Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.
Every place a name appeared changed: the code, the viper keys, tests,
documents, examples, the README's settings table and the image files.

Model: deepseek-v4-pro

internal/config/config_test.go

@@ -17,105 +17,107 @@ import (
 	"testing"
 	"time"
 
+	"github.com/spf13/viper"
+
 	"sneak.berlin/go/smallwebwaf/internal/anomaly"
 	"sneak.berlin/go/smallwebwaf/internal/config"
 )
 
 // The settings, by name.
 const (
-	listenAddr           = "SWW_LISTEN_ADDR"
-	mode                 = "SWW_MODE"
-	ipv6GroupPrefix      = "SWW_IPV6_GROUP_PREFIX"
-	maxTrackedClients    = "SWW_MAX_TRACKED_CLIENTS"
-	allowNets            = "SWW_ALLOW_NETS"
-	rateLimitExemptNets  = "SWW_RATE_LIMIT_EXEMPT_NETS"
-	denyNets             = "SWW_DENY_NETS"
-	rateLimitPerMinute   = "SWW_RATE_LIMIT_PER_MINUTE"
-	rateLimitPerHour     = "SWW_RATE_LIMIT_PER_HOUR"
-	rateLimitPerDay      = "SWW_RATE_LIMIT_PER_DAY"
-	rateLimitExemptPaths = "SWW_RATE_LIMIT_EXEMPT_PATHS"
-	bytesLimitPerMinute  = "SWW_BYTES_LIMIT_PER_MINUTE"
-	bytesLimitPerHour    = "SWW_BYTES_LIMIT_PER_HOUR"
-	bytesLimitPerDay     = "SWW_BYTES_LIMIT_PER_DAY"
-	bytesCount           = "SWW_BYTES_COUNT"
-	lookupSource         = "SWW_LOOKUP_SOURCE"
-	lookupDBPath         = "SWW_LOOKUP_DB_PATH"
-	lookupTimeout        = "SWW_LOOKUP_TIMEOUT"
-	addLookupHeaders     = "SWW_ADD_LOOKUP_HEADERS"
-	deniedCountries      = "SWW_DENIED_COUNTRIES"
-	allowedCountries     = "SWW_EXCLUSIVELY_ALLOWED_COUNTRIES"
-	asnLimitPercent      = "SWW_ASN_LIMIT_PERCENT"
-	countryLimitPercent  = "SWW_COUNTRY_LIMIT_PERCENT"
-	asnBytesPercent      = "SWW_ASN_BYTES_PERCENT"
-	countryBytesPercent  = "SWW_COUNTRY_BYTES_PERCENT"
-	unknownLimitPercent  = "SWW_UNKNOWN_LIMIT_PERCENT"
-	asnLimitPercentURL   = "SWW_ASN_LIMIT_PERCENT_URL"
-	blocklistURLs        = "SWW_BLOCKLIST_URLS"
-	blocklistRefresh     = "SWW_BLOCKLIST_REFRESH"
-	blocklistAction      = "SWW_BLOCKLIST_ACTION"
-	dnsblZones           = "SWW_DNSBL_ZONES"
-	dnsblResolver        = "SWW_DNSBL_RESOLVER"
-	abuseIPDBKey         = "SWW_ABUSEIPDB_KEY"
-	abuseIPDBMinScore    = "SWW_ABUSEIPDB_MIN_SCORE"
-	abuseIPDBDailyBudget = "SWW_ABUSEIPDB_DAILY_BUDGET"
-	reputationAction     = "SWW_REPUTATION_ACTION"
-	reputationCacheTTL   = "SWW_REPUTATION_CACHE_TTL"
-	reputationTimeout    = "SWW_REPUTATION_TIMEOUT"
-	crowdSecURL          = "SWW_CROWDSEC_LAPI_URL"
-	crowdSecKey          = "SWW_CROWDSEC_LAPI_KEY"
-	banResponse          = "SWW_BAN_RESPONSE"
-	limitBanDuration     = "SWW_LIMIT_BAN_DURATION"
-	limitBanRepeatWindow = "SWW_LIMIT_BAN_REPEAT_WINDOW"
-	maxBanDuration       = "SWW_MAX_BAN_DURATION"
-	attackBanDuration    = "SWW_ATTACK_BAN_DURATION"
-	maxBans              = "SWW_MAX_BANS"
-	banScopeV4Prefix     = "SWW_BAN_SCOPE_V4_PREFIX"
-	stateDir             = "SWW_STATE_DIR"
-	stateWriteDelay      = "SWW_STATE_WRITE_DELAY"
-	stateCounterInterval = "SWW_STATE_COUNTER_INTERVAL"
-	adminToken           = "SWW_ADMIN_TOKEN"   //nolint:gosec // the setting's name
-	metricsToken         = "SWW_METRICS_TOKEN" //nolint:gosec // the setting's name
