930140"
 
-// defaultLogRequestHeaders is the default of SWW_LOG_REQUEST_HEADERS.
+// defaultLogRequestHeaders is the default of SWW_WAF_LOG_REQUEST_HEADERS.
 const defaultLogRequestHeaders = "accept,accept-language,accept-encoding," +
 	"content-type,origin,range"
 
@@ -195,8 +197,8 @@ const (
 	otherToken = "fedcba9876543210fedcba9876543210"
 )
 
-// instance is an SWW_INSTANCE_NAME that is a valid app name too, and
-// remoteURL an SWW_LOG_REMOTE_URL, for the tests that send the lines.
+// instance is an SWW_WAF_INSTANCE_NAME that is a valid app name too, and
+// remoteURL an SWW_WAF_LOG_REMOTE_URL, for the tests that send the lines.
 const (
 	instance  = "fsn1app1/blog"
 	remoteURL = "syslog+udp://192.0.2.1:514"
@@ -208,7 +210,7 @@ const off = "off"
 // enabled is true, as a setting's value.
 const enabled = "true"
 
-// defaultLookupSource is the default of SWW_LOOKUP_SOURCE, and
+// defaultLookupSource is the default of SWW_WAF_LOOKUP_SOURCE, and
 // fileSource the source that is the lookup database.
 const (
 	defaultLookupSource = "geojs"
@@ -218,18 +220,22 @@ const (
 // environment is a set of environment variables, for FromEnvironment.
 type environment map[string]string
 
-// lookupEnv reads one of the variables, as os.LookupEnv does.
-func (e environment) lookupEnv(name string) (string, bool) {
-	value, ok := e[name]
+// viper returns a viper Set with each of the variables, as the viper
+// NewViper returns one bound to a process's environment.
+func (e environment) viper() *viper.Viper {
+	v := viper.New()
+	for name, value := range e {
+		v.Set(name, value)
+	}
 
-	return value, ok
+	return v
 }
 
 // fromEnvironment reads the settings from env, which must be valid.
 func fromEnvironment(t *testing.T, env environment) *config.Config {
 	t.Helper()
 
-	cfg, err := config.FromEnvironment(env.lookupEnv)
+	cfg, err := config.FromEnvironment(env.viper())
 	if err != nil {
 		t.Fatalf("settings %v: %v", env, err)
 	}
@@ -456,7 +462,7 @@ func TestPathPrefixNotStartingWithSlashStopsTheStart(t *testing.T) {
 	t.Parallel()
 
 	_, err := config.FromEnvironment(
-		environment{rateLimitExemptPaths: "/favicon.ico,assets/"}.lookupEnv)
+		environment{rateLimitExemptPaths: "/favicon.ico,assets/"}.viper())
 
 	want := rateLimitExemptPaths + `: "assets/" is not a path prefix ` +
 		`starting with /, such as /assets/`
@@ -511,7 +517,7 @@ func TestInvalidTrapPathOrErrorBurstThresholdStopsTheStart(t *testing.T) {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+			_, err := config.FromEnvironment(environment{tc.name: tc.value}.viper())
 
 			want := tc.name + ": " + tc.want
 			if err == nil || err.Error() != want {
@@ -640,7 +646,7 @@ func TestInvalidCoreRuleSetSettingStopsTheStart(t *testing.T) {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+			_, err := config.FromEnvironment(environment{tc.name: tc.value}.viper())
 
 			want := tc.name + ": " + tc.want
 			if err == nil || err.Error() != want {
@@ -765,7 +771,7 @@ func TestInvalidRemoteLogSettingStopsTheStart(t *testing.T) {
 		{logRemoteAppName, ""}, {logRemoteAppName, "my app"},
 		{logRemoteAppName, "gitéa"}, {logRemoteAppName, strings.Repeat("a", 49)},
 	} {
-		_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+		_, err := config.FromEnvironment(environment{tc.name: tc.value}.viper())
 		if err == nil || !strings.HasPrefix(err.Error(), tc.name+": ") {
 			t.Errorf("%s=%q: error %v, want one naming it", tc.name, tc.value, err)
 		}
@@ -782,7 +788,7 @@ func TestRemoteLogCAFileWithoutCertificateStopsTheStart(t *testing.T) {
 		t.Fatalf("write %s: %v", caFile, err)
 	}
 
-	_, err = config.FromEnvironment(environment{logRemoteTLSCAFile: caFile}.lookupEnv)
+	_, err = config.FromEnvironment(environment{logRemoteTLSCAFile: caFile}.viper())
 
 	want := logRemoteTLSCAFile + `: "` + caFile + `" holds no PEM certificate`
 	if err == nil || err.Error() != want {
@@ -797,7 +803,7 @@ func TestInstanceNameNotAnAppNameStopsTheStartOnlyWhileSending(t *testing.T) {
 
 	sending := environment{logRemoteURL: remoteURL, instanceName: spaced}
 
-	_, err := config.FromEnvironment(sending.lookupEnv)
+	_, err := config.FromEnvironment(sending.viper())
 
 	want := logRemoteAppName + `: is unset, and ` + instanceName +
 		` "fsn1 app1", its default, is not 1 to 48 printable ASCII characters ` +
@@ -827,7 +833,7 @@ func TestAppNameSetStopsTheStartWhileSending(t *testing.T) {
 		logRemoteURL:     remoteURL,
 		instanceName:     instance,
 		logRemoteAppName: "my app",
-	}.lookupEnv)
+	}.viper())
 
 	want := logRemoteAppName + `: "my app" is not 1 to 48 printable ASCII ` +
 		`characters without a space, such as blog`
@@ -958,7 +964,7 @@ func TestWebhookHeadersAreLoggedMaskedAndNeverShown(t *testing.T) {
 	// An item that is not a header is named by its place, not shown.
 	_, err := config.FromEnvironment(environment{
 		alertWebhookHeaders: "X-Team:ops," + secret,
-	}.lookupEnv)
+	}.viper())
 
 	want := alertWebhookHeaders + ": item 2 is not a header name followed by : " +
 		"and the header's value, such as Authorization:Bearer <token>"
@@ -995,7 +1001,7 @@ func TestWebhookURLIsLoggedWithoutItsPathOrQueryAndNeverShown(t *testing.T) {
 		"ftp://hooks.example/services/" + secret,
 		"https://hooks.example/services/%zz" + secret,
 	} {
-		_, err := config.FromEnvironment(environment{alertWebhookURL: value}.lookupEnv)
+		_, err := config.FromEnvironment(environment{alertWebhookURL: value}.viper())
 
 		want := alertWebhookURL + ": is not an http or https URL without a user or " +
 			"a fragment, such as https://alerts.example/sww"
@@ -1046,7 +1052,7 @@ func TestNtfyTokenWithAControlCharacterStopsTheStartWithoutShowingIt(t *testing.
 		"set":       {alertNtfyToken: token + "\r"},
 		"in a file": {alertNtfyToken + "_FILE": writeFile(t, token+"\r\n")},
 	} {
-		_, err := config.FromEnvironment(env.lookupEnv)
+		_, err := config.FromEnvironment(env.viper())
 
 		want := alertNtfyToken + ": holds a control character, such as the " +
 			"carriage return of a Windows line end"
@@ -1063,7 +1069,7 @@ func TestInstanceNameWithAControlCharacterStopsTheStartOnlyWithNtfySet(t *testin
 
 	_, err := config.FromEnvironment(environment{
 		instanceName: name, alertNtfyURL: "https://ntfy.example/sww-alerts",
-	}.lookupEnv)
+	}.viper())
 
 	want := instanceName + `: "fsn1app1\r" holds a control character, such as the ` +
 		`carriage return of a Windows line end, and is sent to ntfy in a header ` +
@@ -1088,7 +1094,7 @@ func TestInstanceNameNotUTF8StopsTheStart(t *testing.T) {
 		"set":       {instanceName: latin1},
 		"in a file": {instanceName + "_FILE": writeFile(t, latin1+"\n")},
 	} {
-		_, err := config.FromEnvironment(env.lookupEnv)
+		_, err := config.FromEnvironment(env.viper())
 
 		want := instanceName + `: "caf\xe9" is not valid UTF-8`
 		if err == nil || err.Error() != want {
@@ -1103,7 +1109,7 @@ func TestCodeOnBothCountryListsStopsTheStart(t *testing.T) {
 	_, err := config.FromEnvironment(environment{
 		deniedCountries:  "cn,ru",
 		allowedCountries: "de,RU",
-	}.lookupEnv)
+	}.viper())
 	if err == nil {
 		t.Fatal("ru on both country lists was accepted")
 	}
@@ -1165,7 +1171,7 @@ func TestLookupDBPathGoesWithTheFileSourceAlone(t *testing.T) {
 			lookupDBPath + ": is set while " + lookupSource + " is off; only file reads it",
 		},
 	} {
-		_, err := config.FromEnvironment(tc.env.lookupEnv)
+		_, err := config.FromEnvironment(tc.env.viper())
 		if err == nil || err.Error() != tc.want {
 			t.Errorf("settings %v: error %v, want %s", tc.env, err, tc.want)
 		}
@@ -1195,7 +1201,7 @@ func TestSettingNeedingLookupsStopsTheStartWhileTheyAreOff(t *testing.T) {
 
 			_, err := config.FromEnvironment(environment{
 				lookupSource: off, name: value,
-			}.lookupEnv)
+			}.viper())
 			if err == nil || !strings.HasPrefix(err.Error(), name+": ") ||
 				!strings.Contains(err.Error(), lookupSource+" is off") {
 				t.Errorf("error %v, want one naming %s and %s", err, name, lookupSource)
@@ -1204,7 +1210,7 @@ func TestSettingNeedingLookupsStopsTheStartWhileTheyAreOff(t *testing.T) {
 	}
 
 	// Set empty, the lists need nothing looked up, and nor does
-	// SWW_UNKNOWN_LIMIT_PERCENT at 100, which lowers no limit, an anomaly
+	// SWW_WAF_UNKNOWN_LIMIT_PERCENT at 100, which lowers no limit, an anomaly
 	// threshold per AS number that is off, any other anomaly threshold, or
 	// a blocklist.
 	env := environment{
@@ -1345,7 +1351,7 @@ func TestInvalidAnomalySettingStopsTheStartSayingWhatIsWrong(t *testing.T) {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+			_, err := config.FromEnvironment(environment{tc.name: tc.value}.viper())
 
 			want := tc.name + ": " + tc.want
 			if err == nil || err.Error() != want {
@@ -1424,7 +1430,7 @@ func TestInvalidBiasedThresholdStopsTheStartSayingWhatIsWrong(t *testing.T) {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+			_, err := config.FromEnvironment(environment{tc.name: tc.value}.viper())
 
 			want := tc.name + ": " + tc.want
 			if err == nil || err.Error() != want {
@@ -1442,7 +1448,7 @@ const (
 	asnURL  = "https://lists.example/asn.txt"
 )
 
-// The actions of SWW_BLOCKLIST_ACTION, as Config gives them.
+// The actions of SWW_WAF_BLOCKLIST_ACTION, as Config gives them.
 const (
 	actionDeny  = "deny"
 	actionLimit = "limit"
@@ -1521,7 +1527,7 @@ func TestInvalidReputationSettingStopsTheStartSayingWhatIsWrong(t *testing.T) {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+			_, err := config.FromEnvironment(environment{tc.name: tc.value}.viper())
 
 			want := tc.name + ": " + tc.want
 			if err == nil || err.Error() != want {
@@ -1536,9 +1542,9 @@ func TestASNLimitPercentURLThatIsABlocklistStopsTheStart(t *testing.T) {
 
 	_, err := config.FromEnvironment(environment{
 		blocklistURLs: dropURL + "," + asnURL, asnLimitPercentURL: asnURL,
-	}.lookupEnv)
+	}.viper())
 
-	want := asnLimitPercentURL + `: "` + asnURL + `" is in SWW_BLOCKLIST_URLS too`
+	want := asnLimitPercentURL + `: "` + asnURL + `" is in SWW_WAF_BLOCKLIST_URLS too`
 	if err == nil || err.Error() != want {
 		t.Errorf("error %v, want %s", err, want)
 	}
@@ -1663,7 +1669,7 @@ func TestInvalidDNSBLSettingStopsTheStartSayingWhatIsWrong(t *testing.T) {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+			_, err := config.FromEnvironment(environment{tc.name: tc.value}.viper())
 
 			want := tc.name + ": " + tc.want
 			if err == nil || err.Error() != want {
@@ -1731,7 +1737,7 @@ func TestDNSBLZoneKeyIsLoggedMaskedAndNeverShown(t *testing.T) {
 		{spamhaus + "," + otherZone, `"` + spamhausMasked + `" is listed twice`},
 		{spamhaus + ",,", "has an empty item in its list"},
 	} {
-		_, err := config.FromEnvironment(environment{dnsblZones: tc.value}.lookupEnv)
+		_, err := config.FromEnvironment(environment{dnsblZones: tc.value}.viper())
 
 		want := dnsblZones + ": " + tc.want
 		if err == nil || err.Error() != want {
@@ -1784,7 +1790,7 @@ func TestInvalidAbuseIPDBSettingStopsTheStartSayingWhatIsWrong(t *testing.T) {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+			_, err := config.FromEnvironment(environment{tc.name: tc.value}.viper())
 
 			want := tc.name + ": " + tc.want
 			if err == nil || err.Error() != want {
@@ -1841,7 +1847,7 @@ func TestInvalidCrowdSecSettingStopsTheStartSayingWhatIsWrong(t *testing.T) {
 		notLAPIURL = " is not an http or https URL without a user or a fragment, " +
 			"such as http://172.17.0.1:8080"
 		anotherList = `gives the decision list "` + lapi + `/v1/decisions", which is in ` +
-			`SWW_BLOCKLIST_URLS or is SWW_ASN_LIMIT_PERCENT_URL too`
+			`SWW_WAF_BLOCKLIST_URLS or is SWW_WAF_ASN_LIMIT_PERCENT_URL too`
 	)
 
 	for _, tc := range []struct {
@@ -1898,7 +1904,7 @@ func TestInvalidCrowdSecSettingStopsTheStartSayingWhatIsWrong(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(tc.env.lookupEnv)
+			_, err := config.FromEnvironment(tc.env.viper())
 			if err == nil || err.Error() != tc.want {
 				t.Errorf("error %v, want %s", err, tc.want)
 			}
@@ -2058,7 +2064,7 @@ func wantStartStopped(t *testing.T, invalid []struct{ name, value string }) {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+			_, err := config.FromEnvironment(environment{tc.name: tc.value}.viper())
 			if err == nil {
 				t.Fatalf("%s=%q was accepted", tc.name, tc.value)
 			}
@@ -2083,7 +2089,7 @@ func TestHostOrTransferEncodingStopsTheStart(t *testing.T) {
 		t.Run(value, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(environment{logRequestHeaders: value}.lookupEnv)
+			_, err := config.FromEnvironment(environment{logRequestHeaders: value}.viper())
 			if err == nil || err.Error() != logRequestHeaders+": "+want {
 				t.Errorf("error %v, want %s: %s", err, logRequestHeaders, want)
 			}
@@ -2100,7 +2106,7 @@ func TestShortTokenStopsTheStartWithoutShowingIt(t *testing.T) {
 			t.Run(name+"="+value, func(t *testing.T) {
 				t.Parallel()
 
-				_, err := config.FromEnvironment(environment{name: value}.lookupEnv)
+				_, err := config.FromEnvironment(environment{name: value}.viper())
 
 				want := name + ": is shorter than 32 characters"
 				if err == nil || err.Error() != want {
@@ -2156,7 +2162,7 @@ func TestSettingFromFileIsCheckedAsTheSettingItself(t *testing.T) {
 
 	_, err := config.FromEnvironment(environment{
 		bytesLimitPerMinute + "_FILE": writeFile(t, "lots\n"),
-	}.lookupEnv)
+	}.viper())
 
 	want := bytesLimitPerMinute + `: "lots" is not a size such as 512K, 100M or 5G, or off`
 	if err == nil || err.Error() != want {
@@ -2167,7 +2173,7 @@ func TestSettingFromFileIsCheckedAsTheSettingItself(t *testing.T) {
 		logRemoteURL:               remoteURL,
 		instanceName:               instance,
 		logRemoteAppName + "_FILE": writeFile(t, "my app\n"),
-	}.lookupEnv)
+	}.viper())
 
 	want = logRemoteAppName + `: "my app" is not 1 to 48 printable ASCII ` +
 		`characters without a space, such as blog`
@@ -2182,7 +2188,7 @@ func TestSettingAndItsFileBothSetStopsTheStart(t *testing.T) {
 	_, err := config.FromEnvironment(environment{
 		metricsToken:           token,
 		metricsToken + "_FILE": writeFile(t, token),
-	}.lookupEnv)
+	}.viper())
 
 	want := metricsToken + ": is set, and so is " + metricsToken +
 		"_FILE; set only one of them"
@@ -2197,7 +2203,7 @@ func TestUnreadableSettingFileStopsTheStart(t *testing.T) {
 	dir := t.TempDir()
 
 	for _, path := range []string{filepath.Join(dir, "missing"), dir} {
-		_, err := config.FromEnvironment(environment{metricsToken + "_FILE": path}.lookupEnv)
+		_, err := config.FromEnvironment(environment{metricsToken + "_FILE": path}.viper())
 
 		want := metricsToken + "_FILE: cannot be read: "
 		if err == nil || !strings.HasPrefix(err.Error(), want) {

internal/config/rproxy.go

@@ -8,38 +8,39 @@ import (
 	"net/netip"
 	"net/url"
 	"strconv"
-	"strings"
 	"time"
+
+	"github.com/spf13/viper"
 )
 
 // RProxy is the settings of `sww rproxy`. A size or time limit of zero
 // is off.
 type RProxy struct {
-	// ListenAddr is where rproxy listens (SWRP_LISTEN_ADDR).
+	// ListenAddr is where rproxy listens (SWW_RPROXY_LISTEN_ADDR).
 	ListenAddr string
-	// UpstreamURL is the app (SWRP_UPSTREAM_URL).
+	// UpstreamURL is the app (SWW_RPROXY_UPSTREAM_URL).
 	UpstreamURL *url.URL
 	// TrustedProxies are the netblocks whose X-Forwarded-For is believed
-	// (SWRP_TRUSTED_PROXIES).
+	// (SWW_RPROXY_TRUSTED_PROXIES).
 	TrustedProxies []netip.Prefix
-	// WAFBackend is discriminator's URL (SWRP_WAF_BACKEND).
+	// WAFBackend is discriminator's URL (SWW_RPROXY_WAF_BACKEND).
 	WAFBackend *url.URL
 	// Timeout is how long rproxy waits for discriminator's answer to a question,
-	// and to a report (SWRP_TIMEOUT_MS). It cannot be off.
+	// and to a report (SWW_RPROXY_TIMEOUT_MS). It cannot be off.
 	Timeout time.Duration
 	// DefaultDisposition is what is done with a request when discriminator cannot be
 	// connected to, does not answer at all, or does not answer within Timeout:
-	// allow or deny (SWRP_DEFAULT_DISPOSITION).
+	// allow or deny (SWW_RPROXY_DEFAULT_DISPOSITION).
 	DefaultDisposition string
-	// MaxRequestSize is the largest request body (SWRP_MAX_REQUEST_SIZE), and
-	// MaxResponseSize the largest response body (SWRP_MAX_RESPONSE_SIZE).
+	// MaxRequestSize is the largest request body (SWW_RPROXY_MAX_REQUEST_SIZE), and
+	// MaxResponseSize the largest response body (SWW_RPROXY_MAX_RESPONSE_SIZE).
 	MaxRequestSize  int64
 	MaxResponseSize int64
 	// MaxRequestTime bounds sending the whole request: the visitor's request
 	// line and headers, and then, from their end, its body on its way to the
-	// app (SWRP_MAX_REQUEST_TIME_MS). MaxResponseTime bounds the answer, from
+	// app (SWW_RPROXY_MAX_REQUEST_TIME_MS). MaxResponseTime bounds the answer, from
 	// the end of the request to its last byte reaching the visitor
-	// (SWRP_MAX_RESPONSE_TIME_MS).
+	// (SWW_RPROXY_MAX_RESPONSE_TIME_MS).
 	MaxRequestTime  time.Duration
 	MaxResponseTime time.Duration
 
@@ -58,24 +59,26 @@ var (
 		"is not a whole number of milliseconds above zero, such as 60000, or off")
 )
 
-// RProxyFromEnvironment reads rproxy's settings with lookupEnv, normally
-// os.LookupEnv. A setting that is not set takes its default, and
-// SWRP_WAF_BACKEND, which has none, must be set. A setting that is set but
-// invalid is an error that names it. Since rproxy never touches disk, its
-// settings have no _FILE form.
-func RProxyFromEnvironment(lookupEnv func(string) (string, bool)) (*RProxy, error) {
-	env := &environment{lookupEnv: withoutFileForms(lookupEnv)}
+// RProxyFromEnvironment reads rproxy's settings through v, normally the viper
+// NewViper returns, bound to the process's environment. A setting that is not
+// set takes its default, and SWW_RPROXY_WAF_BACKEND, which has none, must be
+// set. A setting may instead be given as a file: the variable named by the
+// setting's name with _FILE added names the file, which is read now. A setting
+// that is set but invalid is an error that names it.
+func RProxyFromEnvironment(v *viper.Viper) (*RProxy, error) {
+	env := &environment{v: v, readFiles: true}
 	cfg := &RProxy{
-		ListenAddr:         env.address("SWRP_LISTEN_ADDR"),
-		UpstreamURL:        env.appURL("SWRP_UPSTREAM_URL", defaultUpstreamURL),
-		TrustedProxies:     env.netblocks("SWRP_TRUSTED_PROXIES", privateRanges),
-		WAFBackend:         env.wafBackend("SWRP_WAF_BACKEND"),
-		Timeout:            env.milliseconds("SWRP_TIMEOUT_MS", "2000"),
-		DefaultDisposition: env.disposition("SWRP_DEFAULT_DISPOSITION", "allow"),
-		MaxRequestSize:     env.size("SWRP_MAX_REQUEST_SIZE", "100M"),
-		MaxResponseSize:    env.size("SWRP_MAX_RESPONSE_SIZE", "1G"),
-		MaxRequestTime:     env.millisecondsOrOff("SWRP_MAX_REQUEST_TIME_MS", "60000"),
-		MaxResponseTime:    env.millisecondsOrOff("SWRP_MAX_RESPONSE_TIME_MS", "1800000"),
+		ListenAddr:         env.address("SWW_RPROXY_LISTEN_ADDR"),
+		UpstreamURL:        env.appURL("SWW_RPROXY_UPSTREAM_URL", defaultUpstreamURL),
+		TrustedProxies:     env.netblocks("SWW_RPROXY_TRUSTED_PROXIES", privateRanges),
+		WAFBackend:         env.wafBackend("SWW_RPROXY_WAF_BACKEND"),
+		Timeout:            env.milliseconds("SWW_RPROXY_TIMEOUT_MS", "2000"),
+		DefaultDisposition: env.disposition("SWW_RPROXY_DEFAULT_DISPOSITION", "allow"),
+		MaxRequestSize:     env.size("SWW_RPROXY_MAX_REQUEST_SIZE", "100M"),
+		MaxResponseSize:    env.size("SWW_RPROXY_MAX_RESPONSE_SIZE", "1G"),
+		MaxRequestTime:     env.millisecondsOrOff("SWW_RPROXY_MAX_REQUEST_TIME_MS", "60000"),
+		MaxResponseTime: env.millisecondsOrOff(
+			"SWW_RPROXY_MAX_RESPONSE_TIME_MS", "1800000"),
 	}
 
 	if env.err != nil {
@@ -87,15 +90,15 @@ func RProxyFromEnvironment(lookupEnv func(string) (string, bool)) (*RProxy, erro
 	return cfg, nil
 }
 
-// RProxyListenAddrAndUpstreamURL reads only SWRP_LISTEN_ADDR and
-// SWRP_UPSTREAM_URL. The health check in rproxy's container needs no other
+// RProxyListenAddrAndUpstreamURL reads only SWW_RPROXY_LISTEN_ADDR and
+// SWW_RPROXY_UPSTREAM_URL. The health check in rproxy's container needs no other
 // setting, so it reads no other.
 func RProxyListenAddrAndUpstreamURL(
-	lookupEnv func(string) (string, bool),
+	v *viper.Viper,
 ) (string, *url.URL, error) {
-	env := &environment{lookupEnv: withoutFileForms(lookupEnv)}
-	listenAddr := env.address("SWRP_LISTEN_ADDR")
-	upstreamURL := env.appURL("SWRP_UPSTREAM_URL", defaultUpstreamURL)
+	env := &environment{v: v, readFiles: true}
+	listenAddr := env.address("SWW_RPROXY_LISTEN_ADDR")
+	upstreamURL := env.appURL("SWW_RPROXY_UPSTREAM_URL", defaultUpstreamURL)
 
 	if env.err != nil {
 		return "", nil, env.err
@@ -104,20 +107,6 @@ func RProxyListenAddrAndUpstreamURL(
 	return listenAddr, upstreamURL, nil
 }
 
-// withoutFileForms returns lookupEnv finding no setting named with _FILE, since
-// rproxy never touches disk.
-func withoutFileForms(
-	lookupEnv func(string) (string, bool),
-) func(string) (string, bool) {
-	return func(name string) (string, bool) {
-		if strings.HasSuffix(name, "_FILE") {
-			return "", false
-		}
-
-		return lookupEnv(name)
-	}
-}
-
 // LogValue makes an RProxy log as each setting's name with the value it was
 // given, or its default.
 func (c *RProxy) LogValue() slog.Value {

internal/config/rproxy_test.go

@@ -9,21 +9,23 @@ import (
 	"testing"
 	"time"
 
+	"github.com/spf13/viper"
+
 	"sneak.berlin/go/smallwebwaf/internal/config"
 )
 
