Read every setting through viper and rename the settings (closes #211)

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.
Every place a name appeared changed: the code, the viper keys, tests,
documents, examples, the README's settings table and the image files.

Model: deepseek-v4-pro

internal/reputation/abuseipdb.go

@@ -58,17 +58,17 @@ type Checks struct {
 // AbuseIPDBParams are what NewAbuseIPDB needs.
 type AbuseIPDBParams struct {
 	// URL is where clients are checked, normally AbuseIPDBURL, with Key,
-	// the account's key (SWW_ABUSEIPDB_KEY).
+	// the account's key (SWW_WAF_ABUSEIPDB_KEY).
 	URL string
 	Key string
-	// MinScore is the least score that is a hit (SWW_ABUSEIPDB_MIN_SCORE),
+	// MinScore is the least score that is a hit (SWW_WAF_ABUSEIPDB_MIN_SCORE),
 	// and DailyBudget the most checks made in a day, in UTC
-	// (SWW_ABUSEIPDB_DAILY_BUDGET).
+	// (SWW_WAF_ABUSEIPDB_DAILY_BUDGET).
 	MinScore    int64
 	DailyBudget int
 	// CacheTTL is how long a score is used after it was fetched
-	// (SWW_REPUTATION_CACHE_TTL), and Timeout how long a check may take
-	// (SWW_REPUTATION_TIMEOUT).
+	// (SWW_WAF_REPUTATION_CACHE_TTL), and Timeout how long a check may take
+	// (SWW_WAF_REPUTATION_TIMEOUT).
 	CacheTTL time.Duration
 	Timeout  time.Duration
 	// Now tells the time, normally time.Now in UTC.

internal/reputation/dnsbl.go

@@ -53,15 +53,15 @@ type Verdict struct {
 // DNSBLParams are what NewDNSBL needs.
 type DNSBLParams struct {
 	// Zones are the DNSBL zones clients are asked about in
-	// (SWW_DNSBL_ZONES).
+	// (SWW_WAF_DNSBL_ZONES).
 	Zones []string
 	// Resolver is the resolver they are asked through
-	// (SWW_DNSBL_RESOLVER), or, while it is the zero AddrPort, the
+	// (SWW_WAF_DNSBL_RESOLVER), or, while it is the zero AddrPort, the
 	// host's, as /etc/resolv.conf names it.
 	Resolver netip.AddrPort
 	// CacheTTL is how long a verdict is used after it was fetched
-	// (SWW_REPUTATION_CACHE_TTL), and Timeout how long a query may take
-	// (SWW_REPUTATION_TIMEOUT).
+	// (SWW_WAF_REPUTATION_CACHE_TTL), and Timeout how long a query may take
+	// (SWW_WAF_REPUTATION_TIMEOUT).
 	CacheTTL time.Duration
 	Timeout  time.Duration
 	// Now tells the time, normally time.Now in UTC.
@@ -127,13 +127,13 @@ func NewDNSBL(params DNSBLParams) *DNSBL {
 	}
 }
 
-// Zones returns the zones, in the order SWW_DNSBL_ZONES names them.
+// Zones returns the zones, in the order SWW_WAF_DNSBL_ZONES names them.
 func (d *DNSBL) Zones() []string {
 	return slices.Clone(d.params.Zones)
 }
 
 // ListedBy returns the zones whose verdict on addr, a client's address,
-// lists it, in the order SWW_DNSBL_ZONES names them, each with its key
+// lists it, in the order SWW_WAF_DNSBL_ZONES names them, each with its key
 // masked, as config.MaskZoneKey masks it, since they go to the request
 // log, the alerts and the metrics. A verdict is used until CacheTTL has
 // passed since it was fetched. Each zone without one is asked about addr
@@ -210,7 +210,7 @@ func (d *DNSBL) Snapshot() []Verdict {
 }
 
 // Load keeps verdicts, read from reputation.json, in place of those it
-// keeps, but for those of a zone SWW_DNSBL_ZONES does not name, and,
+// keeps, but for those of a zone SWW_WAF_DNSBL_ZONES does not name, and,
 // past maxVerdicts, those fetched longest ago. One fetched CacheTTL ago or
 // more is neither used nor written, as for any verdict.
 func (d *DNSBL) Load(verdicts []Verdict) {

internal/reputation/dnsbl_test.go

@@ -40,8 +40,8 @@ const (
 	// zone and otherZone are the DNSBL zones the tests name.
 	zone      = "dnsbl.example"
 	otherZone = "other.example"
-	// cacheTTL is the tests' SWW_REPUTATION_CACHE_TTL, and timeout their
-	// SWW_REPUTATION_TIMEOUT: a second, the least time /etc/resolv.conf
+	// cacheTTL is the tests' SWW_WAF_REPUTATION_CACHE_TTL, and timeout their
+	// SWW_WAF_REPUTATION_TIMEOUT: a second, the least time /etc/resolv.conf
 	// can have Go's resolver wait for one server, so that it is the
 	// DNSBL's own timeout that ends a query, whatever that file says.
 	cacheTTL = 24 * time.Hour
@@ -419,7 +419,7 @@ func TestNeitherAVerdictOfAZoneNotNamedNorOnePastItsTTLIsKept(t *testing.T) {
 	dnsbl := reputation.NewDNSBL(p)
 