-	metricsTopN          = "SWW_METRICS_TOP_N"
-	instanceName         = "SWW_INSTANCE_NAME"
-	logRequestHeaders    = "SWW_LOG_REQUEST_HEADERS"
-	logLevel             = "SWW_LOG_LEVEL"
-	rulesDir             = "SWW_RULES_DIR"
-	rulesEnabled         = "SWW_RULES_ENABLED"
-	wafMode              = "SWW_WAF_MODE"
-	wafParanoiaLevel     = "SWW_WAF_PARANOIA_LEVEL"
-	wafAnomalyThreshold  = "SWW_WAF_ANOMALY_THRESHOLD"
-	wafDisabledRules     = "SWW_WAF_DISABLED_RULES"
-	wafExemptPaths       = "SWW_WAF_EXEMPT_PATHS"
-	wafBodyLimit         = "SWW_WAF_BODY_LIMIT"
-	exclusionsFile       = "SWW_CORE_RULE_SET_EXCLUSIONS_FILE"
-	trapPaths            = "SWW_TRAP_PATHS"
-	errorBurstThreshold  = "SWW_ERROR_BURST_THRESHOLD"
-	logRemoteURL         = "SWW_LOG_REMOTE_URL"
-	logRemoteTLSCAFile   = "SWW_LOG_REMOTE_TLS_CA_FILE"
-	logRemoteBuffer      = "SWW_LOG_REMOTE_BUFFER"
-	logRemoteFacility    = "SWW_LOG_REMOTE_FACILITY"
-	logRemoteAppName     = "SWW_LOG_REMOTE_APP_NAME"
-	alertWebhookURL      = "SWW_ALERT_WEBHOOK_URL"
-	alertWebhookHeaders  = "SWW_ALERT_WEBHOOK_HEADERS"
-	alertSlackWebhookURL = "SWW_ALERT_SLACK_WEBHOOK_URL"
-	alertNtfyURL         = "SWW_ALERT_NTFY_URL"
-	alertNtfyToken       = "SWW_ALERT_NTFY_TOKEN" //nolint:gosec // the setting's name
-	alertEvents          = "SWW_ALERT_EVENTS"
-	alertCooldown        = "SWW_ALERT_COOLDOWN"
-	alertMaxPerHour      = "SWW_ALERT_MAX_PER_HOUR"
-	anomalyNetV4Prefix   = "SWW_ANOMALY_NET_V4_PREFIX"
-	anomalyNetV6Prefix   = "SWW_ANOMALY_NET_V6_PREFIX"
-	watchNets            = "SWW_WATCH_NETS"
+	listenAddr           = "SWW_WAF_LISTEN_ADDR"
+	mode                 = "SWW_WAF_MODE"
+	ipv6GroupPrefix      = "SWW_WAF_IPV6_GROUP_PREFIX"
+	maxTrackedClients    = "SWW_WAF_MAX_TRACKED_CLIENTS"
+	allowNets            = "SWW_WAF_ALLOW_NETS"
+	rateLimitExemptNets  = "SWW_WAF_RATE_LIMIT_EXEMPT_NETS"
+	denyNets             = "SWW_WAF_DENY_NETS"
+	rateLimitPerMinute   = "SWW_WAF_RATE_LIMIT_PER_MINUTE"
+	rateLimitPerHour     = "SWW_WAF_RATE_LIMIT_PER_HOUR"
+	rateLimitPerDay      = "SWW_WAF_RATE_LIMIT_PER_DAY"
+	rateLimitExemptPaths = "SWW_WAF_RATE_LIMIT_EXEMPT_PATHS"
+	bytesLimitPerMinute  = "SWW_WAF_BYTES_LIMIT_PER_MINUTE"
+	bytesLimitPerHour    = "SWW_WAF_BYTES_LIMIT_PER_HOUR"
+	bytesLimitPerDay     = "SWW_WAF_BYTES_LIMIT_PER_DAY"
+	bytesCount           = "SWW_WAF_BYTES_COUNT"
+	lookupSource         = "SWW_WAF_LOOKUP_SOURCE"
+	lookupDBPath         = "SWW_WAF_LOOKUP_DB_PATH"
+	lookupTimeout        = "SWW_WAF_LOOKUP_TIMEOUT"
+	addLookupHeaders     = "SWW_WAF_ADD_LOOKUP_HEADERS"
+	deniedCountries      = "SWW_WAF_DENIED_COUNTRIES"
+	allowedCountries     = "SWW_WAF_EXCLUSIVELY_ALLOWED_COUNTRIES"
+	asnLimitPercent      = "SWW_WAF_ASN_LIMIT_PERCENT"
+	countryLimitPercent  = "SWW_WAF_COUNTRY_LIMIT_PERCENT"
+	asnBytesPercent      = "SWW_WAF_ASN_BYTES_PERCENT"
+	countryBytesPercent  = "SWW_WAF_COUNTRY_BYTES_PERCENT"
+	unknownLimitPercent  = "SWW_WAF_UNKNOWN_LIMIT_PERCENT"
+	asnLimitPercentURL   = "SWW_WAF_ASN_LIMIT_PERCENT_URL"
+	blocklistURLs        = "SWW_WAF_BLOCKLIST_URLS"