 // rproxy's settings, by name, and their values in these tests.
 const (
-	wafBackend        = "SWRP_WAF_BACKEND"
-	rproxyTimeout     = "SWRP_TIMEOUT_MS"
-	rproxyDefault     = "SWRP_DEFAULT_DISPOSITION"
-	rproxyListen      = "SWRP_LISTEN_ADDR"
-	rproxyUpstream    = "SWRP_UPSTREAM_URL"
-	rproxyTrusted     = "SWRP_TRUSTED_PROXIES"
-	rproxyMaxRequest  = "SWRP_MAX_REQUEST_SIZE"
-	rproxyMaxResponse = "SWRP_MAX_RESPONSE_SIZE"
-	rproxyRequestTime = "SWRP_MAX_REQUEST_TIME_MS"
-	rproxyAnswerTime  = "SWRP_MAX_RESPONSE_TIME_MS"
+	wafBackend        = "SWW_RPROXY_WAF_BACKEND"
+	rproxyTimeout     = "SWW_RPROXY_TIMEOUT_MS"
+	rproxyDefault     = "SWW_RPROXY_DEFAULT_DISPOSITION"
+	rproxyListen      = "SWW_RPROXY_LISTEN_ADDR"
+	rproxyUpstream    = "SWW_RPROXY_UPSTREAM_URL"
+	rproxyTrusted     = "SWW_RPROXY_TRUSTED_PROXIES"
+	rproxyMaxRequest  = "SWW_RPROXY_MAX_REQUEST_SIZE"
+	rproxyMaxResponse = "SWW_RPROXY_MAX_RESPONSE_SIZE"
+	rproxyRequestTime = "SWW_RPROXY_MAX_REQUEST_TIME_MS"
+	rproxyAnswerTime  = "SWW_RPROXY_MAX_RESPONSE_TIME_MS"
 	backendURL        = "http://discriminator:8080"
 	rproxyDefaultAddr = ":8080"
 	rproxyDefaultApp  = "http://127.0.0.1:8081"
@@ -32,11 +34,12 @@ const (
 
 // rproxyConfig reads rproxy's settings from env.
 func rproxyConfig(env map[string]string) (*config.RProxy, error) {
-	return config.RProxyFromEnvironment(func(name string) (string, bool) {
-		value, ok := env[name]
+	v := viper.New()
+	for name, value := range env {
+		v.Set(name, value)
+	}
 
-		return value, ok
-	})
+	return config.RProxyFromEnvironment(v)
 }
 
 func TestRProxyDefaults(t *testing.T) {
@@ -177,31 +180,41 @@ func TestRProxyNeedsItsBackend(t *testing.T) {
 	}
 }
 
-func TestRProxyReadsNoFile(t *testing.T) {
+func TestRProxySettingReadFromFile(t *testing.T) {
 	t.Parallel()
 
 	path := filepath.Join(t.TempDir(), "backend")
 
-	err := os.WriteFile(path, []byte("http://from-a-file:8080\n"), 0o600)
+	err := os.WriteFile(path, []byte(backendURL+"\n"), 0o600)
 	if err != nil {
 		t.Fatalf("write: %v", err)
 	}
 
-	_, err = rproxyConfig(map[string]string{wafBackend + "_FILE": path})
-	if err == nil || !strings.HasPrefix(err.Error(), wafBackend+": is required") {
-		t.Errorf("error %v, want %s still required", err, wafBackend)
-	}
-
-	cfg, err := rproxyConfig(map[string]string{
-		wafBackend:              backendURL,
-		rproxyTimeout + "_FILE": "/nonexistent/timeout",
-	})
+	cfg, err := rproxyConfig(map[string]string{wafBackend + "_FILE": path})
 	if err != nil {
-		t.Fatalf("settings: %v, with the file left unread", err)
+		t.Fatalf("settings: %v", err)
 	}
 
-	if cfg.Timeout != 2*time.Second {
-		t.Errorf("timeout %v, want the default", cfg.Timeout)
+	if cfg.WAFBackend.String() != backendURL {
+		t.Errorf("backend %v, want %s", cfg.WAFBackend, backendURL)
+	}
+}
+
+func TestRProxyUnreadableSettingFileStopsTheStart(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+
+	for _, path := range []string{filepath.Join(dir, "missing"), dir} {
+		_, err := rproxyConfig(map[string]string{
+			wafBackend:              backendURL,
+			rproxyTimeout + "_FILE": path,
+		})
+
+		want := rproxyTimeout + "_FILE: cannot be read: "
+		if err == nil || !strings.HasPrefix(err.Error(), want) {
+			t.Errorf("%s: error %v, want one starting %s", path, err, want)
+		}
 	}
 }
 

internal/config/viper.go

@@ -0,0 +1,16 @@
+package config
+
+import "github.com/spf13/viper"
+
+// NewViper returns the viper that reads the settings: each setting's
+// environment variable, bound to its own name. Every setting of discriminator
+// and rproxy is read through it, and none is read with os.Getenv or
+// os.LookupEnv outside it. An environment variable that is set but empty is
+// set, as one that holds a value is, which viper does not take for granted.
+func NewViper() *viper.Viper {
+	v := viper.New()
+	v.AutomaticEnv()
+	v.AllowEmptyEnv(true)
+
+	return v
+}

internal/discriminator/admin.go

@@ -51,7 +51,7 @@ func (rq *request) answerHealth() {
 
 // answerAdmin answers a request for one of discriminator's own endpoints. Each
 // needs a token, sent as Authorization: Bearer <token>: the metrics
-// SWW_METRICS_TOKEN, the others SWW_ADMIN_TOKEN. A request without it is
+// SWW_WAF_METRICS_TOKEN, the others SWW_WAF_ADMIN_TOKEN. A request without it is
 // refused with 401. An endpoint whose token is unset answers 404, as any other
 // path does.
 func (rq *request) answerAdmin() {

internal/discriminator/admin_test.go

@@ -17,8 +17,8 @@ import (
 )
 
 const (
-	adminToken = "SWW_ADMIN_TOKEN" //nolint:gosec // the setting's name
-	// adminSecret is the SWW_ADMIN_TOKEN the tests set, and adminBearer
+	adminToken = "SWW_WAF_ADMIN_TOKEN" //nolint:gosec // the setting's name
+	// adminSecret is the SWW_WAF_ADMIN_TOKEN the tests set, and adminBearer
 	// how a request carries it.
 	adminSecret = "fedcba9876543210fedcba9876543210"
 	adminBearer = "Bearer " + adminSecret
@@ -337,12 +337,12 @@ func TestAdminEndpointsNeedTheTokenInObserveMode(t *testing.T) {
 	}
 }
 
-// adminEndpoint is a request to an endpoint SWW_ADMIN_TOKEN opens.
+// adminEndpoint is a request to an endpoint SWW_WAF_ADMIN_TOKEN opens.
 type adminEndpoint struct {
 	method, path, body string
 }
 
-// adminEndpoints returns a request to each endpoint SWW_ADMIN_TOKEN
+// adminEndpoints returns a request to each endpoint SWW_WAF_ADMIN_TOKEN
 // opens: listing the bans, banning otherClient for an hour, lifting the
 // bans on otherClient, and asking about otherClient.
 func adminEndpoints() []adminEndpoint {

internal/discriminator/alerts_test.go

@@ -15,8 +15,8 @@ import (
 )
 
 const (
-	alertWebhookURL = "SWW_ALERT_WEBHOOK_URL"
-	alertMaxPerHour = "SWW_ALERT_MAX_PER_HOUR"
+	alertWebhookURL = "SWW_WAF_ALERT_WEBHOOK_URL"
+	alertMaxPerHour = "SWW_WAF_ALERT_MAX_PER_HOUR"
 	// alertInstance is the instance every alert of these tests gives.
 	alertInstance = "fsn1app1/blog"
 )

internal/discriminator/anomaly_test.go

@@ -21,11 +21,11 @@ import (
 // The anomaly thresholds: the prefix of a scope followed by the end of a
 // count.
 const (
-	anomalyClient = "SWW_ANOMALY_CLIENT_"
-	anomalyNet    = "SWW_ANOMALY_NET_"
-	anomalyASN    = "SWW_ANOMALY_ASN_"
-	anomalyTotal  = "SWW_ANOMALY_TOTAL_"
-	anomalyWatch  = "SWW_WATCH_"
+	anomalyClient = "SWW_WAF_ANOMALY_CLIENT_"
+	anomalyNet    = "SWW_WAF_ANOMALY_NET_"
+	anomalyASN    = "SWW_WAF_ANOMALY_ASN_"
+	anomalyTotal  = "SWW_WAF_ANOMALY_TOTAL_"
+	anomalyWatch  = "SWW_WAF_WATCH_"
 
 	requestsPerMinute = "REQUESTS_PER_MINUTE"
 	requestsPerHour   = "REQUESTS_PER_HOUR"
@@ -35,9 +35,9 @@ const (
 
 // The other anomaly settings.
 const (
-	anomalyNetV4Prefix = "SWW_ANOMALY_NET_V4_PREFIX"
-	anomalyNetV6Prefix = "SWW_ANOMALY_NET_V6_PREFIX"
-	watchNets          = "SWW_WATCH_NETS"
+	anomalyNetV4Prefix = "SWW_WAF_ANOMALY_NET_V4_PREFIX"
+	anomalyNetV6Prefix = "SWW_WAF_ANOMALY_NET_V6_PREFIX"
+	watchNets          = "SWW_WAF_WATCH_NETS"
 )
 
 const (
@@ -164,9 +164,9 @@ func TestEveryRequestIsCountedWhateverIsDoneWithIt(t *testing.T) {
 	t.Parallel()
 
 	const (
-		allowed = "192.0.2.7"  // in SWW_ALLOW_NETS
-		exempt  = "192.0.2.10" // in SWW_RATE_LIMIT_EXEMPT_NETS
-		denied  = "192.0.2.20" // in SWW_DENY_NETS
+		allowed = "192.0.2.7"  // in SWW_WAF_ALLOW_NETS
+		exempt  = "192.0.2.10" // in SWW_WAF_RATE_LIMIT_EXEMPT_NETS
+		denied  = "192.0.2.20" // in SWW_WAF_DENY_NETS
 	)
 
 	s, _, _, queue := startAppWithAlerts(t, readAndAnswer, map[string]string{

internal/discriminator/answertime_test.go

@@ -23,10 +23,10 @@ import (
 )
 
 const (
-	// answerTimeLimit is the default of rproxy's SWRP_TIMEOUT_MS, the time
+	// answerTimeLimit is the default of rproxy's SWW_RPROXY_TIMEOUT_MS, the time
 	// discriminator has to answer.
 	answerTimeLimit = 2 * time.Second
-	// defaultLookupWait is the default of SWW_LOOKUP_TIMEOUT.
+	// defaultLookupWait is the default of SWW_WAF_LOOKUP_TIMEOUT.
 	defaultLookupWait = 800 * time.Millisecond
 	// The header limits SPEC.md gives.
 	cookieLimit      = 50
@@ -166,7 +166,7 @@ func TestHeaderLimitsHoldWhateverTheCoreRuleSetSettingsSay(t *testing.T) {
 	for _, env := range []map[string]string{
 		{wafMode: off},
 		{wafMode: "detect"},
-		{wafMode: block, "SWW_WAF_EXEMPT_PATHS": "/"},
+		{wafMode: block, "SWW_WAF_CORE_RULE_SET_EXEMPT_PATHS": "/"},
 	} {
 		t.Run(fmt.Sprint(env), func(t *testing.T) {
 			t.Parallel()
@@ -399,7 +399,7 @@ func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) {
 		action string
 	}{
 		{
-			name: "SWW_DENY_NETS", env: map[string]string{denyNets: client},
+			name: "SWW_WAF_DENY_NETS", env: map[string]string{denyNets: client},
 			prepare: leaveAsItIs, status: forbidden, action: requestlog.ActionDenied,
 		},
 		{

internal/discriminator/bans.go

@@ -12,7 +12,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 
-// banResponse is a refusal answered with SWW_BAN_RESPONSE, and logged
+// banResponse is a refusal answered with SWW_WAF_BAN_RESPONSE, and logged
 // with action.
 func (rq *request) banResponse(action string) *refusal {
 	return &refusal{status: rq.h.config.BanResponse, action: action}
@@ -85,8 +85,8 @@ func (rq *request) countBytes() {
 // countRefusal counts the request for the error burst once it has been
 // answered, if discriminator refused it after a rule file match, a trap path or a
 // Core Rule Set match, and in observe mode if enforce mode would have: more than
-// SWW_ERROR_BURST_THRESHOLD such refusals of the client within a minute
-// break a limit. A client in SWW_ALLOW_NETS, which the checks skip, is
+// SWW_WAF_ERROR_BURST_THRESHOLD such refusals of the client within a minute
+// break a limit. A client in SWW_WAF_ALLOW_NETS, which the checks skip, is
 // not counted, and nothing is while the threshold is off.
 func (rq *request) countRefusal() {
 	cfg := rq.h.config
@@ -121,7 +121,7 @@ func (rq *request) countRefusal() {
 
 // countedBytes returns the request's bytes, once it has ended, as the
 // byte limits and the anomaly thresholds count them: the response's body
-// bytes, the request's, or both, as SWW_BYTES_COUNT says.
+// bytes, the request's, or both, as SWW_WAF_BYTES_COUNT says.
 func (rq *request) countedBytes() int64 {
 	response, request := rq.out.bytes, rq.requestBytes
 
@@ -138,7 +138,7 @@ func (rq *request) countedBytes() int64 {
 // banForLimit bans the client's netblock at now for a broken limit, the
 // one hit names, notes the offence for the log line and counts the hit in
 // the metrics. status is what the client was sent, or is sent:
-// SWW_BAN_RESPONSE for a request over a rate limit, what the report says for
+// SWW_WAF_BAN_RESPONSE for a request over a rate limit, what the report says for
 // one whose bytes broke a byte limit, the refusal for one that broke the
 // error burst. The ban's notes give the client's limit percentage for a
 // rate limit or a byte limit; the error burst is not lowered. The ban sets
@@ -277,7 +277,7 @@ func (rq *request) banForCrowdSec(now time.Time, decision reputation.Decision) {
 // wouldAlertBan reports whether the alert for a ban on netblock for cause
 // made at now would be sent. In observe mode the ban the request would
 // have made is worked out only then, at most once per
-// SWW_ALERT_COOLDOWN and never with no webhook set: its notes count the
+// SWW_WAF_ALERT_COOLDOWN and never with no webhook set: its notes count the
 // netblock's requests, which can mean going through every client.
 func (rq *request) wouldAlertBan(
 	netblock netip.Prefix, now time.Time, cause string,
@@ -343,7 +343,7 @@ func (rq *request) netblockRequests(netblock netip.Prefix) int64 {
 }
 
 // netblock is the netblock a ban on client covers: its IPv4 address,
-// widened to SWW_BAN_SCOPE_V4_PREFIX, or the IPv6 group clientGroup
+// widened to SWW_WAF_BAN_SCOPE_V4_PREFIX, or the IPv6 group clientGroup
 // counts it in.
 func (h *handler) netblock(client netip.Addr) netip.Prefix {
 	addr := client.Unmap()

internal/discriminator/bans_test.go

@@ -26,7 +26,7 @@ const (
 	userAgent = "ban-test/1.0"
 	// permanent is the log line's ban_expires for a permanent ban.
 	permanent = "permanent"
-	// banResponseClose is the SWW_BAN_RESPONSE that closes the connection.
+	// banResponseClose is the SWW_WAF_BAN_RESPONSE that closes the connection.
 	banResponseClose = "close"
 )
 
@@ -89,19 +89,19 @@ func TestBanLengthsFollowTheSettings(t *testing.T) {
 		}
 	}
 
-	// A first ban lasts SWW_LIMIT_BAN_DURATION; one within
-	// SWW_LIMIT_BAN_REPEAT_WINDOW after it ended, three times as long.
+	// A first ban lasts SWW_WAF_LIMIT_BAN_DURATION; one within
+	// SWW_WAF_LIMIT_BAN_REPEAT_WINDOW after it ended, three times as long.
 	wantExpires(breakLimit(), 10*time.Minute)
 	clk.advance(10*time.Minute + time.Hour)
 	wantExpires(breakLimit(), 30*time.Minute)
 
-	// Later than that, SWW_LIMIT_BAN_DURATION again.
+	// Later than that, SWW_WAF_LIMIT_BAN_DURATION again.
 	clk.advance(30*time.Minute + time.Hour + time.Second)
 	wantExpires(breakLimit(), 10*time.Minute)
 	clk.advance(10 * time.Minute)
 	wantExpires(breakLimit(), 30*time.Minute)
 
-	// 90 minutes would be longer than SWW_MAX_BAN_DURATION: the ban is
+	// 90 minutes would be longer than SWW_WAF_MAX_BAN_DURATION: the ban is
 	// permanent.
 	clk.advance(30 * time.Minute)
 
@@ -148,8 +148,8 @@ func TestBanCoversTheClientsNetblock(t *testing.T) {
 
 	// In the IPv4 cases, client breaks the limit; these two are next to it.
 	const (
-		allowed = "203.0.113.60" // in SWW_ALLOW_NETS
-		exempt  = "203.0.113.50" // in SWW_RATE_LIMIT_EXEMPT_NETS
+		allowed = "203.0.113.60" // in SWW_WAF_ALLOW_NETS
+		exempt  = "203.0.113.50" // in SWW_WAF_RATE_LIMIT_EXEMPT_NETS
 	)
 
 	for _, tc := range []struct {
@@ -164,7 +164,7 @@ func TestBanCoversTheClientsNetblock(t *testing.T) {
 			nil, []string{otherClient, exempt},
 		},
 		{
-			"the IPv4 netblock SWW_BAN_SCOPE_V4_PREFIX sets",
+			"the IPv4 netblock SWW_WAF_BAN_SCOPE_V4_PREFIX sets",
 			map[string]string{banScopeV4Prefix: "24"}, client,
 			[]string{otherClient, exempt}, []string{"203.0.112.9", allowed},
 		},
@@ -173,7 +173,7 @@ func TestBanCoversTheClientsNetblock(t *testing.T) {
 			[]string{"2001:db8:5::ffff:1"}, []string{"2001:db8:5:1::1"},
 		},
 		{
-			"the IPv6 netblock SWW_IPV6_GROUP_PREFIX sets",
+			"the IPv6 netblock SWW_WAF_IPV6_GROUP_PREFIX sets",
 			map[string]string{ipv6GroupPrefix: "48"}, "2001:db8:7::1",
 			[]string{"2001:db8:7:ffff::1"}, []string{"2001:db8:8::1"},
 		},
@@ -231,10 +231,10 @@ func TestBannedClientIsRefusedBeforeItsCountryIsLookedUp(t *testing.T) {
 func TestBanResponseAnswersEveryRefusalButTheSizeLimits(t *testing.T) {
 	t.Parallel()
 
-	const denied = "192.0.2.50" // in SWW_DENY_NETS
+	const denied = "192.0.2.50" // in SWW_WAF_DENY_NETS
 
 	for _, tc := range []struct {
-		setting string // "" leaves SWW_BAN_RESPONSE at its default
+		setting string // "" leaves SWW_WAF_BAN_RESPONSE at its default
 		status  int    // 0 is the connection closed without an answer
 	}{
 		{"", http.StatusForbidden},

internal/discriminator/biased.go

@@ -18,7 +18,7 @@ type percentage struct {
 
 // biasedThresholdsSet reports whether a biased threshold can lower a
 // client's limits: one of its lists is not empty,
-// SWW_UNKNOWN_LIMIT_PERCENT is below 100, or SWW_ASN_LIMIT_PERCENT_URL
+// SWW_WAF_UNKNOWN_LIMIT_PERCENT is below 100, or SWW_WAF_ASN_LIMIT_PERCENT_URL
 // is set. The client's lookup is then needed before its request goes on.
 func biasedThresholdsSet(cfg *config.Config) bool {
 	return len(cfg.ASNLimitPercent) > 0 || len(cfg.CountryLimitPercent) > 0 ||
@@ -31,15 +31,15 @@ func biasedThresholdsSet(cfg *config.Config) bool {
 // up, each "" when unknown, and the blocklists, DNSBL zones and AbuseIPDB
 // that list it. Each is the lowest of those the settings give it, the
 // first of them in the order below when several are lowest: the
-// percentage SWW_ASN_LIMIT_PERCENT gives its AS number, the one the file
-// SWW_ASN_LIMIT_PERCENT_URL names gives it, the one
-// SWW_COUNTRY_LIMIT_PERCENT gives its country, for a client without a
+// percentage SWW_WAF_ASN_LIMIT_PERCENT gives its AS number, the one the file
+// SWW_WAF_ASN_LIMIT_PERCENT_URL names gives it, the one
+// SWW_WAF_COUNTRY_LIMIT_PERCENT gives its country, for a client without a
 // country, unless its request skipped the wait for GeoJS,
-// SWW_UNKNOWN_LIMIT_PERCENT, for a client a blocklist lists, the
-// percentage of SWW_BLOCKLIST_ACTION while it is limit, and for a client
+// SWW_WAF_UNKNOWN_LIMIT_PERCENT, for a client a blocklist lists, the
+// percentage of SWW_WAF_BLOCKLIST_ACTION while it is limit, and for a client
 // a DNSBL zone's verdict lists, or whose AbuseIPDB score is a hit, the
-// percentage of SWW_REPUTATION_ACTION while it is limit. For the byte
-// limits, SWW_ASN_BYTES_PERCENT and SWW_COUNTRY_BYTES_PERCENT take the
+// percentage of SWW_WAF_REPUTATION_ACTION while it is limit. For the byte
+// limits, SWW_WAF_ASN_BYTES_PERCENT and SWW_WAF_COUNTRY_BYTES_PERCENT take the
 // place of the first three for an AS number or a country they list.
 func (rq *request) limitPercentages() (percentage, percentage) {
 	cfg := rq.h.config
@@ -47,36 +47,37 @@ func (rq *request) limitPercentages() (percentage, percentage) {
 
 	unknown := percentage{percent: whole}
 	if country == "" && !rq.skippedLookupWait {
-		unknown = percentage{cfg.UnknownLimitPercent, "SWW_UNKNOWN_LIMIT_PERCENT"}
+		unknown = percentage{cfg.UnknownLimitPercent, "SWW_WAF_UNKNOWN_LIMIT_PERCENT"}
 	}
 
 	fetched := percentage{percent: whole}
 	if percent, listed := rq.h.lists.ASNLimitPercent(asn); listed {
-		fetched = percentage{percent, "SWW_ASN_LIMIT_PERCENT_URL"}
+		fetched = percentage{percent, "SWW_WAF_ASN_LIMIT_PERCENT_URL"}
 	}
 
 	blocklisted := percentage{percent: whole}
 	if rq.blocklisted && cfg.BlocklistAction == "limit" {
-		blocklisted = percentage{cfg.BlocklistLimitPercent, "SWW_BLOCKLIST_ACTION"}
+		blocklisted = percentage{cfg.BlocklistLimitPercent, "SWW_WAF_BLOCKLIST_ACTION"}
 	}
 
 	reputationListed := percentage{percent: whole}
 	if (rq.dnsblListed || rq.abuseIPDBHit) && cfg.ReputationAction == "limit" {
-		reputationListed = percentage{cfg.ReputationLimitPercent, "SWW_REPUTATION_ACTION"}
+		reputationListed = percentage{cfg.ReputationLimitPercent, "SWW_WAF_REPUTATION_ACTION"}
 	}
 
-	asnRequests := lowest(given(cfg.ASNLimitPercent, asn, "SWW_ASN_LIMIT_PERCENT"),
+	asnRequests := lowest(given(cfg.ASNLimitPercent, asn, "SWW_WAF_ASN_LIMIT_PERCENT"),
 		fetched)
 	countryRequests := given(cfg.CountryLimitPercent, country,
-		"SWW_COUNTRY_LIMIT_PERCENT")
+		"SWW_WAF_COUNTRY_LIMIT_PERCENT")
 
 	asnBytes, countryBytes := asnRequests, countryRequests
 	if _, listed := cfg.ASNBytesPercent[asn]; listed {
-		asnBytes = given(cfg.ASNBytesPercent, asn, "SWW_ASN_BYTES_PERCENT")
+		asnBytes = given(cfg.ASNBytesPercent, asn, "SWW_WAF_ASN_BYTES_PERCENT")
 	}
 
 	if _, listed := cfg.CountryBytesPercent[country]; listed {
-		countryBytes = given(cfg.CountryBytesPercent, country, "SWW_COUNTRY_BYTES_PERCENT")
+		countryBytes = given(cfg.CountryBytesPercent, country,
+			"SWW_WAF_COUNTRY_BYTES_PERCENT")
 	}
 
 	return lowest(asnRequests, countryRequests, unknown, blocklisted, reputationListed),

internal/discriminator/biased_test.go

@@ -22,11 +22,11 @@ import (
 
 // The biased thresholds.
 const (
-	asnLimitPercent     = "SWW_ASN_LIMIT_PERCENT"
-	countryLimitPercent = "SWW_COUNTRY_LIMIT_PERCENT"
-	asnBytesPercent     = "SWW_ASN_BYTES_PERCENT"
-	countryBytesPercent = "SWW_COUNTRY_BYTES_PERCENT"
-	unknownLimitPercent = "SWW_UNKNOWN_LIMIT_PERCENT"
+	asnLimitPercent     = "SWW_WAF_ASN_LIMIT_PERCENT"
+	countryLimitPercent = "SWW_WAF_COUNTRY_LIMIT_PERCENT"
+	asnBytesPercent     = "SWW_WAF_ASN_BYTES_PERCENT"
+	countryBytesPercent = "SWW_WAF_COUNTRY_BYTES_PERCENT"
+	unknownLimitPercent = "SWW_WAF_UNKNOWN_LIMIT_PERCENT"
 )
 
 const (
@@ -230,7 +230,7 @@ func TestLowestPercentageApplies(t *testing.T) {
 			noCountry, "25 from " + unknownLimitPercent,
 		},
 		{
-			// SWW_UNKNOWN_LIMIT_PERCENT is left at its default, 100.
+			// SWW_WAF_UNKNOWN_LIMIT_PERCENT is left at its default, 100.
 			"the AS number's, for a client without a country",
 			map[string]string{asnLimitPercent: "AS64500:25"},
 			noCountry, "25 from " + asnLimitPercent,
@@ -487,7 +487,7 @@ func wantPercent(t *testing.T, what string, percent *int64, setting, want string
 }
 
