Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.
Every place a name appeared changed: the code, the viper keys, tests,
documents, examples, the README's settings table and the image files.

Model: deepseek-v4-pro

internal/metrics/metrics.go

@@ -62,8 +62,8 @@ type Metrics struct {
 
 // New returns the metrics, with the Go runtime's and the process's own.
 // topN is how many countries and how many AS numbers get series of their
-// own (SWW_METRICS_TOP_N). Every metric carries instanceName
-// (SWW_INSTANCE_NAME) as its label instance.
+// own (SWW_WAF_METRICS_TOP_N). Every metric carries instanceName
+// (SWW_WAF_INSTANCE_NAME) as its label instance.
 //
 //nolint:funlen // a few lines for each metric, a list that grows with them
 func New(topN int, instanceName string) *Metrics {
@@ -102,7 +102,7 @@ func New(topN int, instanceName string) *Metrics {
 		offences: counterVec("sww_offences_total",
 			"Offences, by kind.", []string{"kind"}),
 		wafMatches: counterVec("sww_waf_matches_total",
-			"Requests that matched a rule of the Core Rule Set, by SWW_WAF_MODE "+
+			"Requests that matched a rule of the Core Rule Set, by SWW_WAF_CORE_RULE_SET_MODE "+
 				"and the rule's id.", []string{"mode", "rule_id"}),
 		countries: newCountries(topN),
 		asns:      newASNs(topN),
@@ -214,13 +214,13 @@ func (m *Metrics) AddRules(ruleFiles *rules.Files) {
 }
 
 // AddRemoteLog adds the metrics of sending the log lines to
-// SWW_LOG_REMOTE_URL, read from remote as the metrics are asked for: the
+// SWW_WAF_LOG_REMOTE_URL, read from remote as the metrics are asked for: the
 // lines sent, those dropped, and those waiting in the buffer.
 func (m *Metrics) AddRemoteLog(remote *remotelog.Sender) {
 	m.registry.MustRegister(
 		prometheus.NewCounterFunc(prometheus.CounterOpts{
 			Name: "sww_remote_log_lines_sent_total",
-			Help: "Log lines sent to SWW_LOG_REMOTE_URL.",
+			Help: "Log lines sent to SWW_WAF_LOG_REMOTE_URL.",
 		}, func() float64 {
 			return float64(remote.Sent())
 		}),
@@ -313,7 +313,7 @@ func (m *Metrics) AddReputation(lists *reputation.Lists, dnsbl *reputation.DNSBL
 // AddAbuseIPDB adds the metrics of AbuseIPDB, with the source abuseipdb,
 // read from abuseIPDB as the metrics are asked for: the checks made, those
 // that failed, and how many checks the day's budget has left. It is
-// called once, after AddReputation, while SWW_ABUSEIPDB_KEY is set.
+// called once, after AddReputation, while SWW_WAF_ABUSEIPDB_KEY is set.
 func (m *Metrics) AddAbuseIPDB(abuseIPDB *reputation.AbuseIPDB) {
 	source := prometheus.Labels{sourceLabel: reputation.AbuseIPDBSource}
 
@@ -322,7 +322,7 @@ func (m *Metrics) AddAbuseIPDB(abuseIPDB *reputation.AbuseIPDB) {
 	m.registry.MustRegister(
 		prometheus.NewGaugeFunc(prometheus.GaugeOpts{
 			Name:        "sww_reputation_daily_budget_remaining",
-			Help:        "Checks of the day's SWW_ABUSEIPDB_DAILY_BUDGET not yet spent.",
+			Help:        "Checks of the day's SWW_WAF_ABUSEIPDB_DAILY_BUDGET not yet spent.",
 			ConstLabels: source,
 		}, func() float64 {
 			return float64(abuseIPDB.BudgetLeft())
@@ -363,8 +363,8 @@ func (m *Metrics) AddAlerts(queue *alerts.Queue) {
 			}),
 			prometheus.NewCounterFunc(prometheus.CounterOpts{
 				Name: "sww_alerts_suppressed_total",
-				Help: "Alerts held back: repeats within SWW_ALERT_COOLDOWN, and " +
-					"alerts past SWW_ALERT_MAX_PER_HOUR, for the hour's summary.",
+				Help: "Alerts held back: repeats within SWW_WAF_ALERT_COOLDOWN, and " +
+					"alerts past SWW_WAF_ALERT_MAX_PER_HOUR, for the hour's summary.",
 				ConstLabels: destination,
 			}, func() float64 {
 				return float64(queue.Suppressed())
@@ -442,7 +442,7 @@ func (m *Metrics) RuleMatched(id, action string) {
 }
 
 // WAFMatched counts a request that matched the Core Rule Set's rule id,
-// with SWW_WAF_MODE at mode.
+// with SWW_WAF_CORE_RULE_SET_MODE at mode.
 func (m *Metrics) WAFMatched(mode string, id int) {
 	m.wafMatches.WithLabelValues(mode, strconv.Itoa(id)).Inc()
 }