+	blocklistRefresh     = "SWW_WAF_BLOCKLIST_REFRESH"
+	blocklistAction      = "SWW_WAF_BLOCKLIST_ACTION"
+	dnsblZones           = "SWW_WAF_DNSBL_ZONES"
+	dnsblResolver        = "SWW_WAF_DNSBL_RESOLVER"
+	abuseIPDBKey         = "SWW_WAF_ABUSEIPDB_KEY"
+	abuseIPDBMinScore    = "SWW_WAF_ABUSEIPDB_MIN_SCORE"
+	abuseIPDBDailyBudget = "SWW_WAF_ABUSEIPDB_DAILY_BUDGET"
+	reputationAction     = "SWW_WAF_REPUTATION_ACTION"
+	reputationCacheTTL   = "SWW_WAF_REPUTATION_CACHE_TTL"
+	reputationTimeout    = "SWW_WAF_REPUTATION_TIMEOUT"
+	crowdSecURL          = "SWW_WAF_CROWDSEC_LAPI_URL"
+	crowdSecKey          = "SWW_WAF_CROWDSEC_LAPI_KEY"
+	banResponse          = "SWW_WAF_BAN_RESPONSE"
+	limitBanDuration     = "SWW_WAF_LIMIT_BAN_DURATION"
+	limitBanRepeatWindow = "SWW_WAF_LIMIT_BAN_REPEAT_WINDOW"
+	maxBanDuration       = "SWW_WAF_MAX_BAN_DURATION"
+	attackBanDuration    = "SWW_WAF_ATTACK_BAN_DURATION"
+	maxBans              = "SWW_WAF_MAX_BANS"
+	banScopeV4Prefix     = "SWW_WAF_BAN_SCOPE_V4_PREFIX"
+	stateDir             = "SWW_WAF_STATE_DIR"
+	stateWriteDelay      = "SWW_WAF_STATE_WRITE_DELAY"
+	stateCounterInterval = "SWW_WAF_STATE_COUNTER_INTERVAL"
+	adminToken           = "SWW_WAF_ADMIN_TOKEN"   //nolint:gosec // the setting's name
+	metricsToken         = "SWW_WAF_METRICS_TOKEN" //nolint:gosec // the setting's name
+	metricsTopN          = "SWW_WAF_METRICS_TOP_N"
+	instanceName         = "SWW_WAF_INSTANCE_NAME"
+	logRequestHeaders    = "SWW_WAF_LOG_REQUEST_HEADERS"
+	logLevel             = "SWW_WAF_LOG_LEVEL"
+	rulesDir             = "SWW_WAF_RULES_DIR"
+	rulesEnabled         = "SWW_WAF_RULES_ENABLED"
+	wafMode              = "SWW_WAF_CORE_RULE_SET_MODE"
+	wafParanoiaLevel     = "SWW_WAF_CORE_RULE_SET_PARANOIA_LEVEL"
+	wafAnomalyThreshold  = "SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD"
+	wafDisabledRules     = "SWW_WAF_CORE_RULE_SET_DISABLED_RULES"
+	wafExemptPaths       = "SWW_WAF_CORE_RULE_SET_EXEMPT_PATHS"
+	wafBodyLimit         = "SWW_WAF_CORE_RULE_SET_BODY_LIMIT"
+	exclusionsFile       = "SWW_WAF_CORE_RULE_SET_EXCLUSIONS_FILE"
+	trapPaths            = "SWW_WAF_TRAP_PATHS"
+	errorBurstThreshold  = "SWW_WAF_ERROR_BURST_THRESHOLD"
+	logRemoteURL         = "SWW_WAF_LOG_REMOTE_URL"
+	logRemoteTLSCAFile   = "SWW_WAF_LOG_REMOTE_TLS_CA_FILE"
+	logRemoteBuffer      = "SWW_WAF_LOG_REMOTE_BUFFER"
+	logRemoteFacility    = "SWW_WAF_LOG_REMOTE_FACILITY"
+	logRemoteAppName     = "SWW_WAF_LOG_REMOTE_APP_NAME"
+	alertWebhookURL      = "SWW_WAF_ALERT_WEBHOOK_URL"
+	alertWebhookHeaders  = "SWW_WAF_ALERT_WEBHOOK_HEADERS"
+	alertSlackWebhookURL = "SWW_WAF_ALERT_SLACK_WEBHOOK_URL"
+	alertNtfyURL         = "SWW_WAF_ALERT_NTFY_URL"
+	alertNtfyToken       = "SWW_WAF_ALERT_NTFY_TOKEN" //nolint:gosec // the setting's name
+	alertEvents          = "SWW_WAF_ALERT_EVENTS"
+	alertCooldown        = "SWW_WAF_ALERT_COOLDOWN"
+	alertMaxPerHour      = "SWW_WAF_ALERT_MAX_PER_HOUR"
+	anomalyNetV4Prefix   = "SWW_WAF_ANOMALY_NET_V4_PREFIX"
+	anomalyNetV6Prefix   = "SWW_WAF_ANOMALY_NET_V6_PREFIX"
+	watchNets            = "SWW_WAF_WATCH_NETS"
 )
 