 // percentText gives a limit percentage and the setting that gave it as
-// text, such as "50 from SWW_ASN_LIMIT_PERCENT", or none when both are
+// text, such as "50 from SWW_WAF_ASN_LIMIT_PERCENT", or none when both are
 // left out.
 func percentText(percent *int64, setting string) string {
 	switch {

internal/discriminator/bytelimits_test.go

@@ -19,13 +19,13 @@ import (
 
 // The byte limit settings.
 const (
-	bytesLimitPerMinute = "SWW_BYTES_LIMIT_PER_MINUTE"
-	bytesLimitPerHour   = "SWW_BYTES_LIMIT_PER_HOUR"
-	bytesLimitPerDay    = "SWW_BYTES_LIMIT_PER_DAY"
-	bytesCount          = "SWW_BYTES_COUNT"
+	bytesLimitPerMinute = "SWW_WAF_BYTES_LIMIT_PER_MINUTE"
+	bytesLimitPerHour   = "SWW_WAF_BYTES_LIMIT_PER_HOUR"
+	bytesLimitPerDay    = "SWW_WAF_BYTES_LIMIT_PER_DAY"
+	bytesCount          = "SWW_WAF_BYTES_COUNT"
 )
 
-// The values of SWW_BYTES_COUNT.
+// The values of SWW_WAF_BYTES_COUNT.
 const (
 	countResponse = "response"
 	countRequest  = "request"
@@ -40,7 +40,7 @@ const (
 	// byteLimit is the byte limit these tests set, as a setting: a request
 	// with a body and its answer, 100 bytes, go over it.
 	byteLimit = "99"
-	// minuteBytes is limit_hit for SWW_BYTES_LIMIT_PER_MINUTE.
+	// minuteBytes is limit_hit for SWW_WAF_BYTES_LIMIT_PER_MINUTE.
 	minuteBytes = "minute_bytes"
 )
 
@@ -212,8 +212,8 @@ func TestByteLimitsLeaveOutWhatTheRateLimitsLeaveOut(t *testing.T) {
 	t.Parallel()
 
 	const (
-		allowed = "192.0.2.7"  // in SWW_ALLOW_NETS
-		exempt  = "192.0.2.10" // in SWW_RATE_LIMIT_EXEMPT_NETS
+		allowed = "192.0.2.7"  // in SWW_WAF_ALLOW_NETS
+		exempt  = "192.0.2.10" // in SWW_WAF_RATE_LIMIT_EXEMPT_NETS
 	)
 
 	s, _ := startWithAnswers(t, map[string]string{

internal/discriminator/client.go

@@ -43,7 +43,7 @@ func scheme(r *http.Request, isQuestion bool) string {
 
 // clientGroup is the client a request is counted toward: its IPv4
 // address, or its IPv6 group, the netblock its IPv6 address is in of the
-// length SWW_IPV6_GROUP_PREFIX sets, a /64 by default, since one abuser
+// length SWW_WAF_IPV6_GROUP_PREFIX sets, a /64 by default, since one abuser
 // usually holds a whole /64. An IPv4 address in IPv6 form counts as IPv4.
 func (h *handler) clientGroup(addr netip.Addr) netip.Prefix {
 	addr = addr.Unmap()

internal/discriminator/coreruleset.go

@@ -10,10 +10,11 @@ import (
 )
 
 // checkCoreRuleSet inspects the request with the Core Rule Set, unless
-// SWW_WAF_MODE is off or SWW_WAF_EXEMPT_PATHS exempts its path, as
+// SWW_WAF_CORE_RULE_SET_MODE is off or SWW_WAF_CORE_RULE_SET_EXEMPT_PATHS exempts its
+// path, as
 // pathExempt decides, and notes the rules it matched and its score in the
 // log line, and the rules in the metrics. A score at or over
-// SWW_WAF_ANOMALY_THRESHOLD is a match: it raises the waf_block alert,
+// SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD is a match: it raises the waf_block alert,
 // and in block mode refuses the request, which is an offence its client's
 // history counts, and so returns ActionWAFBlocked. It returns "" for a
 // request it does not refuse.
@@ -55,7 +56,7 @@ func (rq *request) checkCoreRuleSet() string {
 }
 
 // alertWAFBlock raises the waf_block alert for the request, which the Core
-// Rule Set scored at result, at or over SWW_WAF_ANOMALY_THRESHOLD. Its
+// Rule Set scored at result, at or over SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD. Its
 // detail gives the rule ids, the score, the method and the path with the
 // query, and, for a request that is not refused for it, the mode: detect,
 // or observe in observe mode.
@@ -82,7 +83,8 @@ func (rq *request) alertWAFBlock(result waf.Result) {
 		ASN:      rq.line.ASN,
 		ASName:   rq.line.ASName,
 		Country:  rq.line.Country,
-		Reason:   "scored by the Core Rule Set at or over SWW_WAF_ANOMALY_THRESHOLD",
-		Detail:   detail,
+		Reason: "scored by the Core Rule Set at or over " +
+			"SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD",
+		Detail: detail,
 	})
 }

internal/discriminator/coreruleset_test.go

@@ -14,13 +14,13 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 
-// The Core Rule Set's settings the tests set, besides SWW_WAF_MODE, and
+// The Core Rule Set's settings the tests set, besides SWW_WAF_CORE_RULE_SET_MODE, and
 // its two modes that inspect requests.
 const (
-	wafAnomalyThreshold = "SWW_WAF_ANOMALY_THRESHOLD"
-	wafDisabledRules    = "SWW_WAF_DISABLED_RULES"
-	wafExemptPaths      = "SWW_WAF_EXEMPT_PATHS"
-	wafBodyLimit        = "SWW_WAF_BODY_LIMIT"
+	wafAnomalyThreshold = "SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD"
+	wafDisabledRules    = "SWW_WAF_CORE_RULE_SET_DISABLED_RULES"
+	wafExemptPaths      = "SWW_WAF_CORE_RULE_SET_EXEMPT_PATHS"
+	wafBodyLimit        = "SWW_WAF_CORE_RULE_SET_BODY_LIMIT"
 	block               = "block"
 	detect              = "detect"
 )
@@ -28,7 +28,7 @@ const (
 // formData is the type of a form's body.
 const formData = "application/x-www-form-urlencoded"
 
-// sizeLimit is SWW_WAF_BODY_LIMIT in the tests that read bodies, 1K as a
+// sizeLimit is SWW_WAF_CORE_RULE_SET_BODY_LIMIT in the tests that read bodies, 1K as a
 // setting.
 const (
 	sizeLimit        = 1 << 10
@@ -37,7 +37,7 @@ const (
 
 // sqlInjection asks for / with an SQL injection in its query, which only
 // the Core Rule Set's rule 942100 matches, with a score of 5, the default
-// SWW_WAF_ANOMALY_THRESHOLD.
+// SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD.
 const sqlInjection = "/?id=1'%20OR%20'1'='1"
 
 // wantWAF checks the request log line's waf_rule_ids and waf_score, and
@@ -125,7 +125,7 @@ func TestCoreRuleSetIsNotRunWhenOffOrForAnExemptClientPathOrRuleFileRefusal(
 ) {
 	t.Parallel()
 
-	const allowed = "192.0.2.60" // in SWW_ALLOW_NETS
+	const allowed = "192.0.2.60" // in SWW_WAF_ALLOW_NETS
 
 	s, _, _ := startWithClock(t, "", map[string]string{
 		wafMode:        block,
@@ -134,7 +134,7 @@ func TestCoreRuleSetIsNotRunWhenOffOrForAnExemptClientPathOrRuleFileRefusal(
 		rulesDir:       writeRules(t, testRules),
 	})
 
-	// A client in SWW_ALLOW_NETS, and a path SWW_WAF_EXEMPT_PATHS
+	// A client in SWW_WAF_ALLOW_NETS, and a path SWW_WAF_CORE_RULE_SET_EXEMPT_PATHS
 	// exempts, are not inspected.
 	line := s.request(allowed, sqlInjection, http.StatusOK, requestlog.ActionForward)
 	wantWAF(t, line, nil)
@@ -153,7 +153,7 @@ func TestCoreRuleSetIsNotRunWhenOffOrForAnExemptClientPathOrRuleFileRefusal(
 		requestlog.ActionRuleBlocked)
 	wantWAF(t, line, nil)
 
-	// With SWW_WAF_MODE off, no request is.
+	// With SWW_WAF_CORE_RULE_SET_MODE off, no request is.
 	s, _, _ = startWithClock(t, "", map[string]string{wafMode: off})
 	line = s.request(client, sqlInjection, http.StatusOK, requestlog.ActionForward)
 	wantWAF(t, line, nil)
@@ -468,8 +468,9 @@ func TestCoreRuleSetMatchRaisesTheWAFBlockAlert(t *testing.T) {
 				Host:     appHost,
 				Client:   netip.MustParseAddr(client),
 				Netblock: netip.MustParsePrefix(client + "/32"),
-				Reason:   "scored by the Core Rule Set at or over SWW_WAF_ANOMALY_THRESHOLD",
-				Detail:   detail,
+				Reason: "scored by the Core Rule Set at or over " +
+					"SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD",
+				Detail: detail,
 			})
 
 			if queue.Suppressed() != 1 {

internal/discriminator/countries.go

@@ -7,7 +7,7 @@ import (
 // countryDenied reports whether the country lists refuse the request, by
 // the client's country as it was looked up. A client without a country,
 // or whose country cannot be found, is refused only by
-// SWW_EXCLUSIVELY_ALLOWED_COUNTRIES.
+// SWW_WAF_EXCLUSIVELY_ALLOWED_COUNTRIES.
 func (rq *request) countryDenied() bool {
 	denied := rq.h.config.DeniedCountries
 	allowed := rq.h.config.ExclusivelyAllowedCountries

internal/discriminator/countries_test.go

@@ -245,11 +245,11 @@ func TestExclusiveListRefusesAPrivateAddressUnlessAllowed(t *testing.T) {
 		action    string
 	}{
 		{
-			"not in SWW_ALLOW_NETS", "",
+			"not in SWW_WAF_ALLOW_NETS", "",
 			http.StatusForbidden, requestlog.ActionCountryDenied,
 		},
 		{
-			"in SWW_ALLOW_NETS", "10.0.0.7,fd00::/8",
+			"in SWW_WAF_ALLOW_NETS", "10.0.0.7,fd00::/8",
 			http.StatusOK, requestlog.ActionForward,
 		},
 	} {
@@ -279,7 +279,7 @@ func TestExclusiveListRefusesAPrivateAddressUnlessAllowed(t *testing.T) {
 // startGeoJS starts a stand-in for GeoJS, which places fromDE and fromKP,
 // each in an AS of its own, and no other address. It returns its URL, and
 // what returns the addresses it has been asked about. A test that needs
-// the stand-in to be asked or to answer sets SWW_LOOKUP_TIMEOUT to an
+// the stand-in to be asked or to answer sets SWW_WAF_LOOKUP_TIMEOUT to an
 // hour, whether or not a request waits for the answer: on the default, a
 // hold-up of the test process can abandon the request to the stand-in, and
 // leave the client unknown.

internal/discriminator/crowdsec_test.go

@@ -18,8 +18,8 @@ import (
 // test puts in the copy of its decision list, at decisionsURL, that it
 // needs, as reputation.json would at start.
 const (
-	crowdSecURL  = "SWW_CROWDSEC_LAPI_URL"
-	crowdSecKey  = "SWW_CROWDSEC_LAPI_KEY"
+	crowdSecURL  = "SWW_WAF_CROWDSEC_LAPI_URL"
+	crowdSecKey  = "SWW_WAF_CROWDSEC_LAPI_KEY"
 	lapi         = "http://crowdsec.example:8080"
 	decisionsURL = lapi + "/v1/decisions"
 	bouncerKey   = "crowdsec-key-0123456789abcdef"

internal/discriminator/discriminator.go

@@ -39,7 +39,7 @@ const (
 	// headers and body.
 	DispositionDeny = "deny"
 	// DispositionClose tells rproxy to close the visitor's connection
-	// without an answer, which SWW_BAN_RESPONSE asks for when it is close.
+	// without an answer, which SWW_WAF_BAN_RESPONSE asks for when it is close.
 	// discriminator closing the question's connection instead would read as
 	// discriminator being down, and rproxy would then let the request through.
 	DispositionClose = "close"
@@ -149,7 +149,7 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 // refusedWhateverTheAnswer reports whether the request is one that does not wait
 // for GeoJS, since the checks will refuse it at now whatever GeoJS answers about
 // its client: it is over the header limits, a blocklist lists its client while
-// SWW_BLOCKLIST_ACTION is deny, the CrowdSec decision list lists it, or it is
+// SWW_WAF_BLOCKLIST_ACTION is deny, the CrowdSec decision list lists it, or it is
 // over a whole rate limit. In observe mode, which refuses nothing, none is.
 // rproxy lets a request through when discriminator answers too late.
 func (rq *request) refusedWhateverTheAnswer(now time.Time) bool {
@@ -335,7 +335,7 @@ func asTheVisitorSentIt(r *http.Request, body []byte) *http.Request {
 }
 
 // allow answers a question with DispositionAllow and, while
-// SWW_ADD_LOOKUP_HEADERS is set, the client's AS number and country.
+// SWW_WAF_ADD_LOOKUP_HEADERS is set, the client's AS number and country.
 func (rq *request) allow() {
 	rq.allowed = true
 
@@ -361,7 +361,7 @@ func (rq *request) deny(r refusal) {
 	rq.refused = &r
 
 	if r.status == 0 {
-		// SWW_BAN_RESPONSE is close. Written past rq.out, since the log line's
+		// SWW_WAF_BAN_RESPONSE is close. Written past rq.out, since the log line's
 		// status stays 0: the visitor is sent nothing.
 		rq.out.Header().Set(DispositionHeader, DispositionClose)
 		rq.out.ResponseWriter.WriteHeader(http.StatusOK)

internal/discriminator/discriminator_test.go

@@ -39,7 +39,7 @@ const (
 	// reportBodyLimit is the longest body SPEC.md lets a report have.
 	reportBodyLimit = 1 << 20
 	// anomalyClientPerMinute is the anomaly threshold these tests set.
-	anomalyClientPerMinute = "SWW_ANOMALY_CLIENT_REQUESTS_PER_MINUTE"
+	anomalyClientPerMinute = "SWW_WAF_ANOMALY_CLIENT_REQUESTS_PER_MINUTE"
 )
 
 // The fields of a report, as "discriminator" in SPEC.md names them.
@@ -181,7 +181,7 @@ func (s *Discriminator) history() ratelimit.History {
 }
 
 // metrics returns what the metrics endpoint answers, for a server started with
-// the token as SWW_METRICS_TOKEN.
+// the token as SWW_WAF_METRICS_TOKEN.
 func (s *Discriminator) metrics() string {
 	s.t.Helper()
 
@@ -1485,7 +1485,7 @@ func TestALargeBodyAnnouncedAndLongHeadersAreNoReasonToRefuse(t *testing.T) {
 func TestLogLevelHoldsBackNoRequestLine(t *testing.T) {
 	t.Parallel()
 
-	s := startDiscriminator(t, "", map[string]string{"SWW_LOG_LEVEL": "error"})
+	s := startDiscriminator(t, "", map[string]string{"SWW_WAF_LOG_LEVEL": "error"})
 
 	// A refused question would write a process warning, held back at error.
 	req := s.question(siteA, client, "/")

internal/discriminator/errorburst_test.go

@@ -15,7 +15,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 
-const errorBurstThreshold = "SWW_ERROR_BURST_THRESHOLD"
+const errorBurstThreshold = "SWW_WAF_ERROR_BURST_THRESHOLD"
 
 // refused is a request the tests here send, which discriminator refuses after a rule
 // file match.
@@ -48,7 +48,7 @@ func (r refused) send(s *sender, from string) logLine {
 }
 
 // startForErrorBurst is startWithClock with testRules, the metrics token and
-// SWW_ERROR_BURST_THRESHOLD at threshold, and the settings in env.
+// SWW_WAF_ERROR_BURST_THRESHOLD at threshold, and the settings in env.
 func startForErrorBurst(
 	t *testing.T, threshold string, env map[string]string,
 ) (*sender, *clock, *discriminator.Server) {
@@ -258,15 +258,15 @@ func TestErrorBurstCountsEachClientTheChecksApplyTo(t *testing.T) {
 	t.Parallel()
 
 	const (
-		allowed = "192.0.2.60" // in SWW_ALLOW_NETS
-		exempt  = "192.0.2.50" // in SWW_RATE_LIMIT_EXEMPT_NETS
+		allowed = "192.0.2.60" // in SWW_WAF_ALLOW_NETS
+		exempt  = "192.0.2.50" // in SWW_WAF_RATE_LIMIT_EXEMPT_NETS
 	)
 
 	s, _, _ := startForErrorBurst(t, "1", map[string]string{
 		allowNets: allowed, rateLimitExemptNets: exempt,
 	})
 
-	// A client in SWW_ALLOW_NETS is not refused, and so not counted.
+	// A client in SWW_WAF_ALLOW_NETS is not refused, and so not counted.
 	for range 3 {
 		s.request(allowed, blockedPath, http.StatusOK, requestlog.ActionForward)
 	}

internal/discriminator/lookup.go

@@ -10,7 +10,7 @@ import (
 )
 
 // The headers in which an answer of allow gives rproxy the client's AS number
-// and country, for the app, while SWW_ADD_LOOKUP_HEADERS is set. Go writes
+// and country, for the app, while SWW_WAF_ADD_LOOKUP_HEADERS is set. Go writes
 // every header name in this form, as it sends it and as it receives it, so
 // X-Client-ASN arrives as X-Client-Asn; header names are not case-sensitive.
 const (
@@ -20,7 +20,7 @@ const (
 
 // lookUp looks up the client's AS number and country, in the lookup
 // database or through GeoJS, and notes them for the log line, unless
-// SWW_LOOKUP_SOURCE is off or the client is on a private, loopback or
+// SWW_WAF_LOOKUP_SOURCE is off or the client is on a private, loopback or
 // link-local address, which no lookup can place. The lookup database
 // answers at once. With GeoJS, while a setting needs the answer, such as a
 // country list or a biased threshold, a new client's request waits for it,

internal/discriminator/lookup_test.go

@@ -20,7 +20,7 @@ import (
 // and country.
 type asnAndCountry struct{ asn, asName, country string }
 
-// fileSource is the SWW_LOOKUP_SOURCE that looks clients up in the
+// fileSource is the SWW_WAF_LOOKUP_SOURCE that looks clients up in the
 // lookup database.
 const fileSource = "file"
 

internal/discriminator/metrics_test.go

@@ -17,9 +17,9 @@ import (
 )
 
 const (
-	metricsToken = "SWW_METRICS_TOKEN" //nolint:gosec // the setting's name
-	metricsTopN  = "SWW_METRICS_TOP_N"
-	// token is the SWW_METRICS_TOKEN the tests set, and bearer how a
+	metricsToken = "SWW_WAF_METRICS_TOKEN" //nolint:gosec // the setting's name
+	metricsTopN  = "SWW_WAF_METRICS_TOP_N"
+	// token is the SWW_WAF_METRICS_TOKEN the tests set, and bearer how a
 	// request carries it.
 	token  = "0123456789abcdef0123456789abcdef"
 	bearer = "Bearer " + token
@@ -113,7 +113,7 @@ func TestMetricsCountTheTraffic(t *testing.T) {
 func TestMetricsCountLimitsAndBans(t *testing.T) {
 	t.Parallel()
 
-	const denied = "192.0.2.50" // in SWW_DENY_NETS
+	const denied = "192.0.2.50" // in SWW_WAF_DENY_NETS
 
 	s, clk, _ := startWithClock(t, "", map[string]string{
 		metricsToken:       token,
@@ -124,7 +124,7 @@ func TestMetricsCountLimitsAndBans(t *testing.T) {
 		maxBanDuration:     "2h",
 	})
 
-	// SWW_BAN_RESPONSE=close sends no status at all.
+	// SWW_WAF_BAN_RESPONSE=close sends no status at all.
 	s.get(denied, 0, requestlog.ActionDenied)
 
 	// A first broken limit bans for an hour.
@@ -145,7 +145,7 @@ func TestMetricsCountLimitsAndBans(t *testing.T) {
 	wantMetric(t, s.scrape(), `sww_active_bans{instance="app"}`, 0)
 
 	// A limit broken again right after would ban for three hours, longer
-	// than SWW_MAX_BAN_DURATION, so the ban is permanent.
+	// than SWW_WAF_MAX_BAN_DURATION, so the ban is permanent.
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 	s.get(client, 0, requestlog.ActionRateLimited)
 
@@ -328,12 +328,12 @@ func TestMetricsCountGeoJSRequestsAndFailures(t *testing.T) {
 		})
 
 	// GeoJS fails, so the client counts as coming from an unknown country,
-	// which SWW_DENIED_COUNTRIES does not refuse.
+	// which SWW_WAF_DENIED_COUNTRIES does not refuse.
 	req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
 	req.Header.Set(forwardedFor, fromDE)
 	wantStatus(t, do(t, req), http.StatusOK)
 
-	// The client stops waiting for GeoJS once SWW_LOOKUP_TIMEOUT is up, so
+	// The client stops waiting for GeoJS once SWW_WAF_LOOKUP_TIMEOUT is up, so
 	// GeoJS's failure can come after its request has ended.
 	deadline := time.Now().Add(waitLimit)
 	metrics := scrape(t, server.Addr)

internal/discriminator/observe_test.go

@@ -11,19 +11,19 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 
-// observe is the value of SWW_MODE for observe mode.
+// observe is the value of SWW_WAF_MODE for observe mode.
 const observe = "observe"
 
 func TestObserveModeForwardsWhatEnforceModeRefuses(t *testing.T) {
 	t.Parallel()
 
 	const (
-		denied = "192.0.2.50" // in SWW_DENY_NETS
+		denied = "192.0.2.50" // in SWW_WAF_DENY_NETS
 		banned = otherClient  // under a ban read from bans.json
 	)
 
 	for _, tc := range []struct {
-		setting string // "" leaves SWW_MODE at its default
+		setting string // "" leaves SWW_WAF_MODE at its default
 		observe bool
 	}{
 		{"", false},

internal/discriminator/proxy.go

@@ -33,15 +33,15 @@ const adminPrefix = "/_sww/"
 const HealthPath = "/_sww/healthz"
 
 // MetricsPath is where the metrics are, for a request that carries
-// SWW_METRICS_TOKEN.
+// SWW_WAF_METRICS_TOKEN.
 const MetricsPath = "/_sww/metrics"
 
 // BansPath is where an admin lists and adds bans, and, followed by / and
-// a client's address, lifts them, with SWW_ADMIN_TOKEN.
+// a client's address, lifts them, with SWW_WAF_ADMIN_TOKEN.
 const BansPath = "/_sww/bans"
 
 // ClientsPath is where an admin asks what discriminator knows of a client, by
-// the client's address after it, with SWW_ADMIN_TOKEN.
+// the client's address after it, with SWW_WAF_ADMIN_TOKEN.
 const ClientsPath = "/_sww/clients/"
 
 // Params are what New needs.
@@ -54,16 +54,16 @@ type Params struct {
 	// ProcessLog receives the process's own messages.
 	ProcessLog *slog.Logger
 	// GeoJSURL is where clients' AS numbers and countries are looked up
-	// while SWW_LOOKUP_SOURCE is geojs, normally lookup.URL.
+	// while SWW_WAF_LOOKUP_SOURCE is geojs, normally lookup.URL.
 	GeoJSURL string
 	// AbuseIPDBURL is where clients are checked with AbuseIPDB while
-	// SWW_ABUSEIPDB_KEY is set, normally reputation.AbuseIPDBURL.
+	// SWW_WAF_ABUSEIPDB_KEY is set, normally reputation.AbuseIPDBURL.
 	AbuseIPDBURL string
 	// LookupFile is the lookup database they are looked up in while
-	// SWW_LOOKUP_SOURCE is file, and nil otherwise.
+	// SWW_WAF_LOOKUP_SOURCE is file, and nil otherwise.
 	LookupFile *lookup.File
 	// CoreRuleSet is what NewCoreRuleSet returns: what inspects requests
-	// while SWW_WAF_MODE is not off, and nil while it is.
+	// while SWW_WAF_CORE_RULE_SET_MODE is not off, and nil while it is.
 	CoreRuleSet *waf.CoreRuleSet
 	// Now tells the time by which requests are counted for the rate
 	// limits, bans are made and run out, and GeoJS's answers are kept,
@@ -76,14 +76,14 @@ type Params struct {
 	// permanent, for each count over an anomaly threshold, for each request
 	// whose client a blocklist, the CrowdSec decision list, a DNSBL zone or
 	// AbuseIPDB lists, for each request the Core Rule Set scores at or over
-	// SWW_WAF_ANOMALY_THRESHOLD, and for GeoJS failing, a fetch of a list
+	// SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD, and for GeoJS failing, a fetch of a list
 	// failing, a query to a DNSBL zone or a check with AbuseIPDB failing,
 	// or the day's AbuseIPDB checks used up.
 	Alerts *alerts.Queue
 }
 