 	// The last verdict still in use, one fetched a TTL ago, and one of a
-	// zone SWW_DNSBL_ZONES does not name.
+	// zone SWW_WAF_DNSBL_ZONES does not name.
 	inUse := reputation.Verdict{
 		Zone: zone, Client: netip.MustParseAddr(listed), Listed: true,
 		Fetched: now.Add(-cacheTTL + time.Nanosecond),

internal/reputation/reputation.go

@@ -1,10 +1,10 @@
 // Package reputation fetches the lists the settings name by URL: the
-// blocklists of SWW_BLOCKLIST_URLS, the file of AS:percent lines
-// SWW_ASN_LIMIT_PERCENT_URL names, and the decision list of the CrowdSec
-// engine SWW_CROWDSEC_LAPI_URL names. It keeps the last good copy of
+// blocklists of SWW_WAF_BLOCKLIST_URLS, the file of AS:percent lines
+// SWW_WAF_ASN_LIMIT_PERCENT_URL names, and the decision list of the CrowdSec
+// engine SWW_WAF_CROWDSEC_LAPI_URL names. It keeps the last good copy of
 // each, whole, comment lines included, which is used while a fetch fails,
 // and when each was last tried. It also asks the DNSBL zones of
-// SWW_DNSBL_ZONES about clients, and keeps their verdicts, and checks
+// SWW_WAF_DNSBL_ZONES about clients, and keeps their verdicts, and checks
 // clients with AbuseIPDB, and keeps their scores and the checks spent
 // today. The state package writes all of these to reputation.json and
 // reads them from it, so that a restart keeps them too.
@@ -66,18 +66,18 @@ type List struct {
 
 // Params are what New needs.
 type Params struct {
-	// BlocklistURLs are the blocklists (SWW_BLOCKLIST_URLS), and
+	// BlocklistURLs are the blocklists (SWW_WAF_BLOCKLIST_URLS), and
 	// ASNLimitPercentURL the file of AS:percent lines
-	// (SWW_ASN_LIMIT_PERCENT_URL), "" while it is unset.
+	// (SWW_WAF_ASN_LIMIT_PERCENT_URL), "" while it is unset.
 	BlocklistURLs      []string
 	ASNLimitPercentURL string
 	// CrowdSecDecisionsURL is the CrowdSec decision list, "" while
-	// SWW_CROWDSEC_LAPI_URL is unset, fetched with CrowdSecKey
-	// (SWW_CROWDSEC_LAPI_KEY).
+	// SWW_WAF_CROWDSEC_LAPI_URL is unset, fetched with CrowdSecKey
+	// (SWW_WAF_CROWDSEC_LAPI_KEY).
 	CrowdSecDecisionsURL string
 	CrowdSecKey          string
 	// Refresh is how long after a list was last fetched or tried it is
-	// fetched again (SWW_BLOCKLIST_REFRESH), but for the CrowdSec decision
+	// fetched again (SWW_WAF_BLOCKLIST_REFRESH), but for the CrowdSec decision
 	// list, which is fetched again crowdSecRefresh after.
 	Refresh time.Duration
 	// Now tells the time, normally time.Now in UTC.
@@ -152,7 +152,7 @@ func New(params Params) *Lists {
 }
 
 // URLs returns the URL of every list: the blocklists' in the order
-// SWW_BLOCKLIST_URLS names them, then SWW_ASN_LIMIT_PERCENT_URL, then
+// SWW_WAF_BLOCKLIST_URLS names them, then SWW_WAF_ASN_LIMIT_PERCENT_URL, then
 // the CrowdSec decision list's.
 func (l *Lists) URLs() []string {
 	urls := slices.Clone(l.params.BlocklistURLs)
@@ -168,7 +168,7 @@ func (l *Lists) URLs() []string {
 }
 
 // ListedBy returns the URLs of the blocklists whose copy lists addr, in
-// the order SWW_BLOCKLIST_URLS names them.
+// the order SWW_WAF_BLOCKLIST_URLS names them.
 func (l *Lists) ListedBy(addr netip.Addr) []string {
 	l.mu.Lock()
 	defer l.mu.Unlock()
@@ -551,7 +551,7 @@ func parseNetblock(text string) (netip.Prefix, bool) {
 }
 
 // parsePercents reads the lines of the file of AS:percent lines, each an
-// AS number, : and a percentage, as SWW_ASN_LIMIT_PERCENT takes them. An
+// AS number, : and a percentage, as SWW_WAF_ASN_LIMIT_PERCENT takes them. An
 // AS number listed more than once gets the lowest of its percentages.
 func parsePercents(lines []string) (entries, error) {
 	found := entries{percents: map[string]int64{}}

internal/reputation/reputation_test.go

@@ -34,8 +34,8 @@ const (
 	dropURL = "https://lists.example/drop.txt"
 	torURL  = "https://lists.example/tor.txt"
 	asnURL  = "https://lists.example/asn.txt"
-	// refresh is the tests' SWW_BLOCKLIST_REFRESH, and cooldown their
-	// SWW_ALERT_COOLDOWN, longer than it.
+	// refresh is the tests' SWW_WAF_BLOCKLIST_REFRESH, and cooldown their
+	// SWW_WAF_ALERT_COOLDOWN, longer than it.
 	refresh  = 24 * time.Hour
 	cooldown = 48 * time.Hour
 	// drop is a blocklist as the Spamhaus DROP list is written, with an
@@ -116,7 +116,7 @@ func TestClientIsListedByEachBlocklistThatListsIt(t *testing.T) {
 		}}
 		lists := start(t, servers, params(torURL, dropURL))
 
-		// In the order SWW_BLOCKLIST_URLS names them.
+		// In the order SWW_WAF_BLOCKLIST_URLS names them.
 		wantListedBy(t, lists, "203.0.113.9", torURL, dropURL)
 		wantListedBy(t, lists, "203.0.113.8", dropURL)
 	})