 // The anomaly thresholds: each of the prefixes below, which name a scope,
 // followed by each of the four ends.
 const (
-	anomalyClient = "SWW_ANOMALY_CLIENT_"
-	anomalyNet    = "SWW_ANOMALY_NET_"
-	anomalyASN    = "SWW_ANOMALY_ASN_"
-	anomalyTotal  = "SWW_ANOMALY_TOTAL_"
-	watch         = "SWW_WATCH_"
+	anomalyClient = "SWW_WAF_ANOMALY_CLIENT_"
+	anomalyNet    = "SWW_WAF_ANOMALY_NET_"
+	anomalyASN    = "SWW_WAF_ANOMALY_ASN_"
+	anomalyTotal  = "SWW_WAF_ANOMALY_TOTAL_"
+	watch         = "SWW_WAF_WATCH_"
 
 	requestsPerMinute = "REQUESTS_PER_MINUTE"
 	requestsPerHour   = "REQUESTS_PER_HOUR"
@@ -156,21 +158,21 @@ func loggedAnomalyDefaults() map[string]string {
 	return logged
 }
 
-// defaultAlertEvents is the default of SWW_ALERT_EVENTS, and
-// defaultAlertCooldown that of SWW_ALERT_COOLDOWN.
+// defaultAlertEvents is the default of SWW_WAF_ALERT_EVENTS, and
+// defaultAlertCooldown that of SWW_WAF_ALERT_COOLDOWN.
 const (
 	defaultAlertEvents = "ban,permanent_ban,waf_block,anomaly,reputation_hit," +
 		"source_failure,file_error"
 	defaultAlertCooldown = "15m"
 )
 
-// defaultReputationCacheTTL is the default of SWW_REPUTATION_CACHE_TTL.
+// defaultReputationCacheTTL is the default of SWW_WAF_REPUTATION_CACHE_TTL.
 const defaultReputationCacheTTL = "24h"
 
-// defaultWAFDisabledRules is the default of SWW_WAF_DISABLED_RULES.
+// defaultWAFDisabledRules is the default of SWW_WAF_CORE_RULE_SET_DISABLED_RULES.
 const defaultWAFDisabledRules = "920340,920420,920440,920640,930130,930140"
 
-// defaultLogRequestHeaders is the default of SWW_LOG_REQUEST_HEADERS.
+// defaultLogRequestHeaders is the default of SWW_WAF_LOG_REQUEST_HEADERS.
 const defaultLogRequestHeaders = "accept,accept-language,accept-encoding," +
 	"content-type,origin,range"
 