 // Server is the server discriminator runs, with the parts whose state the state
-// files keep, the lookup database, nil unless SWW_LOOKUP_SOURCE is file, the
+// files keep, the lookup database, nil unless SWW_WAF_LOOKUP_SOURCE is file, the
 // lists fetched from URLs, which its Run fetches, the DNSBL zones' verdicts,
 // AbuseIPDB's scores and checks spent, and the metrics.
 type Server struct {
@@ -175,7 +175,7 @@ func newHandler(params Params) *handler {
 // newReputation returns the lists fetched from URLs, the DNSBL zones'
 // verdicts and AbuseIPDB's scores, as the settings in params name them,
 // with none fetched, asked for or checked yet, and adds their metrics to
-// m, AbuseIPDB's while SWW_ABUSEIPDB_KEY is set.
+// m, AbuseIPDB's while SWW_WAF_ABUSEIPDB_KEY is set.
 func newReputation(
 	params Params, m *metrics.Metrics,
 ) (*reputation.Lists, *reputation.DNSBL, *reputation.AbuseIPDB) {
@@ -207,11 +207,11 @@ func newReputation(
 	return lists, dnsbl, abuseIPDB
 }
 
-// NewCoreRuleSet returns the Core Rule Set at SWW_WAF_PARANOIA_LEVEL,
-// without the rules SWW_WAF_DISABLED_RULES switches off, reading bodies
-// up to SWW_WAF_BODY_LIMIT, with the exclusions in
-// SWW_CORE_RULE_SET_EXCLUSIONS_FILE, or nil while SWW_WAF_MODE is off. It
-// reads at most QuestionBodyMaxBytes less one byte: a question's body of
+// NewCoreRuleSet returns the Core Rule Set at SWW_WAF_CORE_RULE_SET_PARANOIA_LEVEL,
+// without the rules SWW_WAF_CORE_RULE_SET_DISABLED_RULES switches off, reading bodies
+// up to SWW_WAF_CORE_RULE_SET_BODY_LIMIT, with the exclusions in
+// SWW_WAF_CORE_RULE_SET_EXCLUSIONS_FILE, or nil while SWW_WAF_CORE_RULE_SET_MODE is
+// off. It reads at most QuestionBodyMaxBytes less one byte: a question's body of
 // QuestionBodyMaxBytes may be cut short, and the Core Rule Set does not read a
 // JSON or XML body over its limit. An exclusions file that waf.New refuses is
 // an error in every mode. While the mode is off, a set file is loaded with the
@@ -227,7 +227,7 @@ func NewCoreRuleSet(cfg *config.Config) (*waf.CoreRuleSet, error) {
 		ExclusionsFile: cfg.CoreRuleSetExclusionsFile,
 	})
 	if err != nil {
-		return nil, fmt.Errorf("SWW_CORE_RULE_SET_EXCLUSIONS_FILE: %w", err)
+		return nil, fmt.Errorf("SWW_WAF_CORE_RULE_SET_EXCLUSIONS_FILE: %w", err)
 	}
 
 	if cfg.WAFMode == config.WAFModeOff {

internal/discriminator/proxy_test.go

@@ -15,6 +15,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/spf13/viper"
+
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/discriminator"
@@ -55,33 +57,33 @@ const (
 
 // The settings the tests set.
 const (
-	mode                 = "SWW_MODE"
-	trustedProxies       = "SWRP_TRUSTED_PROXIES"
-	ipv6GroupPrefix      = "SWW_IPV6_GROUP_PREFIX"
-	maxTrackedClients    = "SWW_MAX_TRACKED_CLIENTS"
-	allowNets            = "SWW_ALLOW_NETS"
-	rateLimitExemptNets  = "SWW_RATE_LIMIT_EXEMPT_NETS"
-	denyNets             = "SWW_DENY_NETS"
-	rateLimitPerMinute   = "SWW_RATE_LIMIT_PER_MINUTE"
-	rateLimitPerDay      = "SWW_RATE_LIMIT_PER_DAY"
-	rateLimitExemptPaths = "SWW_RATE_LIMIT_EXEMPT_PATHS"
-	lookupSource         = "SWW_LOOKUP_SOURCE"
-	lookupDBPath         = "SWW_LOOKUP_DB_PATH"
-	lookupTimeout        = "SWW_LOOKUP_TIMEOUT"
-	addLookupHeaders     = "SWW_ADD_LOOKUP_HEADERS"
-	deniedCountries      = "SWW_DENIED_COUNTRIES"
-	allowedCountries     = "SWW_EXCLUSIVELY_ALLOWED_COUNTRIES"
-	banResponse          = "SWW_BAN_RESPONSE"
-	limitBanDuration     = "SWW_LIMIT_BAN_DURATION"
-	limitBanRepeatWindow = "SWW_LIMIT_BAN_REPEAT_WINDOW"
-	maxBanDuration       = "SWW_MAX_BAN_DURATION"
-	maxBans              = "SWW_MAX_BANS"
-	banScopeV4Prefix     = "SWW_BAN_SCOPE_V4_PREFIX"
-	instanceName         = "SWW_INSTANCE_NAME"
-	logRequestHeaders    = "SWW_LOG_REQUEST_HEADERS"
-	attackBanDuration    = "SWW_ATTACK_BAN_DURATION"
-	rulesDir             = "SWW_RULES_DIR"
-	wafMode              = "SWW_WAF_MODE"
+	mode                 = "SWW_WAF_MODE"
+	trustedProxies       = "SWW_RPROXY_TRUSTED_PROXIES"
+	ipv6GroupPrefix      = "SWW_WAF_IPV6_GROUP_PREFIX"
+	maxTrackedClients    = "SWW_WAF_MAX_TRACKED_CLIENTS"
+	allowNets            = "SWW_WAF_ALLOW_NETS"
+	rateLimitExemptNets  = "SWW_WAF_RATE_LIMIT_EXEMPT_NETS"
+	denyNets             = "SWW_WAF_DENY_NETS"
+	rateLimitPerMinute   = "SWW_WAF_RATE_LIMIT_PER_MINUTE"
+	rateLimitPerDay      = "SWW_WAF_RATE_LIMIT_PER_DAY"
+	rateLimitExemptPaths = "SWW_WAF_RATE_LIMIT_EXEMPT_PATHS"
+	lookupSource         = "SWW_WAF_LOOKUP_SOURCE"
+	lookupDBPath         = "SWW_WAF_LOOKUP_DB_PATH"
+	lookupTimeout        = "SWW_WAF_LOOKUP_TIMEOUT"
+	addLookupHeaders     = "SWW_WAF_ADD_LOOKUP_HEADERS"
+	deniedCountries      = "SWW_WAF_DENIED_COUNTRIES"
+	allowedCountries     = "SWW_WAF_EXCLUSIVELY_ALLOWED_COUNTRIES"
+	banResponse          = "SWW_WAF_BAN_RESPONSE"
+	limitBanDuration     = "SWW_WAF_LIMIT_BAN_DURATION"
+	limitBanRepeatWindow = "SWW_WAF_LIMIT_BAN_REPEAT_WINDOW"
+	maxBanDuration       = "SWW_WAF_MAX_BAN_DURATION"
+	maxBans              = "SWW_WAF_MAX_BANS"
+	banScopeV4Prefix     = "SWW_WAF_BAN_SCOPE_V4_PREFIX"
+	instanceName         = "SWW_WAF_INSTANCE_NAME"
+	logRequestHeaders    = "SWW_WAF_LOG_REQUEST_HEADERS"
+	attackBanDuration    = "SWW_WAF_ATTACK_BAN_DURATION"
+	rulesDir             = "SWW_WAF_RULES_DIR"
+	wafMode              = "SWW_WAF_CORE_RULE_SET_MODE"
 )
 
 // off is the value that switches a setting off.
@@ -294,8 +296,8 @@ func startProxyWithGeoJS(
 
 // startProxyWithClock is startProxyWithGeoJS with requests counted and
 // bans made by the time now tells, and returns discriminator's server as well, whose
-// Addr is where discriminator listens. Unless env sets SWW_RULES_DIR, it is an empty
-// directory, of no rules, and unless it sets SWW_INSTANCE_NAME, that is app,
+// Addr is where discriminator listens. Unless env sets SWW_WAF_RULES_DIR, it is an
+// empty directory, of no rules, and unless it sets SWW_WAF_INSTANCE_NAME, that is app,
 // the label instance of every metric.
 func startProxyWithClock(
 	t *testing.T, appURL, geojsURL string, now func() time.Time,
@@ -343,27 +345,34 @@ func serve(t *testing.T, server *discriminator.Server) {
 	})
 }
 
+// viperFrom returns a viper Set with each of settings, as the viper
+// config.NewViper returns one bound to a process's environment.
+func viperFrom(settings map[string]string) *viper.Viper {
+	v := viper.New()
+	for name, value := range settings {
+		v.Set(name, value)
+	}
+
+	return v
+}
+
 // startRProxy starts rproxy in front of the app at appURL, asking the discriminator
 // at discriminatorAddr, with the settings in env on top of the defaults, and returns
-// where it listens. What it writes is dropped. SWRP_TIMEOUT_MS is a minute unless
-// env sets it, so that on a busy host SWRP_DEFAULT_DISPOSITION does not decide.
+// where it listens. What it writes is dropped. SWW_RPROXY_TIMEOUT_MS is a minute unless
+// env sets it, so that on a busy host SWW_RPROXY_DEFAULT_DISPOSITION does not decide.
 func startRProxy(
 	t *testing.T, discriminatorAddr, appURL string, env map[string]string,
 ) string {
 	t.Helper()
 
 	settings := map[string]string{
-		"SWRP_WAF_BACKEND":  "http://" + discriminatorAddr,
-		"SWRP_UPSTREAM_URL": appURL,
-		"SWRP_TIMEOUT_MS":   "60000",
+		"SWW_RPROXY_WAF_BACKEND":  "http://" + discriminatorAddr,
+		"SWW_RPROXY_UPSTREAM_URL": appURL,
+		"SWW_RPROXY_TIMEOUT_MS":   "60000",
 	}
 	maps.Copy(settings, env)
 
-	cfg, err := config.RProxyFromEnvironment(func(name string) (string, bool) {
-		value, ok := settings[name]
-
-		return value, ok
-	})
+	cfg, err := config.RProxyFromEnvironment(viperFrom(settings))
 	if err != nil {
 		t.Fatalf("settings %v: %v", settings, err)
 	}
@@ -395,11 +404,11 @@ func startRProxy(
 // settings in env make it. No alert is sent from the queue: they wait in it,
 // for the test to look at.
 // With no geojsURL, there is no stand-in for GeoJS to look clients up at, and
-// SWW_LOOKUP_SOURCE is off unless env sets it. While it is file, the lookup
-// database SWW_LOOKUP_DB_PATH names is read. Clients are checked with AbuseIPDB
-// at abuseIPDBURL while env sets SWW_ABUSEIPDB_KEY. SWW_WAF_MODE is off unless
-// env sets it, so that only the tests of the Core Rule Set have their requests
-// inspected by it.
+// SWW_WAF_LOOKUP_SOURCE is off unless env sets it. While it is file, the lookup
+// database SWW_WAF_LOOKUP_DB_PATH names is read. Clients are checked with AbuseIPDB
+// at abuseIPDBURL while env sets SWW_WAF_ABUSEIPDB_KEY.
+// SWW_WAF_CORE_RULE_SET_MODE is off unless env sets it, so that only the tests of the
+// Core Rule Set have their requests inspected by it.
 func newDiscriminator(
 	t *testing.T, geojsURL string, now func() time.Time, env map[string]string,
 ) (*discriminator.Server, *output, *alerts.Queue) {
@@ -424,11 +433,7 @@ func newDiscriminatorWith(
 
 	maps.Copy(settings, env)
 
-	cfg, err := config.FromEnvironment(func(name string) (string, bool) {
-		value, ok := settings[name]
-
-		return value, ok
-	})
+	cfg, err := config.FromEnvironment(viperFrom(settings))
 	if err != nil {
 		t.Fatalf("settings %v: %v", settings, err)
 	}

internal/discriminator/ratelimits_test.go

@@ -10,7 +10,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 
-// minute is the window of SWW_RATE_LIMIT_PER_MINUTE, as a log line's
+// minute is the window of SWW_WAF_RATE_LIMIT_PER_MINUTE, as a log line's
 // limit_hit names it.
 const minute = "minute"
 
@@ -75,7 +75,7 @@ func TestRateLimitRefusesBeforeTheApp(t *testing.T) {
 func TestIPv6GroupPrefixSetsTheClientTheLimitsCount(t *testing.T) {
 	t.Parallel()
 
-	// With SWW_IPV6_GROUP_PREFIX at 48, the first two addresses, in two
+	// With SWW_WAF_IPV6_GROUP_PREFIX at 48, the first two addresses, in two
 	// /64s of one /48, are one client, and the second's request breaks the
 	// limit; the third, in the next /48, is another client.
 	const (
@@ -118,7 +118,7 @@ func TestIPv6GroupPrefixSetsTheClientTheLimitsCount(t *testing.T) {
 func TestRateLimitExemptPathsAreNeitherCountedNorRefused(t *testing.T) {
 	t.Parallel()
 
-	const denied = "192.0.2.50" // in SWW_DENY_NETS
+	const denied = "192.0.2.50" // in SWW_WAF_DENY_NETS
 
 	geojsURL, _ := startGeoJS(t)
 	s, _, server := startWithClock(t, geojsURL, map[string]string{
@@ -151,7 +151,7 @@ func TestRateLimitExemptPathsAreNeitherCountedNorRefused(t *testing.T) {
 	// /assets/, and breaks the limit.
 	s.request(client, "/assets", http.StatusForbidden, requestlog.ActionRateLimited)
 
-	// A ban, SWW_DENY_NETS and the country lists still refuse a path
+	// A ban, SWW_WAF_DENY_NETS and the country lists still refuse a path
 	// under a prefix.
 	s.request(client, "/assets/app.js", http.StatusForbidden, requestlog.ActionBanned)
 	s.request(denied, "/assets/app.js", http.StatusForbidden, requestlog.ActionDenied)

internal/discriminator/reputation.go

@@ -10,12 +10,12 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
 )
 
-// deny is the SWW_BLOCKLIST_ACTION and the SWW_REPUTATION_ACTION that
+// deny is the SWW_WAF_BLOCKLIST_ACTION and the SWW_WAF_REPUTATION_ACTION that
 // refuses the requests of a client a source lists.
 const deny = "deny"
 
 // blocklistDenied notes the blocklists that list the client, as
-// noteListed does, and reports whether SWW_BLOCKLIST_ACTION, being deny,
+// noteListed does, and reports whether SWW_WAF_BLOCKLIST_ACTION, being deny,
 // refuses the request. Being limit, it lowers the client's limits instead
 // (see limitPercentages), and being log, it does nothing more.
 func (rq *request) blocklistDenied() bool {
@@ -43,7 +43,7 @@ func (rq *request) crowdSecBanned(now time.Time) bool {
 }
 
 // dnsblDenied notes the DNSBL zones whose verdict lists the client, as
-// noteListed does, and reports whether SWW_REPUTATION_ACTION, being
+// noteListed does, and reports whether SWW_WAF_REPUTATION_ACTION, being
 // deny, refuses the request. Being limit, it lowers the client's limits
 // instead (see limitPercentages), and being log, it does nothing more. A
 // zone without a verdict on the client is asked about it in the
@@ -59,8 +59,8 @@ func (rq *request) dnsblDenied(ctx context.Context) bool {
 
 // abuseIPDBDenied notes AbuseIPDB, as noteHit does, with the score, when
 // its score of the client is a hit, and reports whether
-// SWW_REPUTATION_ACTION, being deny, refuses the request, as dnsblDenied
-// does for a zone. While SWW_ABUSEIPDB_KEY is unset it does nothing. A
+// SWW_WAF_REPUTATION_ACTION, being deny, refuses the request, as dnsblDenied
+// does for a zone. While SWW_WAF_ABUSEIPDB_KEY is unset it does nothing. A
 // client without a score is checked in the background, by the request's
 // address, if its history counts an offence, and the request does not
 // wait for the answer. The score is then used for each address of the
@@ -81,7 +81,7 @@ func (rq *request) abuseIPDBDenied(ctx context.Context) bool {
 
 	rq.abuseIPDBHit = true
 	rq.noteHit(bans.ReputationHit{Source: reputation.AbuseIPDBSource, Score: &score},
-		"scored by AbuseIPDB at or over SWW_ABUSEIPDB_MIN_SCORE")
+		"scored by AbuseIPDB at or over SWW_WAF_ABUSEIPDB_MIN_SCORE")
 
 	return rq.h.config.ReputationAction == deny
 }

internal/discriminator/reputation_test.go

@@ -23,12 +23,12 @@ import (
 
 // The reputation settings.
 const (
-	blocklistURLs      = "SWW_BLOCKLIST_URLS"
-	blocklistAction    = "SWW_BLOCKLIST_ACTION"
-	asnLimitPercentURL = "SWW_ASN_LIMIT_PERCENT_URL"
+	blocklistURLs      = "SWW_WAF_BLOCKLIST_URLS"
+	blocklistAction    = "SWW_WAF_BLOCKLIST_ACTION"
+	asnLimitPercentURL = "SWW_WAF_ASN_LIMIT_PERCENT_URL"
 )
 
-// The actions of SWW_BLOCKLIST_ACTION and SWW_REPUTATION_ACTION:
+// The actions of SWW_WAF_BLOCKLIST_ACTION and SWW_WAF_REPUTATION_ACTION:
 // limitHalf gives a listed client half of every limit, and limitQuarter a
 // quarter.
 const (
@@ -127,7 +127,7 @@ func TestBlocklistsComeAfterTheCountryListsAndSkipAllowNets(t *testing.T) {
 	loadLists(t, server, map[string][]string{dropURL: {fromDE, fromKP}})
 
 	// fromKP's country refuses it before the list is looked at, and fromDE,
-	// in SWW_ALLOW_NETS, is not checked at all: neither is noted, nor
+	// in SWW_WAF_ALLOW_NETS, is not checked at all: neither is noted, nor
 	// alerted.
 	wantReputation(t, s.get(fromKP, http.StatusForbidden, requestlog.ActionCountryDenied))
 	wantReputation(t, s.get(fromDE, http.StatusOK, requestlog.ActionForward))
@@ -224,7 +224,7 @@ func TestASNLimitPercentFileCountsAsTheSettingDoesTheLowerWinning(t *testing.T)
 		},
 		{"none, for an AS number the file does not list", nil, asnKP + ":25", none, none},
 		{
-			"SWW_ASN_BYTES_PERCENT's in place of the file's for the byte limits",
+			"SWW_WAF_ASN_BYTES_PERCENT's in place of the file's for the byte limits",
 			map[string]string{asnBytesPercent: asnDE + ":100"}, asnDEQuarter, fromURL, none,
 		},
 	} {
@@ -312,9 +312,9 @@ func TestEachBlocklistThatListsAClientRaisesAnAlertOncePerCooldownAndIsCounted(
 
 // The DNSBL settings.
 const (
-	dnsblZones       = "SWW_DNSBL_ZONES"
-	dnsblResolver    = "SWW_DNSBL_RESOLVER"
-	reputationAction = "SWW_REPUTATION_ACTION"
+	dnsblZones       = "SWW_WAF_DNSBL_ZONES"
+	dnsblResolver    = "SWW_WAF_DNSBL_RESOLVER"
+	reputationAction = "SWW_WAF_REPUTATION_ACTION"
 )
 
 // The DNSBL zones these tests name, which are never asked about the
@@ -370,7 +370,7 @@ func TestEachReputationActionForAClientADNSBLZoneLists(t *testing.T) {
 			for _, from := range []string{fromDE, fromKP} {
 				for i := range 3 {
 					line := s.get(from, tc.statuses[i], tc.actions[i])
-					// In the order SWW_DNSBL_ZONES names them.
+					// In the order SWW_WAF_DNSBL_ZONES names them.
 					wantReputation(t, line, listedBy[from]...)
 					wantPercent(t, "limit_percent", line.LimitPercent,
 						line.LimitPercentSetting, tc.percent)
@@ -416,7 +416,7 @@ func TestDNSBLZonesComeAfterTheBlocklistsAndSkipAllowNets(t *testing.T) {
 	loadVerdicts(server, map[string][]string{fromKP: {dnsblZone}, fromDE: {dnsblZone}})
 
 	// The blocklist refuses fromKP before its verdict is looked at, and
-	// fromDE, in SWW_ALLOW_NETS, is not checked at all: neither is noted
+	// fromDE, in SWW_WAF_ALLOW_NETS, is not checked at all: neither is noted
 	// for the zone, nor alerted, nor asked about.
 	wantReputation(t, s.get(fromKP, http.StatusForbidden, requestlog.ActionDenied),
 		dropURL)
@@ -609,7 +609,7 @@ func TestRequestFromAClientWithoutAVerdictHasTheZoneAskedAboutIt(t *testing.T) {
 
 // The AbuseIPDB settings, and accountKey, the key the tests set.
 const (
-	abuseIPDBKey = "SWW_ABUSEIPDB_KEY"
+	abuseIPDBKey = "SWW_WAF_ABUSEIPDB_KEY"
 	accountKey   = "abuseipdb-key-0123456789abcdef"
 )
 
@@ -800,7 +800,7 @@ func TestEachReputationActionForAClientAbuseIPDBScoresAtOrOverTheMinimum(t *test
 				rateLimitPerMinute: fourAMinute, abuseIPDBKey: accountKey,
 				reputationAction: tc.action,
 			})
-			// At SWW_ABUSEIPDB_MIN_SCORE, 75 by default, and just under it.
+			// At SWW_WAF_ABUSEIPDB_MIN_SCORE, 75 by default, and just under it.
 			loadScores(server, map[string]int64{fromDE: 75, fromKP: 74})
 
 			for i := range 3 {
@@ -851,7 +851,7 @@ func TestAbuseIPDBHitRaisesAnAlertWithTheScoreOncePerCooldownAndIsCounted(
 	// The alert is made as a DNSBL zone's is, with the score besides.
 	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
 	if len(waiting) != 1 || waiting[0].Event != alerts.EventReputationHit ||
-		waiting[0].Reason != "scored by AbuseIPDB at or over SWW_ABUSEIPDB_MIN_SCORE" ||
+		waiting[0].Reason != "scored by AbuseIPDB at or over SWW_WAF_ABUSEIPDB_MIN_SCORE" ||
 		waiting[0].Detail["source"] != abuseipdb || waiting[0].Detail["score"] != int64(90) ||
 		queue.Suppressed() != 1 {
 		t.Errorf("alerts waiting %+v, %d held back, want AbuseIPDB's reputation_hit "+
@@ -922,7 +922,7 @@ func TestBanNotesNameEachReputationSourceThatListedTheClient(t *testing.T) {
 				abuseIPDBKey: accountKey, reputationAction: actionLog,
 			})
 			// Every source lists client, and none otherClient, whose score is
-			// under SWW_ABUSEIPDB_MIN_SCORE, 75 by default.
+			// under SWW_WAF_ABUSEIPDB_MIN_SCORE, 75 by default.
 			loadLists(t, server, map[string][]string{dropURL: {client}})
 			loadVerdicts(server, map[string][]string{client: {dnsblZone}, otherClient: nil})
 			loadScores(server, map[string]int64{client: score, otherClient: 74})
@@ -971,7 +971,7 @@ func verdictsFetched() time.Time {
 }
 
 // loadVerdicts puts into server's DNSBL, for each client listedBy names,
-// a verdict of each zone SWW_DNSBL_ZONES names, fetched at
+// a verdict of each zone SWW_WAF_DNSBL_ZONES names, fetched at
 // verdictsFetched, as reputation.json would at start: one that lists the
 // client from each zone listedBy gives for it, and one that does not from
 // each other zone.

internal/discriminator/request.go

@@ -44,7 +44,7 @@ type decision struct {
 	lookedUp     bool
 	lookupAnswer lookup.Answer
 	// skippedLookupWait is true for a request that did not wait for GeoJS and
-	// found no answer kept. SWW_UNKNOWN_LIMIT_PERCENT does not apply to it,
+	// found no answer kept. SWW_WAF_UNKNOWN_LIMIT_PERCENT does not apply to it,
 	// so that not waiting never lowers its client's limits.
 	skippedLookupWait bool
 	// counted is true for a request the rate limits counted, whose bytes
@@ -161,7 +161,7 @@ func requestHeaders(r *http.Request, names []string) map[string]string {
 
 // check is the one place where a request can be refused. It returns nil to let
 // the request through. The checks of checkClient decide: a request they refuse
-// is answered with SWW_BAN_RESPONSE, 403 for a block rule or the Core Rule Set,
+// is answered with SWW_WAF_BAN_RESPONSE, 403 for a block rule or the Core Rule Set,
 // or 431 for the header limits. In observe mode nothing is refused, and the log
 // line names what enforce mode would have done. ctx is the request's own context.
 func (rq *request) check(ctx context.Context) *refusal {
@@ -185,17 +185,17 @@ func (rq *request) check(ctx context.Context) *refusal {
 
 // checkClient runs the checks on the request's client, and returns the
 // action of the first that refuses the request, or "" when none does. A
-// client in SWW_ALLOW_NETS skips them, and is not looked up. For any
-// other client, SWW_DENY_NETS comes first, then a ban on its netblock,
+// client in SWW_WAF_ALLOW_NETS skips them, and is not looked up. For any
+// other client, SWW_WAF_DENY_NETS comes first, then a ban on its netblock,
 // so that a client either refuses is not looked up, then the lookup of
 // its AS number and country, then the country lists, then the blocklists,
 // then the CrowdSec decision list, which bans the client it lists, then
 // the DNSBL zones' verdicts, and then AbuseIPDB's score; a request any of
 // them refuses is not counted for the rate limits. Then come the
-// rate limits, unless the client is in SWW_RATE_LIMIT_EXEMPT_NETS or the
-// request's path is exempt under SWW_RATE_LIMIT_EXEMPT_PATHS, so that
+// rate limits, unless the client is in SWW_WAF_RATE_LIMIT_EXEMPT_NETS or the
+// request's path is exempt under SWW_WAF_RATE_LIMIT_EXEMPT_PATHS, so that
 // every other request is counted, each of them by the client's limit
-// percentages, then SWW_TRAP_PATHS, then the rule files, then the header
+// percentages, then SWW_WAF_TRAP_PATHS, then the rule files, then the header
 // limits, and last the Core Rule Set. A request exempt from the rate limits
 // is exempt from the byte limits too. ctx is the request's own context.
 func (rq *request) checkClient(ctx context.Context) string {
@@ -266,8 +266,8 @@ func (rq *request) checkClient(ctx context.Context) string {
 }
 
 // countedByRateLimits reports whether the rate limits count the request: its
-// client is not in SWW_RATE_LIMIT_EXEMPT_NETS, and its path is not exempt
-// under SWW_RATE_LIMIT_EXEMPT_PATHS.
+// client is not in SWW_WAF_RATE_LIMIT_EXEMPT_NETS, and its path is not exempt
+// under SWW_WAF_RATE_LIMIT_EXEMPT_PATHS.
 func (rq *request) countedByRateLimits() bool {
 	cfg := rq.h.config
 
@@ -276,7 +276,7 @@ func (rq *request) countedByRateLimits() bool {
 }
 
 // pathExempt reports whether r is exempt under prefixes,
-// SWW_RATE_LIMIT_EXEMPT_PATHS or SWW_WAF_EXEMPT_PATHS: whether its
+// SWW_WAF_RATE_LIMIT_EXEMPT_PATHS or SWW_WAF_CORE_RULE_SET_EXEMPT_PATHS: whether its
 // path as sent, the path the app receives, not percent-decoded, starts
 // with one of prefixes, so that /%61ssets/x is not under /assets/ for an
 // app whose router matches the path as received. A request whose decoded
@@ -378,9 +378,9 @@ func (rq *request) addToHistory() {
 
 // countAnomalies counts the request, which has ended, and its bytes, as
 // countedBytes gives them, for the anomaly thresholds, whatever was done
-// with it: a request refused, one from a client in SWW_ALLOW_NETS or
-// SWW_RATE_LIMIT_EXEMPT_NETS, and one for a path in
-// SWW_RATE_LIMIT_EXEMPT_PATHS are counted too. It is counted for its
+// with it: a request refused, one from a client in SWW_WAF_ALLOW_NETS or
+// SWW_WAF_RATE_LIMIT_EXEMPT_NETS, and one for a path in
+// SWW_WAF_RATE_LIMIT_EXEMPT_PATHS are counted too. It is counted for its
 // client's AS number when answerAtTheEnd gives one. With every anomaly
 // threshold off, the default, it does nothing.
 func (rq *request) countAnomalies() {

internal/discriminator/requestlog_test.go

@@ -18,7 +18,7 @@ import (
 const (
 	// requestIDHeader carries the request's id.
 	requestIDHeader = "X-Request-ID"
-	// instance is the SWW_INSTANCE_NAME a test sets.
+	// instance is the SWW_WAF_INSTANCE_NAME a test sets.
 	instance = "fsn1app1/blog"
 	// ipv6Client is a client on IPv6, and ipv6Group the netblock the rate
 	// limits count it as.
@@ -195,7 +195,7 @@ func TestHasAuthorizationAndHasCookieEachComeFromTheirOwnHeader(t *testing.T) {
 func TestTimingsAreInOrder(t *testing.T) {
 	t.Parallel()
 
-	const denied = "192.0.2.50" // in SWW_DENY_NETS
+	const denied = "192.0.2.50" // in SWW_WAF_DENY_NETS
 
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
 		// The pause sets the times apart; a hold-up of the test only lengthens

internal/discriminator/rulefiles_test.go

@@ -34,14 +34,14 @@ func TestEachRuleAction(t *testing.T) {
 	line := s.get(client, http.StatusOK, requestlog.ActionForward)
 	wantRuleIDs(t, line, "noted")
 
-	// A block rule refuses with 403, whatever SWW_BAN_RESPONSE is, and
+	// A block rule refuses with 403, whatever SWW_WAF_BAN_RESPONSE is, and
 	// bans no one.
 	line = s.request(client, "/blocked", http.StatusForbidden,
 		requestlog.ActionRuleBlocked)
 	wantRuleIDs(t, line, "noted", "blocked")
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 
-	// A ban rule refuses with SWW_BAN_RESPONSE, and bans the client for
+	// A ban rule refuses with SWW_WAF_BAN_RESPONSE, and bans the client for
 	// seven days, the default.
 	line = s.request(client, "/.env", http.StatusTooManyRequests, requestlog.ActionBanned)
 	wantRuleIDs(t, line, "noted", "probe")
@@ -101,7 +101,7 @@ func TestNextClearSignOfAttackAfterABanBansPermanently(t *testing.T) {
 		attackBanDuration: "1h",
 	})
 
-	// The first probe bans for SWW_ATTACK_BAN_DURATION.
+	// The first probe bans for SWW_WAF_ATTACK_BAN_DURATION.
 	line := s.request(client, "/.env", http.StatusForbidden, requestlog.ActionBanned)
 	if line.BanExpires != requestlog.FormatTime(clk.Now().Add(time.Hour)) {
 		t.Errorf("log line has ban_expires %q, want an hour on", line.BanExpires)
@@ -122,8 +122,8 @@ func TestRulesComeAfterTheOtherChecks(t *testing.T) {
 	t.Parallel()
 
 	const (
-		allowed = "192.0.2.60" // in SWW_ALLOW_NETS
-		exempt  = "192.0.2.50" // in SWW_RATE_LIMIT_EXEMPT_NETS
+		allowed = "192.0.2.60" // in SWW_WAF_ALLOW_NETS
+		exempt  = "192.0.2.50" // in SWW_WAF_RATE_LIMIT_EXEMPT_NETS
 	)
 
 	s, _, server := startWithClock(t, "", map[string]string{
@@ -133,7 +133,7 @@ func TestRulesComeAfterTheOtherChecks(t *testing.T) {
 		rateLimitPerMinute:  "1",
 	})
 
-	// A client in SWW_ALLOW_NETS is not checked.
+	// A client in SWW_WAF_ALLOW_NETS is not checked.
 	line := s.request(allowed, "/.env", http.StatusOK, requestlog.ActionForward)
 	wantRuleIDs(t, line)
 

internal/discriminator/rules.go

@@ -10,7 +10,7 @@ import (
 )
 
 // trapPath reports whether the request asks for a path in
-// SWW_TRAP_PATHS: its path as a path rule sees it, without the query,
+// SWW_WAF_TRAP_PATHS: its path as a path rule sees it, without the query,
 // as sent or once percent-decoded, is one of them. Such a request is a
 // clear sign of attack, as a ban rule's match is: it bans the client's
 // netblock, or in observe mode raises the alert for the ban it would have

internal/discriminator/staticlists_test.go

@@ -26,7 +26,7 @@ func TestAllowNetsSkipEveryCheck(t *testing.T) {
 		calls.Add(1)
 	})
 	geojsURL, asked := startGeoJS(t)
-	// fromKP is in SWW_ALLOW_NETS, and in SWW_DENY_NETS too, which
+	// fromKP is in SWW_WAF_ALLOW_NETS, and in SWW_WAF_DENY_NETS too, which
 	// comes after it.
 	addr, out := startProxyWithGeoJS(t, app.URL, geojsURL, map[string]string{
 		trustedProxies:     trustLocalhost,
@@ -36,7 +36,7 @@ func TestAllowNetsSkipEveryCheck(t *testing.T) {
 		rateLimitPerMinute: "1",
 	})
 
-	// Neither SWW_DENY_NETS, the country lists nor the limit of one
+	// Neither SWW_WAF_DENY_NETS, the country lists nor the limit of one
 	// request a minute refuses the client, and its country is not looked
 	// up.
 	wantAnswers(t, addr, out, []sentRequest{

internal/discriminator/trappaths_test.go

@@ -14,14 +14,14 @@ import (
 // trapPaths is the setting's name, and trapPathList what the tests set it
 // to.
 const (
-	trapPaths    = "SWW_TRAP_PATHS"
+	trapPaths    = "SWW_WAF_TRAP_PATHS"
 	trapPathList = "/wp-login.php,/xmlrpc.php"
 )
 
 func TestTrapPathBansAsABanRuleDoes(t *testing.T) {
 	t.Parallel()
 
-	const allowed = "192.0.2.60" // in SWW_ALLOW_NETS
+	const allowed = "192.0.2.60" // in SWW_WAF_ALLOW_NETS
 
 	// A block rule for the same path: the trap path comes first.
 	s, clk, server := startWithClock(t, "", map[string]string{
@@ -38,7 +38,7 @@ func TestTrapPathBansAsABanRuleDoes(t *testing.T) {
 		s.request(otherClient, path, http.StatusOK, requestlog.ActionForward)
 	}
 
-	// A client in SWW_ALLOW_NETS is not checked.
+	// A client in SWW_WAF_ALLOW_NETS is not checked.
 	s.request(allowed, "/xmlrpc.php", http.StatusOK, requestlog.ActionForward)
 
 	// The query is not part of the path.
@@ -103,8 +103,8 @@ func TestTrapPathsNeedNoRuleFiles(t *testing.T) {
 	t.Parallel()
 
 	s, _, _ := startWithClock(t, "", map[string]string{
-		trapPaths:           trapPathList,
-		"SWW_RULES_ENABLED": "false",
+		trapPaths:               trapPathList,
+		"SWW_WAF_RULES_ENABLED": "false",
 	})
 
 	s.request(client, "/xmlrpc.php", http.StatusForbidden, requestlog.ActionBanned)

internal/lookup/file.go

@@ -24,7 +24,7 @@ const quietTime = 2 * time.Second
 // FileParams are what OpenFile needs.
 type FileParams struct {
 	// Path is the lookup database, the IPinfo Lite file in its .mmdb form
-	// (SWW_LOOKUP_DB_PATH).
+	// (SWW_WAF_LOOKUP_DB_PATH).
 	Path string
 	// Now tells the time, normally time.Now.
 	Now func() time.Time
@@ -221,12 +221,12 @@ func (f *File) use(reader *maxminddb.Reader) {
 func read(path string) (*maxminddb.Reader, error) {
 	data, err := os.ReadFile(path) //nolint:gosec // the file the admin names
 	if err != nil {
-		return nil, fmt.Errorf("SWW_LOOKUP_DB_PATH cannot be read: %w", err)
+		return nil, fmt.Errorf("SWW_WAF_LOOKUP_DB_PATH cannot be read: %w", err)
 	}
 
 	reader, err := maxminddb.OpenBytes(data)
 	if err != nil {
-		return nil, fmt.Errorf("SWW_LOOKUP_DB_PATH %s is not a .mmdb file: %w", path, err)
+		return nil, fmt.Errorf("SWW_WAF_LOOKUP_DB_PATH %s is not a .mmdb file: %w", path, err)
 	}
 
 	return reader, nil

internal/lookup/file_internal_test.go

@@ -99,9 +99,9 @@ func TestFileThatCannotBeReadIsAnError(t *testing.T) {
 	writeFile(t, notDatabase, "not a lookup database\n")
 
 	for path, want := range map[string]string{
-		missing: "SWW_LOOKUP_DB_PATH cannot be read: open " + missing +
+		missing: "SWW_WAF_LOOKUP_DB_PATH cannot be read: open " + missing +
 			": no such file or directory",
-		notDatabase: "SWW_LOOKUP_DB_PATH " + notDatabase +
+		notDatabase: "SWW_WAF_LOOKUP_DB_PATH " + notDatabase +
 			" is not a .mmdb file: error opening database: invalid MaxMind DB file",
 	} {
 		_, err := OpenFile(FileParams{
@@ -216,7 +216,7 @@ func TestReplacementThatCannotBeReadLeavesTheFileInUseWithOneAlert(t *testing.T)
 			Reason: "the lookup database cannot be read, and the one read before stays in use",
 			Detail: map[string]any{
 				"file": path,
-				"error": "SWW_LOOKUP_DB_PATH " + path + " is not a .mmdb file: " +
+				"error": "SWW_WAF_LOOKUP_DB_PATH " + path + " is not a .mmdb file: " +
 					"error opening database: invalid MaxMind DB file",
 			},
 		})

internal/lookup/lookup.go

@@ -1,6 +1,6 @@
 // Package lookup looks up each client's AS number and country, through
 // the GeoJS web service or in the lookup database, the IPinfo Lite file
-// SWW_LOOKUP_DB_PATH names. GeoJS's answers are kept in memory, for at
+// SWW_WAF_LOOKUP_DB_PATH names. GeoJS's answers are kept in memory, for at
 // most 100,000 clients and for 7 days each, and are written to
 // lookups.json and read from it by the state package.
 package lookup
@@ -66,7 +66,7 @@ type Params struct {
 	URL string
 	// Timeout is how long a request waits for its client's first answer,
 	// and how long a request to GeoJS may take before it is abandoned
-	// (SWW_LOOKUP_TIMEOUT).
+	// (SWW_WAF_LOOKUP_TIMEOUT).
 	Timeout time.Duration
 	// Wait is true when a setting needs each request's answer before the
 	// request goes on. Otherwise no request waits for one.

internal/metrics/metrics.go

@@ -62,8 +62,8 @@ type Metrics struct {
 
 // New returns the metrics, with the Go runtime's and the process's own.
 // topN is how many countries and how many AS numbers get series of their
-// own (SWW_METRICS_TOP_N). Every metric carries instanceName
-// (SWW_INSTANCE_NAME) as its label instance.
+// own (SWW_WAF_METRICS_TOP_N). Every metric carries instanceName
+// (SWW_WAF_INSTANCE_NAME) as its label instance.
 //
 //nolint:funlen // a few lines for each metric, a list that grows with them
 func New(topN int, instanceName string) *Metrics {
@@ -102,7 +102,7 @@ func New(topN int, instanceName string) *Metrics {
 		offences: counterVec("sww_offences_total",
 			"Offences, by kind.", []string{"kind"}),
 		wafMatches: counterVec("sww_waf_matches_total",
-			"Requests that matched a rule of the Core Rule Set, by SWW_WAF_MODE "+
+			"Requests that matched a rule of the Core Rule Set, by SWW_WAF_CORE_RULE_SET_MODE "+
 				"and the rule's id.", []string{"mode", "rule_id"}),
 		countries: newCountries(topN),
 		asns:      newASNs(topN),
@@ -214,13 +214,13 @@ func (m *Metrics) AddRules(ruleFiles *rules.Files) {
 }
 
 // AddRemoteLog adds the metrics of sending the log lines to
-// SWW_LOG_REMOTE_URL, read from remote as the metrics are asked for: the
+// SWW_WAF_LOG_REMOTE_URL, read from remote as the metrics are asked for: the
 // lines sent, those dropped, and those waiting in the buffer.
 func (m *Metrics) AddRemoteLog(remote *remotelog.Sender) {
 	m.registry.MustRegister(
 		prometheus.NewCounterFunc(prometheus.CounterOpts{
 			Name: "sww_remote_log_lines_sent_total",
-			Help: "Log lines sent to SWW_LOG_REMOTE_URL.",
+			Help: "Log lines sent to SWW_WAF_LOG_REMOTE_URL.",
 		}, func() float64 {
 			return float64(remote.Sent())
 		}),
@@ -313,7 +313,7 @@ func (m *Metrics) AddReputation(lists *reputation.Lists, dnsbl *reputation.DNSBL
 // AddAbuseIPDB adds the metrics of AbuseIPDB, with the source abuseipdb,
 // read from abuseIPDB as the metrics are asked for: the checks made, those
 // that failed, and how many checks the day's budget has left. It is
-// called once, after AddReputation, while SWW_ABUSEIPDB_KEY is set.
+// called once, after AddReputation, while SWW_WAF_ABUSEIPDB_KEY is set.
 func (m *Metrics) AddAbuseIPDB(abuseIPDB *reputation.AbuseIPDB) {
 	source := prometheus.Labels{sourceLabel: reputation.AbuseIPDBSource}
 
@@ -322,7 +322,7 @@ func (m *Metrics) AddAbuseIPDB(abuseIPDB *reputation.AbuseIPDB) {
 	m.registry.MustRegister(
 		prometheus.NewGaugeFunc(prometheus.GaugeOpts{
 			Name:        "sww_reputation_daily_budget_remaining",
-			Help:        "Checks of the day's SWW_ABUSEIPDB_DAILY_BUDGET not yet spent.",
+			Help:        "Checks of the day's SWW_WAF_ABUSEIPDB_DAILY_BUDGET not yet spent.",
 			ConstLabels: source,
 		}, func() float64 {
 			return float64(abuseIPDB.BudgetLeft())
@@ -363,8 +363,8 @@ func (m *Metrics) AddAlerts(queue *alerts.Queue) {
 			}),
 			prometheus.NewCounterFunc(prometheus.CounterOpts{
 				Name: "sww_alerts_suppressed_total",
-				Help: "Alerts held back: repeats within SWW_ALERT_COOLDOWN, and " +
-					"alerts past SWW_ALERT_MAX_PER_HOUR, for the hour's summary.",
+				Help: "Alerts held back: repeats within SWW_WAF_ALERT_COOLDOWN, and " +
+					"alerts past SWW_WAF_ALERT_MAX_PER_HOUR, for the hour's summary.",
 				ConstLabels: destination,
 			}, func() float64 {
 				return float64(queue.Suppressed())
@@ -442,7 +442,7 @@ func (m *Metrics) RuleMatched(id, action string) {
 }
 
 // WAFMatched counts a request that matched the Core Rule Set's rule id,
-// with SWW_WAF_MODE at mode.
+// with SWW_WAF_CORE_RULE_SET_MODE at mode.
 func (m *Metrics) WAFMatched(mode string, id int) {
 	m.wafMatches.WithLabelValues(mode, strconv.Itoa(id)).Inc()
 }

internal/ratelimit/ratelimit.go

@@ -2,7 +2,7 @@
 // and bytes counted over a minute, an hour and a day, as the "Counting
 // method" section of SPEC.md describes, which tell when a request takes
 // the client over a rate limit or a byte limit, and each client's history
-// since it was first seen. At most SWW_MAX_TRACKED_CLIENTS clients are
+// since it was first seen. At most SWW_WAF_MAX_TRACKED_CLIENTS clients are
 // kept, in memory, and written to clients.json and read from it by the
 // state package.
 package ratelimit
@@ -156,7 +156,7 @@ type Request struct {
 }
 
 // New returns a Limiter for limits, with no client counted yet, whose
-// table holds at most maxClients clients (SWW_MAX_TRACKED_CLIENTS). Past
+// table holds at most maxClients clients (SWW_WAF_MAX_TRACKED_CLIENTS). Past
 // it, the least recently seen client is dropped, with its history, and
 // starts afresh if it comes back.
 func New(limits Limits, maxClients int) *Limiter {

internal/ratelimit/ratelimit_test.go

@@ -13,7 +13,7 @@ import (
 const limit = 3
 
 // tableSize is the most clients the tests' tables hold, the default of
-// SWW_MAX_TRACKED_CLIENTS.
+// SWW_WAF_MAX_TRACKED_CLIENTS.
 const tableSize = 20000
 
 // whole is the percentage of each limit a client gets when nothing lowers

internal/remotelog/remotelog.go

@@ -1,5 +1,5 @@
 // Package remotelog sends the lines sww writes on stdout to the
-// remote log endpoint, SWW_LOG_REMOTE_URL, as the "Request log" section
+// remote log endpoint, SWW_WAF_LOG_REMOTE_URL, as the "Request log" section
 // of SPEC.md describes: each line as the message of an RFC 5424 syslog
 // record, over UDP, TCP or TLS. Lines wait in a bounded buffer, so a slow
 // or unreachable endpoint never holds up a request or stdout.
@@ -24,7 +24,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 
-// The forms of SWW_LOG_REMOTE_URL, by its scheme.
+// The forms of SWW_WAF_LOG_REMOTE_URL, by its scheme.
 const (
 	SchemeUDP = "syslog+udp"
 	SchemeTCP = "syslog+tcp"
@@ -56,18 +56,18 @@ const (
 
 // Params are what New needs.
 type Params struct {
-	// URL is the endpoint (SWW_LOG_REMOTE_URL): SchemeUDP, SchemeTCP or
+	// URL is the endpoint (SWW_WAF_LOG_REMOTE_URL): SchemeUDP, SchemeTCP or
 	// SchemeTLS, a host and a port.
 	URL *url.URL
 	// RootCAs are the certificates a SchemeTLS endpoint's certificate
-	// must chain to (SWW_LOG_REMOTE_TLS_CA_FILE), nil for the host's.
+	// must chain to (SWW_WAF_LOG_REMOTE_TLS_CA_FILE), nil for the host's.
 	RootCAs *x509.CertPool
 	// Buffer is the most lines held while they wait to be sent
-	// (SWW_LOG_REMOTE_BUFFER).
+	// (SWW_WAF_LOG_REMOTE_BUFFER).
 	Buffer int
 	// Facility is the number of the records' syslog facility
-	// (SWW_LOG_REMOTE_FACILITY), and AppName their APP-NAME
-	// (SWW_LOG_REMOTE_APP_NAME).
+	// (SWW_WAF_LOG_REMOTE_FACILITY), and AppName their APP-NAME
+	// (SWW_WAF_LOG_REMOTE_APP_NAME).
 	Facility int
 	AppName  string
 }
@@ -243,7 +243,7 @@ func (s *Sender) send(ctx context.Context, processLog *slog.Logger) net.Conn {
 			}
 		}
 
-		processLog.Warn("sending to SWW_LOG_REMOTE_URL failed",
+		processLog.Warn("sending to SWW_WAF_LOG_REMOTE_URL failed",
 			"error", err.Error(), "connecting_again_in", delay.String())
 
 		select {

internal/remotelog/remotelog_test.go

@@ -586,7 +586,7 @@ func wantRetries(t *testing.T, logged *output, delays ...string) {
 		var fields map[string]any
 
 		err := json.Unmarshal([]byte(line), &fields)
-		if err != nil || fields["msg"] != "sending to SWW_LOG_REMOTE_URL failed" {
+		if err != nil || fields["msg"] != "sending to SWW_WAF_LOG_REMOTE_URL failed" {
 			t.Fatalf("logged %q", line)
 		}
 

internal/reputation/abuseipdb.go

@@ -58,17 +58,17 @@ type Checks struct {
 // AbuseIPDBParams are what NewAbuseIPDB needs.
 type AbuseIPDBParams struct {
 	// URL is where clients are checked, normally AbuseIPDBURL, with Key,
-	// the account's key (SWW_ABUSEIPDB_KEY).
+	// the account's key (SWW_WAF_ABUSEIPDB_KEY).
 	URL string
 	Key string
-	// MinScore is the least score that is a hit (SWW_ABUSEIPDB_MIN_SCORE),
+	// MinScore is the least score that is a hit (SWW_WAF_ABUSEIPDB_MIN_SCORE),
 	// and DailyBudget the most checks made in a day, in UTC
-	// (SWW_ABUSEIPDB_DAILY_BUDGET).
+	// (SWW_WAF_ABUSEIPDB_DAILY_BUDGET).
 	MinScore    int64
 	DailyBudget int
 	// CacheTTL is how long a score is used after it was fetched
-	// (SWW_REPUTATION_CACHE_TTL), and Timeout how long a check may take
-	// (SWW_REPUTATION_TIMEOUT).
+	// (SWW_WAF_REPUTATION_CACHE_TTL), and Timeout how long a check may take
+	// (SWW_WAF_REPUTATION_TIMEOUT).
 	CacheTTL time.Duration
 	Timeout  time.Duration
 	// Now tells the time, normally time.Now in UTC.

internal/reputation/dnsbl.go

@@ -53,15 +53,15 @@ type Verdict struct {
 // DNSBLParams are what NewDNSBL needs.
 type DNSBLParams struct {
 	// Zones are the DNSBL zones clients are asked about in
-	// (SWW_DNSBL_ZONES).
+	// (SWW_WAF_DNSBL_ZONES).
 	Zones []string
 	// Resolver is the resolver they are asked through
-	// (SWW_DNSBL_RESOLVER), or, while it is the zero AddrPort, the
+	// (SWW_WAF_DNSBL_RESOLVER), or, while it is the zero AddrPort, the
 	// host's, as /etc/resolv.conf names it.
 	Resolver netip.AddrPort
 	// CacheTTL is how long a verdict is used after it was fetched
-	// (SWW_REPUTATION_CACHE_TTL), and Timeout how long a query may take
-	// (SWW_REPUTATION_TIMEOUT).
+	// (SWW_WAF_REPUTATION_CACHE_TTL), and Timeout how long a query may take
+	// (SWW_WAF_REPUTATION_TIMEOUT).
 	CacheTTL time.Duration
 	Timeout  time.Duration
 	// Now tells the time, normally time.Now in UTC.
@@ -127,13 +127,13 @@ func NewDNSBL(params DNSBLParams) *DNSBL {
 	}
 }
 
-// Zones returns the zones, in the order SWW_DNSBL_ZONES names them.
+// Zones returns the zones, in the order SWW_WAF_DNSBL_ZONES names them.
 func (d *DNSBL) Zones() []string {
 	return slices.Clone(d.params.Zones)
 }
 
 // ListedBy returns the zones whose verdict on addr, a client's address,
-// lists it, in the order SWW_DNSBL_ZONES names them, each with its key
+// lists it, in the order SWW_WAF_DNSBL_ZONES names them, each with its key
 // masked, as config.MaskZoneKey masks it, since they go to the request
 // log, the alerts and the metrics. A verdict is used until CacheTTL has
 // passed since it was fetched. Each zone without one is asked about addr
@@ -210,7 +210,7 @@ func (d *DNSBL) Snapshot() []Verdict {
 }
 