@@ -195,8 +197,8 @@ const (
 	otherToken = "fedcba9876543210fedcba9876543210"
 )
 
-// instance is an SWW_INSTANCE_NAME that is a valid app name too, and
-// remoteURL an SWW_LOG_REMOTE_URL, for the tests that send the lines.
+// instance is an SWW_WAF_INSTANCE_NAME that is a valid app name too, and
+// remoteURL an SWW_WAF_LOG_REMOTE_URL, for the tests that send the lines.
 const (
 	instance  = "fsn1app1/blog"
 	remoteURL = "syslog+udp://192.0.2.1:514"
@@ -208,7 +210,7 @@ const off = "off"
 // enabled is true, as a setting's value.
 const enabled = "true"
 
-// defaultLookupSource is the default of SWW_LOOKUP_SOURCE, and
+// defaultLookupSource is the default of SWW_WAF_LOOKUP_SOURCE, and
 // fileSource the source that is the lookup database.
 const (
 	defaultLookupSource = "geojs"
@@ -218,18 +220,22 @@ const (
 // environment is a set of environment variables, for FromEnvironment.
 type environment map[string]string
 
-// lookupEnv reads one of the variables, as os.LookupEnv does.
-func (e environment) lookupEnv(name string) (string, bool) {
-	value, ok := e[name]
+// viper returns a viper Set with each of the variables, as the viper
+// NewViper returns one bound to a process's environment.
+func (e environment) viper() *viper.Viper {
+	v := viper.New()
+	for name, value := range e {
+		v.Set(name, value)
+	}
 
-	return value, ok
+	return v
 }
 
 // fromEnvironment reads the settings from env, which must be valid.
 func fromEnvironment(t *testing.T, env environment) *config.Config {
 	t.Helper()
 
-	cfg, err := config.FromEnvironment(env.lookupEnv)
+	cfg, err := config.FromEnvironment(env.viper())
 	if err != nil {
 		t.Fatalf("settings %v: %v", env, err)
 	}
@@ -456,7 +462,7 @@ func TestPathPrefixNotStartingWithSlashStopsTheStart(t *testing.T) {
 	t.Parallel()
 
 	_, err := config.FromEnvironment(
-		environment{rateLimitExemptPaths: "/favicon.ico,assets/"}.lookupEnv)
+		environment{rateLimitExemptPaths: "/favicon.ico,assets/"}.viper())
 
 	want := rateLimitExemptPaths + `: "assets/" is not a path prefix ` +
 		`starting with /, such as /assets/`
@@ -511,7 +517,7 @@ func TestInvalidTrapPathOrErrorBurstThresholdStopsTheStart(t *testing.T) {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+			_, err := config.FromEnvironment(environment{tc.name: tc.value}.viper())
 
 			want := tc.name + ": " + tc.want
 			if err == nil || err.Error() != want {
@@ -640,7 +646,7 @@ func TestInvalidCoreRuleSetSettingStopsTheStart(t *testing.T) {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+			_, err := config.FromEnvironment(environment{tc.name: tc.value}.viper())
 
 			want := tc.name + ": " + tc.want
 			if err == nil || err.Error() != want {
@@ -765,7 +771,7 @@ func TestInvalidRemoteLogSettingStopsTheStart(t *testing.T) {
 		{logRemoteAppName, ""}, {logRemoteAppName, "my app"},
 		{logRemoteAppName, "gitéa"}, {logRemoteAppName, strings.Repeat("a", 49)},
 	} {
-		_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+		_, err := config.FromEnvironment(environment{tc.name: tc.value}.viper())
 		if err == nil || !strings.HasPrefix(err.Error(), tc.name+": ") {
 			t.Errorf("%s=%q: error %v, want one naming it", tc.name, tc.value, err)
 		}
@@ -782,7 +788,7 @@ func TestRemoteLogCAFileWithoutCertificateStopsTheStart(t *testing.T) {
 		t.Fatalf("write %s: %v", caFile, err)
 	}
 
-	_, err = config.FromEnvironment(environment{logRemoteTLSCAFile: caFile}.lookupEnv)
+	_, err = config.FromEnvironment(environment{logRemoteTLSCAFile: caFile}.viper())
 
 	want := logRemoteTLSCAFile + `: "` + caFile + `" holds no PEM certificate`
 	if err == nil || err.Error() != want {
@@ -797,7 +803,7 @@ func TestInstanceNameNotAnAppNameStopsTheStartOnlyWhileSending(t *testing.T) {
 
 	sending := environment{logRemoteURL: remoteURL, instanceName: spaced}
 
-	_, err := config.FromEnvironment(sending.lookupEnv)
+	_, err := config.FromEnvironment(sending.viper())
 
 	want := logRemoteAppName + `: is unset, and ` + instanceName +
 		` "fsn1 app1", its default, is not 1 to 48 printable ASCII characters ` +
@@ -827,7 +833,7 @@ func TestAppNameSetStopsTheStartWhileSending(t *testing.T) {
 		logRemoteURL:     remoteURL,
 		instanceName:     instance,
 		logRemoteAppName: "my app",
-	}.lookupEnv)
+	}.viper())
 
 	want := logRemoteAppName + `: "my app" is not 1 to 48 printable ASCII ` +
 		`characters without a space, such as blog`
@@ -958,7 +964,7 @@ func TestWebhookHeadersAreLoggedMaskedAndNeverShown(t *testing.T) {
 	// An item that is not a header is named by its place, not shown.
 	_, err := config.FromEnvironment(environment{
 		alertWebhookHeaders: "X-Team:ops," + secret,
-	}.lookupEnv)
+	}.viper())
 
 	want := alertWebhookHeaders + ": item 2 is not a header name followed by : " +
 		"and the header's value, such as Authorization:Bearer <token>"
@@ -995,7 +1001,7 @@ func TestWebhookURLIsLoggedWithoutItsPathOrQueryAndNeverShown(t *testing.T) {
 		"ftp://hooks.example/services/" + secret,
 		"https://hooks.example/services/%zz" + secret,
 	} {
-		_, err := config.FromEnvironment(environment{alertWebhookURL: value}.lookupEnv)
+		_, err := config.FromEnvironment(environment{alertWebhookURL: value}.viper())
 
 		want := alertWebhookURL + ": is not an http or https URL without a user or " +
 			"a fragment, such as https://alerts.example/sww"
@@ -1046,7 +1052,7 @@ func TestNtfyTokenWithAControlCharacterStopsTheStartWithoutShowingIt(t *testing.
 		"set":       {alertNtfyToken: token + "\r"},
 		"in a file": {alertNtfyToken + "_FILE": writeFile(t, token+"\r\n")},
 	} {
-		_, err := config.FromEnvironment(env.lookupEnv)
+		_, err := config.FromEnvironment(env.viper())
 
 		want := alertNtfyToken + ": holds a control character, such as the " +
 			"carriage return of a Windows line end"
@@ -1063,7 +1069,7 @@ func TestInstanceNameWithAControlCharacterStopsTheStartOnlyWithNtfySet(t *testin
 
 	_, err := config.FromEnvironment(environment{
 		instanceName: name, alertNtfyURL: "https://ntfy.example/sww-alerts",
-	}.lookupEnv)
+	}.viper())
 
 	want := instanceName + `: "fsn1app1\r" holds a control character, such as the ` +
 		`carriage return of a Windows line end, and is sent to ntfy in a header ` +
@@ -1088,7 +1094,7 @@ func TestInstanceNameNotUTF8StopsTheStart(t *testing.T) {
 		"set":       {instanceName: latin1},
 		"in a file": {instanceName + "_FILE": writeFile(t, latin1+"\n")},
 	} {
-		_, err := config.FromEnvironment(env.lookupEnv)
+		_, err := config.FromEnvironment(env.viper())
 
 		want := instanceName + `: "caf\xe9" is not valid UTF-8`
 		if err == nil || err.Error() != want {
@@ -1103,7 +1109,7 @@ func TestCodeOnBothCountryListsStopsTheStart(t *testing.T) {
 	_, err := config.FromEnvironment(environment{
 		deniedCountries:  "cn,ru",
 		allowedCountries: "de,RU",
-	}.lookupEnv)
+	}.viper())
 	if err == nil {
 		t.Fatal("ru on both country lists was accepted")
 	}
@@ -1165,7 +1171,7 @@ func TestLookupDBPathGoesWithTheFileSourceAlone(t *testing.T) {
 			lookupDBPath + ": is set while " + lookupSource + " is off; only file reads it",
 		},
 	} {
-		_, err := config.FromEnvironment(tc.env.lookupEnv)
+		_, err := config.FromEnvironment(tc.env.viper())
 		if err == nil || err.Error() != tc.want {
 			t.Errorf("settings %v: error %v, want %s", tc.env, err, tc.want)
 		}
@@ -1195,7 +1201,7 @@ func TestSettingNeedingLookupsStopsTheStartWhileTheyAreOff(t *testing.T) {
 