 // Load keeps verdicts, read from reputation.json, in place of those it
-// keeps, but for those of a zone SWW_DNSBL_ZONES does not name, and,
+// keeps, but for those of a zone SWW_WAF_DNSBL_ZONES does not name, and,
 // past maxVerdicts, those fetched longest ago. One fetched CacheTTL ago or
 // more is neither used nor written, as for any verdict.
 func (d *DNSBL) Load(verdicts []Verdict) {

internal/reputation/dnsbl_test.go

@@ -40,8 +40,8 @@ const (
 	// zone and otherZone are the DNSBL zones the tests name.
 	zone      = "dnsbl.example"
 	otherZone = "other.example"
-	// cacheTTL is the tests' SWW_REPUTATION_CACHE_TTL, and timeout their
-	// SWW_REPUTATION_TIMEOUT: a second, the least time /etc/resolv.conf
+	// cacheTTL is the tests' SWW_WAF_REPUTATION_CACHE_TTL, and timeout their
+	// SWW_WAF_REPUTATION_TIMEOUT: a second, the least time /etc/resolv.conf
 	// can have Go's resolver wait for one server, so that it is the
 	// DNSBL's own timeout that ends a query, whatever that file says.
 	cacheTTL = 24 * time.Hour
@@ -419,7 +419,7 @@ func TestNeitherAVerdictOfAZoneNotNamedNorOnePastItsTTLIsKept(t *testing.T) {
 	dnsbl := reputation.NewDNSBL(p)
 
 	// The last verdict still in use, one fetched a TTL ago, and one of a
-	// zone SWW_DNSBL_ZONES does not name.
+	// zone SWW_WAF_DNSBL_ZONES does not name.
 	inUse := reputation.Verdict{
 		Zone: zone, Client: netip.MustParseAddr(listed), Listed: true,
 		Fetched: now.Add(-cacheTTL + time.Nanosecond),

internal/reputation/reputation.go

@@ -1,10 +1,10 @@
 // Package reputation fetches the lists the settings name by URL: the
-// blocklists of SWW_BLOCKLIST_URLS, the file of AS:percent lines
-// SWW_ASN_LIMIT_PERCENT_URL names, and the decision list of the CrowdSec
-// engine SWW_CROWDSEC_LAPI_URL names. It keeps the last good copy of
+// blocklists of SWW_WAF_BLOCKLIST_URLS, the file of AS:percent lines
+// SWW_WAF_ASN_LIMIT_PERCENT_URL names, and the decision list of the CrowdSec
+// engine SWW_WAF_CROWDSEC_LAPI_URL names. It keeps the last good copy of
 // each, whole, comment lines included, which is used while a fetch fails,
 // and when each was last tried. It also asks the DNSBL zones of
-// SWW_DNSBL_ZONES about clients, and keeps their verdicts, and checks
+// SWW_WAF_DNSBL_ZONES about clients, and keeps their verdicts, and checks
 // clients with AbuseIPDB, and keeps their scores and the checks spent
 // today. The state package writes all of these to reputation.json and
 // reads them from it, so that a restart keeps them too.
@@ -66,18 +66,18 @@ type List struct {
 
 // Params are what New needs.
 type Params struct {
-	// BlocklistURLs are the blocklists (SWW_BLOCKLIST_URLS), and
+	// BlocklistURLs are the blocklists (SWW_WAF_BLOCKLIST_URLS), and
 	// ASNLimitPercentURL the file of AS:percent lines
-	// (SWW_ASN_LIMIT_PERCENT_URL), "" while it is unset.
+	// (SWW_WAF_ASN_LIMIT_PERCENT_URL), "" while it is unset.
 	BlocklistURLs      []string
 	ASNLimitPercentURL string
 	// CrowdSecDecisionsURL is the CrowdSec decision list, "" while
-	// SWW_CROWDSEC_LAPI_URL is unset, fetched with CrowdSecKey
-	// (SWW_CROWDSEC_LAPI_KEY).
+	// SWW_WAF_CROWDSEC_LAPI_URL is unset, fetched with CrowdSecKey
+	// (SWW_WAF_CROWDSEC_LAPI_KEY).
 	CrowdSecDecisionsURL string
 	CrowdSecKey          string
 	// Refresh is how long after a list was last fetched or tried it is
-	// fetched again (SWW_BLOCKLIST_REFRESH), but for the CrowdSec decision
+	// fetched again (SWW_WAF_BLOCKLIST_REFRESH), but for the CrowdSec decision
 	// list, which is fetched again crowdSecRefresh after.
 	Refresh time.Duration
 	// Now tells the time, normally time.Now in UTC.
@@ -152,7 +152,7 @@ func New(params Params) *Lists {
 }
 
 // URLs returns the URL of every list: the blocklists' in the order
-// SWW_BLOCKLIST_URLS names them, then SWW_ASN_LIMIT_PERCENT_URL, then
+// SWW_WAF_BLOCKLIST_URLS names them, then SWW_WAF_ASN_LIMIT_PERCENT_URL, then
 // the CrowdSec decision list's.
 func (l *Lists) URLs() []string {
 	urls := slices.Clone(l.params.BlocklistURLs)
@@ -168,7 +168,7 @@ func (l *Lists) URLs() []string {
 }
 
 // ListedBy returns the URLs of the blocklists whose copy lists addr, in
-// the order SWW_BLOCKLIST_URLS names them.
+// the order SWW_WAF_BLOCKLIST_URLS names them.
 func (l *Lists) ListedBy(addr netip.Addr) []string {
 	l.mu.Lock()
 	defer l.mu.Unlock()
@@ -551,7 +551,7 @@ func parseNetblock(text string) (netip.Prefix, bool) {
 }
 
 // parsePercents reads the lines of the file of AS:percent lines, each an
-// AS number, : and a percentage, as SWW_ASN_LIMIT_PERCENT takes them. An
+// AS number, : and a percentage, as SWW_WAF_ASN_LIMIT_PERCENT takes them. An
 // AS number listed more than once gets the lowest of its percentages.
 func parsePercents(lines []string) (entries, error) {
 	found := entries{percents: map[string]int64{}}

internal/reputation/reputation_test.go

@@ -34,8 +34,8 @@ const (
 	dropURL = "https://lists.example/drop.txt"
 	torURL  = "https://lists.example/tor.txt"
 	asnURL  = "https://lists.example/asn.txt"
-	// refresh is the tests' SWW_BLOCKLIST_REFRESH, and cooldown their
-	// SWW_ALERT_COOLDOWN, longer than it.
+	// refresh is the tests' SWW_WAF_BLOCKLIST_REFRESH, and cooldown their
+	// SWW_WAF_ALERT_COOLDOWN, longer than it.
 	refresh  = 24 * time.Hour
 	cooldown = 48 * time.Hour
 	// drop is a blocklist as the Spamhaus DROP list is written, with an
@@ -116,7 +116,7 @@ func TestClientIsListedByEachBlocklistThatListsIt(t *testing.T) {
 		}}
 		lists := start(t, servers, params(torURL, dropURL))
 
-		// In the order SWW_BLOCKLIST_URLS names them.
+		// In the order SWW_WAF_BLOCKLIST_URLS names them.
 		wantListedBy(t, lists, "203.0.113.9", torURL, dropURL)
 		wantListedBy(t, lists, "203.0.113.8", dropURL)
 	})

internal/requestlog/requestlog.go

@@ -33,12 +33,12 @@ const (
 	// rule.
 	ActionRuleBlocked = "rule_blocked"
 	// ActionWAFBlocked is a request refused because the Core Rule Set
-	// scored it at or over SWW_WAF_ANOMALY_THRESHOLD.
+	// scored it at or over SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD.
 	ActionWAFBlocked = "waf_blocked"
 	// ActionDenied is a request refused because its client is in
-	// SWW_DENY_NETS, in a blocklist while SWW_BLOCKLIST_ACTION is deny,
+	// SWW_WAF_DENY_NETS, in a blocklist while SWW_WAF_BLOCKLIST_ACTION is deny,
 	// or listed by a DNSBL zone, or scored a hit by AbuseIPDB, while
-	// SWW_REPUTATION_ACTION is deny.
+	// SWW_WAF_REPUTATION_ACTION is deny.
 	ActionDenied = "denied"
 	// ActionCountryDenied is a request refused for its client's country.
 	ActionCountryDenied = "country_denied"
@@ -112,7 +112,7 @@ type Line struct {
 	ContentType  string `json:"content_type,omitempty"`
 	// ContentLength is the length of its body the request announced.
 	ContentLength int64 `json:"content_length,omitempty"`
-	// RequestHeaders are the headers SWW_LOG_REQUEST_HEADERS names that
+	// RequestHeaders are the headers SWW_WAF_LOG_REQUEST_HEADERS names that
 	// the request carried, by name in lower case.
 	RequestHeaders   map[string]string `json:"request_headers,omitempty"`
 	HasAuthorization bool              `json:"has_authorization,omitempty"`
@@ -202,7 +202,7 @@ type RProxyLine struct {
 	DurationRequest  float64 `json:"duration_request"`
 	DurationResponse float64 `json:"duration_response"`
 	// Disposition is the valid disposition discriminator answered or, while
-	// DefaultDisposition is true, the value of SWRP_DEFAULT_DISPOSITION. It is ""
+	// DefaultDisposition is true, the value of SWW_RPROXY_DEFAULT_DISPOSITION. It is ""
 	// when neither gave one.
 	Disposition        string `json:"disposition,omitempty"`
 	DefaultDisposition bool   `json:"default_disposition,omitempty"`
@@ -250,8 +250,8 @@ func Milliseconds(d time.Duration) float64 {
 
 // NewProcessLogger returns the logger for the process's own messages:
 // JSON lines on w, marked "type":"process", with the time in the same form
-// as a request line's, and instanceName, SWW_INSTANCE_NAME, as instance.
-// It writes only the messages at level, SWW_LOG_LEVEL, or more severe;
+// as a request line's, and instanceName, SWW_WAF_INSTANCE_NAME, as instance.
+// It writes only the messages at level, SWW_WAF_LOG_LEVEL, or more severe;
 // the request lines Write writes are never held back.
 func NewProcessLogger(w io.Writer, instanceName string, level slog.Level) *slog.Logger {
 	handler := slog.NewJSONHandler(w, &slog.HandlerOptions{

internal/rproxy/bodies.go

@@ -10,16 +10,16 @@ import (
 )
 
 // errResponseTooLarge ends an app's response body that is longer than
-// SWRP_MAX_RESPONSE_SIZE.
+// SWW_RPROXY_MAX_RESPONSE_SIZE.
 var errResponseTooLarge = errors.New(
-	"the response body is over SWRP_MAX_RESPONSE_SIZE")
+	"the response body is over SWW_RPROXY_MAX_RESPONSE_SIZE")
 
 // requestBody is the visitor's request body. rproxy first reads up to the first
 // 64 KiB of it into held, and then, on its way to the app, the transport reads
 // it on a goroutine of its own.
 type requestBody struct {
 	// body is the visitor's body, ending in an *http.MaxBytesError past
-	// SWRP_MAX_REQUEST_SIZE.
+	// SWW_RPROXY_MAX_REQUEST_SIZE.
 	body io.ReadCloser
 	rq   *request
 	// held is the part read before the request goes to the app, which Read gives
@@ -68,7 +68,7 @@ func (b *requestBody) Close() error {
 // responseBody is the app's response body on its way to the visitor.
 type responseBody struct {
 	// body is the app's body, ending in an *http.MaxBytesError past
-	// SWRP_MAX_RESPONSE_SIZE.
+	// SWW_RPROXY_MAX_RESPONSE_SIZE.
 	body io.ReadCloser
 	rq   *request
 }

internal/rproxy/discriminator.go

@@ -65,9 +65,9 @@ func (rq *request) handleNoUsableAnswer(ctx context.Context, err error) {
 		rq.answer(http.StatusBadGateway)
 	default:
 		// discriminator cannot be connected to, does not answer at all, or does not answer
-		// within SWRP_TIMEOUT_MS. A request that keeps discriminator busy past
-		// SWRP_TIMEOUT_MS, like any request while discriminator is overloaded, gets
-		// SWRP_DEFAULT_DISPOSITION here. deny closes this, at the cost of answering 503
+		// within SWW_RPROXY_TIMEOUT_MS. A request that keeps discriminator busy past
+		// SWW_RPROXY_TIMEOUT_MS, like any request while discriminator is overloaded, gets
+		// SWW_RPROXY_DEFAULT_DISPOSITION here. deny closes this, at the cost of answering 503
 		// whenever discriminator is slow. Making such requests hard to send is
 		// https://git.eeqj.de/sneak/smallwebwaf/issues/182.
 		rq.h.processLog.Warn("discriminator gave no answer", "error", err.Error())
@@ -84,7 +84,7 @@ func (rq *request) handleNoUsableAnswer(ctx context.Context, err error) {
 }
 
 // ask sends discriminator the question, and returns its answer, which must have come
-// whole within SWRP_TIMEOUT_MS. It ends when ctx does, as when the visitor goes
+// whole within SWW_RPROXY_TIMEOUT_MS. It ends when ctx does, as when the visitor goes
 // away.
 func (rq *request) ask(ctx context.Context) (*discriminatorAnswer, error) {
 	ctx, cancel := context.WithTimeout(ctx, rq.h.config.Timeout)
@@ -228,7 +228,7 @@ func (h *handler) sendReport(ctx context.Context, report *discriminator.Report)
 }
 
 // postReport posts report to discriminator, and waits for its answer for up to
-// SWRP_TIMEOUT_MS.
+// SWW_RPROXY_TIMEOUT_MS.
 func (h *handler) postReport(ctx context.Context, report *discriminator.Report) error {
 	body, err := json.Marshal(report)
 	if err != nil {

internal/rproxy/limits_test.go

@@ -33,13 +33,9 @@ func announcedLength(size int) string {
 func TestServerHasTheFixedLimits(t *testing.T) {
 	t.Parallel()
 
-	cfg, err := config.RProxyFromEnvironment(func(name string) (string, bool) {
-		if name == "SWRP_WAF_BACKEND" {
-			return nowhere, true
-		}
-
-		return "", false
-	})
+	cfg, err := config.RProxyFromEnvironment(viperFrom(map[string]string{
+		"SWW_RPROXY_WAF_BACKEND": nowhere,
+	}))
 	if err != nil {
 		t.Fatalf("settings: %v", err)
 	}

internal/rproxy/request.go

@@ -50,10 +50,10 @@ type request struct {
 	start       time.Time
 
 	// disposition is what is done with the request: discriminator's valid disposition,
-	// or SWRP_DEFAULT_DISPOSITION. It is "" when neither gave one.
+	// or SWW_RPROXY_DEFAULT_DISPOSITION. It is "" when neither gave one.
 	disposition string
 	// answered is true when discriminator gave disposition, which makes a report due,
-	// and byDefault when SWRP_DEFAULT_DISPOSITION did.
+	// and byDefault when SWW_RPROXY_DEFAULT_DISPOSITION did.
 	answered  bool
 	byDefault bool
 	// asn and country are discriminator's X-Client-ASN and X-Client-Country, for the
@@ -118,10 +118,10 @@ func (rq *request) answerHealth() {
 }
 
 // readFirstPartOfBody reads up to the first 64 KiB of the body into memory,
-// within SWRP_MAX_REQUEST_TIME_MS, and reports whether the request goes on. A
+// within SWW_RPROXY_MAX_REQUEST_TIME_MS, and reports whether the request goes on. A
 // visitor too slow to send it is answered 408. For a malformed chunk, or a
 // visitor that went away or stopped its sending side, the connection is closed
-// without an answer. A body over SWRP_MAX_REQUEST_SIZE goes on with the part
+// without an answer. A body over SWW_RPROXY_MAX_REQUEST_SIZE goes on with the part
 // read, so that discriminator is asked first; passToApp then refuses it.
 func (rq *request) readFirstPartOfBody() bool {
 	if rq.body == nil {
@@ -190,7 +190,7 @@ func (rq *request) forward(ctx context.Context) {
 }
 
 // rewrite makes the request the app receives: the visitor's request, unchanged,
-// sent to SWRP_UPSTREAM_URL, with the forwarded headers and the request's id set,
+// sent to SWW_RPROXY_UPSTREAM_URL, with the forwarded headers and the request's id set,
 // without any X-Client-ASN or X-Client-Country the visitor sent, and with
 // discriminator's.
 func (rq *request) rewrite(pr *httputil.ProxyRequest) {
@@ -325,7 +325,7 @@ func (rq *request) send(status int, body []byte) {
 
 // prepareOwnAnswer readies the connection for an answer rproxy gives itself: the
 // reading of a body that has not arrived whole ends at deadline, and the answer
-// has SWRP_MAX_RESPONSE_TIME_MS from now to reach the visitor, even when the app
+// has SWW_RPROXY_MAX_RESPONSE_TIME_MS from now to reach the visitor, even when the app
 // used that time up first.
 func (rq *request) prepareOwnAnswer(deadline time.Time) {
 	rq.stopReadingBody(deadline)
@@ -419,7 +419,7 @@ func (rq *request) bytesEachWay() (int64, int64) {
 }
 
 // requestDeadline is when the visitor must have sent its whole request, or zero
-// when SWRP_MAX_REQUEST_TIME_MS is off.
+// when SWW_RPROXY_MAX_REQUEST_TIME_MS is off.
 func (rq *request) requestDeadline() time.Time {
 	limit := rq.h.config.MaxRequestTime
 	if limit == 0 {
@@ -440,7 +440,7 @@ func (rq *request) stopReadingBody(deadline time.Time) {
 	_ = rq.rc.SetReadDeadline(deadline)
 }
 
-// startRequestTimer starts SWRP_MAX_REQUEST_TIME_MS, which runs from the
+// startRequestTimer starts SWW_RPROXY_MAX_REQUEST_TIME_MS, which runs from the
 // request's headers being read until the app has been sent the whole request.
 func (rq *request) startRequestTimer() {
 	deadline := rq.requestDeadline()
@@ -454,7 +454,7 @@ func (rq *request) startRequestTimer() {
 	rq.requestTimer = time.AfterFunc(time.Until(deadline), rq.requestTimedOut)
 }
 
-// requestTimedOut is called when SWRP_MAX_REQUEST_TIME_MS runs out while the
+// requestTimedOut is called when SWW_RPROXY_MAX_REQUEST_TIME_MS runs out while the
 // request is still on its way to the app. The answer names the side rproxy was
 // waiting on at that moment: 408 when it was waiting for the visitor to send more
 // of its body, 504 when it was waiting for the app to be reached or to take what
@@ -500,7 +500,7 @@ func (rq *request) gotFirstResponseByte() {
 }
 
 // wroteRequest is called once the app has been sent the whole request:
-// SWRP_MAX_REQUEST_TIME_MS ends and SWRP_MAX_RESPONSE_TIME_MS starts.
+// SWW_RPROXY_MAX_REQUEST_TIME_MS ends and SWW_RPROXY_MAX_RESPONSE_TIME_MS starts.
 func (rq *request) wroteRequest(info httptrace.WroteRequestInfo) {
 	if info.Err != nil {
 		return // the transport gives up, or tries again
@@ -524,7 +524,7 @@ func (rq *request) wroteRequest(info httptrace.WroteRequestInfo) {
 	}
 }
 
-// responseTimedOut is called when SWRP_MAX_RESPONSE_TIME_MS runs out before the
+// responseTimedOut is called when SWW_RPROXY_MAX_RESPONSE_TIME_MS runs out before the
 // app has sent its whole answer.
 func (rq *request) responseTimedOut() {
 	rq.mu.Lock()
@@ -539,7 +539,7 @@ func (rq *request) responseTimedOut() {
 // answer before the visitor has sent its whole body, as with a 404 it sends
 // without reading it. The time limits then run on: until the transport's read of
 // the body returns, Go's server cannot send the answer, and
-// SWRP_MAX_REQUEST_TIME_MS is what ends that read for a visitor that stops
+// SWW_RPROXY_MAX_REQUEST_TIME_MS is what ends that read for a visitor that stops
 // sending.
 func (rq *request) responseReceived() {
 	if rq.body != nil && !rq.body.received.Load() {
@@ -549,7 +549,7 @@ func (rq *request) responseReceived() {
 	rq.stopTimers()
 }
 
-// setResponseDeadline sets SWRP_MAX_RESPONSE_TIME_MS on the connection to the
+// setResponseDeadline sets SWW_RPROXY_MAX_RESPONSE_TIME_MS on the connection to the
 // visitor: the app's answer must reach the visitor within it of the end of the
 // request.
 func (rq *request) setResponseDeadline() {

internal/rproxy/rproxy.go

@@ -1,9 +1,10 @@
 // Package rproxy is the reverse proxy in front of one app that asks discriminator
 // about each request. It passes a request discriminator allows to the app and the
 // app's answer back, within the size and time limits. Any other answer from
-// discriminator goes to the visitor as discriminator gave it. SWRP_DEFAULT_DISPOSITION
+// discriminator goes to the visitor as discriminator gave it.
+// SWW_RPROXY_DEFAULT_DISPOSITION
 // decides only when discriminator cannot be connected to, does not answer at all, or
-// does not answer within SWRP_TIMEOUT_MS. rproxy itself refuses a request with a
+// does not answer within SWW_RPROXY_TIMEOUT_MS. rproxy itself refuses a request with a
 // method it does not pass on, or one it cannot put to discriminator as the visitor
 // sent it. It keeps nothing between requests and never touches disk. "rproxy" in
 // SPEC.md says what it does.
@@ -71,7 +72,7 @@ type Server struct {
 
 // New returns the server `sww rproxy` runs. Go's server itself refuses
 // a request line and headers over requestHeaderMaxBytes, with 431, closes a
-// connection idle for idleTimeout, and applies SWRP_MAX_REQUEST_TIME_MS while
+// connection idle for idleTimeout, and applies SWW_RPROXY_MAX_REQUEST_TIME_MS while
 // the headers arrive. The handler applies the time and size limits from then
 // on.
 func New(params Params) *Server {
@@ -103,7 +104,7 @@ func New(params Params) *Server {
 }
 
 // WaitForReports returns once the reports being sent have gone or failed,
-// which SWRP_TIMEOUT_MS bounds. Any report after this call is dropped: that of
+// which SWW_RPROXY_TIMEOUT_MS bounds. Any report after this call is dropped: that of
 // a WebSocket that closes while rproxy stops, for one.
 func (s *Server) WaitForReports() {
 	s.h.reportsMu.Lock()
@@ -212,7 +213,7 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 
 // passToApp passes the request on to the app, unless a limit or its path keeps
 // it from the app. discriminator answers a path under adminPrefix itself, so such a
-// request gets here only when SWRP_DEFAULT_DISPOSITION allowed it. ctx is the
+// request gets here only when SWW_RPROXY_DEFAULT_DISPOSITION allowed it. ctx is the
 // request's own context.
 func (rq *request) passToApp(ctx context.Context) {
 	maxBytes := rq.h.config.MaxRequestSize

internal/rproxy/rproxy_test.go

@@ -18,6 +18,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/spf13/viper"
+
 	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
@@ -43,13 +45,13 @@ const (
 
 // The settings the tests set.
 const (
-	timeoutSetting     = "SWRP_TIMEOUT_MS"
-	defaultDisposition = "SWRP_DEFAULT_DISPOSITION"
-	trustedProxies     = "SWRP_TRUSTED_PROXIES"
-	maxRequestSize     = "SWRP_MAX_REQUEST_SIZE"
-	maxResponseSize    = "SWRP_MAX_RESPONSE_SIZE"
-	maxRequestTime     = "SWRP_MAX_REQUEST_TIME_MS"
-	maxResponseTime    = "SWRP_MAX_RESPONSE_TIME_MS"
+	timeoutSetting     = "SWW_RPROXY_TIMEOUT_MS"
+	defaultDisposition = "SWW_RPROXY_DEFAULT_DISPOSITION"
+	trustedProxies     = "SWW_RPROXY_TRUSTED_PROXIES"
+	maxRequestSize     = "SWW_RPROXY_MAX_REQUEST_SIZE"
+	maxResponseSize    = "SWW_RPROXY_MAX_RESPONSE_SIZE"
+	maxRequestTime     = "SWW_RPROXY_MAX_REQUEST_TIME_MS"
+	maxResponseTime    = "SWW_RPROXY_MAX_RESPONSE_TIME_MS"
 )
 
 // The headers the tests set and look at.
@@ -345,6 +347,17 @@ func startServer(
 	return addr, out, server
 }
 
+// viperFrom returns a viper Set with each of settings, as the viper
+// config.NewViper returns one bound to a process's environment.
+func viperFrom(settings map[string]string) *viper.Viper {
+	v := viper.New()
+	for name, value := range settings {
+		v.Set(name, value)
+	}
+
+	return v
+}
+
 // startServerLogging is startServer with rproxy's request lines going to
 // requestLog and its process lines to processLog.
 func startServerLogging(
@@ -354,15 +367,11 @@ func startServerLogging(
 	t.Helper()
 
 	settings := map[string]string{
-		"SWRP_WAF_BACKEND": backend, "SWRP_UPSTREAM_URL": appURL,
+		"SWW_RPROXY_WAF_BACKEND": backend, "SWW_RPROXY_UPSTREAM_URL": appURL,
 	}
 	maps.Copy(settings, env)
 
-	cfg, err := config.RProxyFromEnvironment(func(name string) (string, bool) {
-		value, ok := settings[name]
-
-		return value, ok
-	})
+	cfg, err := config.RProxyFromEnvironment(viperFrom(settings))
 	if err != nil {
 		t.Fatalf("settings %v: %v", settings, err)
 	}

internal/rules/rules.go

@@ -1,5 +1,5 @@
 // Package rules reads the rule files: the plain text files in
-// SWW_RULES_DIR, one rule to a line, that each request is checked
+// SWW_WAF_RULES_DIR, one rule to a line, that each request is checked
 // against, as the "Rule files" section of SPEC.md describes. They are read
 // at start, and again once the directory has had no change for a short
 // time after one is edited, added or removed.
@@ -40,7 +40,7 @@ const (
 // extension ends the name of every rule file.
 const extension = ".rules"
 