 			_, err := config.FromEnvironment(environment{
 				lookupSource: off, name: value,
-			}.lookupEnv)
+			}.viper())
 			if err == nil || !strings.HasPrefix(err.Error(), name+": ") ||
 				!strings.Contains(err.Error(), lookupSource+" is off") {
 				t.Errorf("error %v, want one naming %s and %s", err, name, lookupSource)
@@ -1204,7 +1210,7 @@ func TestSettingNeedingLookupsStopsTheStartWhileTheyAreOff(t *testing.T) {
 	}
 
 	// Set empty, the lists need nothing looked up, and nor does
-	// SWW_UNKNOWN_LIMIT_PERCENT at 100, which lowers no limit, an anomaly
+	// SWW_WAF_UNKNOWN_LIMIT_PERCENT at 100, which lowers no limit, an anomaly
 	// threshold per AS number that is off, any other anomaly threshold, or
 	// a blocklist.
 	env := environment{
@@ -1345,7 +1351,7 @@ func TestInvalidAnomalySettingStopsTheStartSayingWhatIsWrong(t *testing.T) {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+			_, err := config.FromEnvironment(environment{tc.name: tc.value}.viper())
 
 			want := tc.name + ": " + tc.want
 			if err == nil || err.Error() != want {
@@ -1424,7 +1430,7 @@ func TestInvalidBiasedThresholdStopsTheStartSayingWhatIsWrong(t *testing.T) {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+			_, err := config.FromEnvironment(environment{tc.name: tc.value}.viper())
 
 			want := tc.name + ": " + tc.want
 			if err == nil || err.Error() != want {
@@ -1442,7 +1448,7 @@ const (
 	asnURL  = "https://lists.example/asn.txt"
 )
 
-// The actions of SWW_BLOCKLIST_ACTION, as Config gives them.
+// The actions of SWW_WAF_BLOCKLIST_ACTION, as Config gives them.
 const (
 	actionDeny  = "deny"
 	actionLimit = "limit"
@@ -1521,7 +1527,7 @@ func TestInvalidReputationSettingStopsTheStartSayingWhatIsWrong(t *testing.T) {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+			_, err := config.FromEnvironment(environment{tc.name: tc.value}.viper())
 
 			want := tc.name + ": " + tc.want
 			if err == nil || err.Error() != want {
@@ -1536,9 +1542,9 @@ func TestASNLimitPercentURLThatIsABlocklistStopsTheStart(t *testing.T) {
 
 	_, err := config.FromEnvironment(environment{
 		blocklistURLs: dropURL + "," + asnURL, asnLimitPercentURL: asnURL,
-	}.lookupEnv)
+	}.viper())
 
-	want := asnLimitPercentURL + `: "` + asnURL + `" is in SWW_BLOCKLIST_URLS too`
+	want := asnLimitPercentURL + `: "` + asnURL + `" is in SWW_WAF_BLOCKLIST_URLS too`
 	if err == nil || err.Error() != want {
 		t.Errorf("error %v, want %s", err, want)
 	}
@@ -1663,7 +1669,7 @@ func TestInvalidDNSBLSettingStopsTheStartSayingWhatIsWrong(t *testing.T) {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+			_, err := config.FromEnvironment(environment{tc.name: tc.value}.viper())
 
 			want := tc.name + ": " + tc.want
 			if err == nil || err.Error() != want {
@@ -1731,7 +1737,7 @@ func TestDNSBLZoneKeyIsLoggedMaskedAndNeverShown(t *testing.T) {
 		{spamhaus + "," + otherZone, `"` + spamhausMasked + `" is listed twice`},
 		{spamhaus + ",,", "has an empty item in its list"},
 	} {
-		_, err := config.FromEnvironment(environment{dnsblZones: tc.value}.lookupEnv)
+		_, err := config.FromEnvironment(environment{dnsblZones: tc.value}.viper())
 
 		want := dnsblZones + ": " + tc.want
 		if err == nil || err.Error() != want {
@@ -1784,7 +1790,7 @@ func TestInvalidAbuseIPDBSettingStopsTheStartSayingWhatIsWrong(t *testing.T) {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+			_, err := config.FromEnvironment(environment{tc.name: tc.value}.viper())
 