-// quietTime is how long SWW_RULES_DIR must go without a change before
+// quietTime is how long SWW_WAF_RULES_DIR must go without a change before
 // the rule files are read again, so that a file still being written, such
 // as one saved in place, appended to or copied in with scp, is read only
 // once whole.
@@ -100,9 +100,9 @@ type Rule struct {
 
 // Params are what Load needs.
 type Params struct {
-	// Dir is the directory of the rule files (SWW_RULES_DIR).
+	// Dir is the directory of the rule files (SWW_WAF_RULES_DIR).
 	Dir string
-	// Enabled is SWW_RULES_ENABLED: while it is false, no file is read
+	// Enabled is SWW_WAF_RULES_ENABLED: while it is false, no file is read
 	// and no rule loaded.
 	Enabled bool
 	// ProcessLog receives how many rules were read, and the error in a
@@ -271,7 +271,7 @@ func (f *Files) logRead(count int) {
 func read(dir string) ([]Rule, string, error) {
 	entries, err := os.ReadDir(dir)
 	if err != nil {
-		return nil, dir, fmt.Errorf("SWW_RULES_DIR cannot be read: %w", err)
+		return nil, dir, fmt.Errorf("SWW_WAF_RULES_DIR cannot be read: %w", err)
 	}
 
 	var rules []Rule
@@ -299,7 +299,7 @@ func read(dir string) ([]Rule, string, error) {
 // readFile appends the rules of the rule file at path to rules. places
 // are where each id read so far is, and gain those of the file.
 func readFile(path string, rules []Rule, places map[string]string) ([]Rule, error) {
-	data, err := os.ReadFile(path) //nolint:gosec // a rule file, in SWW_RULES_DIR
+	data, err := os.ReadFile(path) //nolint:gosec // a rule file, in SWW_WAF_RULES_DIR
 	if err != nil {
 		return nil, err
 	}

internal/rules/rules_test.go

@@ -298,7 +298,7 @@ func TestDirectoryThatDoesNotExistStopsTheStart(t *testing.T) {
 
 	dir := filepath.Join(t.TempDir(), "rules.d")
 
-	wantRefused(t, dir, "SWW_RULES_DIR cannot be read: open "+dir+
+	wantRefused(t, dir, "SWW_WAF_RULES_DIR cannot be read: open "+dir+
 		": no such file or directory")
 }
 
@@ -321,7 +321,7 @@ func TestEmptyDirectoryLoadsNoRulesAndSaysSo(t *testing.T) {
 func TestRuleFilesOffReadNothing(t *testing.T) {
 	t.Parallel()
 
-	// SWW_RULES_DIR does not exist, which would stop the start.
+	// SWW_WAF_RULES_DIR does not exist, which would stop the start.
 	params, _ := newParams(filepath.Join(t.TempDir(), "rules.d"))
 	params.Enabled = false
 

internal/state/state.go

@@ -1,5 +1,5 @@
 // Package state keeps sww's state in JSON files in
-// SWW_STATE_DIR, as the "Persistent state" section of SPEC.md requires
+// SWW_WAF_STATE_DIR, as the "Persistent state" section of SPEC.md requires
 // and docs/state-files.md lists them:
 // bans.json holds the bans, clients.json each client's counters and
 // history, lookups.json GeoJS's answers, reputation.json the last try and
@@ -72,11 +72,11 @@ var (
 
 // Params are what Load needs.
 type Params struct {
-	// Dir is the directory of the state files (SWW_STATE_DIR).
+	// Dir is the directory of the state files (SWW_WAF_STATE_DIR).
 	Dir string
 	// WriteDelay is how long after a ban is made bans.json is written
-	// (SWW_STATE_WRITE_DELAY), and CounterInterval how often every file
-	// is (SWW_STATE_COUNTER_INTERVAL).
+	// (SWW_WAF_STATE_WRITE_DELAY), and CounterInterval how often every file
+	// is (SWW_WAF_STATE_COUNTER_INTERVAL).
 	WriteDelay      time.Duration
 	CounterInterval time.Duration
 	// Ledger, Limiter, GeoJS, Lists, DNSBL, AbuseIPDB, Alerts and Anomalies
@@ -185,7 +185,7 @@ type stateFile interface {
 func Load(params Params) (*Files, error) {
 	err := checkWritable(params.Dir)
 	if err != nil {
-		return nil, fmt.Errorf("SWW_STATE_DIR cannot be written: %w", err)
+		return nil, fmt.Errorf("SWW_WAF_STATE_DIR cannot be written: %w", err)
 	}
 
 	f := &Files{params: params, sums: map[string][sha256.Size]byte{}}
@@ -362,7 +362,7 @@ func (f *Files) read(name string) (int, error) {
 func (f *Files) readChanged(name string) ([]byte, bool, error) {
 	path := filepath.Join(f.params.Dir, name)
 
-	data, err := os.ReadFile(path) //nolint:gosec // a state file, in SWW_STATE_DIR
+	data, err := os.ReadFile(path) //nolint:gosec // a state file, in SWW_WAF_STATE_DIR
 	if errors.Is(err, fs.ErrNotExist) {
 		return nil, false, nil
 	}
@@ -1035,7 +1035,7 @@ func write(dir, name string, data []byte) error {
 
 // syncDirectory syncs dir to the disk, so that a rename in it lasts.
 func syncDirectory(dir string) error {
-	directory, err := os.Open(dir) //nolint:gosec // SWW_STATE_DIR itself
+	directory, err := os.Open(dir) //nolint:gosec // SWW_WAF_STATE_DIR itself
 	if err != nil {
 		return err
 	}
@@ -1045,7 +1045,7 @@ func syncDirectory(dir string) error {
 
 // writeSynced writes data to the file at path, and syncs it to the disk.
 func writeSynced(path string, data []byte) error {
-	//nolint:gosec // a state file's temporary file, in SWW_STATE_DIR
+	//nolint:gosec // a state file's temporary file, in SWW_WAF_STATE_DIR
 	file, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, fileMode)
 	if err != nil {
 		return err

internal/state/state_test.go

@@ -931,7 +931,7 @@ func TestUnwritableDirectoryStopsTheStart(t *testing.T) {
 		filepath.Join(t.TempDir(), "missing"),
 		notADirectory,
 	} {
-		const want = "SWW_STATE_DIR cannot be written: "
+		const want = "SWW_WAF_STATE_DIR cannot be written: "
 
 		_, err := state.Load(newParams(dir))
 		if err == nil || !strings.HasPrefix(err.Error(), want) {

internal/sww/healthcheck.go

@@ -10,6 +10,8 @@ import (
 	"net/url"
 	"time"
 
+	"github.com/spf13/viper"
+
 	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 )
@@ -21,17 +23,17 @@ var errHealthEndpoint = errors.New("the health endpoint answered")
 
 // HealthCheck is the container's health check. In discriminator's container, where
 // SWW_COMMAND is discriminator, it returns 0 while discriminator answers its health
-// endpoint on 127.0.0.1, at the port in SWW_LISTEN_ADDR. In rproxy's container,
+// endpoint on 127.0.0.1, at the port in SWW_WAF_LISTEN_ADDR. In rproxy's container,
 // where SWW_COMMAND is rproxy, unset or empty, it returns 0 while rproxy
-// answers its health endpoint on 127.0.0.1, at the port in SWRP_LISTEN_ADDR, and
-// the app accepts connections at the address in SWRP_UPSTREAM_URL. Otherwise,
+// answers its health endpoint on 127.0.0.1, at the port in SWW_RPROXY_LISTEN_ADDR, and
+// the app accepts connections at the address in SWW_RPROXY_UPSTREAM_URL. Otherwise,
 // any other value of SWW_COMMAND included, it writes why to stderr and
 // returns 1. It reads no other setting, nor a file that another names, so neither
 // can fail it.
 // args are the arguments after `healthcheck`; it takes none, and given
 // one it names it on stderr and returns 1 without checking anything.
 func HealthCheck(
-	ctx context.Context, args []string, lookupEnv func(string) (string, bool),
+	ctx context.Context, args []string, v *viper.Viper,
 	stderr io.Writer,
 ) int {
 	if len(args) > 0 {
@@ -44,15 +46,15 @@ func HealthCheck(
 	ctx, cancel := context.WithTimeout(ctx, healthCheckTimeout)
 	defer cancel()
 
-	command, err := config.Command(lookupEnv)
+	command, err := config.Command(v)
 
 	switch {
 	case err != nil:
 		err = fmt.Errorf("invalid setting: %w", err)
 	case command == "discriminator":
-		err = checkDiscriminator(ctx, lookupEnv)
+		err = checkDiscriminator(ctx, v)
 	default:
-		err = checkRProxyAndApp(ctx, lookupEnv)
+		err = checkRProxyAndApp(ctx, v)
 	}
 
 	if err != nil {
@@ -65,10 +67,8 @@ func HealthCheck(
 }
 
 // checkDiscriminator asks discriminator's health endpoint.
-func checkDiscriminator(
-	ctx context.Context, lookupEnv func(string) (string, bool),
-) error {
-	listenAddr, err := config.DiscriminatorListenAddr(lookupEnv)
+func checkDiscriminator(ctx context.Context, v *viper.Viper) error {
+	listenAddr, err := config.DiscriminatorListenAddr(v)
 	if err != nil {
 		return fmt.Errorf("invalid setting: %w", err)
 	}
@@ -82,10 +82,8 @@ func checkDiscriminator(
 }
 
 // checkRProxyAndApp asks rproxy's health endpoint, and connects to the app.
-func checkRProxyAndApp(
-	ctx context.Context, lookupEnv func(string) (string, bool),
-) error {
-	listenAddr, upstreamURL, err := config.RProxyListenAddrAndUpstreamURL(lookupEnv)
+func checkRProxyAndApp(ctx context.Context, v *viper.Viper) error {
+	listenAddr, upstreamURL, err := config.RProxyListenAddrAndUpstreamURL(v)
 	if err != nil {
 		return fmt.Errorf("invalid setting: %w", err)
 	}

internal/sww/healthcheck_test.go

@@ -54,9 +54,9 @@ func TestHealthCheckInDiscriminatorsContainer(t *testing.T) {
 	// or invalid token file, or an invalid value of another setting, does not
 	// fail it.
 	for _, other := range []struct{ name, value string }{
-		{"SWW_METRICS_TOKEN_FILE", filepath.Join(t.TempDir(), "removed")},
-		{"SWW_METRICS_TOKEN_FILE", writeFile(t, "too short\n")},
-		{"SWW_MODE", "neither"},
+		{"SWW_WAF_METRICS_TOKEN_FILE", filepath.Join(t.TempDir(), "removed")},
+		{"SWW_WAF_METRICS_TOKEN_FILE", writeFile(t, "too short\n")},
+		{"SWW_WAF_MODE", "neither"},
 	} {
 		wantHealthCheck(t, map[string]string{
 			commandSetting:       discriminatorCommand,
@@ -72,7 +72,7 @@ func TestHealthCheckInDiscriminatorsContainer(t *testing.T) {
 	}, 1, "unhealthy: ask discriminator: ")
 	wantHealthCheck(t, map[string]string{
 		commandSetting: discriminatorCommand, listenAddr: "8080",
-	}, 1, "unhealthy: invalid setting: SWW_LISTEN_ADDR: ")
+	}, 1, "unhealthy: invalid setting: SWW_WAF_LISTEN_ADDR: ")
 
 	stop()
 
@@ -111,8 +111,8 @@ func TestHealthCheckInRProxysContainer(t *testing.T) {
 		0, "")
 
 	// Another setting does not fail it, even an invalid one, and neither does
-	// SWRP_WAF_BACKEND being unset.
-	wantHealthCheck(t, settings("SWRP_TIMEOUT_MS", "soon"), 0, "")
+	// SWW_RPROXY_WAF_BACKEND being unset.
+	wantHealthCheck(t, settings("SWW_RPROXY_TIMEOUT_MS", "soon"), 0, "")
 
 	// Another test can take a closed server's port at once, so the app's
 	// address here is a multicast address, to which TCP cannot connect.
@@ -123,13 +123,14 @@ func TestHealthCheckInRProxysContainer(t *testing.T) {
 	// itself.
 	wantHealthCheck(t, settings(rproxyListenAddr, ":0"), 1, "unhealthy: ask rproxy: ")
 	wantHealthCheck(t, settings(rproxyListenAddr, "8080"), 1,
-		"unhealthy: invalid setting: SWRP_LISTEN_ADDR: ")
+		"unhealthy: invalid setting: SWW_RPROXY_LISTEN_ADDR: ")
 
-	// No setting of rproxy's has a form given as a file.
+	// A setting of rproxy's can be given as a file too, here the listen
+	// address, which the health check reads.
 	wantHealthCheck(t, map[string]string{
 		rproxyListenAddr + "_FILE": writeFile(t, ":"+port+"\n"),
 		rproxyUpstreamURL:          app.URL,
-	}, 1, "unhealthy: ask rproxy: ")
+	}, 0, "")
 }
 
 func TestHealthCheckFailsWithAnyOtherCommand(t *testing.T) {
@@ -145,11 +146,7 @@ func TestHealthCheckRefusesAnArgument(t *testing.T) {
 
 	var stderr bytes.Buffer
 
-	noSettings := func(string) (string, bool) {
-		return "", false
-	}
-
-	got := sww.HealthCheck(t.Context(), []string{"now"}, noSettings, &stderr)
+	got := sww.HealthCheck(t.Context(), []string{"now"}, viperFrom(nil), &stderr)
 
 	want := "sww healthcheck: unexpected argument \"now\"\n"
 	if got != 1 || stderr.String() != want {
@@ -166,11 +163,7 @@ func wantHealthCheck(t *testing.T, env map[string]string, status int, message st
 
 	var stderr bytes.Buffer
 
-	got := sww.HealthCheck(t.Context(), nil, func(name string) (string, bool) {
-		value, ok := env[name]
-
-		return value, ok
-	}, &stderr)
+	got := sww.HealthCheck(t.Context(), nil, viperFrom(env), &stderr)
 
 	wrote := stderr.String()
 	if got != status || !strings.HasPrefix(wrote, message) ||

internal/sww/rproxy.go

@@ -15,7 +15,7 @@ import (
 
 // RunRProxy is `sww rproxy`: it reads rproxy's settings, then serves
 // requests until ctx is done. Then it gives the requests in progress
-// shutdownTimeout to finish, and the reports being sent SWRP_TIMEOUT_MS. It
+// shutdownTimeout to finish, and the reports being sent SWW_RPROXY_TIMEOUT_MS. It
 // returns the process's exit status, 1 when rproxy cannot start. Its process
 // messages name the host's name as instance, and it writes those at info or
 // more severe: rproxy has no setting for either.
@@ -23,7 +23,7 @@ func RunRProxy(ctx context.Context, params Params) int {
 	hostname, _ := os.Hostname() // "" when the host has no name to give
 	processLog := requestlog.NewProcessLogger(params.Stdout, hostname, slog.LevelInfo)
 
-	cfg, err := config.RProxyFromEnvironment(params.LookupEnv)
+	cfg, err := config.RProxyFromEnvironment(params.Viper)
 	if err != nil {
 		processLog.Error("invalid setting", "error", err.Error())
 
@@ -38,7 +38,7 @@ func RunRProxy(ctx context.Context, params Params) int {
 
 	listener, err := (&net.ListenConfig{}).Listen(ctx, "tcp", cfg.ListenAddr)
 	if err != nil {
-		processLog.Error("cannot listen on SWRP_LISTEN_ADDR", "error", err.Error())
+		processLog.Error("cannot listen on SWW_RPROXY_LISTEN_ADDR", "error", err.Error())
 
 		return 1
 	}

internal/sww/rproxy_test.go

@@ -25,13 +25,13 @@ import (
 
 const (
 	// wafBackend is the setting that names discriminator to rproxy.
-	wafBackend = "SWRP_WAF_BACKEND"
+	wafBackend = "SWW_RPROXY_WAF_BACKEND"
 	// rproxyListenAddr is the setting that says where rproxy listens.
-	rproxyListenAddr = "SWRP_LISTEN_ADDR"
+	rproxyListenAddr = "SWW_RPROXY_LISTEN_ADDR"
 	// rproxyUpstreamURL is the setting that says where the app is.
-	rproxyUpstreamURL = "SWRP_UPSTREAM_URL"
+	rproxyUpstreamURL = "SWW_RPROXY_UPSTREAM_URL"
 	// rproxyTimeout is the setting that says how long rproxy waits for discriminator.
-	rproxyTimeout = "SWRP_TIMEOUT_MS"
+	rproxyTimeout = "SWW_RPROXY_TIMEOUT_MS"
 	// bannedProbe is a path the default rule file bans a client for.
 	bannedProbe = "/.env"
 	// otherClient is a client the tests do not ban.
@@ -43,12 +43,8 @@ const (
 func runRProxy(ctx context.Context, env map[string]string, out *output) int {
 	return sww.RunRProxy(ctx, sww.Params{
 		Version: testVersion,
-		LookupEnv: func(name string) (string, bool) {
-			value, ok := env[name]
-
-			return value, ok
-		},
-		Stdout: out,
+		Viper:   viperFrom(env),
+		Stdout:  out,
 	})
 }
 
@@ -64,10 +60,10 @@ func startRProxy(t *testing.T, backend, appURL string) (string, *output) {
 
 	go func() {
 		exited <- runRProxy(ctx, map[string]string{
-			rproxyListenAddr:       localhost + ":0",
-			"SWRP_UPSTREAM_URL":    appURL,
-			"SWRP_TRUSTED_PROXIES": localhost + "/32",
-			wafBackend:             backend,
+			rproxyListenAddr:             localhost + ":0",
+			"SWW_RPROXY_UPSTREAM_URL":    appURL,
+			"SWW_RPROXY_TRUSTED_PROXIES": localhost + "/32",
+			wafBackend:                   backend,
 		}, out)
 	}()
 
@@ -437,7 +433,7 @@ func startRProxyProcess(t *testing.T, env ...string) (string, *exec.Cmd, *output
 
 	cmd.Env = append(os.Environ(),
 		commandForMain+"=rproxy",
-		"SWRP_LISTEN_ADDR="+localhost+":0")
+		"SWW_RPROXY_LISTEN_ADDR="+localhost+":0")
 	cmd.Env = append(cmd.Env, env...)
 
 	err = cmd.Start()
@@ -485,7 +481,7 @@ func TestRProxyAsksADiscriminatorThatSpeaksHTTP2OverHTTP1(t *testing.T) {
 
 	addr, _, _ := startRProxyProcess(t,
 		wafBackend+"="+backend.URL,
-		"SWRP_UPSTREAM_URL="+startApp(t),
+		"SWW_RPROXY_UPSTREAM_URL="+startApp(t),
 		"SSL_CERT_FILE="+certificates)
 
 	for name, headers := range map[string]string{
@@ -550,10 +546,10 @@ func TestRProxyStoppingWaitsForAReportBeingSent(t *testing.T) {
 	defer stop()
 
 	env := map[string]string{
-		rproxyListenAddr:    localhost + ":0",
-		"SWRP_UPSTREAM_URL": startApp(t),
-		rproxyTimeout:       "60000",
-		wafBackend:          backend.URL,
+		rproxyListenAddr:          localhost + ":0",
+		"SWW_RPROXY_UPSTREAM_URL": startApp(t),
+		rproxyTimeout:             "60000",
+		wafBackend:                backend.URL,
 	}
 	out := &output{}
 	exited := make(chan int, 1)
@@ -627,7 +623,7 @@ func TestRProxyStoppingCutsOffARequestAfterFiveSeconds(t *testing.T) {
 
 	const (
 		cutOffAfter     = 5 * time.Second
-		upstreamSetting = "SWRP_UPSTREAM_URL"
+		upstreamSetting = "SWW_RPROXY_UPSTREAM_URL"
 	)
 
 	asked := make(chan struct{})
@@ -749,7 +745,7 @@ func TestRProxyAddressInUseStopsTheStart(t *testing.T) {
 		t.Errorf("exit status %d, want 1", status)
 	}
 
-	out.line(t, "msg", "cannot listen on SWRP_LISTEN_ADDR")
+	out.line(t, "msg", "cannot listen on SWW_RPROXY_LISTEN_ADDR")
 }
 
 func TestMainRunsRProxy(t *testing.T) {

internal/sww/sww.go

@@ -20,6 +20,8 @@ import (
 	"syscall"
 	"time"
 
+	"github.com/spf13/viper"
+
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/discriminator"
@@ -38,7 +40,7 @@ import (
 const shutdownTimeout = 5 * time.Second
 
 // remoteLogStopTimeout is how long, as discriminator stops, the log lines still
-// waiting are sent to SWW_LOG_REMOTE_URL before they are given up. stdout has
+// waiting are sent to SWW_WAF_LOG_REMOTE_URL before they are given up. stdout has
 // carried them.
 const remoteLogStopTimeout = 2 * time.Second
 
@@ -59,8 +61,9 @@ commands:
 type Params struct {
 	// Version is the version of the binary, set when it is built.
 	Version string
-	// LookupEnv reads an environment variable, normally os.LookupEnv.
-	LookupEnv func(string) (string, bool)
+	// Viper reads the settings, normally the viper config.NewViper returns
+	// for the process's environment.
+	Viper *viper.Viper
 	// Stdout receives the request log and the process's own messages.
 	Stdout io.Writer
 }
@@ -79,7 +82,7 @@ func Main(version string) int {
 		syscall.SIGTERM, os.Interrupt)
 	defer stop()
 
-	params := Params{Version: version, LookupEnv: os.LookupEnv, Stdout: os.Stdout}
+	params := Params{Version: version, Viper: config.NewViper(), Stdout: os.Stdout}
 
 	switch args[0] {
 	case "rproxy":
@@ -87,7 +90,7 @@ func Main(version string) int {
 	case "discriminator":
 		return RunDiscriminator(ctx, params)
 	case "healthcheck":
-		return HealthCheck(ctx, args[1:], os.LookupEnv, os.Stderr)
+		return HealthCheck(ctx, args[1:], params.Viper, os.Stderr)
 	default:
 		return printUsage(os.Stderr)
 	}
@@ -105,18 +108,18 @@ func printUsage(w io.Writer) int {
 // done. It returns the process's exit status, 1 when discriminator cannot start.
 func RunDiscriminator(ctx context.Context, params Params) int {
 	// Until the settings are read, the one message is an invalid setting's
-	// error, which every SWW_LOG_LEVEL lets through.
+	// error, which every SWW_WAF_LOG_LEVEL lets through.
 	processLog := requestlog.NewProcessLogger(params.Stdout,
-		config.InstanceName(params.LookupEnv), slog.LevelError)
+		config.InstanceName(params.Viper), slog.LevelError)
 
-	cfg, err := config.FromEnvironment(params.LookupEnv)
+	cfg, err := config.FromEnvironment(params.Viper)
 	if err != nil {
 		processLog.Error("invalid setting", "error", err.Error())
 
 		return 1
 	}
 
-	// While SWW_LOG_REMOTE_URL is set, every line on stdout from here on
+	// While SWW_WAF_LOG_REMOTE_URL is set, every line on stdout from here on
 	// is sent there too.
 	stdout := params.Stdout
 
@@ -178,7 +181,7 @@ func RunDiscriminator(ctx context.Context, params Params) int {
 
 	listener, err := (&net.ListenConfig{}).Listen(ctx, "tcp", cfg.ListenAddr)
 	if err != nil {
-		processLog.Error("cannot listen on SWW_LISTEN_ADDR", "error", err.Error())
+		processLog.Error("cannot listen on SWW_WAF_LISTEN_ADDR", "error", err.Error())
 
 		return 1
 	}
@@ -192,7 +195,7 @@ func RunDiscriminator(ctx context.Context, params Params) int {
 }
 
 // newServer returns the server discriminator runs, with the metrics of the alerts,
-// after reading the lookup database while SWW_LOOKUP_SOURCE is file. A lookup
+// after reading the lookup database while SWW_WAF_LOOKUP_SOURCE is file. A lookup
 // database that cannot be read is an error.
 func newServer(
 	cfg *config.Config, stdout io.Writer, processLog *slog.Logger,
@@ -281,7 +284,7 @@ func newAlertQueue(
 }
 
 // newRemoteLogSender returns a sender of the log lines to
-// SWW_LOG_REMOTE_URL, with the settings for it.
+// SWW_WAF_LOG_REMOTE_URL, with the settings for it.
 func newRemoteLogSender(cfg *config.Config) *remotelog.Sender {
 	return remotelog.New(remotelog.Params{
 		URL:      cfg.LogRemoteURL,

internal/sww/sww_test.go

@@ -19,6 +19,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/spf13/viper"
+
 	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/lookup/lookuptest"
@@ -34,21 +36,21 @@ const (
 	testVersion = "test"
 	// localhost is where the tests listen.
 	localhost            = "127.0.0.1"
-	listenAddr           = "SWW_LISTEN_ADDR"
-	stateDir             = "SWW_STATE_DIR"
-	stateWriteDelay      = "SWW_STATE_WRITE_DELAY"
-	stateCounterInterval = "SWW_STATE_COUNTER_INTERVAL"
-	rateLimitPerDay      = "SWW_RATE_LIMIT_PER_DAY"
-	rateLimitExemptNets  = "SWW_RATE_LIMIT_EXEMPT_NETS"
-	rulesDir             = "SWW_RULES_DIR"
-	lookupSource         = "SWW_LOOKUP_SOURCE"
-	lookupDBPath         = "SWW_LOOKUP_DB_PATH"
-	instanceName         = "SWW_INSTANCE_NAME"
-	adminToken           = "SWW_ADMIN_TOKEN"   //nolint:gosec // the setting's name
-	metricsToken         = "SWW_METRICS_TOKEN" //nolint:gosec // the setting's name
-	// adminSecret is the SWW_ADMIN_TOKEN the tests set.
+	listenAddr           = "SWW_WAF_LISTEN_ADDR"
+	stateDir             = "SWW_WAF_STATE_DIR"
+	stateWriteDelay      = "SWW_WAF_STATE_WRITE_DELAY"
+	stateCounterInterval = "SWW_WAF_STATE_COUNTER_INTERVAL"
+	rateLimitPerDay      = "SWW_WAF_RATE_LIMIT_PER_DAY"
+	rateLimitExemptNets  = "SWW_WAF_RATE_LIMIT_EXEMPT_NETS"
+	rulesDir             = "SWW_WAF_RULES_DIR"
+	lookupSource         = "SWW_WAF_LOOKUP_SOURCE"
+	lookupDBPath         = "SWW_WAF_LOOKUP_DB_PATH"
+	instanceName         = "SWW_WAF_INSTANCE_NAME"
+	adminToken           = "SWW_WAF_ADMIN_TOKEN"   //nolint:gosec // the setting's name
+	metricsToken         = "SWW_WAF_METRICS_TOKEN" //nolint:gosec // the setting's name
+	// adminSecret is the SWW_WAF_ADMIN_TOKEN the tests set.
 	adminSecret = "fedcba9876543210fedcba9876543210"
-	// instance is the SWW_INSTANCE_NAME the tests set where they look at
+	// instance is the SWW_WAF_INSTANCE_NAME the tests set where they look at
 	// it.
 	instance = "fsn1app1/blog"
 	// greeting is what the tests' app answers.
@@ -123,21 +125,30 @@ func (o *output) text() string {
 	return o.buf.String()
 }
 
+// viperFrom returns a viper Set with each of settings, as the viper
+// config.NewViper returns one bound to a process's environment.
+func viperFrom(settings map[string]string) *viper.Viper {
+	v := viper.New()
+	for name, value := range settings {
+		v.Set(name, value)
+	}
+
+	return v
+}
+
 // run runs `sww discriminator` with the settings in env until ctx is done,
-// and returns its exit status. SWW_LOOKUP_SOURCE is off unless env sets it,
+// and returns its exit status. SWW_WAF_LOOKUP_SOURCE is off unless env sets it,
 // so that no test sends GeoJS its clients' addresses.
 func run(ctx context.Context, env map[string]string, out *output) int {
+	v := viperFrom(env)
+	if _, set := env["SWW_WAF_LOOKUP_SOURCE"]; !set {
+		v.Set("SWW_WAF_LOOKUP_SOURCE", "off")
+	}
+
 	return sww.RunDiscriminator(ctx, sww.Params{
 		Version: testVersion,
-		LookupEnv: func(name string) (string, bool) {
-			value, ok := env[name]
-			if !ok && name == "SWW_LOOKUP_SOURCE" {
-				return "off", true
-			}
-
-			return value, ok
-		},
-		Stdout: out,
+		Viper:   v,
+		Stdout:  out,
 	})
 }
 
@@ -147,8 +158,8 @@ func TestInvalidSettingStopsTheStart(t *testing.T) {
 	out := &output{}
 
 	status := run(t.Context(), map[string]string{
-		"SWW_BYTES_LIMIT_PER_MINUTE": "lots",
-		instanceName:                 instance,
+		"SWW_WAF_BYTES_LIMIT_PER_MINUTE": "lots",
+		instanceName:                     instance,
 	}, out)
 	if status != 1 {
 		t.Errorf("exit status %d, want 1", status)
@@ -159,7 +170,7 @@ func TestInvalidSettingStopsTheStart(t *testing.T) {
 
 	if line["type"] != "process" || line["instance"] != instance ||
 		line["level"] != "ERROR" ||
-		!strings.HasPrefix(message, "SWW_BYTES_LIMIT_PER_MINUTE: ") {
+		!strings.HasPrefix(message, "SWW_WAF_BYTES_LIMIT_PER_MINUTE: ") {
 		t.Errorf("start refused with %v", line)
 	}
 }
@@ -215,7 +226,7 @@ func TestAddressInUseStopsTheStart(t *testing.T) {
 		t.Errorf("exit status %d, want 1", status)
 	}
 
-	out.line(t, "msg", "cannot listen on SWW_LISTEN_ADDR")
+	out.line(t, "msg", "cannot listen on SWW_WAF_LISTEN_ADDR")
 }
 
 func TestServesUntilToldToStop(t *testing.T) {
@@ -278,11 +289,11 @@ func TestLogLevelHoldsBackTheLessSevereProcessLines(t *testing.T) {
 
 	go func() {
 		exited <- run(ctx, map[string]string{
-			listenAddr:           localhost + ":0",
-			stateDir:             t.TempDir(),
-			rulesDir:             t.TempDir(),
-			"SWW_BLOCKLIST_URLS": lists.URL + "/tor.txt",
-			"SWW_LOG_LEVEL":      "warn",
+			listenAddr:               localhost + ":0",
+			stateDir:                 t.TempDir(),
+			rulesDir:                 t.TempDir(),
+			"SWW_WAF_BLOCKLIST_URLS": lists.URL + "/tor.txt",
+			"SWW_WAF_LOG_LEVEL":      "warn",
 		}, out)
 	}()
 
@@ -385,7 +396,7 @@ func TestStateKeptAcrossRestarts(t *testing.T) {
 func TestBanRefusesItsNetblockAfterARestartWithAnotherScope(t *testing.T) {
 	t.Parallel()
 
-	const scope = "SWW_BAN_SCOPE_V4_PREFIX"
+	const scope = "SWW_WAF_BAN_SCOPE_V4_PREFIX"
 
 	env := map[string]string{
 		listenAddr:      localhost + ":0",
@@ -505,7 +516,7 @@ func TestRuleFileAddedWhileRunningTakesEffect(t *testing.T) {
 		rulesDir:   dir,
 		// The requests sent until the rule takes effect must not break a
 		// rate limit, whose ban would refuse them too.
-		"SWW_RATE_LIMIT_PER_MINUTE": "off",
+		"SWW_WAF_RATE_LIMIT_PER_MINUTE": "off",
 	}
 
 	out := runUntilStopped(t, env, func(url string) {
@@ -548,7 +559,7 @@ func TestRulesDirThatDoesNotExistStopsTheStart(t *testing.T) {
 
 	dir := filepath.Join(t.TempDir(), "rules.d")
 
-	wantRulesRefused(t, dir, "SWW_RULES_DIR cannot be read: open "+dir+
+	wantRulesRefused(t, dir, "SWW_WAF_RULES_DIR cannot be read: open "+dir+
 		": no such file or directory")
 }
 
@@ -560,14 +571,14 @@ func TestCoreRuleSetExclusionsFileThatCannotBeReadStopsTheStart(t *testing.T) {
 
 	status := run(t.Context(), map[string]string{
 		listenAddr: localhost + ":0", stateDir: t.TempDir(), rulesDir: t.TempDir(),
-		"SWW_CORE_RULE_SET_EXCLUSIONS_FILE": path,
+		"SWW_WAF_CORE_RULE_SET_EXCLUSIONS_FILE": path,
 	}, out)
 	if status != 1 {
 		t.Fatalf("exit status %d, want 1", status)
 	}
 
 	line := out.line(t, "msg", "cannot use the Core Rule Set")
-	want := "SWW_CORE_RULE_SET_EXCLUSIONS_FILE: read the exclusions file: open " +
+	want := "SWW_WAF_CORE_RULE_SET_EXCLUSIONS_FILE: read the exclusions file: open " +
 		path + ": no such file or directory"
 
 	if line["error"] != want {
@@ -592,7 +603,8 @@ func TestCoreRuleSetExclusionsFileThatCannotBeUsedStopsTheStartWhileTheCoreRuleS
 
 		status := run(t.Context(), map[string]string{
 			listenAddr: localhost + ":0", stateDir: t.TempDir(), rulesDir: t.TempDir(),
-			"SWW_WAF_MODE": config.WAFModeOff, "SWW_CORE_RULE_SET_EXCLUSIONS_FILE": path,
+			"SWW_WAF_CORE_RULE_SET_MODE":            config.WAFModeOff,
+			"SWW_WAF_CORE_RULE_SET_EXCLUSIONS_FILE": path,
 		}, out)
 		if status != 1 {
 			t.Fatalf("%s: exit status %d, want 1", path, status)
@@ -611,14 +623,14 @@ func TestLookupDatabaseReplacedWhileRunningTakesEffect(t *testing.T) {
 	writeLookupDatabase(t, path, "DE")
 
 	env := map[string]string{
-		listenAddr:             localhost + ":0",
-		stateDir:               t.TempDir(),
-		rulesDir:               t.TempDir(),
-		metricsToken:           token,
-		instanceName:           instance,
-		lookupSource:           "file",
-		lookupDBPath:           path,
-		"SWW_DENIED_COUNTRIES": "kp",
+		listenAddr:                 localhost + ":0",
+		stateDir:                   t.TempDir(),
+		rulesDir:                   t.TempDir(),
+		metricsToken:               token,
+		instanceName:               instance,
+		lookupSource:               "file",
+		lookupDBPath:               path,
+		"SWW_WAF_DENIED_COUNTRIES": "kp",
 		// The requests sent until a replacement takes effect, and those
 		// for the metrics, must not break a rate limit, whose ban would
 		// refuse them too.
@@ -708,12 +720,12 @@ func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T)
 	torURL, dropURL := server.URL+torPath, server.URL+dropPath
 	dir := t.TempDir()
 	env := map[string]string{
-		listenAddr:           localhost + ":0",
-		stateDir:             dir,
-		rulesDir:             t.TempDir(),
-		metricsToken:         token,
-		instanceName:         instance,
-		"SWW_BLOCKLIST_URLS": torURL,
+		listenAddr:               localhost + ":0",
+		stateDir:                 dir,
+		rulesDir:                 t.TempDir(),
+		metricsToken:             token,
+		instanceName:             instance,
+		"SWW_WAF_BLOCKLIST_URLS": torURL,
 		// The requests sent until the list takes effect, and those for the
 		// metrics, must not break a rate limit, whose ban would refuse them
 		// too.
@@ -729,12 +741,12 @@ func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T)
 	})
 
 	// Restarted with drop.txt named after it and the server answering, tor.txt
-	// waits SWW_BLOCKLIST_REFRESH after its failed try, kept in reputation.json,
+	// waits SWW_WAF_BLOCKLIST_REFRESH after its failed try, kept in reputation.json,
 	// while drop.txt, never tried, is fetched at once. Lists are fetched in the
 	// order named, so once drop.txt refuses the client, tor.txt has had its turn.
 	failing.Store(false)
 
-	env["SWW_BLOCKLIST_URLS"] = torURL + "," + dropURL
+	env["SWW_WAF_BLOCKLIST_URLS"] = torURL + "," + dropURL
 	out := runUntilStopped(t, env, func(url string) {
 		for statusFrom(t, url, placed) != http.StatusForbidden {
 			time.Sleep(pollInterval)
@@ -790,11 +802,11 @@ func TestCrowdSecDecisionListKeptInReputationJSONAcrossARestart(t *testing.T) {
 
 	dir := t.TempDir()
 	env := map[string]string{
-		listenAddr:              localhost + ":0",
-		stateDir:                dir,
-		rulesDir:                t.TempDir(),
-		"SWW_CROWDSEC_LAPI_URL": engine.URL,
-		"SWW_CROWDSEC_LAPI_KEY": bouncerKey,
+		listenAddr:                  localhost + ":0",
+		stateDir:                    dir,
+		rulesDir:                    t.TempDir(),
+		"SWW_WAF_CROWDSEC_LAPI_URL": engine.URL,
+		"SWW_WAF_CROWDSEC_LAPI_KEY": bouncerKey,
 	}
 
 	// Once the list is fetched, the client's request bans it.
@@ -867,7 +879,7 @@ func TestLookupDatabaseThatCannotBeReadStopsTheStart(t *testing.T) {
 		t.Fatalf("exit status %d, want 1", status)
 	}
 
-	want := "SWW_LOOKUP_DB_PATH cannot be read: open " + path +
+	want := "SWW_WAF_LOOKUP_DB_PATH cannot be read: open " + path +
 		": no such file or directory"
 
 	line := out.line(t, "msg", "cannot use the lookup database")
@@ -889,10 +901,10 @@ func TestEveryLineIsAlsoSentToTheRemoteLogEndpoint(t *testing.T) {
 	}()
 
 	env := map[string]string{
-		listenAddr:           localhost + ":0",
-		stateDir:             t.TempDir(),
-		rulesDir:             t.TempDir(),
-		"SWW_LOG_REMOTE_URL": "syslog+tcp://" + endpoint.Addr().String(),
+		listenAddr:               localhost + ":0",
+		stateDir:                 t.TempDir(),
+		rulesDir:                 t.TempDir(),
+		"SWW_WAF_LOG_REMOTE_URL": "syslog+tcp://" + endpoint.Addr().String(),
 	}
 
 	out := runUntilStopped(t, env, func(url string) {
@@ -944,13 +956,13 @@ func TestStalledRemoteLogEndpointHoldsUpNoRequest(t *testing.T) {
 	}()
 
 	env := map[string]string{
-		listenAddr:              localhost + ":0",
-		stateDir:                t.TempDir(),
-		rulesDir:                t.TempDir(),
-		"SWW_LOG_REMOTE_URL":    "syslog+tls://" + endpoint.Addr().String(),
-		"SWW_LOG_REMOTE_BUFFER": "1",
-		metricsToken:            token,
-		instanceName:            instance,
+		listenAddr:                  localhost + ":0",
+		stateDir:                    t.TempDir(),
+		rulesDir:                    t.TempDir(),
+		"SWW_WAF_LOG_REMOTE_URL":    "syslog+tls://" + endpoint.Addr().String(),
+		"SWW_WAF_LOG_REMOTE_BUFFER": "1",
+		metricsToken:                token,
+		instanceName:                instance,
 	}
 
 	out := runUntilStopped(t, env, func(url string) {
@@ -1003,12 +1015,12 @@ func TestBanIsAlertedAndAnAlertNotSentIsKeptAcrossARestart(t *testing.T) {
 
 	dir := t.TempDir()
 	env := map[string]string{
-		listenAddr:                  localhost + ":0",
-		stateDir:                    dir,
-		rulesDir:                    rules,
-		"SWW_ALERT_WEBHOOK_URL":     webhook.url,
-		"SWW_ALERT_WEBHOOK_HEADERS": "Authorization:Bearer " + adminSecret,
-		instanceName:                instance,
+		listenAddr:                      localhost + ":0",
+		stateDir:                        dir,
+		rulesDir:                        rules,
+		"SWW_WAF_ALERT_WEBHOOK_URL":     webhook.url,
+		"SWW_WAF_ALERT_WEBHOOK_HEADERS": "Authorization:Bearer " + adminSecret,
+		instanceName:                    instance,
 	}
 
 	runUntilStopped(t, env, func(url string) {
@@ -1056,7 +1068,7 @@ func TestBanIsAlertedAndAnAlertNotSentIsKeptAcrossARestart(t *testing.T) {
 
 	webhook.failing.Store(false)
 
-	env["SWW_ALLOW_NETS"] = localhost
+	env["SWW_WAF_ALLOW_NETS"] = localhost
 	env[metricsToken] = token
 
 	runUntilStopped(t, env, func(url string) {
@@ -1092,12 +1104,12 @@ func TestBanIsAlertedToSlackAndNtfy(t *testing.T) {
 		rulesDir:        t.TempDir(),
 		rateLimitPerDay: "1",
 		// The metrics are read from 127.0.0.1, which no limit counts.
-		"SWW_ALLOW_NETS":              localhost + "/32",
-		metricsToken:                  token,
-		instanceName:                  instance,
-		"SWW_ALERT_SLACK_WEBHOOK_URL": slack.url,
-		"SWW_ALERT_NTFY_URL":          ntfy.url,
-		"SWW_ALERT_NTFY_TOKEN":        ntfyToken,
+		"SWW_WAF_ALLOW_NETS":              localhost + "/32",
+		metricsToken:                      token,
+		instanceName:                      instance,
+		"SWW_WAF_ALERT_SLACK_WEBHOOK_URL": slack.url,
+		"SWW_WAF_ALERT_NTFY_URL":          ntfy.url,
+		"SWW_WAF_ALERT_NTFY_TOKEN":        ntfyToken,
 	}
 
 	runUntilStopped(t, env, func(url string) {
@@ -1162,7 +1174,7 @@ func TestUnwritableStateDirStopsTheStart(t *testing.T) {
 	t.Parallel()
 
 	wantStartRefused(t, filepath.Join(t.TempDir(), "missing"),
-		"SWW_STATE_DIR cannot be written: ")
+		"SWW_WAF_STATE_DIR cannot be written: ")
 }
 
 // wantStartRefused runs sww with its state files in dir, and
@@ -1268,28 +1280,28 @@ func wantStartingLine(t *testing.T, line map[string]any, dir string) {
 
 	settings, _ := line["settings"].(map[string]any)
 	want := map[string]any{
-		listenAddr:                          localhost + ":0",
-		stateDir:                            dir,
-		"SWW_MODE":                          "enforce",
-		stateWriteDelay:                     "10s",
-		stateCounterInterval:                "15m",
-		"SWW_ALLOW_NETS":                    "",
-		rateLimitExemptNets:                 "",
-		"SWW_DENY_NETS":                     "",
-		"SWW_RATE_LIMIT_PER_MINUTE":         "120",
-		"SWW_RATE_LIMIT_PER_HOUR":           "1500",
-		rateLimitPerDay:                     "6000",
-		"SWW_RATE_LIMIT_EXEMPT_PATHS":       "",
-		"SWW_DENIED_COUNTRIES":              "",
-		"SWW_EXCLUSIVELY_ALLOWED_COUNTRIES": "",
-		"SWW_BAN_RESPONSE":                  "403",
-		"SWW_LIMIT_BAN_DURATION":            "1h",
-		"SWW_LIMIT_BAN_REPEAT_WINDOW":       "24h",
-		"SWW_MAX_BAN_DURATION":              "7d",
-		"SWW_ATTACK_BAN_DURATION":           "7d",
-		"SWW_MAX_BANS":                      "5000",
-		"SWW_BAN_SCOPE_V4_PREFIX":           "32",
-		"SWW_RULES_ENABLED":                 "true",
+		listenAddr:                              localhost + ":0",
+		stateDir:                                dir,
+		"SWW_WAF_MODE":                          "enforce",
+		stateWriteDelay:                         "10s",
+		stateCounterInterval:                    "15m",
+		"SWW_WAF_ALLOW_NETS":                    "",
+		rateLimitExemptNets:                     "",
+		"SWW_WAF_DENY_NETS":                     "",
+		"SWW_WAF_RATE_LIMIT_PER_MINUTE":         "120",
+		"SWW_WAF_RATE_LIMIT_PER_HOUR":           "1500",
+		rateLimitPerDay:                         "6000",
+		"SWW_WAF_RATE_LIMIT_EXEMPT_PATHS":       "",
+		"SWW_WAF_DENIED_COUNTRIES":              "",
+		"SWW_WAF_EXCLUSIVELY_ALLOWED_COUNTRIES": "",
+		"SWW_WAF_BAN_RESPONSE":                  "403",
+		"SWW_WAF_LIMIT_BAN_DURATION":            "1h",
+		"SWW_WAF_LIMIT_BAN_REPEAT_WINDOW":       "24h",
+		"SWW_WAF_MAX_BAN_DURATION":              "7d",
+		"SWW_WAF_ATTACK_BAN_DURATION":           "7d",
+		"SWW_WAF_MAX_BANS":                      "5000",
+		"SWW_WAF_BAN_SCOPE_V4_PREFIX":           "32",
+		"SWW_WAF_RULES_ENABLED":                 "true",
 	}
 
 	for name, value := range want {
@@ -1489,7 +1501,7 @@ func onlyBan(t *testing.T, dir string) map[string]any {
 }
 
 // wantRefused checks that discriminator at url refuses a request from localhost with
-// 403, the default SWW_BAN_RESPONSE.
+// 403, the default SWW_WAF_BAN_RESPONSE.
 func wantRefused(t *testing.T, url string) {
 	t.Helper()
 
@@ -1530,8 +1542,8 @@ func saveUntilAnswered(t *testing.T, path, content, url, from string, status int
 	}
 }
 
-// destination is a stand-in for SWW_ALERT_SLACK_WEBHOOK_URL or
-// SWW_ALERT_NTFY_URL. It notes each request it is sent, and answers
+// destination is a stand-in for SWW_WAF_ALERT_SLACK_WEBHOOK_URL or
+// SWW_WAF_ALERT_NTFY_URL. It notes each request it is sent, and answers
 // 200.
 type destination struct {
 	url string
@@ -1590,7 +1602,7 @@ func (d *destination) firstPost(t *testing.T) destinationPost {
 	}
 }
 
-// webhook is a stand-in for SWW_ALERT_WEBHOOK_URL. It notes each alert
+// webhook is a stand-in for SWW_WAF_ALERT_WEBHOOK_URL. It notes each alert
 // it is sent, and answers 204, or 503 while failing.
 type webhook struct {
 	url     string

internal/waf/waf.go

@@ -1,7 +1,7 @@
 // Package waf runs the OWASP Core Rule Set 4.25.0, through Coraza, on the
 // method, the URL with its query and the headers of a request, and on its
-// body while SWW_WAF_BODY_LIMIT is set, with the eight changes sww
-// makes to it and the exclusions in SWW_CORE_RULE_SET_EXCLUSIONS_FILE, as
+// body while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set, with the eight changes sww
+// makes to it and the exclusions in SWW_WAF_CORE_RULE_SET_EXCLUSIONS_FILE, as
 // "Attack detection" under "Settings" in SPEC.md describes them. It reads no
 // response.
 //
@@ -32,16 +32,16 @@ import (
 
 // directives are the Core Rule Set as sww runs it, with the
 // paranoia level for %d, bodyDirectives for the first %s while
-// SWW_WAF_BODY_LIMIT is set, the exclusions file for the second, and
+// SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set, the exclusions file for the second, and
 // giteaExclusions for the third.
 // Each rule sww adds has an id from 900000 to 900999, the ids the
 // Core Rule Set keeps for the rules that set it up, which
-// SWW_WAF_DISABLED_RULES and the exclusions file refuse, so that no
+// SWW_WAF_CORE_RULE_SET_DISABLED_RULES and the exclusions file refuse, so that no
 // setting switches one off. Coraza joins a line ending in \ to the next,
 // without the spaces at the start of the next.
 const directives = `
 # The engine only detects. sww compares the request's anomaly
-# score with SWW_WAF_ANOMALY_THRESHOLD itself, in block and detect mode
+# score with SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD itself, in block and detect mode
 # alike. It reads no body, unless bodyDirectives switch that on.
 SecRuleEngine DetectionOnly
 SecRequestBodyAccess Off
@@ -183,16 +183,16 @@ var cookiesNotRead = []string{"gitea_flash", "redirect_to"}
 
 // Params are what New needs.
 type Params struct {
-	// ParanoiaLevel is SWW_WAF_PARANOIA_LEVEL, from 1 to 4.
+	// ParanoiaLevel is SWW_WAF_CORE_RULE_SET_PARANOIA_LEVEL, from 1 to 4.
 	ParanoiaLevel int
 	// DisabledRules are the ids of the rules switched off
-	// (SWW_WAF_DISABLED_RULES).
+	// (SWW_WAF_CORE_RULE_SET_DISABLED_RULES).
 	DisabledRules []int
 	// BodyLimit is the most of a request body the Core Rule Set reads
-	// (SWW_WAF_BODY_LIMIT), 0 while it is off and it reads none.
+	// (SWW_WAF_CORE_RULE_SET_BODY_LIMIT), 0 while it is off and it reads none.
 	BodyLimit int64
 	// ExclusionsFile is the path of a file of exclusions loaded before the
-	// Core Rule Set's rules (SWW_CORE_RULE_SET_EXCLUSIONS_FILE), "" while
+	// Core Rule Set's rules (SWW_WAF_CORE_RULE_SET_EXCLUSIONS_FILE), "" while
 	// there is none.
 	ExclusionsFile string
 }
@@ -218,7 +218,7 @@ var errSwwRuleID = errors.New("an id of sww's own rules")
 // SecRuleRemoveById. The Core Rule Set's rules load after the file, so
 // the directive finds none of them.
 var errChangesNoRule = errors.New("the Core Rule Set's rules load after the file; " +
-	"switch a rule off with SWW_WAF_DISABLED_RULES, or on some requests " +
+	"switch a rule off with SWW_WAF_CORE_RULE_SET_DISABLED_RULES, or on some requests " +
 	"with a ctl exclusion")
 
 // directivesIn returns the directives in text as Coraza reads them: it
@@ -404,7 +404,7 @@ func (c *CoreRuleSet) Inspect(
 }
 
 // readBody reads body, the body of the request in tx, which has run on
-// the request's headers, while SWW_WAF_BODY_LIMIT is set and the body is
+// the request's headers, while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set and the body is
 // of a kind the Core Rule Set reads: form data and multipart, of which it
 // reads the first c.bodyLimit bytes, and JSON and XML, which it reads only
 // when they are no longer than that, since they cannot be read in part.

internal/waf/waf_test.go

@@ -15,7 +15,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
-// defaultDisabledRules are the rules SWW_WAF_DISABLED_RULES switches off
+// defaultDisabledRules are the rules SWW_WAF_CORE_RULE_SET_DISABLED_RULES switches off
 // by default.
 //
 //nolint:gochecknoglobals // a constant cannot be a list
@@ -525,7 +525,7 @@ func giteaRequests(t *testing.T) []request {
 func TestOrdinaryGiteaRequestsPassAndAttacksAreRefused(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
 
 	crs := atDefaults(t)
 
@@ -550,7 +550,7 @@ func TestOrdinaryGiteaRequestsPassAndAttacksAreRefused(t *testing.T) {
 	}
 }
 
-// bodyLimit is SWW_WAF_BODY_LIMIT in the tests that read bodies.
+// bodyLimit is SWW_WAF_CORE_RULE_SET_BODY_LIMIT in the tests that read bodies.
 const bodyLimit = 8 << 10
 
 // The Content-Type headers of the kinds of body the Core Rule Set reads.