 			want := tc.name + ": " + tc.want
 			if err == nil || err.Error() != want {
@@ -1841,7 +1847,7 @@ func TestInvalidCrowdSecSettingStopsTheStartSayingWhatIsWrong(t *testing.T) {
 		notLAPIURL = " is not an http or https URL without a user or a fragment, " +
 			"such as http://172.17.0.1:8080"
 		anotherList = `gives the decision list "` + lapi + `/v1/decisions", which is in ` +
-			`SWW_BLOCKLIST_URLS or is SWW_ASN_LIMIT_PERCENT_URL too`
+			`SWW_WAF_BLOCKLIST_URLS or is SWW_WAF_ASN_LIMIT_PERCENT_URL too`
 	)
 
 	for _, tc := range []struct {
@@ -1898,7 +1904,7 @@ func TestInvalidCrowdSecSettingStopsTheStartSayingWhatIsWrong(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(tc.env.lookupEnv)
+			_, err := config.FromEnvironment(tc.env.viper())
 			if err == nil || err.Error() != tc.want {
 				t.Errorf("error %v, want %s", err, tc.want)
 			}
@@ -2058,7 +2064,7 @@ func wantStartStopped(t *testing.T, invalid []struct{ name, value string }) {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+			_, err := config.FromEnvironment(environment{tc.name: tc.value}.viper())
 			if err == nil {
 				t.Fatalf("%s=%q was accepted", tc.name, tc.value)
 			}
@@ -2083,7 +2089,7 @@ func TestHostOrTransferEncodingStopsTheStart(t *testing.T) {
 		t.Run(value, func(t *testing.T) {
 			t.Parallel()
 
-			_, err := config.FromEnvironment(environment{logRequestHeaders: value}.lookupEnv)
+			_, err := config.FromEnvironment(environment{logRequestHeaders: value}.viper())
 			if err == nil || err.Error() != logRequestHeaders+": "+want {
 				t.Errorf("error %v, want %s: %s", err, logRequestHeaders, want)
 			}
@@ -2100,7 +2106,7 @@ func TestShortTokenStopsTheStartWithoutShowingIt(t *testing.T) {
 			t.Run(name+"="+value, func(t *testing.T) {
 				t.Parallel()
 
-				_, err := config.FromEnvironment(environment{name: value}.lookupEnv)
+				_, err := config.FromEnvironment(environment{name: value}.viper())
 
 				want := name + ": is shorter than 32 characters"
 				if err == nil || err.Error() != want {
@@ -2156,7 +2162,7 @@ func TestSettingFromFileIsCheckedAsTheSettingItself(t *testing.T) {
 
 	_, err := config.FromEnvironment(environment{
 		bytesLimitPerMinute + "_FILE": writeFile(t, "lots\n"),
-	}.lookupEnv)
+	}.viper())
 
 	want := bytesLimitPerMinute + `: "lots" is not a size such as 512K, 100M or 5G, or off`
 	if err == nil || err.Error() != want {
@@ -2167,7 +2173,7 @@ func TestSettingFromFileIsCheckedAsTheSettingItself(t *testing.T) {
 		logRemoteURL:               remoteURL,
 		instanceName:               instance,
 		logRemoteAppName + "_FILE": writeFile(t, "my app\n"),
-	}.lookupEnv)
+	}.viper())
 
 	want = logRemoteAppName + `: "my app" is not 1 to 48 printable ASCII ` +
 		`characters without a space, such as blog`
@@ -2182,7 +2188,7 @@ func TestSettingAndItsFileBothSetStopsTheStart(t *testing.T) {
 	_, err := config.FromEnvironment(environment{
 		metricsToken:           token,
 		metricsToken + "_FILE": writeFile(t, token),
-	}.lookupEnv)
+	}.viper())
 
 	want := metricsToken + ": is set, and so is " + metricsToken +
 		"_FILE; set only one of them"
@@ -2197,7 +2203,7 @@ func TestUnreadableSettingFileStopsTheStart(t *testing.T) {
 	dir := t.TempDir()
 
 	for _, path := range []string{filepath.Join(dir, "missing"), dir} {
-		_, err := config.FromEnvironment(environment{metricsToken + "_FILE": path}.lookupEnv)
+		_, err := config.FromEnvironment(environment{metricsToken + "_FILE": path}.viper())
 
 		want := metricsToken + "_FILE: cannot be read: "
 		if err == nil || !strings.HasPrefix(err.Error(), want) {